Your “Broker” Is the House. And the House Knows Your Cards.

On a 2023 Polish Supreme Administrative Court ruling, asymmetric slippage, and the millisecond between a click and a loss

The customer sees a platform. The broker sees parameters. Between the two of them lies the entire difference between a market and a casino—a casino where only the dealer knows the order of the cards, and only the dealer changes the deck when the game stops paying.

The case of X-Trade Brokers, brought to its definitive conclusion by a ruling of the Supreme Administrative Court of February 28, 2023, demonstrates that difference with surgical precision. A single parameter in the code of a trading system, asymmetrically configured, generated over the course of seventeen months what the Polish Financial Supervision Authority would later describe as “materialized negative price slippage” of somewhere between roughly 7.96 million and 23.54 million złotys. One numerical value, tucked away in a configuration file. The rest is consequence.

I described every one of these mechanisms nineteen years ago, in an e-book titled The Casino Always Wins: A Few Little-Known Truths About Investing in the Forex Market.

I look back at that text now with a peculiar mixture of authorial satisfaction and civic resignation. The diagnosis was correct. The protections owed to the consumer have, in the intervening two decades, remained largely theoretical.

How Much Can You Squeeze From a Customer in a Millisecond?

Imagine a buy order on the EUR/USD pair, placed in what the industry calls “instant” mode—a model that guarantees the customer execution at the price displayed in the order. The customer clicks. Between the click and the execution, several dozen milliseconds elapse: a sliver of time invisible to the human eye, during which the market price of the asset may twitch in one direction or the other. This is where a parameter called deviation enters the picture: the maximum permissible divergence between the price in the order and the market price at the moment of execution, beyond which the broker may decline to fill the trade.

The mechanism itself is not, in principle, fraudulent. It is a tool of risk management. A broker operating as a market maker—that is, the counterparty to every customer transaction—has a legitimate interest in protecting itself against orders that would have to be executed at prices wildly out of line with current market values. The point at which risk management slides into expropriation lies in a single feature: symmetry.

The findings of the Polish Financial Supervision Authority (KNF), upheld by the Voivodeship Administrative Court in Warsaw on June 6, 2019 (case no. VI SA/Wa 2246/18), and left undisturbed in cassation proceedings before the Supreme Administrative Court (II GSK 1302/19), are unambiguous. From January 1, 2014 to May 31, 2015, XTB applied the deviation parameter in a manner that, in the Court’s own words, “imposed a limit on the divergence between the price at the moment the order was placed and the price at the moment of execution, in the case of price changes directionally favorable to the client, but left without any limit the divergence between the price in the order and the price at the moment of execution, in the case of price changes unfavorable to the client.”

In plainer English: if the price moved in the customer’s favor, the broker could decline to fill the order. If the price moved against the customer, the order was executed without restriction.

The mechanism applied to every customer who traded in this mode. During the period under review, the system processed approximately 12.5 million orders across more than 21,300 accounts.

A second mechanism, called delay, operated on a different principle. A select group of customers—roughly four hundred individuals, flagged within the company’s internal classification system as “sp” or “n” and described, in XTB’s own words, as “exploiting weaknesses in the system”—had their orders held back by a specified number of milliseconds. After the delay elapsed, the system checked the current market price and decided whether to execute or reject the order. In practice, the delay sat on top of the asymmetric deviation. It was deployed from January 1, 2014 to December 12, 2016—surviving the deviation parameter by over a year and a half, which, from a compliance standpoint, suggests that the company removed one mechanism and left the other quietly running. The materialized losses attributable to delay alone amounted to between approximately 1.50 and 1.53 million złotys.

The customer affected by delay had no way of knowing that delay applied to him. The customer affected by asymmetric deviation had no way of knowing the parameter was asymmetric. The terms-of-service agreement contained no such information. The KNF, the Voivodeship Court, and the Supreme Administrative Court treated this circumstance as central—and rightly so. In a model where the broker is the counterparty to every transaction—a model in which, as the Voivodeship Court put it, “the client’s profit on a given financial instrument represented a loss for the company, and the client’s loss represented a profit for the company”—the failure to disclose a mechanism that consistently shifts the equilibrium toward one side is not an oversight in disclosure. It is the instrument itself.

