A trade surveillance analyst reviews the alerts a firm's surveillance system raises on its own orders and trades, gathers the evidence behind each one, and decides whether it shows a reasonable suspicion of insider dealing or market manipulation. If it does, the analyst escalates it and a suspicious transaction and order report (STOR) goes to the regulator; if it does not, the analyst closes it with a written reason that the firm must keep for five years. That decision is the job. The difficulty is that the alert says only which pattern fired, so most of the analyst's time goes on pulling the order, the instruction behind it, the news, the trader's messages and the lists from systems that do not talk to each other. Botminds' Trade Surveillance is built around that seat: its agents assemble a cited case for every alert before the analyst opens it, so the analyst spends the time on judgment, and a second person checks every close.
Where this page uses the solution, the examples are sample data on a fictional asset manager, Quillfield Capital. The time estimates are Botminds' own, labelled as such.
The rules that define the seat
5 yrs
how long the analysis and the reason behind every examined alert must be kept, reported or not
24 h
an insider-dealing lookback the FCA criticised, because information exists before it is released
3,806
STORs the FCA received in 2025, each one a decision by a firm's surveillance team
What does a trade surveillance analyst do?
The analyst turns alerts into decisions. A surveillance engine runs scenarios over the firm's orders and executions: trading before news, front running, spoofing and layering, marking the close, wash trades, breaches of information barriers. Each hit becomes an alert. The analyst reviews it, gathers what is needed to understand it, and either closes it with a reason or escalates it for a STOR or an internal investigation.
The rules require a person in that loop. Delegated Regulation 2016/957 says firms must "ensure an appropriate level of human analysis in the monitoring, detection and identification" of orders and transactions that could be market abuse (Article 3(4)). The duty itself comes from Article 16 of the Market Abuse Regulation, which, as the guide to Article 16 explains, applies to asset managers as well as brokers and banks. In the US, an adviser's analysts do the same review to enforce the firm's policies against misuse of material nonpublic information under Section 204A of the Advisers Act.
Around the core work sit three other tasks: drafting STORs when an escalation is confirmed, asking the front office questions without tipping anyone off, and feeding back on which alert models find real cases and which produce noise.
The one decision the rules leave to a person
Report or close. Everything else in the seat serves that choice. The standard is reasonable suspicion, which is lower than proof and higher than an alert firing, and the regulator will not make the call for the firm: the FCA says plainly that whether to submit a STOR is the firm's decision, not something it will advise on (FCA STOR page).
The close is as much a regulatory act as the report. For every order examined, the firm must keep the analysis it did and its reasons for reporting or not reporting, for five years (Article 3(8)). A buy-side team may close hundreds of alerts for each one it reports, so the analyst's written reasons are most of the firm's surveillance record. How a STOR is written covers the report; the close note is covered in the best-practices guide.
Where a trade surveillance analyst's hours go
Mostly into gathering. To decide a non-trivial alert, the analyst needs the order and its audit history from the order management system, the algorithm log from the execution system, the portfolio manager's instruction or rebalance ticket, the news and issuer disclosures around the trade, often in another language, the trader's chats, emails and recorded calls from a separate archive, and the watch, restricted and insider lists. Each lives in a different system with its own login and search.
Most of an alert's time goes on gathering evidence, not on judging it
By hand · about 45 minutes
- Order, fills, audit and algorithm logs · 27%
- News and disclosures · 18%
- Chats, emails, calls · 22%
- Lists and personal trading · 11%
- Writing the note · 13%
- Judging · 9%
Case file assembled · about 14 minutes
- Checking the order record · 7%
- News · 7%
- Messages · 14%
- Lists · 7%
- Editing the drafted note · 22%
- Judging and answering the challenge · 43%
Two things change in the second bar, and the first matters more than the second. The minutes fall because the gathering is done before the analyst opens the case. And the judging takes longer, in absolute terms and as a share, because the analyst now answers a structured challenge before deciding. A good tool should move time from fetching to thinking, not just remove it.
Who works around the analyst
The analyst sits between the front office, whose trades are reviewed, and the regulator, who receives the reports. Several other seats share the work, and on a well-run team each has a distinct job that no one else can do.
The trade surveillance team, before and after the case file is assembled for them
Today
Works through a queue of alerts, spending most of each one collecting evidence from separate systems, then writes a free-text note.
With agents
Opens a case already assembled with cited sources, answers the strongest counter-argument, and decides with a reason code.
Still theirs: The decision to close or escalate
Today
Second-reviews a sample of closes, reading notes whose evidence lives somewhere else.
