System Design: Low-Latency Electronic Trading Platform (Equities)

You are designing a single-region electronic trading platform (exchange/ATS-like) that supports market and limit orders for equities. Assume co-located clients in the same region and a need for high determinism, strict auditability, and robust failure handling. Design the system to meet the following requirements:

1. Order Books and Matching

• Maintain a separate order book per symbol.
• Implement a price–time priority matching engine (FIFO within each price level).

2. Market Data Ingest and Publish

• Ingest and normalize market data from multiple external venues.
• Publish market data for your platform (snapshots and incremental updates) with bounded skew across symbols/shards.

3. Client Interfaces

• Expose authenticated APIs for order entry (REST and/or gRPC).
• Provide a low-latency streaming protocol for market data.

4. Risk, Idempotency, and Reports

• Perform pre-trade risk checks (credit, position, and price bands).
• Ensure idempotent order submissions.
• Provide exactly-once execution reports to clients.

5. Performance and Scale

• Achieve P99 end-to-end acknowledgement under 5 ms within one region at 200k orders/second peak.
• Scale horizontally to handle bursts beyond the steady-state peak.

6. Persistence and Auditability

• Persist state via an append-only log or event sourcing.
• Support deterministic replay/backtesting and strict audit trails.

7. Trading Scenarios

• Correctly handle partial fills, cancels, mass cancels, auctions, market halts, and symbol pauses.

8. Partitioning, Concurrency, and Recovery

• Design partitioning/sharding of order books.
• Define concurrency control inside the matcher.
• Support recovery and disaster recovery (RPO ≈ 0, RTO < 1 minute).

9. Reliability and Fairness

• Address fault tolerance, time synchronization and clock skew (e.g., PTP), fairness across partitions, backpressure, and flow control.

10. Operability

• Define monitoring, SLOs, capacity planning, and strategies to test latency and correctness under failures.

Assumptions:

• Orders are day-only, with tick size of $0.01; extend as needed.
• Clients are authenticated institutional participants.
• One production region with multiple AZs; optional warm-standby region for DR.