Developing and implementing an appropriate surveillance ... · FSA and worked there for five years with the insider register, market abuse investigations and managing the suspicious

Peter Nylén started his career in market surveil-lance in 2001 when he joined the surveillancedepartment at Stockholm Stock Exchange, nowNasdaq OMX. In 2004 he joined the SwedishFSA and worked there for five years with theinsider register, market abuse investigations andmanaging the suspicious transaction reports. In2009 Peter left for Burgundy AB, an MTF startedby the Nordic banks, and became Head ofMarket Surveillance. Since august 2013 Peter isa Surveillance Expert within Trapets AB,Scandinavia's leading provider of market surveil-lance systems.

ABSTRACT

The securities trading industry has evolved rap-idly since the implementation of MiFID in2007. With a growing regulatory frameworkand increased surveillance obligations for firmsand venues, it is not an easy thing to come outon top.

Implementing an appropriate, well-function-ing surveillance system requires a firm to adaptthe setup to specific conditions, and to find theright answer to all the questions related to thetask.

The objective of this article is to present tothe reader a number of relevant principles andkey areas that need to be taken into considera-tion when implementing and developing asystem with sufficient technical capacity andwell-trained, experienced staff able to protect

your own organisation — as well as the rest ofthe market — from different types of marketabuse and other trading malpractices. The articlealso traces the changes in the trading landscapesince MiFID was implemented, with emphasison automation, fragmentation and high fre-quency trading.

Keywords: market abuse, insider trading, market manipulation, marketabuse regulation (MAR), market surveil-lance, trade surveillance, surveillancesystem, surveillance organisation

The complexity of securities trading hasincreased dramatically over the last coupleof years as a result of fragmentation,automation and the constant quest forspeed, which has led to a more-dominantposition for high frequency trading(HFT). This development, combined witha never-ending occurrence of scandalsrelated to market manipulation or insidertrading, has made it understandable forregulators to put increasingly greaterdemands on venues and firms to conductefficient and appropriate surveillance inorder to maintain control, promote fairand orderly securities trading and upholdinvestors’ confidence in the financialmarket. But, for firms and venues to get an

Journal of Securities Operations & Custody Volume 6 Number 3

Page 270

Journal of Securities Operations& CustodyVol. 6 No. 3, pp. 270–281� Henry Stewart Publications,1753–1802

Developing and implementing an appropriate surveillance system andorganisation

Peter NylénReceived: 4th December, 2013Trapets AB, Birger Jarlsgatan 41A, 111 45 Stockholm, Sweden;Tel: +46 8 644 0150; E-mail: [email protected]; Website: www.trapets.com

Peter Nylén

Nylen:JSC page.qxd 06/03/2014 14:34 Page 270

effective and appropriate surveillanceorganisation in place, which has the capa-bility of maximising the benefits of a com-plex and tailor-made surveillance system,and, by doing so, be capable of monitoringevery single order entered to maintaincontrol and detect disorderly trading andmarket abuse, requires them to have donetheir homework properly. In the author’sview there are no ‘one size fits all’ solutionswhich can be taken right off the shelf andplugged in, instead, it requires initial andongoing adaptations, updates and changesfor a surveillance system to work asintended — today and tomorrow.

There are also huge demands on thesurveillance officers responsible for thesurveillance task, both in terms of theircompetence and knowledge within theconstantly changing and growing regula-tory field as well as their in-depth under-standing of modern securities trading andthe technical aspects that have becomeincreasingly important. But, in order to geta feeling for the reality that surveillancestaff face today and also to get an idea ofwhat the future has to offer, it would bewise to take a short recap on the progressof securities trading starting on 1stNovember, 2007 with the implementationof the Markets in Financial InstrumentsDirective (MiFID). On the regulatory side,the paper will start with the Market AbuseDirective (MAD), which was imple-mented in 2005, and follow up with theEuropean Securities Markets Authority(ESMA) guidelines on automated tradingas of 1st May, 2012.