With agents
Checks every close against its sources, with flags where a rationale and its evidence disagree.
Still theirs: The right to return a close to its maker
Today
Signs reports drafted from scratch and approves threshold changes argued by email.
With agents
Approves reports drafted from the cited case and threshold changes that come with a backtest.
Still theirs: Approval of every report and model change
Today
Rebuilds volumes, reasons and escalations by hand when the regulator asks.
With agents
Reads volumes, timeliness and reasons by desk, and approves information barrier rules proposed from real cases.
Still theirs: Barrier policy and the regulator relationship
Today
Gets ad hoc questions about orders days after the trade.
With agents
Answers specific, logged questions about specific orders, with nothing about whether a report is coming.
Still theirs: The trading decision, and the duty to escalate concerns
What a surveillance team needs from its analysts
Market knowledge first, then judgment, then writing. The skills follow from what regulators find going wrong. The FCA has repeatedly said that firms "are often over-prescriptive with analysts and do not encourage them to look beyond the initial alert", and that in fixed income some analysts reviewed "only the activity in the product which triggered the alert and not considering other trading in correlated products" such as cash against futures (FCA, Market Watch 56). It has also warned that price-based surveillance of instruments that trade on yield "may fail to carry out meaningful monitoring".
A head of surveillance should therefore staff the desk for the following. Knowledge of how each asset class the firm trades actually trades: auctions and closing prices in equities, yield and duration in bonds, settlement windows in futures. The ability to read an order audit log and an algorithm log, and to tell a scheduled program from a discretionary order. Languages, or the habit of checking the original of a translated disclosure. Independence from the desk, since the FCA flags that front office staff "whose remuneration is linked to client business might be conflicted in considering whether to escalate" (Market Watch 69). And plain, checkable writing.
Training is a legal requirement, not a perk. Firms must provide "effective and comprehensive training to the staff involved in the monitoring, detection and identification" of possible market abuse, on a regular basis (Delegated Regulation 2016/957, Article 4).
What regulators criticise in surveillance analysts' work
Four findings recur in the FCA's published observations, and each is a habit an analyst can avoid. The first is closing alerts for want of an obvious link: some firms escalated only when they could see a connection between the client and the issuer or the source of the information, and the FCA said the lack of such a connection is not, on its own, a reason to close (Market Watch 69).
The second is working from vague procedures. The FCA saw procedures "directing analysts reviewing surveillance alerts to look for signs of market abuse, but with no guidance on what these signs might be, or what materials / information to use", and found that in such firms "alerts may be inappropriately closed rather than escalated". The third is a narrow review that looks at the triggering instrument only. The fourth is accepting a short lookback: a "small number of firms" alerted only on trading in the 24 hours before inside information was released, "without considering the time the information might exist before its release".
None of these is a failure of effort. Each is what happens when an analyst with forty alerts to clear has to choose which evidence to fetch. Procedures that say what to gather for each alert type, and a case file that gathers it before the analyst arrives, address the cause rather than the symptom.
Calibration cases for a trade surveillance alert review team
Good calibration cases test the decision, not the vocabulary. The cases below are drawn from the rules and the regulators' findings above, each with what a sound answer contains. A head of surveillance can run them as part of the regular training Article 4 requires: as they stand for junior reviewers and, with harder follow-ups, for senior ones.
Eight alert-review cases, and what a sound answer includes
- An alert shows a fund bought a stock 20 minutes before a profit upgrade. What do you check first?
When and by whom the order was created and its release time set; whether it was part of a scheduled program; whether anyone amended it; news before the order; the trader's and PM's messages; lists and wall-crossings.
- What is the threshold for filing a STOR?
Reasonable suspicion that an order or transaction could be insider dealing, market manipulation or an attempt; without delay once formed; not proof, and not merely an alert.
- You find no link between the trader and the issuer. Can you close?
Not on that alone. The FCA has said the absence of a link is not sufficient mitigation; say what else explains the trade.
- How would you review a bond alert differently from an equity alert?
Look at correlated instruments, such as futures and other maturities, and at yield rather than price, as the FCA has asked.
- The desk head asks why you want an order's rationale. What do you say?
Nothing that suggests a report: gather from systems first, and never inform the subject or anyone who need not know.
- What must your close note record?
What fired, what you checked, what each source showed, and why the facts fall short of suspicion, kept for five years.
- An alert model raises 200 alerts a month and has never found anything. What do you propose?
A threshold change backtested against past real cases, not one judged by how many alerts it removes; approval by the head of surveillance.
