Market Surveillance

Systems collect order and trade data in near real time and apply rules and statistical models. Typical alerts catch repeated cancellations, trades between linked accounts, price moves ahead of news and unusual concentration in a thin stock. Analysts examine each alert, pull related data such as account holders and communications, and decide whether to close it, escalate it or report it to the regulator. Surveillance happens at three levels: the trading venue watches its own market, the regulator watches across venues, and each firm watches its own staff and clients. Setting thresholds is a balance, since tight settings flood analysts with false alerts and loose ones miss abuse. Alert thresholds decide whether abuse is caught or analysts drown in noise.

The system at a retail broker flags a client whose orders in a small-cap share were cancelled within seconds nine times out of ten, while smaller opposite orders were filled. An analyst reviews a week of data, finds the pattern repeats across days and, after consulting compliance, files a suspicious transaction report with the regulator.