To describe all relevant changes thatEuropean securities trading has gonethrough in the last six years would be anenormous task, so instead this paper willfocus on the three key drivers that, in theauthor’s opinion and from a strictly sur-veillance point of view, have had thebiggest impact: automation, fragmentationand HFT.

TRADING DEVELOPMENT

Automation

For centuries, all securities trading wasfully manual with people who actuallymet face to face and traded. For the lastfew decades the trend is clear: scale off anymanual elements and automate the processas much as possible. The investment deci-sion itself, however, ie to buy or sell a cer-tain asset at a certain price, was somethingthat was taken by humans and also theexecution of the order — when andwhere to buy and sell — was handled by ahuman. This meant that, in the executionphase, there was a human filter consistingof, hopefully, competent and honest bro-kers who prevented disorderly or abusiveorders from ever entering the market;however, should these orders slip throughthe filters the impact on the market wouldbe detected immediately by numerousbrokers keeping a close eye on what wasgoing on in the order books. The manual,human element of trading nowadays isdrastically declining. In order to cutlatency (the time it takes for an orderentered to reach the market) and cut costsfor firms this filter has been almost fullyautomated. The message is clear: avoidmanual elements and humans tamperingwith orders. It is more effective, faster andcheaper to let a smart order router forwardthe order, either partial or whole, to thevenue(s), where it can be executed duringthe most favourable conditions accordingto some predefined logic, than to leave thistask to a human being. The same applies toa large client order that needs to be exe-cuted at some time: leave it up to someorder-executing algorithm, which, withthe lowest possible market impact, buys orsells the desired volume. Direct marketaccess (DMA) has become the dominantmethod for institutional and retail clientsto access the market and trade at a fractionof the cost of ten years ago.

Page 271

Nylén


The fact that orders are being routedthrough the firm’s servers without anyhuman involvement, in the author’s expe-rience, sometimes tends to result in a shiftof responsibility for the orders enteredfrom the firm to its client. This renunci-ation of responsibility might lead to alesser control function resulting in anincreased risk of severe trading irregulari-ties and market abuse. Therefore, it ishugely important to point out that the fullresponsibility for all orders entered alwayslies with the firm and it has to be able tomonitor every single order placed in itsname, regardless of whether the order isbeing placed by a broker or just electroni-cally and automatically routed through thefirm’s server without any human interfer-ence. Not only have the elements of rout-ing and execution of orders beenautomated, but also increasingly themaking of the investment decision. Thenumber of orders entered originating froman investment decision made by a humanbrain is in the substantial minority com-pared to the massive number of ordersentered, updated and cancelled according

to decisions generated by computerisedtrading algorithms.

Where it used to be a person callingtheir broker who entered an order thatwas matched in the venue’s matchingengine, the case today is that a tradingalgorithm enters an order via a smart orderrouter to the venue’s matching engineresulting in a trade. In an almost fullyautomated and computerised trading envi-ronment, holding on to the thought thathumans, with all their natural limitations,should take the part of watchdogs is naive.Humans can monitor humans, machineshave to monitor machines.

FragmentationWhen MiFID was implemented on 1stNovember, 2007, the monopoly for thetraditional stock exchanges came to anend, making it possible for alternativevenues, such as Chi-X and Turquoise, tooffer trading in securities that were listedon the primary exchanges. Figure 1 showsthe market share for the primary lit mar-kets (trades executed on-book) comparedto total turnover (including dark pools,

Developing and implementing an appropriate surveillance system

Page 272

Figure 1 Marketshare for theprimary lit marketscompared to totalturnover

Source: (Fidessa Fragulator http://fragmentation.fidessa.com/fragulator)


systematic internalisers and over-the-counter (OTC) reporting).