It is worth noting, in passing, that the regulatory history of XTB did not end with the 2023 cassation ruling. By a decision of March 30, 2026, made public in a press release dated April 12, 2026, the KNF imposed a second monetary penalty on the company—this one in the amount of 20 million złotys—for a separate set of violations committed between January 1, 2022 and August 16, 2023. These included improper assessment of customer knowledge and experience, inadequate target-market identification, and the dissemination of misleading or unreliable information to current and prospective clients (see the KNF communiqué; see also Business Insider’s coverage). The second sanction, twice the size of the first, addressed a materially different set of obligations—suitability and retail-customer protection—suggesting that the structural tension between the market maker model and the duties owed to the customer has not subsided. It has merely changed costume.

“The Best Interest of the Client”: What Hides Behind the Phrase

The duty to act in the client’s best interest is set forth in Article 83a, paragraph 3, of the Polish Act on Trading in Financial Instruments of July 29, 2005. The phrasing is innocuous—almost banal. Its normative weight, however, becomes apparent the moment one traces the language back to its doctrinal source: Recital 33 of the preamble to Directive 2004/39/EC (MiFID I), in which the European legislator states expressis verbis that “it is necessary to impose an effective ‘best execution’ obligation to ensure that investment firms execute client orders on terms that are most favorable to the client.”

The doctrine of best execution—for that is what is at stake—has, in the interpretation adopted by the Voivodeship Court (and undisturbed in the cassation proceedings), one significant feature: it does not require proof of harm to any individual customer. It is enough to establish that the broker designed the order-execution process in a manner systemically inconsistent with the interests of the customer placing the order. The dispute that XTB brought before the administrative courts turned, in fact, on this very distinction: the company argued that actual customer losses had to be demonstrated; the regulator and the Court replied that the obligation of best execution is structural, not contingent on outcomes.

The Court’s position carries a distinctly practical weight. If proof of a violation required precise calculation of the loss suffered by every aggrieved client—across 12.5 million orders and 21,300 accounts—enforcement of the rule would be illusory. The doctrine of best execution does not confer a right to compensation; it imposes a duty of design. Brokers must architect their systems so that those systems, in their normal operation, work toward the maximization of customer benefit. Asymmetric deviation violates this rule not incidentally, but constitutionally. The European Securities and Markets Authority, in its Q&A on CFDs and similar instruments, confirms outright that asymmetric slippage signals that a broker is not “taking all reasonable steps to avoid conflicts of interest” within the meaning of MiFID II.

A subtlety deserves attention here. In its cassation appeal, the company argued that the obligation of best execution (Article 83a §3 of the Act, §47 of the implementing regulation) and the duty of disclosure (§8(1) and §10(2)(7) of the same regulation) constitute two distinct categories of obligations and may not be conflated. The Supreme Administrative Court declined to engage the argument on its merits—reasoning, in points 5.1 and 5.2 of its opinion, that the appellant had framed the claim as one of misinterpretation of law, when in substance it sought to demonstrate misapplication, a ground the appeal did not actually invoke. The Court, in other words, stepped back from doctrinal engagement on procedural grounds—a posture that, in cassation practice, is categorically distinct from substantive endorsement of the lower court’s reasoning. What stands undisturbed, therefore, is the position of the Voivodeship Court, which held expressis verbis that “the company’s responsibility was established for violations of provisions requiring the consideration of the client’s best interest in the provision of brokerage services on the [forex] market, not for whether clients […] suffered losses,” and that the question of actual losses “may bear on the character of the sanction—and, in this case, on its amount.” This position, undisturbed in cassation, leads to a conclusion that should not be drawn more sharply than the rulings allow: when a broker’s conduct simultaneously violates the standard of order execution and the duty to inform the client of how orders are executed, two distinct administrative offenses arise—offenses related causally, however, in that the concealment of the mechanism is the operational precondition of its use. The failure to disclose is not, in this scheme, secondary. It is part of the same project.

Doctor Jekyll and Mr. Hyde at the Brokerage

It is worth stepping briefly outside the strict framework of administrative procedure and turning attention to an asymmetry that is structural to the brokerage business but rarely named outright.

The same firm that defends itself before the administrative courts—and not without intellectual flair—by arguing that no individualized proof of harm to each of 21,300 clients has been adduced; that the asymmetric configuration of the deviation parameter does not, in itself, prove anything; and that the obligation of best execution is one of due care, not of guaranteed outcome—runs, in parallel, a marketing operation that addresses the prospective retail client in language that is the precise inverse of all of the above. The marketing speaks of attainable profit, of control, of strategy.

The customer reading XTB’s marketing material lives in the conviction that his result depends, primarily, on his skill—and that the seventy-five percent of clients who lose money on the platform are at fault, having lacked experience, discipline, or knowledge.

