Visual analytics allows discovered alerts to be represented as graphs,  heatmaps and other intuitive, visually explorable metaphors. Humans can drill into complex alerts to see what the root cause analysis is. Alerts can also trigger processes, such as automatically creating a case and launching a workflow for a compliance officer to investigate an incident.

One example is the collection of news events, trade events, and trader behaviour, and observing an unusually large trade placed by a trader that doesn’t usually trade in that instrument seconds before a news event comes out that significantly moved the market. Perhaps it was luck or intuition; perhaps not. A visual representation of the alert can then be examined and an investigation workflow launched.

Tuning the Machine

If you have the right technology, and you know what you’re seeking, you can detect the rogues. However, one particular  challenge that has kept surveillance analysts busy for years is figuring out how to calibrate the monitoring logic for best results.

Too few alerts raise concerns that improper behaviours are going undetected, i.e. false negatives. Too many alerts are a clear sign that behaviours that are perfectly reasonable are being flagged as improper, i.e. false positives.

The ‘calibration’ of behavioural monitoring is a non-trivial task with the profiles of institutional vs. retail, electronics,voice, exchange traded vs. OTC and other factors all playing a role in how monitoring should be configured. For example,  'front running’ is commonly thought of as placing a proprietary order in the market ahead of a large client order that will  likely move the market. How much time is allowed between the proprietary and agency orders? What is large? What defines  movement in the market? These parameters vary widely based on the profile of business being transacted and so calibration is  a specialised challenge that should be considered unique to each firm.

Over the years, market surveillance vendors provided clients with the means to help ‘calibrate’ their behaviour monitoring  with varying degrees of success. At one end of the spectrum, vendor platforms simply generate alerts (or not) and provide  tools to fine-tune parameters over time. Surveillance analysts are expected to learn on-the-job and gradually improve their monitoring through trial and error.

Amazingly, this time-consuming, error-prone method was the norm for years. Not only is it an enormously wasteful approach, it exposes the firm to serious regulatory risk while their monitoring gradually improves to the point where it could be  considered genuinely effective.

Further along the spectrum are tools to replay, or back-test, large quantities of historical data to conduct what-if  cenarios, i.e. what-if the time between the proprietary order and the agency order was three seconds? Again in this area, CEP  technology has been used to allow surveillance analysts to fine tune the parameters in a protected environment. Analysts are  still learning through trial and error, but at a greatly accelerated rate and not with live orders/trades and hence reduce  the firm’s exposure to regulatory risk. But this technique still requires a brute force approach to understanding what is"normal” behaviour in an attempt to detect what is abnormal.

Charting the Unknown

Lately, I have seen the market demanding innovation to spot the potential emergence of new patterns. To achieve this, data is  recorded and replayed over many months into analytics in a CEP/streaming analytics engine to calculate and benchmark what is  "normal”, including trader behaviour, market behaviour etc. This analytic process continues in real-time to continually refine the model of “normal” and to monitor for unusual events. When anything beyond a certain tolerance or standard deviation from “normal” is detected, an alert is triggered possibly indicating new abnormal behaviour. A member of the compliance team can investigate and categorize it accordingly. In this way, surveillance becomes a self-evolving system, combining machine pattern detection with human intuition and experience.