Capital markets infrastructure: The end of the trade-off between performance and resilience

How leaders in exchanges, banks, and trading firms are modernizing infrastructure to achieve resilience, consistency, high availability, and regulatory readiness without sacrificing performance.

The new reality for capital markets technology leaders

Ask a capital markets technology leader what keeps them up at night and you will rarely get a single answer. You will get four, and they will be the same four whether the firm is a tier-1 bank, a global exchange, a Central Counterparty Clearing House (CCP), or a prime broker.

Their systems have to be performant, resilient, consistent, and maintainable, at the same time, in the same architecture, under a regulator that no longer accepts narrative as evidence.

For most of the last two decades, the firm could choose. It could trade latency for consistency, or resilience for throughput, or maintainability for raw speed. The architecture made the trade-off, the business absorbed the cost, and everyone moved on.

That permission has quietly been withdrawn. Markets do not stop. Crypto runs 24×7, equities sessions extend, and the next geopolitical event will arrive outside any window the firm has planned for. DORA examiners and prime brokers’ due diligence now ask for proof of resilience, not a runbook describing it. And the firm’s own engineers, the ones who built the platform layer, are the same people the business needs on the matching engine, the pricing model, and the risk engine they actually compete on.

The trade-off has not become harder to make. It has become unaffordable.

Four infrastructure challenges facing trading platforms today

We work with banks, exchanges, hedge funds, and crypto venues on the systems that sit closest to the money. Across all of them, the same four problems show up. None of them are new. All of them have become materially worse in recent years.

1. Disaster recovery is a story, not a property: The DR drill was timed end-to-end ten months ago, against the failure modes the team rehearsed, not the one that actually happens. Failover depends on a runbook and a calm engineer at 3 am. The CTO can describe the recovery posture confidently in a board pack, but cannot prove it to a regulator. Audit requirements and findings on resilience are increasing, and “we believe we can recover in X” is no longer the answer that closes them.
2. Recovery time is unbounded: A matching engine host fails an hour before the close. The replacement has to warm its caches, replay buffered messages, and reconcile state with surviving services. Cold start runs to forty minutes. The session ends before the system is back. 99.99% availability allows four minutes of downtime a month; 99.999% allows thirty seconds. Most firms’ real cold-start times are well above both, and the gap widens as the state grows.
3. Releases are now the riskiest moment of the week: The weekend change window has closed. Security patches, JVM upgrades, business logic changes: they all have to land while the market is live. In mature systems, the largest source of outage is no longer hardware failure. It is operator error and recent releases. The firm’s own change cadence has become its biggest operational risk.
4. The firm holds several views of the same truth: A position service, a risk service, and a client UI drift apart in milliseconds. When the regulator asks what the firm believed at 14:32:07, the answer is reconstructed after the fact from disparate logs that never quite agree. The firm’s systems act on the wrong picture at a point in time. As a result, reputational, regulatory, and operational costs compound. Eventual consistency, in the moments that matter most, is weak and not a viable safety guarantee.

Why the ‘build it yourself’ answer to trading infrastructure no longer works.

Solving these problems at the platform level is a serious undertaking. Internally, it is several million pounds of initial development with material ongoing cost, and the bill lands before the firm has shipped a line of business logic that drives the competitive edge. The teams capable of doing the work are the same teams the firm needs for the strategic initiatives that actually differentiate it from their competitors.

The opportunity cost is not the platform engineers’ salaries. It is the differentiating work that does not happen while the platform layer gets built from scratch.

And yet, individually, each of these four problems has a known answer. Mission-critical infrastructure outside the financial industry (i.e. air traffic control, nuclear power, and ship command and control) has run on the resilience and consistency patterns capital markets have needed for decades. Forty years of distributed-systems research has worked through split-brain, network partitions, divergence, and recovery, and converged on a small number of structural choices.

The reason capital markets has not adopted them at the platform level is throughput and latency. Until recently, an implementation that gave a trading firm those properties simply could not run at the rate an exchange demands.
That is the constraint that has changed.

What Adaptive has learned from building mission-critical trading systems with our clients

Adaptive has spent the last decade building these systems alongside the firms that have to run them. This includes Tier 1 banks, prediction markets and digital asset firms. Namely, Coinbase, EDXM and Bullish; and roughly thirty further capital markets firms running on Aeron Premium support across banking, crypto, hedge funds, and payments.