This is not an isolated case. In July of 2024, a research team from the British universities of Bristol, Nottingham, and Swansea—Andrade, Costa, Weiss-Cohen, Torrance, and Newall—posted a preprint, later published in March of 2025 in the peer-reviewed Behavioural Public Policy (Cambridge University Press), documenting an audit of fourteen of the most popular CFD-trading apps in the United Kingdom, available on both iOS and Android, accounting collectively for ninety-two percent of British downloads in the segment.

The methodology combined content analysis, double-coded with inter-rater agreement above eighty-five percent, with thematic analysis of the educational materials provided in the apps’ demo modes. The findings—setting aside the specifics of the U.K. regulatory regime, where the obligation to display warnings about the fate of sixty-five to eighty-nine percent of customer accounts is imposed by the FCA rather than the KNF—form a coherent, quantitatively documented portrait of the industry’s structural duplicity. Risk warnings (“89% of retail investor accounts lose money when trading CFDs with this provider”) are present, but routinely placed in a manner that frustrates actual perception: 31.6% of warnings fall short of regulatory standards, only 35.7% of apps display them in their main navigation, more than half are placed at the bottom of the screen, and 75.2% of warnings in customer email correspondence appear in a font smaller than the surrounding text. The educational materials available in demo mode actively cultivate in the user what the authors call “the hope of winning.”

They do this through systematic emphasis on the importance of “strategy,” of “discipline,” of “emotional control,” of “mastering one’s own psychological disposition”—on factors which, in a phenomenon whose dominant component is randomness, are neither necessary nor sufficient for profit, but create the impression that they are.

Andrade and her co-authors note a structurally instructive paradox. The requirement to disclose that most accounts lose money would be effective only if the customer noticed the disclosure and treated it as a forecast applicable to himself. The educational materials in demo modes systematically undermine both premises—the first through the placement of the warning, the second through a narrative in which the loss of money is framed as the consequence of a particular trader’s insufficient discipline rather than a structural property of CFDs as an asset class.

The message that the recipient of these educational materials receives—always indirectly, never expressis verbis—runs as follows: if others are losing, it’s because they had no strategy. You will have a strategy. You will not be among the eighty-nine percent.

Structurally, this is the same mechanism that the U.K. Gambling Commission identified in the demo modes of gambling games—where players in trial mode statistically win, rather than lose, generating a false belief in their ability to win once they begin playing for real money. The British Gambling Commission banned the practice in 2021. Its analogue in CFD apps remains in a regulatory gray zone, though, as the cited study makes clear, it operates in structurally identical fashion.

The conclusion that may be drawn from this, with the appropriate caution against conflating academic findings with the legal assessment of any particular firm, is nevertheless of considerable weight. The sanction imposed by the supervisor on a broker for asymmetric deviation, or for an inadequate fulfillment of the best-execution duty, addresses one layer of the company’s conduct: the layer regulated by the Act on Trading in Financial Instruments and its implementing acts.

A second layer—the marketing message, the educational materials in demo modes, the multimillion-złoty sponsorship deals with sports clubs whose audience is the same demographic of men aged eighteen to forty-five—is currently under no systematic supervision by any Polish authority.

The Act on Competition and Consumer Protection, together with the Unfair Commercial Practices Directive (2005/29/EC, transposed into Polish law by the Act of August 23, 2007), provide, in theory, the tools to pursue misleading advertising in the sector. In practice, their application to CFDs has remained rare. And it is precisely this second layer—not the deviation in the configuration file, but the hope of winning in the demo’s tutorial—that determines, more than any other factor, whether a customer opens an account with a market maker in the first place. The mechanism that surfaces and is sanctioned at the moment of order execution functions, in truth, only because of a promise made far earlier.

Can XTB’s Customers Sue for Damages?

A final observation, which may be drawn from the Voivodeship Court’s reasoning, has implications that reach beyond the administrative-law regime—and opens a path that Polish jurisprudence has, to date, traveled only in fragments. The Court stated expressis verbis that “the duty to execute orders on the most favorable terms is not a special construct of public law, introduced by Directive 2004/39. It is a straightforward consequence of the duty of loyalty owed by the investment firm to its client, and of the essentially fiduciary character of the contract for order execution. This duty cannot be excluded by agreement. To do so would constitute a violation of the mandatory provisions of §47 of the Regulation on Procedure and Conditions, as well as a breach of the limit on freedom of contract expressed in Article 353¹ of the Polish Civil Code.” The Voivodeship Court recites the proposition with an explicit citation to T. Sójka (ed.), Cywilnoprawna ochrona inwestorów korzystających z usług na rynku kapitałowym [The Civil-Law Protection of Investors Using Capital Markets Services] (WKP, 2016), Chapter VI, point 6—a doctrinal anchoring that matters, because it locates the fiduciary construction not in judicial improvisation but in established Polish civil-law scholarship.

