Trade Surveillance

Behavioral anomaly detection compares a registered person's current activity against their own historical baseline and against a comparable peer cohort baseline. A representative whose activity deviates materially from either baseline generates an exception even if no fixed threshold was breached and no known manipulation sequence was matched. Behavioral analytics is increasingly important because it is harder to circumvent: activity deliberately calibrated to stay below threshold and pattern parameters cannot prevent the system from detecting the statistical deviation from normal behavior. In practice, the large majority of behavioral alerts — like alerts across all surveillance types — are false positives. This makes parameter calibration and false positive management a core compliance function, not just an operational efficiency matter. Firms should maintain tuning documentation — records of the parameter calibration history, the data reviewed to support each threshold decision, and the rationale for changes — that can be produced in a FINRA examination. Broker-dealers deploying AI or machine learning for behavioral detection should also maintain a model validation audit trail: the testing and validation methodology used before deployment, records of algorithmic bias testing, and documentation of how the model was challenged and validated. FINRA expects firms to be able to explain the inference path behind any given exception; a "the model flagged it" response without a description of the triggering data pattern does not satisfy the supervisory documentation requirement.

Market Manipulation Patterns Requiring Detection

Regulators have identified and prohibited several manipulation patterns that broker-dealer surveillance programs must be capable of detecting. Front-running — executing trades in a security ahead of known customer orders whose anticipated size will move the price — is one of the oldest and most consistently enforced violations. Cross-market manipulation exploits the relationship between related instruments: activity in an equity, for example, coordinated to move the price of a correlated derivative before the derivatives position is unwound. Cross-venue layering uses orders on one venue or liquidity pool to create a misleading price signal while the actual execution occurs on a different venue that is not visible to participants watching the first — a pattern that requires multi-venue data aggregation to detect. Surveillance systems that ingest data from only one venue cannot detect cross-venue manipulation, and a WSP that purports to supervise cross-venue activity without the corresponding data infrastructure has a gap.

Insider trading detection is a distinct surveillance function that focuses on information rather than order pattern. Surveillance systems monitor for unusual pre-announcement trading activity — purchases or short sales in a security in the days or weeks before a material corporate event — as well as correlated trading across accounts that may indicate a shared informational source. Behavioral analytics contributes here: a registered person whose trading activity in a specific security spikes in correlation with an upcoming corporate announcement they were positioned to learn about before it became public may generate both a threshold exception (the activity level) and a behavioral anomaly exception (the deviation from their normal trading). Communications surveillance is the typical complement — trading and communications data are cross-referenced to assess whether the informational source can be identified.

Digital Asset Trade Surveillance

Digital asset trading creates three surveillance challenges that traditional equities-oriented systems do not address without modification. The first is operational continuity: digital asset markets operate 24 hours a day, seven days a week, while surveillance systems and supervisory workflows are often structured around standard exchange hours. A wash trading pattern initiated on a Saturday must be detected and escalated before the next active trading session — defined escalation paths for off-hours exceptions are a WSP requirement for any firm with digital asset trading activity.

The second is data richness: where settlement occurs on-chain — which is not the case for all digital asset transactions, as many centralized exchange trades settle off-chain within the exchange's internal ledger — the execution record and the settlement event can be correlated at the block level with no settlement lag. This creates a surveillance advantage for on-chain transactions: a manipulation pattern that traditionally exploits the gap between trade date and settlement date becomes visible as a single correlated event when settlement is atomic. Surveillance systems can instantly verify whether a suspected wash trade involved a genuine transfer of economic risk or was reversed in the same block — reducing the false positives that arise during T+1 reconciliation when this confirmation is not yet available. Firms holding custodied digital assets should additionally monitor for unauthorized internal asset movements — USDC or tokenized assets transferred between firm wallets without a corresponding trade record — as potential misappropriation exceptions, a surveillance scope that does not exist in traditional securities custody.

The third is market structure: digital asset liquidity is fragmented across centralized exchanges, decentralized protocols, and OTC desks with no single consolidated order book for most assets. Cross-venue layering and spoofing patterns that are detectable in equity markets through CAT data require multi-venue feed ingestion in digital asset markets. Firms without multi-venue ingestion capability have a material gap between their WSP surveillance obligations and their actual detection coverage.

The Consolidated Audit Trail as Surveillance Infrastructure

The Consolidated Audit Trail (CAT) is the NMS plan that requires broker-dealers and national securities exchanges to report order lifecycle events — initial receipt, modification, routing, execution, and cancellation — to FINRA's CAT repository. CAT data is typically submitted through end-of-day processing, not in real time. A broker-dealer's internal trade surveillance operates on the firm's live OMS and EMS data — the same order and execution records that are later reported to CAT — generating supervisory documentation in near real time under Rule 3110 before CAT filing is complete. Reporting to CAT satisfies a regulatory reporting obligation; running internal trade surveillance satisfies the Rule 3110 supervisory obligation. One does not substitute for the other. Trade surveillance systems configured to cross-check internal order records against CAT submission data surface reporting discrepancies as data integrity exceptions — reducing the risk of CAT filing deficiencies that would otherwise only surface in a regulatory review. A broker-dealer's failure to report to CAT correctly is a regulatory violation independent of any underlying trading conduct.