Trade Surveillance for Brokers, Trading Venues and Crypto Exchanges: Buy a Product, Use Your Platform's Tools, or Build Your Own Alerts

Trade surveillance is software that watches a firm's own orders and trades for possible market abuse, such as spoofing or wash trades, and raises alerts for a person to review. A broker, trading venue or crypto exchange can buy a product, use what its trading platform or a partner provides, or build its own alerts. Under EU rules and FINRA guidance, the firm stays responsible even when someone else does the work. The choice rests on how complete your order data is and on who will review the alerts.

What does trade surveillance do?

Surveillance software reads your order and trade records and raises an alert when activity matches a pattern of possible abuse. An analyst then reviews the alert and either closes it or escalates it. When the firm has a reasonable suspicion, it reports the activity to its regulator, in the EU and UK through a suspicious transaction and order report (STOR). Commission Delegated Regulation (EU) 2016/522, quoted here as adopted, describes the first two patterns in this list:

• Layering and spoofing. Multiple or large orders are placed on one side of the book “in order to execute a trade on the other side of the order book”. They often sit “away from the touch”, meaning away from the highest bid and lowest offer. After the trade, “the orders with no intention to be executed shall be removed”.
• Wash trades. Deals “where there is no change in beneficial interests or market risk”, or where those pass between parties “acting in concert or collusion”.
• Insider dealing. Trading on inside information, meaning precise information that is not public and would be likely to move the price significantly if it were. The European Securities and Markets Authority (ESMA) is the EU's securities regulator. Its guidelines of 9 July 2025 give the example of an “employee in a CASP aware of the decision to list a new token on a trading platform”. A CASP is a crypto-asset service provider. Alerts for this pattern compare trades with news that came later.

What do EU rules require of brokers and venues?

The EU Market Abuse Regulation (MAR) sets the duty in Article 16. For brokers, Article 16(2) says “Any person professionally arranging or executing transactions shall establish and maintain effective arrangements, systems and procedures to detect and report suspicious orders and transactions.” Market operators and investment firms that run a trading venue have a duty, under Article 16(1), “aimed at preventing and detecting” abuse. Both must report to their regulator “without delay”.

Commission Delegated Regulation (EU) 2016/957 adds the detail. MAR and this regulation are quoted as adopted, from legislation.gov.uk, so check the current text. All regulator and vendor pages were opened on 9 November 2026, and the adopted text of Delegated Regulation (EU) 2025/885 on 10 November 2026. These parts matter most when you choose a route:

• Coverage. Under Article 3(1), systems must allow analysis of “each and every transaction executed and order placed, modified, cancelled or rejected”.
• Alerts and people. Systems must “produce alerts indicating activities requiring further analysis”, and Article 3(4) requires “an appropriate level of human analysis”.
• Replay for venues. Article 3(3) requires market operators and firms running a venue to have “software capable of deferred automated reading, replaying and analysis of order book data”.
• Proportion and review. Article 2(5) wants arrangements that fit the size of your business, “regularly assessed, at least through an annually conducted audit and internal review”, and “clearly documented in writing”.

What do crypto exchanges have to do under MiCA?

The Markets in Crypto-Assets Regulation (MiCA) is read here as published in ESMA's online rulebook. Article 92(1) says “Any person professionally arranging or executing transactions in crypto-assets shall have in place effective arrangements, systems and procedures to prevent and detect market abuse.” That person must report “any reasonable suspicion regarding an order or transaction, including any cancellation or modification thereof”, and suspicions about how the blockchain works, such as “the consensus mechanism”, where the circumstances might point to market abuse.

On monitoring the blockchain, ESMA's final report of 17 December 2024 limits the expectation to “those transactions that reach the PPAET”, a person professionally arranging or executing transactions. Monitoring should “encompass off-chain transactions, where most trading takes place”, and on-chain data “as long as this concerns the activity of the PPAET”. The adopted standards are Commission Delegated Regulation (EU) 2025/885 of 29 April 2025, which ESMA's guidelines of 9 July 2025 also name. Its Article 3(1)(c) sets requirements for “crypto-asset service providers operating a trading platform” by name, so an exchange should expect to be covered. ESMA's final report chose not to define in the standards who else counts, so other crypto businesses should ask a lawyer where they stand.

What do US and UK rules say about trade surveillance?

FINRA, the self-regulatory body for US broker-dealers, requires in Rule 3110 that each member “establish and maintain a system to supervise the activities of each associated person”. Supplementary Material .05 to that rule says “A member is not required to conduct detailed reviews of each transaction if a member is using a reasonably designed risk-based review system”. Rule 5210 adds that members “must have policies and procedures in place that are reasonably designed to review their trading activity” for a pattern of self-trades from one algorithm, one desk or related ones, and to prevent such a pattern. A self-trade here means orders of one firm that unintentionally trade against each other with no change in who owns the security. This article covers FINRA members only, so futures firms and other US businesses should check their own rules.