This proposition has two consequential corollaries.

First: if the source of the best-execution duty lies in the fiduciary character of the broker-client relationship, then its breach generates liability not only in the administrative regime but also in civil law—grounded, plausibly, in Articles 354 §1 and 471 of the Civil Code, and, where the breach involves the disclosure obligation, in Article 415 (the general tort provision).

Second: since the matter implicates the limit on freedom of contract under Article 353¹, no contractual clause and no provision of the broker’s terms of service can effectively waive or curtail the duty. This line of argument—largely unexploited, to date, in Polish individual-claim litigation against market maker brokers—is rendered doctrinally accessible by the XTB case, even though that case was tried in the public-law regime.

A Global Standard: The Anatomy of the Same Case in Three Jurisdictions

To a Polish reader, the XTB case may appear as a local incident. It is, in fact, the local edition of a script that played out earlier in American and British jurisdictions. The triangulation XTB (Poland) ↔ FXCM Ltd. (United Kingdom) ↔ FXCM LLC (United States) demonstrates that asymmetric slippage is not a pathology of the Polish market but a structural temptation built into the market maker model itself. Jurisdictions and regulatory frameworks change. The mechanism remains identical.

FXCM LLC: The American Chapter (NFA + CFTC, 2011)

On August 12, 2011, the National Futures Association imposed a 2-million-dollar penalty on FXCM LLC for retaining the gains generated by asymmetric slippage. On October 3, 2011, the Commodity Futures Trading Commission followed with a 6-million-dollar penalty and an order of restitution in the amount of 8,261,937 dollars to the firm’s American clients. The mechanism, as described in the NFA and CFTC orders, is rendered in the same vocabulary that would later be used in the XTB decision: positive price movements during the latency window between order placement and execution were retained by the broker; negative ones were passed through to the customer. The American restitution covered FXCM LLC clients alone; clients of sister entities in other jurisdictions received nothing.

FXCM Ltd.: The British Chapter (FCA, February 24, 2014)

The British FCA—then, during the period under review, the Financial Services Authority—issued a Final Notice on February 24, 2014, imposing on FXCM Ltd. and FXCM Securities Limited (jointly, “FXCM UK”) the following sanctions: a monetary penalty of £3.2 million on FXCM Ltd. for breaches of Principle 6 of the FCA Handbook (treating customers fairly) and the best-execution rules contained in COB 7.5.3R and 7.5.5R (until October 31, 2007), and in COBS 11.2.1R, 11.2.14R, 11.2.27R, and 11.2.28R (from November 1, 2007 onward); a public censure of FXCM Securities Limited for analogous violations during the period from May 14 to December 17, 2010; and a joint penalty of £800,000 against FXCM UK for breach of Principle 11—the obligation to deal openly with regulators—about which more in a moment.

The combined financial sanction came to £4 million plus an Unclaimed Redress component (the amount of restitution unclaimed by clients after fifteen months). FXCM Group additionally committed itself to the payment of restitution of up to 9,941,970 dollars. And here is a detail that gives the case its particular weight: had it not been for a twenty-percent settlement discount granted for early cooperation, the FCA would have imposed the full £4 million (Principle 6) and £1 million (Principle 11).

The Recurring Facts

To read the FCA’s Final Notice alongside the KNF’s decision is to experience a particular sort of déjà vu. At FXCM Ltd., between August 1, 2006 and December 17, 2010—over a period of more than four years—the group retained 6,725,106 dollars from positive price movements across 2,214,053 customer transactions, and an additional 3,103,571 dollars from 1,101,161 limit-order trades. There were approximately seventy-five thousand active customers. The mean individual slippage retained by the broker came, by the FCA’s calculation, to approximately 3.70 dollars per transaction. The conclusion that follows from that figure is troublingly simple: the scale does not derive from the rapacity of any single act of theft, but from the multiplication of micro-extractions across millions of events. The asymmetry of the parameter is, here, less a crime than a machine. And the machine works conscientiously.

