Post-trade compliance checks are the tests a manager runs on its portfolios after trades are booked to find investment-limit breaches, and the review that decides which alerts are real. The only way to know they work is to plant breaches whose answer you already know and see whether they are found. A seeded test does that: copy a day of positions, insert known active breaches, known passive ones and known false alarms, run the checks and the review, and count what was caught, missed, closed and escalated. Regulators test the same thing from the other end, by sampling real breaches and following each through investigation, escalation and reporting. Botminds' Investment Guideline Monitoring, which works the post-trade alert queue with agents that recompute each alert and check its inputs, is built to be tested this way: every proposal carries its evidence and its agent version, so a seeded run can be scored line by line.
Regulatory findings on this page come from France's AMF and the SEC's examination staff. The solution's figures are sample data on a fictional manager.
When the AMF tested real breaches, this is what failed
Post-trade compliance checks that never missed a breach have never been tested
A monitoring process is usually judged by what it found. That tells you nothing about what it missed, and the misses are where the cost is. The AMF's inspection shows how they hide: in its whole campaign it identified a single breach that neither the manager's pre-trade and post-trade checks nor the fund's valuer had detected, a prohibited Swiss franc overdraft that only the depositary caught, in September 2021. The breach was passive and cured in three days. Nobody would have known the checks had a gap without a third party's test.
The bars above show the other kind of gap: breaches that were found but then handled outside the firm's own procedure. Two managers had escalation rules for breaches that lasted two or three days and did not apply them in most of the cases sampled; both explained the delay by the time the corrective trades took, and neither could show the management team had committed to the cure when told. A seeded test catches both kinds, because it plants the breach and then watches the clock.
What is a seeded test in compliance?
A seeded test is a run of the checks on data into which known cases have been inserted, so the result can be scored against an answer key. In investment compliance the seeds are breaches and false alarms with known causes: a purchase that takes an issuer over its cap, a price move that pushes a sector over its limit, a stale price that makes a compliant holding look over. The checks and the review run as normal, without knowing which cases are planted, and the output is compared with the key.
The method answers questions a review of last year's breaches cannot. It tells you the detection rate for each kind of breach, whether the classification as active or passive was right, whether false alarms were closed for the right reason, and how long each step took. It is also repeatable: the same seed set, run after every change to coded rules, data feeds or agents, shows whether the change broke anything. The SEC's 2026 risk alert on annual reviews found advisers whose policies required testing and validation but who had no documented procedure for how to test, what to consider, or what records to keep (SEC Division of Examinations, 14 September 2026). A seed set with its answer key is such a procedure.
Post-trade compliance examples to plant: ten seeds
A useful seed set covers each way the checks can fail: a real breach not raised, a real breach raised but mislabelled, and a false alarm treated as real. The ten seeds below cover the breach types and the false-alert causes the AMF recorded at the managers it inspected.
Ten seeds for a post-trade compliance test, and the right answer for each
| Seed | Expected answer | What it tests |
|---|---|---|
| A purchase takes an issuer from 4.8% to 5.3% against a 5% cap | Breach, active | Detection, and the label for a trade-caused breach |
| A purchase in a finance subsidiary of an issuer already near its cap | Breach, active, if the agreement aggregates guarantor and subsidiary | Issuer hierarchy in the security master |
| A 6% rally lifts a sector from 34.0% to 35.6% against a 35% limit, no trades | Breach, passive | Detection, and the label for a market-caused breach |
| A bond matures and the proceeds sit above the cash limit for three NAVs | Breach, active | Whether foreseeable inaction is labelled active |
| A passive breach left uncorrected past its cure period | Escalated; reclassified active where the procedure says so | The escalation clock |
| A stale price that puts a compliant holding over its limit | False alarm: price | Second-source price check |
| One agency downgrades a bond below a floor that uses the middle of three ratings | False alarm: clause method | Reading the agreement's rating rule |
| A classification vendor remaps an issuer into a sector near its cap | False alarm unless the agreement's classification moved too | Second-source sector check |
| Management fees loaded a day late into the order system, so net assets differ | False alarm: timing | Accounting and order-system views reconciled |
| A buy and a sell on markets with different settlement cycles, one leg unfilled | Depends on the limit's measure; a person decides | Escalation of a genuine ambiguity |
Plant the seeds in a copy of a real day, not an empty book. Breaches behave differently next to other positions: a 5.3% issuer in a fund already near its 40% aggregate trips two limits, and a seed that trips only the one you meant to test is a seed that tells you less than you think. Keep the key away from the people and agents being tested, and plant at least as many false alarms as breaches, because false alarms are what a real queue is mostly made of.
How to measure compliance alert accuracy
Score every seed into one of four outcomes, and report each as a rate on its own. A single accuracy figure hides the trade-off that matters: a review that closes every false alarm correctly but misses one breach in twenty is worse than one that escalates a few false alarms and misses nothing.
Four outcomes for every planted case, and what each one measures
Caught
A planted breach the checks flagged and the review confirmed, with the right label.
Detection rate: caught ÷ planted breaches, by type
Missed
A planted breach no alert raised, or an alert closed as false.
The number that matters most; every miss gets a root cause
Closed right
A planted false alarm the review closed, citing the right reason.
False-alert accuracy: closed right ÷ planted false alarms
Escalated
A planted false alarm treated as a breach, or sent to a person.
