What is market abuse surveillance?

Market abuse surveillance is the monitoring of orders, trades and related activity to detect insider dealing and market manipulation, such as trading on confidential information, spoofing, layering or wash trades. Brokers, trading venues and investment firms run it because they must spot and report suspicious activity. AI agents can investigate alerts; deciding to report stays with a person.

Why does market abuse surveillance matter once agents act?

Surveillance systems produce alerts from rules: a trade shortly before a price-sensitive announcement, orders placed and cancelled in quick succession, two accounts trading the same instrument back and forth. Each alert needs an analyst to reconstruct what happened, which means pulling order books, news, client history and communications. That reconstruction is slow, and it is exactly the kind of reading an agent does well.

Agents also create a new surveillance subject. A firm whose agents place or route orders must surveil those orders like any other. An execution agent that develops a pattern of placing and cancelling orders could produce a manipulative footprint without any intent, and the firm still answers for it.

How does it work in practice?

The work runs in three layers:

1. Detection: rules and models scan orders and trades and raise alerts.
2. Investigation: an analyst reviews each alert, gathers context and decides whether it is explained or suspicious. Our guide on reviewing trade surveillance alerts with an AI agent covers how an agent prepares this.
3. Reporting: where suspicion is reasonable, the firm reports to its regulator, as most market abuse regimes require.

The agent's natural place is the second layer, as a preparer. It assembles the timeline, the price movement, the relevant news and any linked communications, and drafts a summary.

An example from an equities desk

Take an investment firm's surveillance team. An alert fires because a client bought shares in a listed company two days before a takeover was announced. The agent builds a timeline: the client's past trading in that stock, the size of the purchase relative to their usual activity, the news flow before the announcement and whether the client has any known connection to the company.

It finds the client trades this stock every month in similar size, and a broker's note recommending it was published the day before. The agent drafts a recommendation to close with that evidence. The analyst checks the note, agrees and records the disposition. Had the trade been unusual and unexplained, the draft would have gone to a senior analyst to consider a report.

How is it different from communications surveillance?

Market abuse surveillance in the narrow sense looks at what was traded: orders, executions, cancellations, prices. Communications surveillance looks at what was said: emails, chats and calls between staff, and with clients.

They answer different halves of the same question. A trade pattern shows what happened; a message can show who knew what and when. Strong investigations combine them, and an agent that can read both is more useful than two that each see half.

Which terms sit next to market abuse surveillance?

• Insider dealing: trading on inside information.
• Market manipulation: behaviour that gives false or misleading signals about supply, demand or price.
• Whether an AI agent can do market abuse surveillance depends on keeping disposition and reporting with people, as in all second-line compliance work.

Where Pryme fits

In Pryme, a surveillance agent reads order data and communications at depth 1 and drafts investigation notes at depth 2. It has no connection to order entry, so its role scope cannot reach the market. Every draft, the analyst's decision and any later report are filed in the same record.