How to evaluate trade surveillance and personal trading monitoring software

What this software does

Trade surveillance software reviews trading for patterns that may point to insider trading, front-running or manipulation, raises an exception when a pattern matches a rule, and gives compliance staff a place to review it, record the outcome and follow up. The category covers two different jobs, and many products do only one:

• Market and order surveillance reviews the orders and executions the firm handles for itself and its clients, looking for patterns such as spoofing, layering, wash trades or marking the close.
• Personal trading surveillance reviews the trading of employees and their households under a code of ethics: pre-clearance requests, restricted and watch lists, holding periods and blackout windows, broker statements, and comparison with the firm’s and clients’ orders in the same security.

Decide which of these you are buying before you compare products, and whether surveillance of email, chat and recorded calls is in scope or handled by a separate archive.

The rules that shape the work

For broker-dealers, two rules set much of what surveillance software has to support.

• Supervision. FINRA Rule 3110 requires each member to establish, maintain and enforce written procedures to supervise its business and the activities of its associated persons, reasonably designed to achieve compliance with securities laws and FINRA rules. The procedures must include review by a registered principal, evidenced in writing, of all transactions relating to the member’s investment banking or securities business.
• Transaction review and investigation. Rule 3110(d) requires a process for reviewing securities transactions that is reasonably designed to identify trades that may violate rules prohibiting insider trading and manipulative and deceptive devices. It covers the firm’s own accounts, accounts the firm introduces or carries in which an associated person has a beneficial interest or investment authority, accounts at other firms disclosed under FINRA Rule 3210, and covered accounts such as those of a spouse or of a child in the same household. The member must promptly investigate any such trade internally. Members that provide investment banking services also report those investigations to FINRA in writing: within ten business days of the end of each quarter, and within five business days of completing an investigation that found a violation.
• Books and records. SEC Rule 17a-4 sets how long broker-dealers keep the records Rule 17a-3 requires: some, such as blotters, for six years, and others, including business communications, for three years, the first two years in an easily accessible place in each case. An electronic recordkeeping system must either keep a complete time-stamped audit trail of every modification and deletion or keep records in a non-rewriteable, non-erasable format. It must be able to download records and audit trails in a human-readable and a reasonably usable electronic format, and have a backup or other redundancy. The firm files an undertaking, signed by a designated executive officer or a designated third party, to furnish records to regulators on request.

Investment advisers have a parallel duty for personal trading. SEC Rule 204A-1 requires a code of ethics under which access persons report their holdings on becoming access persons and at least once a year, report their transactions no later than 30 days after each calendar quarter, and obtain approval before buying in an initial public offering or a limited offering. The adviser must review those reports.

Who should be on the evaluation team

• The chief compliance officer, who answers for the supervisory procedures or code of ethics and approves escalations.
• Surveillance analysts, who will review exceptions every day.
• The control room, or whoever maintains restricted and watch lists, since every check depends on the list as it stood on the trade date.
• Owners of the order management and trading systems, because comparing personal trades with firm and client orders needs order and execution data.
• Records management and IT, to confirm how surveillance records are retained and produced.
• Internal audit, as an observer.

Questions to ask and things to test

• Load a recent period of your own anonymized data, personal trades and firm orders or executions, and compare the exceptions with those your current process found. Ask the vendor to explain each difference.
• Read the explanation attached to an exception. Does it state the rule, the trade, the related order or list entry and the timing, in words an examiner could follow?
• Check the lists as they stood. Add a name to the restricted list today and confirm a trade from last month is still judged against last month’s list, with the list’s history kept.
• Submit a pre-clearance request as an employee and see which checks run before compliance is involved.
• Walk an exception through escalation to the chief compliance officer, including contact with the employee, notes and the recorded outcome, and see what an internal investigation file would contain.
• Confirm what employees can see. They should see their own requests and obligations, and nothing about colleagues or the watch list.
• Ask how records are kept under Rule 17a-4: audit trail or non-rewriteable storage, export formats, backup, and who would sign the undertaking if the vendor holds the records.

Common limits to probe

• Flags, not findings. Software raises patterns for review. Whether insider trading or front-running took place is your compliance staff’s judgment, recorded in the system.
• Scope. A personal trading tool is not a market-wide surveillance system for client or proprietary trading, and the reverse is also true.
• Data dependence. Results are only as complete as the broker feeds and statements received, the accounts employees declare, and the order data your order management system supplies.
• Communications. Review of email, chat and recorded calls usually needs a separate archiving and review tool.
• Other code of ethics items. Gifts and entertainment, political contributions and outside business activities may not be included.
• Filings. Reports to FINRA and referrals to regulators are your firm’s decisions and filings. Check what, if anything, the product prepares.

Implementation risks

• Missing accounts. Surveillance covers only the accounts it knows about. Reconcile declared accounts with Rule 3210 notifications and new-hire disclosures before go-live, and periodically after.
• Broker coverage. Some brokers send electronic feeds and others only statements. Plan who loads statements, how quickly, and how gaps are noticed.
• Untuned rules. Default thresholds can flood analysts with exceptions or miss what matters. Set them from tests on your own data, record each change, and review them on a schedule.
• Clocks and identifiers. Comparing personal trades with firm orders depends on consistent times and security identifiers across systems. Test this with real cases.
• The cutover. Decide where open exceptions and investigations will be finished, and how historical reviews, lists and certifications will be kept for their retention periods.
• Ownership of the rules. Rules come from your written procedures and code of ethics. When either changes, someone must update the system and record the change.

Related reading on this site

Requirement pages: FINRA Rule 3110 (supervision), SEC Rule 17a-4 and FINRA Rule 4511 (books and records).

In the glossary: FINRA, SEC Rule 17a-4, WORM storage.

This guide describes the category, not any one product. It is general information, not legal advice: for what a rule requires of your organization, read the rule itself or ask your counsel.