Skip to main content

The Changing Behaviour of Surveillance

Following the 2008 global financial crisis and recent malpractice scandals, institutions across the financial services industry have started taking proactive measures to protect themselves from market and operational risks by improving their surveillance capabilities. Supported by new regulations including the Markets in Financial Instruments Directive II (MiFID II) and the Market Abuse Regulation (MAR), there has been an increasing emphasis on surveillance related to trading activities – regulators want institutions to more vigorously address and prevent instances of market abuse and insider trading. MAR requires firms to have the ability to identify, map, monitor and report on manipulative behaviours. Meanwhile, MiFID II requirements also create an obligation for all sellside and buyside institutions to time stamp, record and store all trade activity. As a result, firms looking to comply with both MiFID II and MAR need to have trade surveillance capabilities in the form of an in-house solution or via the use of an external vendor – and in conjunction with the implementation of other risk controls associated with trading activity. While trade surveillance maturity has significant improved, GreySpark has noted that industry participants are looking for a more holistic solution that will allow them to understand a trader’s behaviours and activity in real time and perform the associated analytics that will assist in mitigating the risk created through unauthorised trading practices, with behavioural analytic capabilities at the centre of this drive.

GreySpark defines holistic surveillance as the capability to monitor all aspects of conduct by incorporating structured trade and HR data alongside unstructured communications data such as emails, recorded phone conversations and instant messaging platform data. Combining the capture and analysis of the two categories of data allows compliance teams to create a better understanding of how each individual trader acts, forming a key part of successful holistic surveillance: behavioural analytics.

Within financial services, behavioural analytics is the capture, cleansing and use of data to understand how and why traders conduct business, build relationships and communicate amongst themselves and to clients. Data generated by the traders’ trading activity and communications is subsequently collected by embedded company surveillance systems, usually managed by compliance or dedicated surveillance team. As the surveillance landscape has evolved to perform analysis on multiple data types from a growing pool of sources without limitations in storage and processing power, provided the end client is able to provide the surveillance tool with the data, behavioural analysis can be performed on any data and parameters the client wishes for as the ability to compile, learn and monitor is not restricted to one data source/type. While the way the data is captured has remained consistent, the breadth of data available has significantly aided the ability to conduct deeper and more accurate surveillance.

To improve the quality of their surveillance programs, an increasing number of vendors are using behavioural analytics to create ‘trader profiles,’ which logs a trader’s patterns and normal behaviours and subsequently identifies actions that may be deemed out of character or ‘abnormal.’ Without providing the ability to document, store and identify individuals’ patterns, behavioural analysis cannot be effectively monitored.

GreySpark has identified three key risk indicators that are fundamental in establishing the correct alerts for trader profiles:

  1. frequency of communication with another individual;
  2. the chosen method of communication; and
  3. the trading frequency of a particular product.

Once the requisite data has been ingested, a surveillance tool can analyse the trader’s behaviour – logging whether they’ve been in increasingly regular contact with someone, used a new method of communication or adopting a trading strategy that they have not employed before. The surveillance tool will flag a significant outlier in any one of the three key risk indictors as an alert that the trader is behaving in a manner that is inconsistent with their profile.

Behavioural analytics therefore significantly helps compliance teams by reducing the number of false positives generated by relying solely on a rules-based engine, which works fundamentally on a lexicon-based approach or outdated strict parameters not accounting for individual traits. The benefit of more accurate alerts is seen first and foremost in the cost-cutting potential for the bank as a whole, both in terms of personnel and general operation of the bank. Reducing the number of alerts means results the ability to shrink the size of expensive compliance/surveillance teams dedicated to reviewing them. Where teams remain the same size, there is also a time-saving element associated – less time wasted on reviewing false positives leads to more time that can be focused on compliance activities that protects the operational and reputational risk of the bank. In actual fact, providing behavioural analytics as a component of an effective trade surveillance system directly reduces the operational and reputational risk a bank is exposed to. The improved accuracy that this analysis enables can help prevent banks from suffering significant financial losses or having fines imposed upon them for breaking market regulations.

Its benefits likely have not been fully realised; 84% of market participants have noted behavioural analytics as one of their top five priorities for 2017-2018.[1]

GreySpark has recognised that both financial services firms and surveillance vendors are experiencing increasing levels of technological innovation. Vendors have been developing new Machine Learning (ML) and Artificial Intelligence (AI) technologies to help make surveillance systems stronger and more effective and to provide clients with solutions that are able to capture, store and learn key elements of regular trader activity. By incorporating voice and electronic communications, trade data and ML, clients will be able to better and more accurately identify instances of market abuse through outliers in behaviour. This trend will be further explored in GreySpark’s upcoming Buyer’s Guide on Holistic Surveillance.

Today’s financial landscape is characterised by continued regulatory reform and the mandate for higher standards of operation for all financial services firms. Behavioural analytics allows these institutions to gain more predictive, rather than reactive, surveillance services. As part of a complete holistic solution, behavioural analytics is the missing piece to an increasingly complex surveillance puzzle.


[1] NICE Actimize, 2017. The Emergence of Behavioral Analytics in Financial Markets Compliance. Available at: