Francisco Merlos Fernandez, Head RegTech Solutions at SIX, explores why, after years of widening the surveillance net, now is the time to sharpen detection and reduce noise.
The financial industry has invested heavily in detection over the past 15 years, building up its organisational ‘CCTV’ to monitor and analyse trade activities. Most institutions today have well-developed surveillance systems designed to spot suspicious trading and potential market abuse.
But rising trading volumes, greater market participation, and changing trading behaviour are shifting the landscape as we know it. Surveillance systems have become ever more sophisticated, while more investment products and trading venues have also been brought into the fold of these frameworks. Inevitably, this has greatly increased the number of alerts trade surveillance systems generate.
For compliance teams, this has made it much harder for suspicious activity to slip under the radar unnoticed while also dramatically increasing the workload of teams to sift through alerts. This has left a burning question as compliance departments buckle under the strain – how can teams make sense of the vast volume of alerts their surveillance tools are producing?
More alerts do not necessarily mean better surveillance
Under the UK Market Abuse Regulation (UK MAR), firms professionally arranging or executing transactions must detect and report suspicious orders and transactions to the FCA without delay. In 2025, the FCA logged 3,806 suspicious transaction and order reports (STORs), 82 per cent of which were attributed to insider dealing.
Many alerts are false positives, but compliance teams must still investigate, document, and close each one. While firms should prefer a system that occasionally raises a questionable alert over one that misses genuine red flags, these systems can also create an operational burden.
The problem is often that surveillance rules have not been recalibrated to reflect changing circumstances – such as shifts in trading patterns or volatility rising and falling. Activity that may once have appeared abnormal can become more common as markets evolve. A threshold calibrated several years ago can thus produce very different results in today’s market.
Sharpening detection
The challenge is made more complex by the range of behaviour surveillance systems need to identify. UK MAR covers three broad forms of market abuse around insider dealing, the unlawful disclosure of inside information, and market manipulation. Each can manifest itself in different ways, requiring surveillance frameworks to distinguish genuinely suspicious behaviour from legitimate trading activity.
Trade surveillance now casts a wide net across financial markets, allowing firms to identify the vast majority of suspicious behaviour. After years of investment in detection, the focus now should be on sharpening effectiveness rather than ever-wide coverage.
Improving surveillance requires targeted adjustments to the underlying detection framework. Firms should be asking whether the right market and reference data are being used, whether calculations still reflect current trading behaviour, and whether alert thresholds remain appropriate.
Better calibration looks like making deliberate, evidenced adjustments that reduce noise, without opening up blind spots.
Data quality is central to that process. Trade surveillance stitches several structured feeds together, including order data; trade and execution data; market data; reference data; corporate events, news, and price-sensitive announcements; watch lists; insider lists, and more. If those inputs are incomplete, the resulting alerts can be misleading. In practice, better surveillance therefore depends as much on the quality, lineage, and context of the underlying data as it does on the rules themselves.
The regulatory focus does not begin and end with the number of STORs ultimately filed. ESMA’s report on STORs released at the end of 2025 found that 659 different investment firms submitted at least one STOR across the EEA, while describing STORs as a useful source of information for market-abuse investigations. The implication for firms is that the quality of the internal process leading up to that decision is vital. Surveillance needs to produce alerts that can be investigated efficiently, be understood in context, and supported by a clear rationale for escalation.
AI can support the judgement
Some of the challenges that come with modern trade surveillance – the vast swathes of data, plus compliance teams investigating and documenting each alert – are exactly the kinds of tasks where artificial intelligence can add value. AI is well suited to processing large amounts of information quickly.
Its most credible role, however, comes after deterministic surveillance rules have triggered an alert. AI can bring together information about the client, instrument and surrounding market conditions; summarise why an alert was generated; prioritise cases; and help prepare the analyst’s written rationale.
But the final judgement should always remain human. Months or even years after an event, a firm may need to demonstrate how an alert was investigated, why it was escalated or closed, and what evidence supported that decision.
Ultimately, the goal should not be to eliminate false positives altogether – even if that was an achievable feat, some level of caution should be welcomed and encouraged. Firms should prefer to investigate a questionable alert, rather than risk overlooking genuine market abuse. The real opportunity in this space is to reduce the alerts that add little value, without weakening the firm’s ability to identify genuine abnormalities.
A properly calibrated approach can reduce unnecessary alert volumes, focus skilled analysts on the cases that matter most, and make each decision more traceable and defensible. After years of expanding the surveillance net, the next phase should be about sharpening it.