A Comparative Table

Doctrinal Lesson the First: Principle 6 and Article 83a §3 of the Polish Act

The British Principle 6—“A firm must pay due regard to the interests of its customers and treat them fairly”—and the Polish duty to act in the client’s best interest are materially identical. Both share the feature highlighted by the Voivodeship Court in the XTB case: they are structural obligations, not outcome-based ones. The FCA states it plainly in the Final Notice: “This handling of price movements was inherently unfair to customers”—regardless of how much any particular client lost individually. The architecture of the order-execution process is itself a vehicle of unfairness. This is the same interpretation that the Polish regulator pressed before the administrative courts, and that XTB sought, unsuccessfully, to rebut.

Doctrinal Lesson the Second: Bad Legal Advice as a Non-Defense

A particularly instructive thread in the FXCM Ltd. case concerns compliance. On June 13, 2008, the firm received an opinion from outside legal counsel stating that, because it contracted with clients on a principal-to-principal basis, it was not subject to the best-execution rules in COBS. The FCA notes in the Final Notice that this advice was “incorrect”—since COBS 11.2.2G and 11.2.3G state expressis verbis that the best-execution duty extends to firms acting on their own account against the client, and “principal-to-principal” is, in substance, a synonym for own-account dealing. Furthermore, the opinion did not even address the broader question of whether customers were being treated fairly.

The lesson for compliance practice and for the work of any law firm is unambiguous: a written legal opinion may reduce the subjective culpability of the firm—and the FCA did, in fact, take this into account, declining to impose a fine for COBS breaches after June 13, 2008, and confining itself to disgorgement, the recovery of profits—but it does not absolve the firm of its substantive obligations or of its civil exposure to its customers. Bad legal advice is not a shield. It is, at most, a mitigating circumstance.

Doctrinal Lesson the Third: The Duty to Notify the Regulator

The most memorable passage of the British decision, however, is not Principle 6 but Principle 11—“A firm must deal with its regulators in an open and co-operative way.” Between July 2010 and August 2011, FXCM UK failed to inform the FCA of three matters of first-order regulatory significance: of the initiation of NFA and CFTC proceedings against its sister company in the United States; of the findings of those proceedings; and of the agreed-upon restitution to American clients. The FCA learned of all of it “through press monitoring.” That sentence ought to be framed and hung in the offices of every law firm advising international corporate groups.

The FCA found that the silence was not intentional. It arose from the mistaken assumption, on the part of the U.K. board, that the U.S. compliance department would inform the U.K. compliance department, which would in turn inform the U.K. board. The chain of communication broke—even though directors of FXCM LLC who sat simultaneously on the board of FXCM Ltd. did know about the American proceedings. The FCA concluded that “this breakdown in communication was inadvertent and did not amount to a deliberate withholding of information.” It nevertheless imposed an £800,000 fine—£1 million absent the settlement discount. Why? Because had the FCA not learned of the matter through its own press monitoring, the U.K. clients would never have received the 9.94 million dollars in restitution that their American counterparts were receiving in parallel.

Polish law, particularly in the wake of MiFID II’s transposition, contains analogous notification obligations (Article 89 of the Act on Trading in Financial Instruments, KNF guidelines for investment firms, among others). The FXCM case is a warning that those obligations apply not only to events within the regulated entity itself, but also to events within sister companies of the corporate group, where those events bear on Polish customers.

The Spectrum: From Code Asymmetry to Bucket Shops

The XTB case sits, in the Polish legal order, on the regulatory side of what amounts, in the global ecosystem of foreign-exchange intermediation, to a spectrum of practices inconsistent with the customer’s interest. The spectrum has several distinct bands. Asymmetric slippage, as the previous section demonstrated, is the broadest of them—linking the United States, the United Kingdom, and Poland in a single factual sequence.

Stop Hunting

XTB’s case turns on deviation; FXCM’s, on latency. Stop hunting is their more aggressive cousin: the practice of widening a spread or generating brief price “spikes” on a broker’s proprietary quote feed, in order to trigger stop-loss orders that would not have been triggered by movement on the actual market. The mechanism operates on the same economic premise: a broker who, in the market maker model, profits when the customer loses, has every incentive to design a system that magnifies customer losses. Unlike deviation asymmetry, stop hunting leaves a verifiable trace—a comparison of the broker’s tick data against an independent feed (Reuters, Bloomberg) reveals “candles” that exist exclusively in the broker’s quote channel.

