Home  /  Learn  /  What is trade surveillance?

What is trade surveillance?

Trade surveillance is the practice of monitoring trading activity to detect, investigate and report market abuse: conduct such as insider dealing and market manipulation that undermines fair and orderly markets.

FOUNDATIONS · ~6 MIN READ

Every regulated trading venue and financial institution has an obligation to watch the trading that flows through it. Trade surveillance is the function that meets that obligation. Its purpose is to spot behaviour that distorts price formation or exploits an unfair informational advantage, and, where the evidence supports it, to escalate it to a regulator.

It matters because markets only work when participants trust them. If prices can be pushed around by manipulation, or if insiders can trade ahead of news the rest of the market cannot see, the fairness, transparency and efficiency that make a market useful all break down. Surveillance is the operational mechanism through which firms and regulators defend that integrity.

Trade surveillance vs transaction monitoring

These two disciplines are often confused, and the distinction is one of the first things a practitioner needs to be clear about. Transaction monitoring looks at the movement of funds for anti-money-laundering and sanctions purposes: where money came from and where it is going. Trade surveillance looks at trading conduct, at whether the pattern of orders and executions amounts to manipulation or insider dealing. They use different tools, answer to different parts of the rulebook, and serve different regulatory purposes. A single firm typically runs both, side by side.

What does a trade surveillance analyst do?

The day-to-day work is built around alerts. Automated systems apply rules to market and order data and raise an alert when activity matches a known pattern of concern, say an unusual spike in volume before an announcement, or a cluster of orders placed and cancelled in milliseconds. The analyst’s job is to triage each alert, reconstruct what actually happened, gather the surrounding context, and reach a defensible conclusion: close it, or escalate it.

That conclusion has to stand up to scrutiny. A good analyst does not simply confirm or dismiss a pattern. They ask the counterfactual (would this trading look unusual if the suspected inside information or manipulative intent did not exist?) and document the reasoning either way.

The five-layer surveillance pipeline

Modern surveillance programmes are best understood as a pipeline, where the quality of each stage constrains everything downstream:

• Data ingestion and normalisation. Capturing complete, accurate order and trade data.
• The alert engine. Rules-based scenarios that flag patterns of concern.
• Scoring and prioritisation. Ranking alerts so the most material get attention first.
• Case management. Where investigation and regulatory accountability mostly live.
• Reporting and governance. Filing decisions, audit trails and programme oversight.

If the data layer is incomplete, no amount of clever analytics further down will catch what was never captured. This is why data integrity is treated as a first-order surveillance issue, not a technical afterthought.

The conduct surveillance is built to catch

Broadly, market abuse divides into two families. Insider dealing exploits an informational asymmetry, trading on information that is material and not yet public. Market manipulation creates an artificial price or a false impression of supply and demand, through conduct such as spoofing, layering, wash trading, front running and marking the close. Each leaves its own signature in the data, and learning to read those signatures is the core craft of the discipline.