Market surveillance is the continuous monitoring of orders, quotes and trades in financial markets in order to detect abusive, manipulative or disorderly behaviour. It is carried out by trading venues over their own markets, by regulators across markets, and by brokers and banks over the activity of their clients and staff. Its purpose is to protect the integrity of prices, so that investors can trust that what they see reflects genuine supply and demand.
The term is used in securities, derivatives, commodity and, increasingly, crypto-asset markets. It is distinct from prudential supervision, which is concerned with the soundness of firms, and from transaction monitoring for money laundering, although the three share data and techniques. In European product regulation the same phrase is used for checks on goods placed on the market; this entry concerns the financial sense.
What surveillance looks for
Surveillance programmes are built around known forms of misconduct and around threats to orderly trading. The main categories are:
- Manipulation of prices or volumes. This includes spoofing and layering with orders that are not intended to trade, the wash trade in which the same party is on both sides, and attempts to move a closing or reference price.
- Misuse of information. Insider trading ahead of announcements and front-running of client orders fall here.
- Disorderly trading. Erroneous orders, runaway algorithms and extreme price moves may not be abusive but still require intervention, such as a trading halt.
- Rule breaches. Venues check compliance with their own rules on order types, position limits, short selling and reporting.
Who carries it out
Responsibility is layered. A stock exchange or other trading venue is normally required, as a condition of its licence, to monitor trading on its systems and to report suspected abuse to the regulator. Exchanges see the full detail of their own order book, including orders that were cancelled, but not what the same participants are doing elsewhere.
Regulators therefore run cross-market surveillance using data reported to them. In the United States, the Securities and Exchange Commission oversees the system, with much day-to-day equity and options surveillance performed by the self-regulatory organisation FINRA under agreements with the exchanges; a consolidated audit trail collects order events across venues. In the European Union and the United Kingdom, national regulators receive transaction reports under MiFID II and suspicious transaction and order reports under the Market Abuse Regulation.
The third layer is the firms themselves. Brokers, banks and asset managers must monitor the orders they handle and the dealing of their own traders, a function described under market abuse surveillance.
How surveillance systems work
Modern surveillance is largely automated. Systems ingest order, trade and market data and run detection scenarios, each designed around a behaviour: for example, a large order placed and cancelled shortly after an execution on the opposite side, or an account whose buying is concentrated in the days before takeover announcements. Scenarios are calibrated with thresholds for size, timing and price movement, and they generate alerts for analysts.
An analyst reviews each alert by reconstructing the order book around the event, looking at the trader's history and, in firms, at related communications. Most alerts are closed as explained; a minority are escalated for investigation and may lead to a report to the regulator. Calibration is a constant concern, since thresholds set too tightly bury analysts in false positives and thresholds set too loosely miss abuse. Statistical and machine learning methods are increasingly used alongside fixed rules to identify unusual behaviour and to rank alerts.
Actions and enforcement
Real-time surveillance teams at venues can act immediately: contacting a member about suspicious orders, cancelling erroneous trades under published policies, or triggering a volatility interruption or a longer trading suspension. Post-trade findings are referred to the venue's disciplinary process or to the regulator, which can open an investigation, require information from firms and individuals, and bring an enforcement action leading to fines, bans or criminal prosecution.
Challenges
The fragmentation of trading across many venues and across related products is the main difficulty. A manipulator may place orders in one market to profit in another, for instance in a share and its derivatives, so no single venue sees the whole pattern. Data volumes are very large, clocks must be synchronised to make sequences meaningful, and identifying the person behind an order may require tracing through several intermediaries and jurisdictions.
Crypto-asset markets pose a sharper version of these problems, because trading occurs on many platforms with uneven oversight; in the European Union, market abuse rules for crypto-assets were introduced by the Markets in Crypto-Assets Regulation. The use of algorithmic trading controls by firms, and co-operation between regulators through bodies such as IOSCO, are the main responses to cross-market and cross-border abuse.