• —Who do you call when the markets are in a panic?
• —Your system administrator.

Nothing shouts real‐time risk like seeing a stock's price plummet for no apparent reason. How is it possible that on a day when there isn't much news to speak of, a stock's value can crater? Sometimes the entire market collapses, but often the crashes are contained to individual stocks. At times, the price recovers during the day, prompting investors to ask about the causes of this phenomenon. This chapter describes the spanner in the works.

A flash crash is a significantly negative intraday return coupled with high intraday volatility, collectively known as severe downward volatility. A flash crash does not necessarily span multiple financial instruments; it may affect only one stock, bond, or futures contract.

To complicate matters further, high volatility alone does not guarantee a crash. For a highly volatile day to become a crash day, the price of the asset under consideration has to significantly drop. Few investors can be heard complaining about flash rallies, when the price is driven significantly higher intraday.

Likewise, a steep intraday loss alone may just be considered a “crash” and may or may not constitute a “flash” crash. Most market events commonly considered to be flash crashes are characterized by a sharp reversal or correction of prices. For example, during the infamous flash crash of May 6, 2010, the markets mostly recovered from the intraday losses by the end of the day. A steep drop in prices alone may be reminiscent of a more traditional crash like the one of October 1987 and not a flash crash of the modern day.

WHAT HAPPENS DURING FLASH CRASHES?

Flash crashes are a frequent occurrence. In the Dow Jones Industrial Average (DJIA) index alone, aggregate intraday prices dropped by at least 2 percent on 431 separate trading days since 1985. In individual financial instruments, flash crashes can be even more prevalent. The common shares of IBM, for instance, registered an intraday drop of at least 2 percent 966 times since 1985, nearly double the number of marketwide crashes. Let's consider the question of why and how price crashes in individual securities sometimes lead and sometimes do not lead to marketwide crashes with a specific example of the flash crash of October 15, 2014.

First, we shall review some flash crash statistics. The number of marketwide flash crashes per year has varied from year to year, as shown in Figure 6.1. The periods with the fewest flash crashes included 1992–1995, 2004–2006, and 2012 to present, roughly corresponding to periods of economic expansion in the US markets. The incidence of flash crashes per year in individual securities, for example IBM stock, is highly correlated with the number of annual flash crash occurrences in the markets overall, reaching 59 percent for IBM (in relation to the market) over the 1985–2015 period. Still, flash crashes in individual stocks remain far more numerous, as Figure 6.2 shows, yet not all individual instrument crashes translate into the marketwide pandemics. The silver lining for both marketwide and individual‐security‐level flash crash is that both have been declining since 2008.

Flash crashes may be caused by human “fat fingers,” sending in exaggerated orders. Flash crashes may also be due to poorly written and subsequently runaway algorithms. Most flash crashes, however, are contained within one financial instrument and do not necessarily cause a market‐wide pandemic.

How do market‐wide flash crashes occur? Some researchers believe that ETFs are at least partially responsible for major market flash crashes. These financial products are considered a passive investment and are merely mandated to track established indexes; however, ETFs can also play a role in wild intraday fluctuations.

ETFs became popular as passive investments whose owners enjoy diversification at a much lower cost than that of a traditional mutual fund or even a hedge fund. Issued by an investment manager that collects small fees for fund management, today's ETFs come in all shapes, sizes, and flavors and seem to span most portfolios imaginable. Investors can even access alternatives though mutual funds. The classic ETFs include those tracking the S&P500 (NYSE:SPY) and other common indexes.

Some ETFs are thematic: if you don't like tobacco, there is an ETF for you. For example, the iShares MSCI socially responsible ETF (NYSE: DSI) “excludes companies with significant business activities involving alcohol, tobacco, firearms, gambling, nuclear power or military weapons.”¹ Like solar power? There is an ETF for you! PowerShares WilderHill Clean Energy Portfolio (NYSE: PBW) covers “predominantly clean energy companies (wind, solar, fuel cells, and biofuels).”² There are ETFs even for leverage‐loving credit‐constrained consumers: Want to lever up 3x on the S&P 500? There is an ETF for that (NYSE:SPXL)! And if you want to short the S&P 500 and experience the effect of a 3x downside, there is an ETF for you as well (NYSE:SPXS is designed for that!). In short, there is pretty much an ETF for every taste.

