Trade surveillance alerts are only as good as their context. The agent rebuilds it for each alert: orders and trades in sequence, the market before and after, news, the trader's other activity and linked communications. It drafts a note with possible explanations. An analyst decides the alert, and suspected market abuse goes to the person responsible for reporting it.
What is trade surveillance, and who owns it?
Trade surveillance monitors orders and trades for patterns that may indicate market abuse: insider dealing ahead of announcements, spoofing and layering, wash trades, marking the close, front-running client orders. Firms that execute or arrange trades are generally required to have arrangements to detect and report suspicious orders and transactions. What market abuse surveillance is covers the concepts.
A surveillance team in compliance reviews alerts, with a manager deciding escalations and a named person responsible for reports to the regulator. The volume is high and most alerts are explained by ordinary trading. The skill is reconstructing what happened quickly enough to see the few that are not. Whether an AI agent can do market abuse surveillance sets out the boundary.
What are the steps, and at what depth?
- Agent, depth 1: reads the alert. The scenario that fired, the instrument, the trader or client, and the orders and trades involved.
- Agent, depth 1: rebuilds the order book sequence. Orders placed, amended and cancelled, with timestamps, alongside market prices and volumes for the period.
- Agent, depth 1: reads the market context. Announcements, news, price-sensitive events and sector moves before and after the activity.
- Agent, depth 1: reads the participant's wider activity. Other trades in the instrument and related instruments, positions held, client orders handled, and prior alerts.
- Agent, depth 1: checks restrictions. Insider lists, restricted and watch lists, information barriers and personal account dealing records.
- Agent, depth 1: links communications. Flags any communications alerts or recorded conversations involving the participant around the time, using the approach in reviewing communications surveillance alerts.
- Agent, depth 2: drafts the note. The sequence in plain language, the scenario's concern, possible legitimate explanations, factors that heighten concern, and what is unclear.
- Person, analyst: decides. Close with reason, or escalate.
- Person, surveillance manager and reporting officer: decide further investigation and whether to report.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Alert | Reads scenario and activity | 1 | None |
| Sequence | Rebuilds orders against market | 1 | None |
| Context | News and events | 1 | None |
| Participant | Wider activity and history | 1 | None |
| Restrictions | Lists and barriers | 1 | None |
| Communications | Links related alerts | 1 | None |
| Note | Drafts balanced reconstruction | 2 | The disposition |
| Escalate and report | Nothing | None | Manager and reporting officer |
Which controls apply, and what evidence does each leave?
Reconstruction reproducible. The sequence is built from order and market data with timestamps, so anyone can rebuild it. Evidence: the data extract and sequence stored with the alert.
Balanced notes. Legitimate explanations and heightening factors both appear. Evidence: QA sampling against the note standard.
No disposition capability. Evidence: analyst names on every closure.
Cross-surveillance links. Trade alerts and communications alerts about the same person and period are reviewed together. Evidence: links recorded on both alerts.
Scenario tuning separate. Changes to scenarios and thresholds follow change control and testing. The agent reports patterns of false positives for the team to consider. Evidence: change records.
What should you measure?
- Analyst time per alert, by scenario.
- Escalations where the note leaned towards a legitimate explanation, each reviewed.
- Alerts linked to communications evidence, and their outcomes.
- Reports made, and time from alert to report.
- False positive patterns reported and acted on, each with a recorded tuning decision, even where the decision is to leave the scenario unchanged.
Where does it usually go wrong?
Market context missing. A trade before a price move looks suspicious until you see the move followed public news. Without context, analysts escalate too much; with poor context, they close too much.
Single-instrument view. Insider dealing may show up in options or related shares rather than the obvious instrument. The agent should check related instruments.
Clock problems. Order timestamps from different systems may not align with market data. A sequence built on misaligned clocks can reverse cause and effect. The note should state the time sources used.
Clusters reviewed one alert at a time. A trader who triggers small alerts across several instruments in a week may be doing something none of the alerts shows alone. The agent should group alerts by participant and period so the analyst sees the pattern as well as each event.
Client and proprietary activity mixed. Front-running concerns arise from the relationship between client orders and the firm's own trading. Read both.
Trade-based laundering mistaken for market abuse. Some patterns, such as unusual trades between related parties, point to money laundering rather than market manipulation, and belong in a different process; see whether an agent can spot trade-based money laundering.
The overall stance on compliance agents is in AI compliance agents.
Where Pryme fits
In Pryme, order and trade records reach the reviewing agent as sealed facts from the systems of record, while news arrives as external, so the reconstruction shows which parts are records and which are reports. Closing alerts and making reports are outside the agent's role scope; attempts are refused and filed, and the agent's note-drafting capability is certified on the firm's own past alerts.
Questions people ask
Can the agent identify new types of abuse the scenarios miss?
It can report unusual patterns it notices while reviewing, for the surveillance team to consider. Turning those into scenarios is a tuning decision, tested before use.
How should the agent handle alerts on senior staff or the trading desk head?
The same way, but routed to a reviewer independent of that desk. Your policy should set the routing; the agent applies it.
Does the agent need access to all recorded communications?
Only those linked to the alert's participants and period, under the same scope rules as communications surveillance. Broader access is neither needed nor justified.