- When would you file a STOR before finishing an internal investigation?
When reasonable suspicion is already formed; the FCA has said the STOR may precede the investigation's end, with more information sent later.
Market surveillance analyst vs trade surveillance analyst
The titles overlap, but the seats see different things. A market surveillance analyst usually works for a trading venue or a regulator and watches the whole market's activity on that venue; a trade surveillance analyst works for a firm that trades and watches that firm's own orders, with access to why they were placed.
Two surveillance seats, two views of the same trade
Market surveillance analyst: A trading venue (or a regulator's own surveillance unit).
Trade surveillance analyst: A firm that arranges or executes trades: an asset manager, broker or bank.
Market surveillance analyst: MAR Article 16(1): venues must prevent and detect abuse, and report suspicious orders and transactions.
Trade surveillance analyst: MAR Article 16(2): "any person professionally arranging or executing transactions".
Market surveillance analyst: Every member's orders on the venue, but not why anyone placed them.
Trade surveillance analyst: Only the firm's own orders, but also the instruction, research, messages and lists behind them.
Market surveillance analyst: Spotting cross-member patterns, such as several accounts trading together.
Trade surveillance analyst: Explaining or condemning a specific order with evidence no venue has.
Where the FCA is pushing surveillance teams next
Toward the models behind the alerts, not only the queue. The FCA's 2026 priorities for wholesale markets describe gaps in "alert calibration" and in "testing and governance of surveillance models", which are analyst-adjacent skills, and its newsletters reward teams whose analysts understand alert logic, not just alert queues.
Senior trade surveillance analyst: the checker's seat
The senior analyst's distinctive job is quality: checking other analysts' closes, sampling look-alike sets, and owning the feedback that tunes alert models. The FCA has criticised arrangements with "weak or no quality assurance work on triaging alerts" (Market Watch 69), and the FCA's financial crime guide expects senior management to receive "management information in relation to any possible insider dealing or market manipulation" (FCG 8.2), which the checker's work produces.
The checker's queue: every close reviewed before it is final
In the sample week, 418 closes were checked and 11 were returned, 2.6%, most often because evidence was missing. That return rate is the kind of measure a head of surveillance can put in front of a board, and it only exists when every close is checked rather than a sample. For how a close should read, see trade surveillance best practices.
How the seat changes when agents assemble the case
The decision stays with the analyst; the fetching does not. In Trade Surveillance, eight agents work each alert before it reaches a person: one routes it under the conflict rules, four gather the order record, the news in its original language, the messages and the firm's other flow, a Skeptic agent argues the other side, a Case writer drafts the narrative with every sentence cited, and a Tuning agent measures which models find real cases. None of them can close, escalate or file.
The analyst's morning then starts with judgment. In the sample firm, 214 open alerts had all been assembled as cases by 9:40 a.m. in London; 38 were marked as needing judgment because the agents could not reach 85% confidence; 96 look-alike alerts from scheduled rebalances were grouped to close as a set, with a checker sampling 10. The seat becomes what the rules describe: an appropriate level of human analysis, applied where it counts. See it at Trade Surveillance.
Questions people ask
Which skills should a trade surveillance team build next?
Trade surveillance is a regulated function every firm that arranges or executes trades must staff, and the FCA's published priorities keep pointing at surveillance quality, data and model testing. A team whose analysts understand alert logic and asset-class market structure, not only queue work, can staff the senior checker and model-tuning work those priorities call for.
Must a firm train its trade surveillance analysts?
Yes. Firms must train the staff who monitor and detect market abuse, regularly, under Delegated Regulation 2016/957, Article 4. No specific qualification is required by MAR or the FCA, and many firms look for knowledge of the asset classes they trade.
How many alerts does a trade surveillance analyst review a day?
No regulator or independent study publishes alert volumes or alerts per analyst. In Trade Surveillance's sample firm, nine alert models raised 1,318 alerts a month on average; a team should measure its own volume, time per alert and return rate rather than rely on industry rules of thumb.
Can a trade surveillance analyst be replaced by AI?
Not under the current rules. Delegated Regulation 2016/957 requires "an appropriate level of human analysis" in monitoring and detection, and the decision to submit a STOR is the firm's. Software can gather and organise the evidence and draft the note; a person must decide.
What is the difference between trade surveillance and communications surveillance?
Trade surveillance reviews orders and transactions for market abuse; communications surveillance reviews emails, chats and calls for misconduct. They meet in the case file: an analyst deciding a trade alert reads the trader's messages around it as evidence.