The Investment Company Institute estimates that as of December 2014, there were 1,411 ETFs traded on the US markets provided by 52 “sponsors”—as ETF issuers are known. Those 1,411 ETFs attracted $1.974 trillion and accounted for 13 percent of net assets managed by long‐term mutual funds, other ETFs, closed‐end funds, and unit investment trusts—the most powerful asset managers grouping in the United States (Figure 6.3). The demand for ETFs has been increasing, fueled by the ease of investment (just tell your broker what you want), and the low costs of participation in an ETF. Most ETFs include large‐cap stocks and fixed income, including treasuries, other bonds and potentially foreign exchange, as Figure 6.4 shows.

ETF trading volume has been growing off the charts as well. Figure 6.5 shows the average monthly volume of ETF trading on Deutsche Borse's Xetra exchange over the past 15 years.

Although the proliferation of ETFs has certainly reduced costs and improved the investment lives of many, it has also delivered some unintended consequences. Remarkably, the product that is considered a passive investment, merely tracking established indexes can also play a role in wild intraday fluctuations. According to some researchers, the proliferation of ETFs facilitates stock return synchronicity—a condition whereby portfolio diversification is tossed out the window as the prices of all stocks move south at the same time. Some researchers deduce that ETFs propagate shocks and cause instabilities in the markets, framing the discussion in the direction of the information spillover theory. Others propose alternative theories of ETF behavior, pinning responsibility for the ETF and flash crash effect on the market makers. Still other researchers link the so‐called smart beta models and the ETFs among the causes of flash crashes.

How do ETFs cause flash crashes? For one, many ETFs are created using derivatives on underlying assets, such as futures and options, not the instruments that the ETFs are designed to track. As such, they are potential booby‐traps with unchecked risk exposure ticking away in the markets. Prospectuses for ETFs typically mention the composition of an ETF in general terms, the details are often murky and kept rather confidential for competitive purposes. Instead, most ETF prospectuses contain the following “buyers beware” passage:

The U.S. Securities and Exchange Commission has not approved or disapproved these securities or passed upon the accuracy or adequacy of this prospectus. Any representation to the contrary is a criminal offense. Securities of the Trust (“Units”) are not guaranteed or insured by the Federal Deposit Insurance Corporation or any other agency of the U.S. Government, nor are such Units deposits or obligations of any bank. Such Units of the Trust involve investment risks, including the loss of principal.³

While such derivative exposure makes ETF manufacturing cheap and easy, it is not at all straightforward to assess the true risks of such opaque instruments. One 2014 research paper examined nearly 7,000 ETFs and found that only 11 percent of the ETFs are within 1 percent of the actual mean return and volatility that they are designed to reproduce! In other words, only 89 percent of all ETFs are doing their job of replicating their target baskets of financial instruments! The exact risk profile of ETFs is usually not accessible to investors.

The flash crashes, however, are not influenced by a potential implosion of a single ETF. In the age of electronic trading, ETFs are a target of statistical arbitrage (stat‐arb), a technique employed by high‐ and low‐frequency traders alike. In a nutshell, a stat‐arb strategy seeks to arbitrage the “law of one price”—one of the pillars of finance. The law of one price says that in perfectly efficient markets, a basket of securities, say the S&P500, should have the same price as the ETF tracking the S&P 500 in real time. Most modern markets, although rapidly approaching efficiency, allow for temporary inefficiencies—that is, situations where prices deviate from their equation‐based model linking the price of the basket of securities and the corresponding ETFs. Such abnormalities are perfect for traders possessing ultra‐fast technology: Whoever identifies the mispricing first and trades it away making the most money.

