- ‘Have we updated the rule book with the newest regulatory provisions?’
- ‘Which of our rule book articles are covered by tests?’
- ‘Which obligations remain untested?’
- ‘What is our coverage percentage by regulation/jurisdiction?’
Growing complexity of regulatory change
As financial organisations’ regulatory compliance obligations become increasingly complex and expansive, the links between them and the test coverage evidence may deteriorate. This complicates the work of compliance teams, but also reveals mapping and reporting processes that are not streamlined, which causes interdependencies to go obsolete and integration of new obligations to get delayed.
A structured, transparent approach to regulatory compliance helps financial organisations move away from fragmented, manual processes towards more consistent and efficient management of regulatory obligations. By connecting regulatory provisions, internal rule books, system requirements and test evidence, organisations can improve visibility into their compliance position and respond to regulatory change with greater confidence.
From regulatory complexity to operational efficiency
Regulatory compliance does not end with interpreting a regulatory provision or updating an internal rule book. Requirements must ultimately be reflected in system behaviour and supported by appropriate testing evidence.
Conformance automation frameworks such as th2-RC bridge these different layers, helping organisations maintain traceability from regulatory obligations to rule book provisions and test artefacts. This provides a more complete view of how regulatory requirements are translated into technology implementation and validation.
With th2-RC, rule books can get continuously updated with relevant rules and standards without compromising coverage and traceability coherence. th2-RC can accommodate any regulatory framework, trading rules, asset classes and data protocols.
th2-RC’s AI-assisted coding plugin (that supports various LLMs) underpins rule creation but is not involved in test library execution. This allows the solution to achieve advanced functionality while being resource-light and fully compliant with regulations on handling personal and financial data.
Bridging the gap between regulatory requirements and evolving technology: How th2-RC works
Financial organisations carry out major system transformations for many reasons: a technology upgrade or platform migration, a new business strategy or a change in regulation. Whatever the driver, the same question arises each time: does the system still work as expected? The system has to be tested functionally and non-functionally and remain compliant with current regulatory requirements. Supporting organisations in testing complex, interconnected systems throughout such transformation projects is where our tools deliver the most value.
In this context, independent audit and validation is required: standing apart from the system’s developer and operator, the testing provider performs end-to-end testing of the functionality in scope and provides the firm objective system’s assessment of its readiness for production, documented test coverage report which clearly displays the correlation between the test scenarios and specifications, acceptance criteria and regulatory requirements.
The remaining challenge is producing that evidence at scale. th2-RC addresses this by pairing algorithmic test generation (AML) and execution with rule-based verification (as part of th2-RC functionality).
High-level description of the approach
- AI-powered test generation. Exactpro's algorithmic tool generates test patterns based on obfuscated system output, system data and client specifications and requirements, which is followed by generation of test cases with various parameters. Each generated scenario is checked against the rule book built based on system specification and regulatory requirements.
- Test execution. Algorithmic scenarios of varying complexity are generated and run against the system under test across transactional and market data protocols both standard, such as FIX, OUCH, ITCH, FIXML, FpML and custom venue-specific ones. The platform can accommodate different trading rules, generation algorithms and data protocols.
- Message collection. All inputs sent to the system and outputs received in response are collected and made available for review in one place.
- Behaviour analysis. Messages are classified and transformed into BDD scenarios using Given–When–Then logic.
- Building a test library. Each scenario is reduced to an abstract representation and added to the Library; Library entries represent groups of similar test cases or combinations of actions with different parameter variations, rather than isolated cases.
- Continuous checking. Each new test run result is compared with the results recorded in the existing library. Known behaviour is confirmed, new behaviour is added, and behaviour that contradicts previously observed results is flagged for further investigation.
- AI-powered library maintenance. Additional layers of checks are applied to the test library using Exactpro’s AI-built rule book generator.
The platform supports two complementary activities: active testing and passive verification.
| Active testing | Passive verification |
|---|---|
| Focuses on generating and executing test scenarios to explore system behaviour. | Focuses on checking invariants in the observed data against client specifications and acceptance criteria. |
| Provides test scenarios and execution results for analysis. | Provides rule-level coverage and outcome reporting, including the number of tests generated and their pass/fail status or differences in system behaviour. |
|
Figure 1. Test case combinations |
Figure 2. Rule book |
Continuous comparison of test results with the existing test library is particularly useful in regression testing after defect fixes and system updates. If a new test run reveals a system response that is different to previously observed behaviour, the discrepancy is flagged for further investigation. Testers can filter results by individual test cases, combinations of test cases or rules and examine execution steps and system responses.
The test library can be extended with new scenarios and additional rules as client requirements evolve. The testing scope also includes functional and stress testing, testing at the boundary between functional and non-functional requirements, and systems incorporating AI-based components.
th2-RC capabilities
- Bi-directional mapping of regulatory obligations to rule book provisions in any jurisdiction (e.g., Reg NMS, Reg SCI, CFTC, MiFID II, DORA, etc.) and across regimes.
- Easy and continuous addition of new rules / standards using natural language.
- Linking atomic rule book provisions to test artefacts.
- Intuitive controls for dynamic coverage reporting and gap analysis – formalise, track and monitor all your controls from a single interface.
- Real-time alerting and monitoring – receive alerts, document your observations and manage the implementation of recommendations.
- Express reporting – generate your customised plans and reports in just a few clicks, ready to be shared.
- Native to financial systems out of the box: requires minimal venue-specific customisation, compared to generic enterprise-grade compliance tracking solutions.
- Scale- and domain-agnostic: benefits small-scale venues and technology operators preparing for regulatory filings as well as large venues with cross-enterprise compliance needs.
th2-RC · Conformance Automation
Explore how th2-RC can streamline your regulatory compliance reporting
Request a Demo