NYSE publishes how it audits. Most subscribers read the document for the first time after the announcement email arrives, which is the wrong order. Knowing the structure in advance removes most of the surprise. It does not remove the liability; the record does that.
Two things about scope before the phases. NYSE Market Data Administration audits its own subscribers, and because NYSE administers Network A and Network B under the CTA and CQ Plans, it audits consolidated-tape subscribers on the Plans’ behalf using the same procedures. An “NYSE audit” can therefore cover CTA data as well as NYSE proprietary feeds, and the audit exists under your subscriber agreement: read the audit clause before anything else, as the first note in this series sets out.
Phase 1. Planning, which happens before you hear anything.
Selection and scoping are internal. By the time the audit announcement email reaches you it states the review period and scope, asks for your audit contacts, and asks to schedule a kickoff call. NYSE’s own standard is to hold that kickoff within 15 days of the notification. Use the interval: appoint one point of contact, pull the contract and its amendments, and start reconstructing the entitlement record. Do not describe your environment to anyone until the record exists.
Phase 2. Kickoff and the documentation request.
The kickoff introduces the audit team, walks through the methodology, and asks you for a high-level overview of the firm’s business and data usage. Keep it high level and keep it accurate; it is on the record and the walkthrough later will test it. Within 48 hours of the kickoff a documentation request arrives by email with a submission date, a review agenda, and technical requirements for the data. That request defines the audit’s perimeter. Answer it completely and answer nothing beyond it.
Phase 3. Fieldwork, walkthroughs, and sampling.
Once your data is in, the audit staff analyse it, hold walkthrough meetings on your full data-usage process, and run status checkpoints. One line in NYSE’s procedures deserves attention: where volumes are large, a sampling methodology may be used, and “if any findings are identified, the liability calculation is extrapolated based on the error rate of the sampling data.” An error rate in a sample of nonprofessional records becomes a liability across the whole base. The quality of every record matters, not only the ones you expect to be tested.
Phase 4. Reporting and closing.
If there are no findings, the audit closes with an email. If there are, the preliminary liability is presented verbally and in writing with the supporting workbook, and NYSE’s procedure gives the customer a minimum of 14 days to validate the findings. That window is where the record earns its keep: every line in the workbook is tested against your entitlement history, declared counts, and contract versions. A closing meeting then covers findings, control weaknesses, and corrective actions, and a closing document follows. The account manager joins the close to help with repapering, which is your signal that the outcome is commercial, not adversarial, if the record supports it.
The seven review types.
NYSE lists the common reviews it performs, and each maps to a record you should already hold.
- Feeds versus fees. The datafeeds you receive reconciled to the access and redistribution fees assessed.
- Non-display usage. Whether non-display declarations are complete and match how systems actually consume the data.
- Datafeed redistribution. Distribution records reconciled to reported usage.
- Internal and external device entitlement. Reported usage validated against entitlement data at the device and system level.
- Nonprofessional. Each user reported at the nonprofessional rate checked against the subscriber agreement data: name, address, employer, job title, employment function.
- Quote metering. Whether a metering system is counting quotes accurately.
The nonprofessional review is where firms with retail or wealth populations lose money. NYSE names four misclassifications: registered professionals reported as nonprofessional, users that are not natural persons, professionals who are not registered but act as traders or advisers, and insufficient records. The last one is the trap: a user whose status cannot be documented counts against you, and the finding is sized from the total base, the confirmed misclassifications, and the number of insufficient records. For CTA subscribers, NYSE’s UCERT tool checks FINRA registration at no cost; use it at onboarding, not at audit.
The deadlines that matter.
| Milestone | NYSE standard | What it means for you |
|---|---|---|
| Kickoff call | Within 15 days of the audit notification | Your window to appoint a contact and start the record |
| Documentation request | Within 48 hours after kickoff | Defines the perimeter; sets the submission date |
| Findings validation | A minimum of 14 days | Every line tested against your record before it becomes a number |
NYSE runs its audits as projects with published milestones. Run yours the same way, from a record that already exists.
The practitioners at Paraxis have defended 40+ exchange and vendor audits over the last decade, from both sides of the table. If the announcement email has arrived, or you want the file ready before it does, book a scoping call or write to info@paraxisids.com and mark the subject line Audit.
Source for the phases, milestones, review types, and quoted language: NYSE Market Data Audit Processes and Procedures (NYSE Group, 2022). Record-retention expectations for entitlement systems are set out in the NYSE Market Data Vendor Guide.