For example, suppose the basket of securities representing the S&P 500 is in aggregate priced relatively lower than the ETF tracking the S&P500 (NYSE:SPY). Since the basket and the ETF should follow the law of one price, sooner or later, the prices will equilibrate. In the meantime, a fast trader can pounce and buy up shares of individual S&P 500 equities, buoying their price, while simultaneously short‐selling the SPY ETF, lowering its price, and effectively making the equilibrium between the basket and the ETF happen sooner than it would otherwise. Once the equilibrium is reached, the fast trader would liquidate his position, realizing a tidy profit in the matter of milliseconds or seconds or, possibly, minutes in the process.

While, most of the time, statistical arbitrage facilitates market efficiency by bringing the baskets and the corresponding ETFs into price equilibria, in many cases the market‐ETF dependency may cause a flash crash. Consider the following scenario: One of the financial instruments in a basket tracked by an ETF experiences a sharp fall. Stat‐arb traders trade the ETF to reflect the law of one price. Once the ETF's price falls, however, a new force comes to influence the markets, potentially causing widespread contagion among other financial instruments in the markets. This new force is macro arbitrage. The macro arbitrage traders and systems often rely on a macro factor model to evaluate the prices of major securities. According to the macro model, the price of a major security is tied (within a range) to the price of a major index, nowadays most often approximated by an ETF, such as the one tracking the S&P 500. Once the price of the ETF drops, most of the securities in the underlying basket are revalued by the macro traders and algorithms, dragging down the prices of most individual securities in the basket. The basket is now once again priced below the corresponding ETF!

Next, the vicious cycle repeats itself: the ETF tracking the basket is repriced downward, causing the macro‐repricing of the underlying securities. In what the US Securities and Exchange Commission dubbed a “hot potato effect” in one of its reports on the flash crash of May 6, 2010, the prices of all instruments across the market fall in a death spiral, creating a flash crash.

Once the flash crash begins in a particular market, it can rapidly spread to other instruments, affecting markets across all asset classes and continents. The recovery can be just as swift: All it takes is for one market participant or system to realize the artificial absurdity in the present crash and the low valuations of the securities to begin to repurchase the underpriced instruments. The impact of a flash crash on volatility is much‐longer lived: the heightened volatility and “jitteriness” in the markets may persist for days and months following a substantive crash.

Is the proliferation of ETFs actually increasing flash crash frequency? Figure 6.6 plots the peaks and troughs in the number of flash crashes in the S&P 500 per year against the annual trading volume in the S&P500 ETF (NYSE:SPY). As Figure 6.6 shows, the volume of SPY exactly tracks the number of flash crashes in a given year since 2007. While the chart alone does not establish causality of trading volume, the relationship speaks for itself. At the same time, the overall growth in trading in the S&P 500 does not appear to have a hand in flash crashes. As Figure 6.7 shows, the annual volume in the traded shares of the S&P 500 index appears to lag the number of flash crashes per year.

Are traders and their machines choosing to use ETFs during flash crashes, and, if so, why? A branch of research speculates that ETFs are an easier option to trade when it is urgently required to liquidate positions. Some researchers emphasized the liquidity advantages of ETFs as compared with other forms of investing. Indeed, ETFs are often used in the following solution: Sell anything closely correlated and highly liquid with one's target portfolio first and then slowly rebalance the position to neutralize the portfolio as a whole. The desired effect can be achieved with derivatives and, of course, plain ETFs. Anecdotally, the technique has proved effective and gained popularity with pension funds, hedge funds, and other large institutions charged with capital protection.