The Bucket Shop: The Extreme Variant

A bucket shop is a model in which the broker does not, in fact, route customer orders to the interbank market at all. The customer sees the platform, the prices, the P&L chart—but all of it is simulation, and customer funds never leave the intermediary’s internal books. The case of CFTC v. IB Capital FX, LLC, concluded by a Consent Order issued by the U.S. District Court for the Western District of Texas on October 14, 2016 (1:15-cv-01022-LY), is a textbook illustration: a company registered in New Zealand, operating from the Netherlands, took in approximately 50 million dollars from approximately 1,850 retail clients in the United States and around the world, without registering as a Retail Foreign Exchange Dealer with the CFTC. Customer funds flowed into accounts at ING Bank N.V. in the Netherlands, controlled exclusively by the company’s director, Emad Echadi. The court ordered the return of 35 million dollars in restitution and imposed a 420,000-dollar civil penalty.

Institutional Scale

A second front in this war involves not retail brokers but the largest banks in the world. The scandal of manipulation at the WM/Reuters benchmark and other foreign-exchange reference rates, spanning the years 2008 to 2013, resulted in cumulative fines on Citigroup, JPMorgan, HSBC, RBS, UBS, Barclays, and others totaling somewhere between roughly 9 and 10.3 billion dollars, depending on the method of accounting (multiple jurisdictions, multiple rounds of proceedings). In November of 2014, the CFTC, the British FCA, and the Swiss FINMA imposed the first wave of fines—approximately 4.3 billion dollars in total—on five banks (as covered by the BBC). In May of 2015, a second wave followed: four banks pleaded guilty to charges brought by the U.S. Department of Justice for collusion in foreign-exchange fixing, paying an additional 5.6 billion dollars, of which roughly 2.5 billion was in criminal penalties. The mechanism—coordination of orders through trader chatrooms (“The Cartel”), banging the close, front-running of customer orders, sharing of order books to shift the fixing rate—operated one level above the asymmetric parameters of any individual broker. The effect on the end client (the investment fund, the corporation, the exporter), however, was the same: an unfavorable execution price whose source the client could not have identified without access to the bank’s internal communications.

What to Ask Before You Open an Account

If the foregoing analysis is grim, that is not because the law lacks the tools to address what happens here. It is because the asymmetry between the client and the broker is, by structural design, almost impossible for the client to perceive in real time. Five questions, however, can be posed before the decision to open an account is made.

First: does the broker’s terms-of-service agreement specify the parameters governing order execution—including the deviation mechanism and its configuration? If the text deploys formulations such as “in the manner determined by the firm” or “in accordance with internal procedures,” that should be read as the absence of an answer rather than the presence of one.

Second: is the broker supervised by a competent European regulator (the KNF in Poland, BaFin in Germany, the AMF in France, the FCA in the United Kingdom—though now outside the EU—or FINMA in Switzerland), or does it operate solely under offshore registration (Vanuatu, Seychelles, Saint Vincent and the Grenadines, Belize, Labuan)? The absence of registration in the jurisdiction where the customer resides not only increases the risk of abuse but eliminates any practical avenue for redress. The IB Capital case demonstrates that even a U.S. federal court order requiring the return of 35 million dollars to clients requires, in practice, the appointment of a receiver and a multi-year process of recovering funds dispersed across jurisdictions.

Third: does the broker publish a transparent best-execution policy with concrete metrics on execution quality? Here a complication arises that ought to be made plain to the prospective investor. In its original form, the MiFID II regime addressed this need through RTS 27 reports (published by trading venues and systematic internalizers) and RTS 28 reports (published by investment firms, listing the top five execution venues with quality metrics). The RTS 27 reporting obligation was suspended by Directive (EU) 2021/338 of February 16, 2021, as part of the Capital Markets Recovery Package (the so-called “Quick Fix” to MiFID II), on grounds of excessive compliance burden. The collateral effect of that decision is that the publicly available data, on the basis of which an investor or independent analyst could detect execution asymmetries by statistical analysis, are now considerably thinner than the architects of MiFID II originally envisioned.

Fourth: does the broker offer deposit bonuses tied to a required trading volume (typically thirty to fifty times the bonus) as a condition of withdrawal? Such constructions, formally framed as “premiums,” function in practice as liquidity traps: the retail client, statistically, loses most of his capital before reaching the volume threshold that would entitle him to withdraw. ESMA restricted bonuses for retail clients in 2018 under its product-intervention powers, but offshore-registered brokers remain beyond the reach of that regulation.

Fifth—and this is the most fundamental of the five questions: is the broker a market maker (the counterparty to the transaction), or does it route orders to an external market (the STP/ECN model)? The market maker model is not, in itself, reproachable—it is legal, and disclosed in plain terms, in Article 83a of the Polish Act on Trading in Financial Instruments—but it generates a structural conflict of interest, and the mitigation of that conflict depends on the quality of the firm’s internal procedures. The investor who chooses a market maker should understand that he is choosing an entity whose profit is the mathematical mirror image of his own loss.

