Trade surveillance and how to improve accuracy and detection rates

Trade surveillance departments are under intense pressure from regulators to catch trade market abuse and fraudulent activity. But monitoring is becoming increasingly complex.

by Paul Gibson, Business Development Director, KX

Financial institutions must monitor activity relevant to their specific business, this means checking for market abuse, fraud, market disruption and fair practice as well as more malign abuses such as money laundering to support criminal activities like terrorism and people trafficking. This often means analysing vast amounts of both historical and real-time data, in a variety of formats from trade data to electronic communications. Analysts are becoming weighed down by large amounts of alerts and investigations, many of which prove to be unnecessary when other factors are considered.

To deliver a successful trade surveillance programme that satisfies the rigour of the regulators and the efficiencies demanded by the business, a consolidated approach is required. It must be effective across all lines of business for the detection of emergent, systemic and often unknown risk, and take a proactive approach to make sense of all of the interactions, dependencies, changes, patterns and behaviours across the entire trade lifecycle.

Cross-Product Analysis

Organisations need a platform that can process vast amounts of data from multiple streams in real-time, allowing users to make decisions on alerted behaviours much more effectively with significantly greater efficiency. This means using cross-product analysis to identify errors, automated techniques to reduce false positives and machine learning to extract insights from both historical and real-time data.

Traditional instrument-by-instrument trade surveillance techniques do not typically extend their analysis to related products. This means that in certain areas, such as credit and rates, the links between the topics and how they are affecting one another go unseen. This is opposite to risk management techniques across the same technologies where trade dependencies are closely monitored.

As such, it is important to incorporate risk management elements, such as benchmark and sensitivity measures to help identify potential abuse over a range of instruments. This enables products to be broken into their risk fundamentals and effectively ‘look through’ to the underlying securities in an analysis. In looking for evidence of manipulation of a Financial Risk Advisor (FRA), for example, the analysis may extend to monitor both futures and interest rate swaps too.

Reducing False Positives

The more information available to businesses means the more insightful judgements can be made. In regard to false positives, the presence of surrounding data can help contextualise results by automatically classifying high volumes of alerts. Analysis can then determine which are material and which are not. False positives reduction techniques fall into three areas:

• Data Filters – Filtering out specific data or activity that may not be applicable. For example, excluding immediate-or-cancel (IOC) orders from Spoofing profiles.
• Use of Dynamic Thresholds/Benchmarks – Replacing static thresholds with automatically adjusting parameters that reflect evolving market conditions and changing behaviours, not only of individual traders but across the market.
• Alert Feature Overlays – Including surrounding factors for context in assessing alert severity. For example, factoring in change in portfolio concentration when monitoring potential insider trading.

When used together, these factors help avoid unnecessary and time-wasting alerts that distract analysts from the more important and pressing investigations. Thereby, optimising both operational efficiencies and effectiveness for mitigation of true risks.

Future of Trade Surveillance relies on Machine Learning

From calibration to error reduction, machine learning enables a variety of business practices to be improved. Detection rates can be continuously refined using a blend of supervised learning, unsupervised learning and feature extraction techniques from the historical data store.

Supervised learning uses analyst feedback and assessment of historical results to train models and improve their accuracy. Unsupervised learning works on its own to discover the inherent structure of unlabelled data, using techniques like One-Class Support Vector Machines (SMVs) to detect anomalies to help classify results based on distributions and similarities.

SVMs establish normal behaviour by learning a boundary and then adding a score to the results, based on their distance from that boundary. This adjustment can then guide analysts on what investigations to prioritise. Indeed, the benefits of AI and machine learning are well documented, but their application for improving detection rates in trade surveillance is limited.

Regulators are still hesitant to allow machines to determine whether an activity is suspicious or not. This means that the majority of what we are seeing is a supervised learning approach. However, the regulatory landscape continues to evolve and the demand for real-time decision-making is mounting. Therefore, organisations will need to make a shift in mindset and capitalisation of narrow AI with unsupervised machine learning if they are keen to detect fraud effectively and accurately.

As a result of the ever-evolving market abuse tactics being detected, and which need to be prevented, the requirements for strong trade surveillance are more demanding now than ever. For firms, this increased complexity requires them to adopt a consolidated solution that delivers accurate insights when it’s most valuable – at scale both historically and in real time, enabling users to analyse data at a breadth and scale that wasn’t previously possible.

The flexibility of a high-performance streaming analytics platform is a game-changer for real time intervention where necessary and the timely flagging of abnormal behaviour based on large amounts of historical data. By using this technology, firms can take a proactive approach in their response to abnormal behaviour in as quick as microsecond, instead of reacting when it is too late. By doing so, firms can work to improve detection rates and make significant savings through fewer false positive cases and ensure operational efficiency is met.