Over time, the traded volume of the S&P 500 ETF (NYSE:SPY) has been increasingly correlated with the intraday downward volatility of the ETF. Figure 6.8 shows the 250‐day rolling correlation of intraday downward volatility (daily low versus daily open, expressed as a percentage) versus the daily volume for the same day. As Figure 6.8 shows, in SPY, the correlation has been sloping down to –70 percent, implying an increased dependency between the relative intraday lows and the traded volume. As Figure 6.8 also illustrates, the effect is not as palpable in the S&P 500 itself, implying that SPY is indeed used as a quick liquidation tool in falling markets. Correlations become less pronounced when volume lags downward volatility by one day, implying that trading is really concentrated on the day of the sell‐off. The correlations almost disappear altogether when the downward volatility lags trading volume—it is the trading volume that drives down prices, not volatility.

Is the existence and behavior of ETFs limited to the US equity markets? Far from it. The prices of the constituents in the index were often tracking the ETF. For instance, major constituents of GREK, an ETF following the Greek economy, are closely tracking the index.

Is banning ETFs a solution? Probably not. ETFs deliver a convenient and quite transparent way to trade portfolios of securities. Managing ETF risks, however, is a barely charted territory. In light of this, some researchers, like Professor Maureen O'Hara of Cornell University, suggest that ETFs should be restricted to baskets of widely traded instruments.⁴ As the analysis presented in this chapter shows, however, it is precisely the ETFs on the baskets of widely traded securities, often used as proxies for the broader market, that are most often used as factors in the macro models and are therefore most likely to cause marketwide crashes.

And what if ETFs like SPY were banned? At present, SPY provides a convenient function: It tracks the composition of the S&P 500 index and enables short‐term stat‐arb and macro traders to immediately reference the index in their quest for a quick profit. Banning SPY, however, would not eliminate stat‐arb and macro traders—instead of using a readily available SPY to benchmark intraday price movements, the traders and their algorithms would instead track the composition of the S&P 500 themselves. The implementation of pseudo‐SPY would probably entail some 100 lines of code, and would allow the traders to continue deploying their present strategies for a foreseeable future. In fact, banning any sort of ETFs would probably give rise to a new cottage industry of synthetic ETF proxies potentially traded over the counter—that is, outside of exchanges, without the transparency afforded to them at present. Thus, banning ETFs, as O'Hara suggests, may not have the desired effect.

Another recommendation by O'Hara is to improve information quality; abstract the noise of temporary would‐be flash crashes with a sound understanding of where the fundamentals and other traders stand and whether the markets are ripe for a flash crash. This is where the uncommon data and the Internet of things come in, discussed in Chapter 8.

How do flash crashes in individual instruments spread to other securities and result in marketwide crashes in practice? In this chapter, we will dig into an example from October 15, 2014. The flash crash of October 15, 2014, rattled fixed‐income traders. The day was dominated by the institutional activity that is illustrated on Figure 6.9. The day started with institutions selling off two particular names: MRK and MSFT. Following the sell‐off, institutional activity switched to buying natural gas, gold, and euro, possibly in anticipation of a broad market crash across most asset classes. The resulting sell‐off eventually prompted the sell‐off in gold and natural gas as well, in a presumptive reversal of the previous accumulation. This was also accompanied by a sell‐off in U.S. Treasuries. A subsequent reversal across most equities, commodities, and rates buoyed market expectations.

As with all sudden market crashes and reversals, one always wonders whether the crash was intentionally driven by an unscrupulous market participant in search of a quick yet illicit gain. In the case of the October 15, 2014, crash, the AbleMarkets' analysis cannot rule out such a possibility. The analysis indicated significant institutional purchases of natural gas, gold, and EUR/USD preceding the US equities market crash by as much as one hour. Following the downturn, however, gold and natural gas positions were reversed in tandem with a turnaround in equities. It is, therefore, conceivable that the accumulation of euros and commodities served as a hedge for a flash‐crash market strategy in the US stocks.