The order books of the alternativevenues need to be liquid with bids andoffers in parity with the rest of the marketin order to attract buyers and sellers and itis this provision of liquidity that enableshigh frequency traders to come into thepicture (more on this later). All firms thattrade on the market contribute to theequilibrium of price formation across allmarkets since a price difference creates anarbitrage opportunity that immediatelywill be corrected. If a trader can buy anasset at 100 on venue A and, at the sametime, sell this asset at 101 on venue B, theywill do so until the possibility no longerexists. But they will have to be faster thaneveryone else in order to grasp this oppor-tunity and it is this constant hunt for arbi-trage opportunities that makes the priceformation across different venues more orless identical. The firm’s obligation to exe-cute its client’s orders in the best possibleway (best-ex) plays an important role andis a prerequisite for orderly trading nowthat it is fragmented. Firms that do notfollow best-ex create disturbances in theconsolidated price formation and also feedthe high frequency traders with arbitrageopportunities.

If the price of an asset differs betweendifferent venues it is easier for firms todecide where to execute their orders,because they will just go for the best price(lowest possible when buying and highestpossible when selling). But the fact thatthe pricing is often identical makes otheraspects come into consideration andmakes it more complicated to decidewhere and how to execute orders. Thephysical distance to a venue is one aspectthat might be of importance because itimpacts the latency, ie the time it takes foran order to reach the venue. Even if thelatency only differs by a fraction of asecond, in today’s trading this could be the

difference between getting an order exe-cuted as expected or not. The fee modelon each venue is also of interest, eg thedifference between a 0.2 or 0.25 basispoints (BPS) fee for traded volume couldseem insignificant but makes a big differ-ence in the long run. One frequent feemodel has been the so-called ‘maker-takermodel’, which means that the aggressivepart (the party who is actively trading andtaking liquidity from the market) of atrade pays a fee to the venue but the pas-sive part of the trade (the party who pro-vided liquidity) gets paid by the venue. Atfirst it is hard to see that someone whofirst buys at 100 and then sells at 100could make any money, but for the passiveparty in both trades that is exactly thecase. So, with the maker-taker model, theold saying ‘buy low, sell high’ has had itsday.

Before fragmentation took off, execut-ing orders was quite simple: only onevenue was accessed and, as long as marketimpact and slippage were minimised, theexecution was perceived to be successful.The situation today is much more compli-cated when firms try to chase liquiditywithout revealing their intentions andleaving any marks, and, although themarket has been fragmented for six years,many firms are still struggling to refinetheir methods when trading multi-market.To incessantly tune and calibrate the smartorder router is somewhat of a Sisypheantask and the alternative of just connectingto one venue may seem more appealing.But as the European securities market isconstantly changing and most likely willcontinue to do so in the future, firmsprobably have to realise that they need togo on with the never-ending adaptation oftheir trading model. But, in some places,the trend is that the fragmentation race hasstarted to slow down and traded volumesare again being concentrated on a fewvenues. It is possible, but not yet proven,

Page 273

Nylén



Page 274

this is a sign of firms tiring of never reallygetting into it when trading multi-market,and there are reasons to assume that thismight be the case.

The interaction between an asset’s pric-ing on different venues is of course pos -itive based on the theories of marketefficiency but also brings with it the possi-bility for new types of manipulative strat -egies and other trading irregularities. Oneclassic scheme, and a method of abusingthe fact that pricing of different assets isstrongly linked, is to place orders or tradein the underlying asset of a derivative insuch a way and with the only purpose ofshifting the price of the derivative and, bydoing so, making a profit from trading inthe derivative. In the same way, the stronglink between price formations in a frag-mented market can be abused to create ashift in the price of an asset on venue A byplacing orders or trading on venue B. Thisis just one example of how fragmentationadds another layer of complexity from asurveillance perspective and opens thedoor for new types of manipulative strat-egy. And, since all venues are only moni-toring themselves and no one has thewhole picture, the prerequisites and toolsto detect these types of behaviour arelacking. The interaction between differentliquidity providing strategies sometimesresults in a form of loop where the algo-rithms between themselves cause eachother to enter, update and cancel ordersresulting in massive order volumes but notnecessarily a single trade.