The lesson from those engagements is consistent. The firms that have closed the gap between what they claim about their infrastructure and what they can prove have done it by treating four things as platform properties, not application responsibilities:

• A single, globally-ordered log of every event, replicated by consensus across a resilient cluster: When the platform owns the order of truth, components cannot disagree about what happened. The audit trail stops being a forensic exercise; it becomes the operating system.
• Replicated checkpoints with log truncation: Recovery resumes from a recent point and survives host loss, not just process loss. Cold-start arithmetic stops being the limiting factor on availability.
• Active-active, deterministic services with platform-level deduplication: Multiple service replicas process the same events in parallel, and the platform discards duplicates. The latency tails the firm actually competes on flatten. High availability becomes a deployment choice, not a multi-year programme.
• Versioned protocols and in-place upgrades: Two different versions of a service run alongside each other and cut over deterministically. Releases stop being the riskiest moment in the operating week.

None of this is theoretical. These are the patterns Adaptive’s engineering teams have been running in production with tier-1 clients for years, on the open-source Aeron ecosystem (Transport, Archive, Cluster), that has carried production traffic at the largest banks and exchanges in the world for over a decade.

Accelerating trading system modernization with Aeron Sequencer

What we have done, and what clients have repeatedly asked us to do, is take those patterns out of bespoke engagements and package them, so a CTO does not have to spend three years with a senior engineering team to get the properties their regulators and their business now require.

That product is Aeron Sequencer: Adaptive’s Enterprise platform built on the open-source Aeron foundation, deployable on private data center or public cloud. It industrialises the patterns above, the consensus-replicated log, replicated checkpoints, active-active determinism, versioned in-place upgrades, and server-side filtering into capabilities a firm can adopt rather than build into each component in a technology stack.

The strongest fits are the systems where the trade-off hurts most: matching engines, OMS, pre-trade risk, execution and smart order routing, CCP clearing, and FX prime brokerage.

Two clients are live on Sequencer today, and the early-adopter programme is open. Adopters work directly with Adaptive’s engineering team, the same people who have been running these patterns alongside tier-1 banks and exchanges.

Upcoming blog series: Solving the biggest challenges in capital markets infrastructure design

This post is the opening piece in a series we are writing for capital markets technology leaders over the next few months. Each post looks at the challenges of building trading systems today and shows what changes when the outcome the firm needs becomes a property of the platform rather than an application or operational responsibility.

The series will cover these topics:

• AI makes application code cheap to write but expensive to own: As AI speeds up software development, success will depend on building resilient, well-governed platforms that are reliable, auditable, and easy to operate.
• When your position service and your risk service disagree, the firm acts on the wrong picture: The cost of components holding conflicting views of state, and what total ordering of events actually buys.
• Disaster recovery as a property you can prove, not a story you tell: What DORA examiners and prime broker due diligence are now asking for, and how consensus-replicated state and replicated checkpoints answer it directly.
• Release without the weekend window: changing a live trading system safely. Why patching, upgrading, and releasing into a 24×7 market has become the largest source of operational risk, and the platform properties that take it out of the runbook.
• Active-active for stateful services, without the team rebuilding deduplication every project: What it takes to run multiple replicas of a stateful service in parallel without drift, duplicate output, or the bespoke reconciliation logic every firm rebuilds.
• Scaling the engineering organisation, not just the system: Why co-ordination cost across teams begins to dominate engineering output past a certain headcount, and how enforceable platform contracts answer it.
• Consensus without the latency penalty, and the audit trail regulators read directly: The “is this fast enough?” objection answered with the property the firm has been told it cannot have alongside resilience.

Each will stand on its own. Read them as the conversations they correspond to come up inside your firm.

The future of trading infrastructure – tackling the trade-offs

The question for capital markets technology leaders is no longer “can we tolerate the trade-off?” It is “how much longer can we afford to?”

The firms moving first are not the ones with the biggest budgets. They are the ones who have decided that resilience, consistency, and a credible answer to the regulator should be properties of the platform, not promises made on top of it.

If that is the conversation you are already having internally, it is the conversation we would like to have with you.

1. 

   Ralph Swann Strategy Executive
   Adaptive | Aeron

   LinkedIn profile

   Ralph is a Strategy Executive at Adaptive with 20+ years in capital markets tech, driving exchange, matching engine, and Aeron-based product strategy for global trading venues and fintech leaders.