Was the crash caused by institutions, and how might you know? One of the questions about the events of October 15, 2014, is about institutional participation on that day and its influence on the markets. We can look to the AbleMarkets Institutional Activity Index to glean some answers for the Dow Jones 30 companies as well as selected commodities and currencies. The AbleMarkets Institutional Activity Index is an index based on a proprietary methodology that tracks the participation of institutional traders by classifying each trade initiated by a market or a marketable order as institutional or noninstitutional with a high degree of accuracy.

According to the AbleMarkets Institutional Trading Index, the first 30 minutes of the trading day witnessed a considerable institutional sell‐off in Merck & Co. (NYSE: MRK) and Microsoft (NYSE:MSFT). The proportion of institutions originating market(able) sell orders exceeded those in buy orders by 92 percent in MRK and 85 percent in MSFT from 9:30 AM to 10:00 AM. Interestingly, institutional sell‐offs in MRK and MSFT were accompanied by institutions purchasing Johnson & Johnson stock (NYSE:JNJ), gold, and Japanese yen. Specifically, from 9:30 to 10 AM, the proportion of institutional buyers of JNJ, gold, and Japanese yen exceeded the proportion of institutional sellers by 94 percent, 59 percent, and 69 percent, respectively.

In the following 30 minutes, from 10:00 AM to 10:30 AM, the institutional activity briefly stabilized among the Dow Jones 30 stocks. However, institutions retained their focus on buying commodities, such as the natural gas, where the proportion of institutional buyers exceeded that of sellers by 77 percent. The institutional buying of commodities, however, was reversed from 10:30 AM to 11:00 AM, with institutional sellers outnumbering institutional buyers by 91 percent in natural gas and by 76 percent in crude oil. During the same time period, 16 out of Dow Jones 30 stocks experienced a mild sell‐off, where the proportion of institutions among all entities placing market and marketable sell orders exceeded the proportion of institutions in buy orders.

From 11:00 to 11:30, the relative percentage of institutions placing sell orders further increased, with 22 out of Dow Jones 30 stocks being dominated by institutional sellers. The trend continued from 11:30 to 12 PM, where 23 stocks of the Dow Jones 30 were affected. Simultaneously, institutional buyers outnumbered institutional sellers in gold and the euro. However, institutional sellers dominated in the Canadian dollar, Australian dollar, Swiss franc, and emerging currencies such as Mexican peso and Turkish lira.

From 12:00 PM to 12:30 PM, the trend continued to exacerbate, with 26 out of 30 DJIA stocks being under heavy institutional selling pressure. Institutional sell‐off in US stocks spread to crude oil and most currencies, including UK pound sterling, Canadian dollar, Australian dollar, Swiss franc, Mexican peso, Turkish lira, Chinese yuan, and Brazilian real. At the same time, however, institutional buyers outpaced institutional sellers in commodities, such as gold, silver, and natural gas, and also in currencies, such as Japanese yen, Russian ruble, and, in particular, euro, where the proportion of institutional buyers among all market(able) buy orders exceeded the proportion of institutional sellers among all seller‐initiated trades by 82 percent.

By 1:00 PM, institutional sellers overtook institutional buyers in most equities, commodities, and currencies, with notable exceptions of natural gas and euro, where institutional buyers exceeded institutional sellers by 94 percent and 82 percent, respectively. The stock of McDonald's Corporation (NYSE:MCD) and the Turkish Lira were particularly disbursed by institutions. By 13:30, institutions were dominating the sell‐off across the board in stocks, commodities, currencies and even U.S. Treasuries, with exceptions (institutional buyers‐favored) including American Express (NYSE:AXP), Goldman Sachs Inc. (NYSE:GS), Japanese yen, Brazilian real, and Russian ruble. Euro, crude oil, natural gas, gold, and silver were all registering heavy institutional selling pressure.