High frequency trading (HFT)The most noted kind of automated trad-ing is the so-called HFT. According to the US Commodity Futures TradingCommission (CFTC), HFT is a form ofautomated trading that employs:

• algorithms for decision making, orderinitiation, generation, routing or execu-

tion, for each individual transactionwithout human direction;

• low-latency technology designed tominimise response times, includingproximity and co-location services;

• high-speed connections to markets fororder entry;

• high message rates.

In other words, computers trading bythemselves very fast and very often.

Low latencyThe race for speed has made firms physi-cally put their trading algorithms rightnext to a venue’s matching engines to cutlatency: so-called ‘co-location’. Whenmeasures like this are taken it becomesclear that the concept of time, as currentlyknown, becomes totally overturned.When looking at the example of a co-located trading algorithm using marketdata from a venue’s matching engine aspart of its investment decisions, the sce-nario shown in Figure 2 is achieved. Thetotal timespan taken for a co-located trad-ing algorithm to make a new investmentdecision based on new available marketdata is approximately 140 microseconds(millionths of a second), corresponding to7,000 times in a second. These figures area couple of years old but that is irrelevant,even if the whole process now is 100times faster or 100 times slower, the speedwith which the co-located algorithms aretrading makes the whole concept of timeturn upside down.

High frequencyThe example illustrated in Figure 2 showshow quickly the consolidated volume oforders can totally explode when there arenumerous HFT algorithms that triggereach other to trade. One single order entryin a specific equity could cause five otheralgorithms to immediately update theirorders in that specific equity as well as five


other related instruments on five differentvenues, on both bid and ask. As illustratedin Figure 3, 1 * 5 * 5 * 5 * 2 = 250 ordersare created as a result of the first one. Thischain of events possibly could be repeated7,000 times a second. The fragmented,automated low latency and HFT that isthe case today risks causing a snowballeffect resulting in an avalanche of ordersthat could really disrupt the function ofthe market. From a strict surveillance per-spective, HFT itself is not a big problembut it is more a question of speed andamount and so requires a surveillancesystem capable of handling big volumes ofdata at the speed at which trading is con-ducted. It is also important to emphasisethat HFT is both a result of fragmentationand automation as well as a prerequisitefor fragmented trading ever to exist andfunction as intended by providing liquidityon the alternative venues and creating

equilibrium in the prices across differentvenues.

REGULATORY DEVELOPMENT The fundamental regulation on whichmarket surveillance is mainly based is stillMAD 2003, which was implemented in2005. MAD is one of the main measuresin the European Union (EU) FinancialServices Action Plan and containscommon definitions of the fundamentalconcepts of insider information andmarket manipulation. MAD also intro-duced a reporting obligation meaningthat any person professionally arrangingtransactions in financial instruments whoreasonably suspects that a transactionmight constitute insider dealing ormarket manipulation must notify thecompetent authority without delay.MAD defines insider information as pre-

Page 275

Nylén

Figure 2Co-located HFTalgorithm totalround-trip

A. Time it takes for the order to travel from the trading algorithm to the matching engine: 25 microsecondsB. Time it takes for the matching engine to process the new order and publish this new

Information: 50 microsecondsC. Time it takes for the data to travel from the matching engine to the trading algorithm: 25 microsecondsD. Time it takes for the trading algorithm to evaluate the data and make a new decision: 20 microseconds

Total round-trip: 140 microseconds


cise, non-public and likely to have a sig-nificant impact on the price of a financialinstrument. A rule of thumb used todecide whether or not something is con-sidered significant is if it is something areasonable investor would be likely to usein making investment decisions. If a trad-ing algorithm is deemed to be the mostreasonable of all investors and, taking intoconsideration that an arbitrage tradingalgorithm definitely would trade if itdetected an opportunity to earn a tick ortwo, then the computerisation of tradingshifts the limit for what is to be consid-ered as a significant impact from maybe afew per cent down to only a tick or two.The reporting obligation explicitlyincludes only transactions and not orders,and there is no obligation actually tomonitor and look for suspicious transac-tions, it is more the case of, if somethingis accidentally detected or suspiciousbehaviour is stumbled upon, it must bereported.