What Should the Law Be? Five Proposals De Lege Ferenda

The Polish regulatory regime governing the brokerage industry, shaped principally by the Act on Trading in Financial Instruments and its implementing regulations and by the MiFID II/MiFIR package (2014), possesses—as the XTB case demonstrates—the tools to identify and to penalize abuse. There remain, however, areas in which the law de lege lata requires supplementation. The triangulation XTB ↔ FXCM ↔ FXCM LLC adds an additional, important entry to that list.

The first: the absence of a settled answer to the question of civil liability of the broker to clients affected by a systemic violation of best execution—that is, of a collective-redress mechanism that would not require each of 21,300 clients to prove individual damage. The Polish Group Litigation Act of December 17, 2009 (Dz.U. 2010, no. 7, item 44), in its current form, remains a tool of limited efficacy—particularly in cases where the evidentiary base consists of millions of orders. Notably, the FXCM Ltd. case offers an alternative model: the FCA required the firm to establish a redress scheme—a restitution program administered by the regulator itself, in which clients are not required to initiate court proceedings, but merely to come forward and claim what is owed. The Polish legal order has no analogue. The introduction of such an instrument de lege ferenda—as, for example, an optional component of sanctions imposed by the KNF—would radically alter the asymmetry between the efficacy of public-law enforcement and the practical availability of civil-law redress.

The second: the scope of the disclosure obligation when the configuration of technical parameters in a trading system is changed. Should a change—however minor—to the deviation parameter trigger an obligation to notify customers, with reasonable advance notice? The current text of §8 and §10 of the implementing regulation, though interpreted broadly by the courts, does not answer this question expressis verbis.

The third: the suspension of the RTS 27 obligation by Directive (EU) 2021/338, justified by reference to compliance-burden reduction, has had the practical effect of depriving the market of a tool for the statistical verification of execution quality. This was a deliberate choice on the part of the European legislator, but a choice that—particularly in light of the fact that asymmetric execution mechanisms can be detected only in the aggregate—calls for renewed reflection at the next review of the MiFID II/MiFIR regime.

The fourth, contributed by the FXCM case: the absence of an institutionalized mechanism for the cross-border exchange of information among regulators in cases involving corporate groups operating in parallel across multiple jurisdictions. A case in which the FCA learned of CFTC proceedings through the press, while both agencies were members of IOSCO and both regulated entities of the same corporate group, points to a gap not in substantive law but in the architecture of information exchange. ESMA possesses formal cooperation mechanisms (notably Articles 81 and 82 of Regulation (EU) No. 1095/2010), but their activation in practice depends on the initiative of an authority that already knows something is happening. What is missing is a “push” mechanism—an automatic notification that would lift from the firm the burden of loyally informing five or ten regulators in parallel. The lesson of FXCM is that, so long as the burden lies on the firm, it will fail in predictable ways.

The fifth, and the most fundamental: in the case of brokers operating in the market maker model, would it be justified to introduce an obligation of structural separation of the function of designing execution parameters from the function of generating proprietary profit—analogous to the Chinese walls erected, in investment banking, between trading and advisory services? The argument in favor is behavioral: when the same team designs the parameters intended to make execution more predictable and is responsible for the firm’s bottom line, the asymmetry of the parameters becomes a predictable side-effect of organizational psychology. The argument against is economic: separation increases costs and may push some activity outside the European regulatory perimeter altogether. The dispute, in Polish doctrine, has not been resolved.

Postscript

The Supreme Administrative Court’s ruling of February 28, 2023 is not, in the deepest sense, a ruling about XTB. It is a ruling about where the line runs between brokerage service and structural extraction; between the broker’s risk management and a cost transferred systemically onto the customer; between information owed to the customer as a matter of law and information whose absence becomes, itself, an instrument by which the customer’s wealth is disposed of.

The mechanics of forex-broker fraud do not require a conspiracy or a spectacular theft. A parameter in a configuration file, asymmetrically set, operating in the millisecond gap between the customer’s click and the order’s execution, is sufficient. The rest is consequence—accounting consequence, regulatory consequence, judicial consequence.