The UK Financial Conduct Authority (FCA) says “Persons professionally arranging or executing transactions must also detect and report suspicious transactions and orders.” The same page says operators of UK trading venues must detect and report them too. In Market Watch 86, its newsletter of October 2026, the FCA reports “We visited 7 retail brokers to assess the effectiveness of their market abuse surveillance arrangements.” It “found material weaknesses in how these arrangements had been designed, implemented and operated in practice”.

What order data does trade surveillance need?

An alert can only work on the data it receives. The FCA's Market Watch 68, from November 2021, says “Capturing and monitoring orders, as well as trades, is necessary to effectively and consistently identify potential market abuse.” Its warning about layering and spoofing is “If firms do not capture all unexecuted orders, they may fail to identify this activity.” Market Watch 69, from May 2022, found firms “not monitoring all orders and trades, including cancelled and amended orders”.

Before you compare products, check these four things in your own records:

• Order events. Each entry, amendment, cancel, reject and fill should share one order ID. A trade-only export cannot show a spoof.
• Clocks. Commission Delegated Regulation (EU) 2017/574, read as adopted, ties the clocks of EU venues and their members to UTC, the international reference time. For members, the limit runs from one second in voice trading down to one millisecond in most other trading, and less in high-frequency trading. FINRA Rule 4590 sets a “50-millisecond tolerance of the NIST clock”, the reference time of the US standards agency, for computer clocks. It applies to events in NMS securities and OTC equities, meaning securities listed on US exchanges and shares traded over the counter.
• Client identity. Market Watch 67, from May 2021, says wrong mapping of client codes “could result in incorrect data being stored by trading venues”. FINRA's 2026 Annual Regulatory Oversight Report lists as an effective practice “monitoring accounts identified as related (or in concert)”.
• Retention. Delegated Regulation 2016/957 requires five years for the analysis of orders and transactions you examined and “the reasons for submitting or not submitting a STOR”. FINRA Rule 4511 sets “at least six years” for records with no other specified period.

Who reviews the false alarms?

Many alerts turn out to be nothing, and each one still needs a person. ESMA's report on crypto-assets says “Automation can also lead to high rates of false positives in identifying suspicious transactions.” It says human analysis “should always be present in the detection of orders and transactions that could be abusive”, partly so that weak alerts do not “flood” regulators as reports.

Thresholds decide how many false alarms you get. Market Watch 69 warns that one threshold for all instruments can miss activity or “generate a high amount of ‘noise’”. Market Watch 86 found brokers with a “flat price move threshold” that ignored how volatile a stock is. Others had a minimum trade value “set too high, resulting in a significant proportion of client trading activity being excluded from monitoring”.

Decide who clears alerts before you choose a tool. Delegated Regulation 2016/957 requires regular training for the staff doing this work, and FINRA's 2026 report faults firms for “Not documenting alert review findings.” Market Watch 86 criticised procedures that “steered analysts to find reasons to close an alert”. A crypto venue trades around the clock, so name who owns alerts at night and at weekends.

Should we rely on what our trading platform or a partner gives us?

This route has the fewest parts to run, because the data already sits with someone else. Trading Technologies, a trading platform maker, sells TT Trade Surveillance, which can “Import trading data from any system via exchange drop copy, FIX drop copy, direct file uploads”. A drop copy is a live duplicate of your order messages, and FIX is a shared message format that brokers and venues use. The product comes with “explainable out-of-the-box models”. FINRA's Report Center has a Cross Market Equities Supervision report that shows possible cases of layering and spoofing. Article 3(6) of Delegated Regulation 2016/957 also lets a person professionally arranging or executing transactions delegate monitoring, by written agreement, to a company in its own group.

A tool like this sees only the flow it receives. A platform's own tool usually reads only that platform's orders, and a liquidity provider reads the orders that reach it. A broker with several platforms has gaps unless every platform feeds the tool. Ask whether the feed carries cancelled and amended orders, and whether you can change the thresholds yourself.

Handing over the work leaves the duty with you. Article 3(7) of Delegated Regulation 2016/957 covers a person professionally arranging or executing transactions. That person may delegate “data analysis, including order and transaction data, and the generation of alerts” to a third party but “shall remain fully responsible”. It must keep the expertise to assess the provider and “direct access to all the relevant information regarding the data analysis and the generation of alerts”. FINRA's Regulatory Notice 21-29 says outsourcing “does not relieve members of their ultimate responsibility for compliance with all applicable federal securities laws and regulations”.

Articles 3(6) and 3(7) do not mention operators of trading venues, so a venue should ask its lawyer what it may hand out. The crypto-asset rule goes further. Article 3(4) of Delegated Regulation 2025/885 lets persons professionally arranging or executing transactions in crypto-assets outsource monitoring and detection as well as data analysis and alerts. They “shall remain fully responsible”.

Is a surveillance product worth buying?