As trading has become increasinglymore automated and moved from humansto machines it has become obvious that, inorder to stay in control and be able tomonitor and detect market abuse andother trading irregularities, automatedmonitoring and surveillance systems areneeded. Manual (human) trading can bemonitored manually but automated (com-puterised) trading has to be monitored

automatically by other computers. In addi-tion, the ratio between orders and tradeshas risen dramatically and increasinglymore abusive behaviours are taking placein the order books not necessarily involv-ing any trades, so it has become obviousthat suspicious orders also should be cov-ered by the reporting obligation.

Fragmentation postulates that full cover-ing surveillance is conducted cross-marketunlike single market, which was the casewhen MAD was initially implemented. So,the many changes to the trading landscapethat have taken place since MiFID requirethe regulatory framework regarding marketabuse to be updated as well and this is whatthe ESMA guidelines on automated tradingaim to do by emphasising the fact thatautomated trading requires automated con-trols and monitoring and investment firmsneed ‘adequate systems in place (includingautomated alert systems), using a sufficientlevel of time granularity, to flag any behav-iour likely to give rise to suspicions ofmarket abuse (in particular market manipu-lation)’.1 Due to the fact that market abuseis conducted in the order books as well ason the trade ticker, ‘investment firms shouldhave arrangements to identify transactions,and it is recommended that these arrange-ments also cover orders, that require a STR[suspicious transaction report] to compe-tent authorities in relation to market abuse(in particular market manipulation)’2.

The new types of market abuse men-tioned in the ESMA guidelines related toautomated trading — layering, spoofingand momentum ignition — are somewhatupdated automated versions of classic abu-sive behaviours with the difference thatnow it is a programmed trading strategycarried out by a rogue algorithm when itused to be a human conducting these abu-sive behaviours. The result is that an algo-rithm is capable of carrying out thesemanipulative strategies innumerable timesand does not need to gain as much each


Page 276

Figure 3 Theorder avalanche


time, which makes the trading harder todetect. To be able to detect this type ofmarket abuse requires the ability to searchfor repeated patterns over a long time inwhich each offence is not particularlyobvious, meaning that, altogether, therogue strategy makes money.

Quote stuffing — ie entering, updatingor cancelling large numbers of orders tocreate uncertainty for other participants,slowing down their process and camou-flaging a trading strategy — in the author’sopinion, is not market manipulation in itsoriginal sense but rather sabotage, equiva-lent to pulling the plug on someone’scomputer. How the ESMA guidelineshave expanded the responsibilities forfirms when it comes to surveillance andprevention of market abuse compared toMAD is shown in Figure 4.

DEVELOPING AN APPROPRIATE SURVEILLANCE SYSTEM ANDORGANISATIONAs mentioned before, there are no off-the-shelf surveillance solutions available if a

firm wants a well-functioning surveillancesystem and organisation; instead, firmsneed to do their homework properly inorder to adapt their total surveillance setupto their specific prerequisites and obliga-tions. However, there are a couple of prac-tical principles to take into considerationwhen setting up the system and organisa-tion.