By 2:00 PM, there was a sharp reversal in institutional activity among equities and currencies. Twenty‐two out of 30 constituents of the DJIA registered significantly higher institutional participation among market buy orders and marketable limit buy orders than sell orders. Heavy institutional buying activity was also observed in Japanese yen, Australian dollar, Canadian dollar, Swiss franc, British pound sterling, Chinese yuan, Brazilian real, Mexican peso, Korean won, and Russian ruble. Institutional activity in the euro reversed direction, resulting in a sell‐off. Institutional sell‐off persisted in silver, gold, and US Treasuries. At the same time, institutional activity in crude oil and natural gas was already mostly dominated by buyers.

This pattern largely persisted until the end of the North American trading session with a couple of notable changes. Around 3:00 PM, crude oil underwent a sharp institutional sell‐off, only to stabilize by the end of the trading day. Institutional activity in silver and gold reversed (became buyer‐dominated) by 3:30 PM, while the sell‐off in the US Treasuries persisted until the end of the day.

DETECTING FLASH‐CRASH PRONE MARKET CONDITIONS

Can flash crashes occur independently of ETFs? Absolutely, yes. As Figure 6.10 shows, flash crashes in individual securities are incredibly common. Market‐wide flash crashes, however, are much less frequent, in part because a dropping stock does not necessarily precipitate contagion in other securities. Accordingly, the number of market‐wide flash crashes has been steadily decreasing over a number of years, as depicted in Figure 6.1. In particular, 1974, 2002, and 2008 were “high‐flash‐crash years,” where the number of market‐wide flash crashes with over 2 percent intraday plunges reached and surpassed 45 trading days out of 251 available for a typical trading year, resulting in one flash crash every six trading days on average!

What is the solution to the problem of flash crashes? According to research, the onset of flash crashes can be detected in much the same way as the human propensity to have heart attacks and other diseases. AbleMarkets has identified certain markers that, like tests on human blood, point to whether the markets are susceptible to price agitation, potentially leading to flash crashes. Specifically, flash crashes can be spotted in deformities of the limit order book as many as two days ahead of the flash crash. Erratic micro‐movements of prices that can only be detected in the limit order book are also reliable predictors of subsequent market‐wide crashes.

This phenomenon is not that different from conventional physics. Consider this experiment: Take a sealed bottle of water (“the market”) and start warming it up slowly. What happens next? The water molecules (“prices of individual financial instruments”) inside the bottle begin moving at an increasingly high pace. Heat the bottle more, and the molecules will ultimately erupt out of the bottle, not unlike a flash crash in the markets. Cool the water bottle, however, and the molecules stabilize and return to their business as usual, giving us hope that swift detection of abnormal flash‐crash‐leading market conditions may actually help spare the markets from flash crashes. A limit order book filling exercise may be the answer to rescue the market but much more research is needed to determine exactly what kind of remedy works best for this purpose.

The sharp movements of prices preceding flash crashes can be modeled as high‐frequency runs. When there is too much one‐sided trading activity, it erodes liquidity on the opposite side of the market, resulting in drastic price precipitations. In the time before flash crashes, trading data also ceases following regular patterns.

Under normal market conditions, trades often form “sequences” or “runs.” Under flash‐crash prone conditions, the runs exacerbate—like the molecules in the heated water bottle, the one‐dimensional runs of prices become longer and more pronounced. A run is a one‐directional price movement. For example, IBM stock may experience a run if its price increases from $158.85 to $158.86 to $158.87 in a continuous sequence. Once the price declines by even one tick, the run ceases. A length of a run is a number of ticks that the trade price moves up or down in sequence. In the IBM example, the first run has a length of 3. When the price increases for two trade ticks in a row, the price is considered to be in a positive run of length 2. Similarly, if the price decreases for five trade ticks in a row, then the price is considered to be in negative run of length 5. Figure 6.11 illustrates the idea.