Cost, not risk: the review hours a better input would save
Two further measures come from the clock. Time to confirm is how long each planted breach took from the run to a confirmed classification; time to escalate is how long a planted uncured breach waited before the escalation ladder moved. The AMF's tests were about exactly these: "the robustness and speed of the investigation process, compliance with the escalation procedure and the provision of adequate information to the managers" (AMF summary, §4.3.6).
What false alerts are most common in post-trade compliance?
Input problems and timing differences, more than rule logic. In the solution's sample run of 412 overnight alerts, 141 came from bad or late inputs: 52 rating feed mismatches where the agreement's rating method still passed, 38 stale or wrong prices, 29 sector code changes and 22 corporate actions not yet booked. Another 118 were soft warnings inside a warning band and 97 repeated an alert already open. At the French managers the AMF inspected, the breaches recorded most often concerned the fund's cash account, more than half of all breaches at one manager, and minimum or maximum holdings in a type of product, 40% at the same manager.
Cash breaches are worth a seed of their own for that reason. They are frequent, they look alike, and they split between real breaches, such as an overdraft the manager let run, and artefacts of timing, such as one currency account overdrawn while the fund's total cash is positive. A review that has learned to close cash alerts quickly is the review most likely to close a real one.
How do auditors test compliance monitoring?
They sample real breaches and follow each one end to end. The AMF drew 15 to 20 breaches at random from each manager's records for the inspection period, including breaches found by depositaries, and checked whether the detection was evidenced, whether the investigation was prompt, whether escalation followed the procedure and whether managers and senior management were properly told. Internal audit does the same on a smaller scale: four of the five managers the AMF inspected had a periodic control plan, usually over three years, and three of those plans had already included an audit of the ratio monitoring process.
The SEC's examiners test the annual review rather than the breaches directly. Advisers must review their policies at least annually for adequacy and for the effectiveness of their implementation (Rule 206(4)-7(b)), and the 2026 risk alert lists what examiners found wanting: reviews that were late, run on outdated versions of the policies, undocumented, or followed by corrective actions that were never taken. A sample of real breaches tells you what happened; a seeded test tells you what would happen, which is what an effectiveness review is meant to establish.
Investment compliance testing beyond the seed: configuration and reconciliation
Two tests sit beside the seeded run. The first checks the coded rules themselves: the AMF called it good practice to review the consistency of all configured limits periodically, which the managers did every six months, every two years or at each prospectus update, and poor practice not to review changes to the configuration after the fact. That work belongs to the people who code and change the rules, and is covered by re-testing coded rules after every change.
The second reconciles the manager's own alerts with the valuer's and the depositary's. The AMF found managers explaining the differences by human error in configuring the pre-trade tool and by different interpretations of a limit or its calculation, such as the manager and the depositary using different securities data. Every unexplained difference is a seed the real world planted; keeping a formal reconciliation is how a firm finds them.
Running the test on Investment Guideline Monitoring
The solution is built to be scored. Every proposal carries the agent's confidence, the agent version and the evidence it used, and every decision carries a named approver, so a seeded day can be run through it and compared with the key line by line. In the sample data, the Triage agent's current version was approved by the compliance officer on 15 October after scoring 98.1% on a held set of past alerts with known answers, and the October reports show dispositions by 12:00 ET for 96.4% of 4,906 alerts and 14 of 14 breaches confirmed the day they were found.
Reports that show what the morning produced, and which rules made the noise
A seeded test plan for post-trade compliance checks
- Copy one real day of positions, prices and alerts
Into a test environment, with the coded rules as they stand.
- Write the answer key first
Each seed with its expected outcome and label, held by someone outside the review.
- Plant breaches and false alarms in equal measure at least
Active, passive, foreseeable inaction, uncured past its period; prices, ratings, sectors, timing.
- Run the checks and the review as normal
Agents and analysts, without knowing which cases are planted.
- Score four outcomes and two clocks
Caught, missed, closed right, escalated; time to confirm and time to escalate.
- Root-cause every miss
Rule, data, review or procedure, and the fix with an owner.
- Re-run after every change
To rules, feeds or agent versions; keep each run with the annual review papers.
The comparison against an engine-only process is the other reason to run it. Seeded once without agents and once with them, the same day shows where the agents add detection, where they add speed, and where they make a mistake a person would not, which is the evidence a buyer needs before trusting the agents with a real queue. The guide to the KPIs to baseline first shows which of these numbers to carry into production.
Questions people ask
What is investment compliance testing?
Testing whether the controls that keep portfolios within their limits work: the coded rules, the pre-trade and post-trade checks, the review of alerts and the escalation of breaches. It ranges from periodic reviews of configured rules, through sampling real breaches, to seeded tests that plant known cases and score the result.
How many breaches should a seeded test include?
Enough to cover every breach type and false-alert cause you care about at least once, and in volume close to a real day's mix. The AMF's own inspection sampled 15 to 20 real breaches per manager; a seeded set of a few dozen planted cases, run on a copy of a real day, is a practical start.
Should the analysts know which cases are planted?
No. The point is to measure the review as it really runs, so the answer key is held by someone outside the review and opened only after the run. Telling the reviewers changes how carefully they read, which is what the test is meant to measure.
How often should post-trade compliance checks be tested?
At least once a year for the annual review of effectiveness, and again after any material change to coded rules, data feeds, systems or agent versions. Re-running the same seed set after each change shows whether the change broke a check that used to work.
What does a missed breach in a test mean?
That a real breach of the same kind could be missed too, and that the cause has to be found: a rule coded wrongly, a feed that failed, a review that closed too quickly or a procedure not followed. Each miss should be traced to one of those, fixed, and the seed kept in the set.