The surveillance system

Rubbish in, rubbish outCrucial for how well the surveillancesystem will work for the firm instead ofagainst it is the quality of the data inputinto it. To a large extent, market surveil-lance is about monitoring and comparinga firm’s trading activity with the rest of themarket to make sure it does not interruptit or is abusive. Therefore, reliable and cor-rect public market data comprise a corner-stone of the data input into thesurveillance system and, without it, thefirm will lack the conditions to carry outeffective and appropriate surveillance. Ifthe input data are unreliable, the output, ie

Page 277

Nylén

MADMAD

TransactionsTransactions

Port-tradePort-trade

Report

Report

ManualManual

Single-marketSingle-market

Inside tradingmarket manipulation

Inside tradingmarket manipulation

Cross-marketMarket place

regulation

Orders

Pre-trade

Monitor

Automatic

Disorderlytrading

Figure 4Surveillance scopepre and post ESMAGuidelines onautomated trading


what the system tells surveillance staff totake a closer look at, will be as unreliable.Firms also have private data in differentforms and extents, and, if the quality ofthose data is sufficient and the data areused in the right way by the system, thesecan greatly improve the conditions for thesystem to perform more exact analysis andassessment of complex events. For exam-ple, different types of client-related datacombined with data on monetary transfersand transactions could be valuable inputsfor the system to notify surveillance staff ofsuspicious behaviour.

The requirement for all input data isthat the quality and reliability is highenough so the outcome is not numerousfalse positives or other incorrect assump-tions or assessments. The expression ‘rub-bish in, rubbish out’ means precisely that— if the system is fed with rubbish datathe output of the system will be rubbish. Ifthe data quality is not sufficient, it is bestto exclude them and not use these data.

AdaptationThe surveillance system with all its func-tionality and alerts has to be adapted to theprevailing conditions at the specific firm.What is considered to be a price move-ment, rise in turnover or suspicious orderactivity worth looking at closer differs sig-nificantly from firm to firm and fromequity to equity. Therefore, it is of theutmost importance to set the limits andparameters of each alert carefully andthoroughly in order to avoid beingflooded with false positives or missing outon something that actually should havebeen detected and investigated further.Different businesses have different require-ments as to which data need to be usedand what tailor-made functionality isrequired. For example, firms with a highelement of telephone-based trading couldhave the need and add functionality forvoice and conversation analysis and logic

to automatically analyse what is being saidas one type of indicator from which todraw conclusions as to whether or not abehaviour or event is suspicious. Anotherexample is firms with a large proportionof retail clients providing DMA, whichcould need to add information from their‘know your customer’ process into thesurveillance system to automatically takecertain data into consideration, such asemployer, address, relations etc. But, again,firms should endeavour to use only reli-able and qualitative data.

UpdateAnother important principle to keep inmind and a provision for the surveillancesystem to work for the firm is the constantneed for upgrades to keep up with reality.The system and the setup that were appro-priate and sufficient five years ago are cer-tainly obsolete today. No one believes thatthe rapid change and development ofsecurities trading will slow down so thesystem and the setup used today also mostcertainly will be obsolete in a couple ofyears from now. To stay in control and beconfident that the surveillance setup worksas intended and protects the firm as well aspossible, in addition to the market as awhole, from market abuse, it needs to be inparity with the trading setup. Changes inthe firm’s business, the securities market asa whole or the regulatory framework needto be considered and appropriate modifi-cations need to be made.

• Changes in the firm’s business: Anychanges in a firm’s trading related busi-ness have to result in equivalent changesin the firm’s surveillance setup. Suchchanges may include new methods oftrading, access to new venues, clientofferings etc. Because the aim is to con-nect the surveillance system to all areasof trading and monitor everything toeliminate any blind spots, the scope


Page 278


needs to be continuously reviewed toensure comprehensive monitoring. Inthis regard it should be mentioned thatall the input data for the surveillanceand all the logic and functionalityincluded may be used for purposesother than strictly surveillance tasks.One example is to let the surveillancesystem monitor that the firm’s orderexecution strategies are working asintended and best-ex requirements arebeing met. Also, numerous types of sta-tistics can be calculated and extractedfrom the surveillance system that can beused by other departments within thefirm and, if applicable, used to follow upliquidity providing agreements.