It is often assumed that price runs follow a so‐called random walk, where the probability of staying in the run is independent of the duration or length of the run. Our research shows that the probability of staying in the run actually increases with the duration or length of the run. Ahead of flash crashes, the runs increase in length, resulting in more one‐sided trading as well as in irregular trading patterns. Specifically, the runs become unusually long and jut out as data abnormalities. The runs themselves are generated by one‐sided order flow, eroding the opposite side of the limit order. Furthermore, certain parameters of runs are highly persistent. As a result, abnormal run activity, as well as the resulting flash crashes, can be predicted as far as a day in advance. Figure 6.12 demonstrates properties of runs computed using tick data on single days in May of 2008, 2010, and 2012. On the horizontal axis, each figure shows the number of periods or lags in the runs that have consecutive returns in the same direction: positive, negative, or zero. On the vertical axis, each figure shows a conditional probability of staying in the run given the number of lags already achieved within the run corresponding to the location on the horizontal axis. That is, the probability of staying in a positive run given that the run has already lasted three consecutive ticks was 3 percent on May 5, 2008 (Figure 6.12, panel a). All data used are for the S&P 500 ETF (SPY), as reported by Reuters. Trade prices that are 20 or more percent away from the latest price tick are considered erroneous and are ignored, as is customary in quantitative analysis of financial data.

Each figure shows that the probability of staying in the run actually increases with the duration of the run. This is particularly true for runs with zero returns: The conditional probability of staying in a zero return run often reaches 99 percent, and such runs may last for 300 or more trade ticks. By comparison, positive and negative runs seldom reach double digits in length, yet a conditional probability of staying in the positive or negative run also increases with the length of the run. In the short term, at lag of two or three or four, the runs are highly unstable: Probability of one positive return following another is only 20 percent. It is more likely for a positive return to be followed by a negative or zero return than by another positive return. In the longer run, say seven or eight nonzero unidirectional returns in length, the probability of staying in the run of them exceeds 50 percent.

As Figure 6.13 shows, such dynamics are undetectable at lower frequencies, say, one‐second bars, where the runs appear to follow a random walk.

Figure 6.14 displays the profit obtained by an average positive and negative run. As Figure 6.14 shows, the runs tend to be back‐loaded: The price change is more pronounced toward the end of the run, possibly due to the limit order book erosion caused by the run.

Predictably, then the runs become longer and more persistent due to the inclusion of zero returns, as shown in Figures 6.15 and 6.16. Figures 6.17 and 6.18 show the economic gains of non‐negative (runs including positive and zero returns) and non‐positive runs (runs including negative and zero price changes) corresponding to Figures 6.15 and 6.16. As the figures demonstrate, positive and negative returns can appear ahead and in the midst of zero returns.

The run phenomenon does not appear to have changed in recent years. Figure 6.19 shows the length of a maximum positive sequence less the length of a maximum negative sequence observed on any given day from October 2009 through October 2012. No structural breaks are apparent.

Next, the runs can be modeled mathematically. The outcomes of models can be compared to realized values to see if the runs are staying on course in the confined “normal” market zone or are drifting off into the flash crash territory. Of course, like the predictions of human heart attacks, the detection of market crashes is probabilistic, and false positives exist. Still, the benefits of understanding the market dangers outweigh the ignorance.

What can investors do when flash crash–ripe conditions are detected in the markets? Hedging becomes a priority, especially for smart beta strategies that bear huge exposure to ETFs and the broader markets. Whether futures or options‐based, hedging carries a low cost in comparison with the benefit it provides. It is indeed better to be safe than sorry, especially when the probability of an impending flash crash is high.

ARE HFTS RESPONSIBLE FOR FLASH CRASHES?

Most recent routs in the US financial markets have prompted an outpouring of angst. Detractors of high‐frequency trading (HFT) were particularly up in arms about the market downturn, which many of them blamed squarely on manipulation by HFT. Much of the debate about the role of HFT in the events of the August 2015 crash, as well as previous market crashes, was largely based on speculation. The second example for this chapter introduces data‐driven evidence about the sequence of events on August 24, 2015, a particularly bad Monday when the US equity markets lost over 4 percent in a single day.