For most brokers and venues, yes, as long as someone on your side can explain how it is set up. A typical product combines alert types with screens for reviewing cases, and these vendors describe theirs this way:

• Eventus says Validus has “Over 150 procedures out-of-the-box” and can run “in either near real-time or on a T+1 basis”, meaning the day after trading. It also claims “Automation resolves on average 90% of false positives”.
• From NICE Actimize, SURVEIL-X “dramatically reduces false positives”, the company says, with no figure for that claim on the page, and it “Monitors various communication channels, including emails, chats, and voice calls”.
• Solidus Labs says its HALO platform can “Uncover correlated manipulation across spot, derivatives, onchain and offchain markets”, and that clients can “run A/B back-tests, and preview impact before going live”.
• Scila describes “real-time market surveillance and risk calculations for market participants”.

These are the vendors' own statements, so test them on your own data. None of the vendor pages read for this article showed a price. Ask what the price depends on and who pays when you add a market.

A bought product can still leave you unable to explain it. In Market Watch 86 the FCA says “We found examples where individuals responsible for surveillance could not adequately explain how their systems worked.” It adds “Some appeared to rely on out-of-the-box settings provided by third-party vendors.” Market Watch 56, from September 2018, says “Each firm is responsible for making its own judgements about alert calibration”.

When should we build our own surveillance alerts?

Building makes sense when your market does not fit the products you tested, for example a venue with unusual order types or a crypto exchange with its own matching rules. You need complete order records before the first alert is written. You also need analysts who can say what a good alert looks like and who will test it for as long as it runs. A venue also needs the order book replay that Article 3(3) describes.

Do not build to save a licence fee. The alert logic is usually the smaller part of the job, and every duty described above applies in full to a system you wrote yourself.

A halfway option is to own the database of orders and the feeds that fill it, and send that data to a bought product. Some vendors accept drop copies and file uploads, as Trading Technologies' page shows. The records stay yours while someone else maintains the alert library.

How do we test whether alerts work?

Counting alerts is a weak test. Market Watch 86 says some firms “relied on simple testing metrics such as comparing alert volumes to trading volumes or using historical trading data alone to check alert outputs”. It names as good practice “testing alerts at different thresholds through ‘above’ and ‘below the line’ testing” and, as another approach, “using synthetic trade data to test whether alerts would trigger as expected”. A test plan has four parts:

• Above the line. Sample the alerts that fired at each threshold and check whether the review outcomes justify the setting.
• Below the line. Pull activity that fell just short of a threshold and have an analyst review it. If some of it deserved an alert, the threshold is too high.
• Planted cases. Insert a known spoof or wash trade, built from made-up orders, into a test copy of your data and confirm the right alert fires.
• Replay. Run a past trading day through the system and compare the order and cancel counts with the counts at the venue or platform.

What do we keep if we leave a vendor?

Plan the exit before you sign. The five-year record duty in Article 3(8) of Delegated Regulation 2016/957 carries on after a contract ends. Article 3(7) says the agreement must “set out the grounds that allow the person delegating the functions to terminate such agreement”.

Get a written right to export every alert, case note, analyst decision and threshold setting, in a format you can read without the vendor's software. Keep your own copy of the raw orders and trades and of the way client codes map to clients. A vendor owns its alert logic, so expect to set your thresholds again on a new system. If you build, you can own the code, as long as the contract says so and lists anything the builder keeps.

What should we ask a surveillance vendor or a firm that would build our alerts?

• Does the system read every order event, including amendments, cancels and rejects, and can we see that on a sample of our own flow?
• Which alert types cover our markets and products, and which do not?
• Can our staff change thresholds, and is each change logged with who made it and why?
• How do we run above-the-line and below-the-line testing, and can we insert made-up orders?
• Which timestamps do you keep, and how do you handle venues whose clocks disagree?
• How does a reviewer record the reason for closing an alert, and can we export that history?
• Who can see the alert logic, and can you explain in writing why a given alert fired?
• Can you show this working on a system that runs today?

Where does amBrain fit?

amBrain publishes this blog. It describes one part of its trading work in one line: “amBrain builds algorithmic trading infrastructure: order execution, market data and pre-trade risk controls.” That line does not name trade surveillance.

The company's line on its history is “amBrain has been building software since 2019.” On how it works with clients, it says: “Three formats: full delivery, a dedicated team, or engineers embedded in your team.” Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” Ask for the list of those components by name before you sign.

This article is not a case study and describes no client work. Nothing in it says that amBrain has built, licensed or integrated a surveillance system for any client. The quotations come from the published pages of ESMA, the FCA, FINRA, Trading Technologies, Eventus, NICE Actimize, Solidus Labs and Scila, and from legislation.gov.uk and EUR-Lex. The article claims no relationship between amBrain and any of them, recommends none of their products and gives no amBrain prices or timelines.

It is not legal or investment advice either. Check the rules that apply to your firm with a lawyer in each market where you operate. If amBrain is on your shortlist, ask it the same questions as any other firm.