• Changes in the securities market: TheEuropean securities market is constantlychanging and it is a challenge to stayupdated and ensure that a surveillancesystem is as sophisticated as the rest ofthe market in order to be able to mon-itor the trading activity. One examplethat illustrates this development is theresolution with which timestamps arestated. Not too long ago it was suffi-cient to specify events with the granu-larity of one second. The low latencyrace soon made it possible for thousandsof events to take place during the samesecond so this granularity had to bechanged, first to milliseconds (onethousandth of a second: 0.001 second)and then to microseconds (one mil-lionth of a second; 0.000001 second). Inthe most time-dependent fields of secu-rities trading, time is discussed on ananosecond level (one billionth of asecond; 0.000000001 second), so it isobvious that, for a surveillance system tobe able to monitor trading activity, itneeds to be on the same level withregards to time granularity. Now andthen new venues with different offer-ings and different trading modelsemerge that increase the monitoring

scope and also require modification tothe surveillance system.

• Changes in the regulatory framework: Ofcourse, changes to the regulatory frame-work are not as frequent as the contin-uous change in the securities market,but the ESMA guidelines are a goodexample of the regulator’s intention toupdate the monitoring requirements tothe prevailing conditions, with emphasison automated surveillance solutionsthat are in line with today’s automatedtrading environment. Obviously, anysignificant change to the regulatoryframework is picked up and imple-mented by the providers and developersof surveillance systems but it still landson the firm to tune any new function-ality or alerts to make sure they areappropriate and well suited for the spe-cific firm. Taking into considerationforthcoming regulation — such as theMarket Abuse Regulation, which seemsto clarify and solidifies firms’ obligationto conduct market surveillance — it isreasonable to assume that firms, in orderto make sure they are fully compliant,need to put some time and effort intothis area over the next couple of years.The obligation for firms according tothe Proposal for a Regulation of theEuropean Parliament and of theCouncil on insider dealing and marketmanipulation (market abuse) as of 8thJuly, 2013, is stated in Chapter 2, Article11.2:

‘Any person professionally arranging orexecuting transactions in financialinstruments shall establish and maintaineffective arrangements, have systemsand procedures to detect and reportsuspicious orders and transactions.Whenever such a person has a reason-able suspicion that an order or transac-tion in any financial instrument,whether placed or executed on or out-

Page 279

Nylén


side a trading venue, might constituteinsider dealing, market manipulation oran attempt to engage in insider dealingor market manipulation, the personshall notify the competent authoritywithout delay’3.

Buy or build? Buy then build!Regarding the surveillance system, thequestion of whether to build or buy isrecurrent. In the author’s experience, noone size fits all solutions exist, but on theother hand, few firms have the compe-tence and resources to develop their ownsurveillance system. The best solution inthe author’s opinion is to buy a flexible,well-proven system that constitutes thefoundation of the firm’s surveillance setupand then put all the effort into modifyingand adapting it to fit that firm’s conditions,including developing new tailor-madefunctionality in close collaboration withthe system provider.

The organisationThe most important element for conduct-ing efficient market surveillance never willbe the system itself, no matter how mucheffort is put into it, but the surveillanceofficers detailed to handle the system anddeal with the output from it. A surveil-lance system itself never will be able todetect actual insider trading or marketmanipulation but it can notify users ofindications of, or behaviour giving rise tosuspicion of, market abuse or other tradingirregularities. It still takes manual work tofully investigate and analyse the event inorder to decide whether to send a suspi-cious transaction report (STR) to the reg-ulator or to close the case. In theinvestigation and analysis phase the sur-veillance system plays an important role byenabling the replay of trading events andpowerful search mechanisms to really drilldown to the specific event that needs to belooked at closely, filtering out all irrelevant

trading noise. In today’s electronic tradingenvironment, proper and efficient marketsurveillance cannot be conducted withoutsupport from a surveillance system, but onthe other hand, the system cannot berelied upon to do all the work.Experienced and competent surveillanceofficers obviously not only need extremelygood knowledge of the regulatory frame-work surrounding securities trading, butalso securities trading itself in order to beable to analyse and draw sensible conclu-sions from complex trading events andhow they relate to relevant regulation. Atrader without regulatory knowledge or acompliance officer who does not under-stand securities trading probably will domore harm than good within a surveil-lance organisation.