To understand the trading dynamics that led to a precipitous drop in prices on August 24, 2015, we use probabilistic estimates (shown accurate in tests) of aggressive HFT and institutional activity. To detect aggressive HFT and institutional flow, AbleMarkets uses complicated data‐intensive computer programs running on hundreds of servers at any one time. The programs use highly granular market data and apply proprietary data science techniques to extract trading profiles of entities behind observed market orders. Since AbleMarkets uses anonymous market data to develop conclusions, the results do not identify particular institutions behind the trades. For instance, the results say with a high degree of confidence that a particular market order was placed by a high‐frequency trading firm, but do not point to whether the high‐frequency trader in question was, for example, employed by Getco or Virtu. Similarly, the analysis can point to orders placed by large institutions, but does not identify institutions that may include CALPERS or the Harvard University Endowment.

AbleMarkets' analysis of trading on August 24, 2015, shows that while there were bursts of aggressive HFT activity during the sell‐off, it was the institutional activity, not the HFT activity, that led and dominated the sell‐off. Specifically, the events have appeared to unfold as follows: institutions would sell particular securities, creating acute selling pressure in the markets. Aggressive HFTs would then step in and sell off the market further, but only for a relatively short period of time.

Specifically, on August 24, 2015, aggressive HFT reached 50 percent by volume in several major stocks throughout the day. However, the proportion of aggressive HFTs alternated between HFT buyers and sellers. For instance, the proportion of aggressive HFT sellers in the S&P500 ETF (NYSE:SPY) was 62 percent shortly after the market open. However, proportion of aggressive HFT quickly reversed to spike to 75 percent in aggressive HFT BUY trades in major US equities, such as MMM, at 9:45 AM that same day. Following that, aggressive HFTs further reversed the buy streak and started selling around 10:20 AM on the same day, with aggressive HFT sellers accounting for 53 percent in MMM, for example.

The dominance of aggressive HFT sellers continued through 2:21 PM in equities such as V, GS, and SPY, staying at about 55 percent by volume in these securities. Around 2:30 PM, aggressive HFTs became once again more prominent on the buy side of the limit order book, where they stayed until the market close at about 50 percent of trading volume initiated by market buy orders.

On the same day, August 24, 2015, institutional sellers reached 70 to 90 percent of trading volume at market open and at noon in major US equities such as V, GS, and MMM. In other words, in stocks like V and GS, institutional sellers started the sell‐off before HFT sellers by an extensive period of time, as well as an extensive volume of trades.

The results of the analysis make sense intuitively when the nature of HFT strategies is taken into account. By definition, HFT is very short‐term in its outlook and does not sustain a prolonged sell‐off. Instead, HFT strategies alternate buy and sell (long and short) positions throughout the day. While achieving high‐frequency reversals of positions throughout the day, aggressive HFTs tend to be balanced in their buy and sell activity: Market buy orders quickly follow market sells, and vice versa. Aggressive HFTs avoid accumulating large positions, and, as a result, do not tend to be directional on any particular day.

On the other hand, trades of large institutions, such as pension funds, tend to be large (sometimes taking several days to process) and are unidirectional—selling or buying without much alternating. As a result, institutions are capable of impacting the markets much more than do aggressive HFTs.

CONCLUSIONS

Flash crashes are a phenomenon that has been around for years, although the lack of intraday data masked the crashes for years until recently. Crashes in individual securities can be predicted as far as two days in advance by identifying market risk factors that, like clogged arteries in a human, may drive a heart attack in a market.

While the flash crashes in individual instruments are common, they do not necessarily result in a market‐wide pandemic. The market‐wide flash crashes can be traced to contagions transmitted by ETF trading.

END OF CHAPTER QUESTIONS

1. What is a flash crash? How can it be characterized and measured?
2. Have flash crashes become more pronounced with electronization of trading?
3. What are ETFs?
4. How are ETFs potentially contributing to flash crashes?
5. What is the role of high‐frequency traders in flash crashes?