The FXCM case adds one further lesson to the diagnosis. The same mechanism that the KNF identified at XTB in 2018 had already been identified by the FCA in 2014, and by the NFA and the CFTC in 2011. Three jurisdictions, three decisions, three redress schemes—and one identical configuration of a single parameter. The global standard exists. The question is only whether it can be enforced quickly enough at the level of any individual brokerage, before the mechanism manages to operationalize itself across hundreds of thousands of customer orders.

Sources and Authorities

Judgment of the Supreme Administrative Court of February 28, 2023, case no. II GSK 1302/19. Judgment of the Voivodeship Administrative Court in Warsaw of June 6, 2019, case no. VI SA/Wa 2246/18. Decision of the Polish Financial Supervision Authority of September 18, 2018, imposing on X-Trade Brokers Dom Maklerski S.A. (now XTB S.A.) a monetary penalty of 9,900,000 PLN. KNF press release of March 1, 2023: “The Supreme Administrative Court dismissed XTB SA’s appeal against the KNF decision.”

KNF press release, 2026: imposition of a 20,000,000 PLN penalty on XTB S.A. for violations during the period from January 1, 2022 to August 16, 2023. See also press coverage by Business Insider Poland.

Final Notice issued to Forex Capital Markets Limited (FXCM Ltd.) and FXCM Securities Limited, Financial Conduct Authority, Reference Numbers 217689 / 171487, February 24, 2014 (combined sanction £4 million plus Unclaimed Redress; restitution up to $9,941,970; violations of Principle 6, Principle 11, COB 7.5.3R, 7.5.5R, COBS 11.2.1R, 11.2.14R, 11.2.27R, 11.2.28R). See also the FCA press release.

NFA Decision and CFTC Order against FXCM LLC, August–October 2011 (combined sanction $8 million and $8,261,937 in restitution to American clients).

Consent Order for Permanent Injunction, Civil Monetary Penalty and Other Equitable Relief Against Michael Geurkink, Emad Echadi and IB Capital FX, LLC, U.S. Commodity Futures Trading Commission v. IB Capital FX, LLC et al., Case No. 1:15-cv-01022-LY, U.S. District Court for the Western District of Texas, October 14, 2016.

Receiver’s Initial Status Report, Commodity Futures Trading Commission v. Traders Domain FX, Ltd. et al., U.S. District Court for the Southern District of Florida, case no. 1:24-cv-23745, full text of the receiver’s report.

CFTC Orders Five Banks to Pay over $1.4 Billion in Penalties for Attempted Manipulation of Foreign Exchange Benchmark Rates, Press Release, November 12, 2014; Five Major Banks Agree to Parent-Level Guilty Pleas, U.S. Department of Justice, May 20, 2015; Six banks fined £2.6bn by regulators over forex failings, BBC News.

The Polish Act of July 29, 2005 on Trading in Financial Instruments (Dz.U. of 2017, item 1768, as amended). The Regulation of the Minister of Finance of September 24, 2012 on the procedure and conditions of conduct of investment firms (Dz.U. of 2012, item 1078). The Regulation of the Minister of Finance of September 24, 2012 on detailed technical and organizational requirements for investment firms (Dz.U. of 2012, item 1072).

FCA Handbook: Principles for Businesses (Principle 6, Principle 11); Conduct of Business Sourcebook (COBS 11.2.1R, 11.2.2G, 11.2.3G, 11.2.14R, 11.2.20G, 11.2.27R, 11.2.28R); Decision Procedure and Penalties Manual (DEPP 6.5A); Enforcement Guide (EG 7).

Directive 2004/39/EC of the European Parliament and of the Council of April 21, 2004 on markets in financial instruments (MiFID I), OJ EU L 145, April 30, 2004, p. 1; in particular, Recital 33 of the preamble. Directive 2014/65/EU of the European Parliament and of the Council of May 15, 2014 on markets in financial instruments (MiFID II), OJ EU L 173, June 12, 2014, p. 349. Directive (EU) 2021/338 of the European Parliament and of the Council of February 16, 2021, amending Directive 2014/65/EU.

ESMA Q&A on CFDs and other speculative products—Conflict of Interest. IOSCO, Guidelines for the Regulation of Conflicts of Interest Facing Market Intermediaries, IOSCOPD342.

Andrade, D. Costa, L. Weiss-Cohen, J. Torrance, P. Newall, Trading is a losing game: An audit of deceptive choice architecture in demo-mode Contract for Difference (CFD) trading apps, preprint posted July 25, 2024 on Open Science Framework; peer-reviewed final version: Behavioural Public Policy, Cambridge University Press, online March 20, 2025, DOI: 10.1017/bpp.2024.62.