In recent years, in the author’s view, theneed for in-depth knowledge of the tech-nical aspects of securities trading (such asthe logic of matching engines, how algo-rithms behave, different trading modelsetc) has become increasingly important.Of course, this comes as no surprise as thetrading environment has become increas-ingly more automated and technical, but itis still an important element in order tofully understand different trading behav-iours in the market. Cases that initiallylook like suspicious market manipulationor some sort of disorderly trading some-times can be explained by how differentsystems actually are designed to behave,meaning the case is explained and can bedismissed. A surveillance organisation thatlacks knowledge of how trading systems orapplications are designed will constantlygo out on a wild-goose chase and, withincreasingly automated trading, that com-plexity will rise and with it the demandfor technical expertise from surveillancestaff. But different firms set the bar at dif-ferent heights when it comes to thestaffing and organisation of their surveil-lance function. Some firms may have a


Page 280


team of professional surveillance officersthat monitors in real time while otherfirms may have T+1 data with someonefrom the back office who handles the sur-veillance tasks on a part-time basis. From astrict market abuse perspective, it could beargued that there is no need for real-timesurveillance and T+1 is sufficient; how-ever, from the perspective of protectingmarket integrity and being able to detectand take action quickly against disorderlytrading, real-time surveillance is required,which again shows that a firm needs toadapt its surveillance organisation to itsspecific conditions. A firm without anyDMA offering, which only trades in asingle market and has not replaced itshuman brokers and traders with algo-rithms in any way, has less of a need andfewer requirements concerning the degreeof complexity and automation of its con-trol and monitoring setup than a firm witha greater element of automated trading.Some firms might feel confident they havea sufficient surveillance setup by having adetection function regarding marketabuse, well-educated brokers and an inves-tigation function comprised of compli-ance generalists with Excel spreadsheets,but the author’s belief is that these firmsare becoming increasingly fewer innumber.

Despite the importance of advancedautomated surveillance systems, firms willnever get away from the demand for expe-rienced and qualified surveillance officerswho can set up the surveillance system andmaximise the utility of it, while also takingover and further investigating, reportingand, if necessary, disciplining any abusiveor disorderly trading behaviours about

which the system notifies the staff. Thehuman element always will be the mostimportant part of the whole range of sur-veillance tasks, but it needs to be carriedout with support from systems that areable to monitor each and every order andtrade, in addition to performing complexanalysis of these and the patterns theycreate.

Finally, in the same way that a firm hasto decide whether or not to build or buythe surveillance system, it also has to deter-mine to what extent the surveillance taskswill be carried out within the organisa-tion. Along with increased requirementsfor firms to carry out surveillance, includ-ing systems and staff, the time and moneythat need to be put into this function inorder to be fully compliant surely willincrease. In view of this development, theauthor believes it is a good idea for manyfirms to take a closer look at the differentpossibilities of outsourcing the surveillancefunction to various degrees.

REFERENCES

(1) ESMA guidelines on automated trading,Guideline 6, p 3.c, available at:http://www.esma.europa.eu/system/files/esma_2012_122_en.pdf (accessed 12thFebruary, 2014)

(2) ESMA guidelines on automated trading,Guideline 6, p 3.d, available at:http://www.esma.europa.eu/system/tiles/esma_2012_I22_en.pdf (accessed 12thFebruary, 2014)

(3) Proposal for a Regulation of theEuropean Parliament and of the Councilon insider dealing and marketmanipulation (market abuse), 8th July,2013, Chapter 2, Article 11 .2

Page 281

Nylén


Documents

Developing and implementing an appropriate surveillance ... · FSA and worked there for five years with the insider register, market abuse investigations and managing the suspicious