Trade surveillance best practices: the close note that holds up

Trade surveillance best practices start from the record the law requires: for every alert a firm examines, the analysis it carried out and the reason it did or did not file a suspicious transaction and order report, kept for five years and produced on request. A best-practice programme makes that record defensible: the alert is reproducible, the evidence is named, the strongest case against closing is answered, the decision fits the reasonable-suspicion test, and a second person checked it. Around the note sit the controls that make it trustworthy: a market abuse risk assessment, calibrated scenarios, complete data and tested models. It is hard because most alerts are closed, quickly, by analysts with many more waiting, and a free-text note rarely shows its evidence. Botminds' Trade Surveillance writes the close from a case file in which every statement is cited to its source, asks a second person to check every close, and keeps the record for seven years.

The examples come from a fictional asset manager, Quillfield Capital, and its sample data in the solution. The rules and findings are the regulators' own.

What are trade surveillance best practices?

They are the habits that make a surveillance programme effective and provably so. The rules set the frame: arrangements must be "appropriate and proportionate in relation to the scale, size and nature" of the business, audited and reviewed internally at least once a year, and written down, with the documents kept for five years (Delegated Regulation 2016/957, Article 2(5)). The FCA's newsletters fill in what that looks like and what it does not.

In practice the programme has five layers, each feeding the next. A market abuse risk assessment says which abuses the firm is exposed to, by desk and asset class. Scenarios and thresholds are chosen and calibrated to those risks. Data feeds bring every order and transaction into the system. Analysts review alerts and record decisions. And testing, quality checks and the annual review make sure the first four still work. A weakness in any layer shows up in the last place anyone looks: the close note.

What should an alert close-out note say?

Enough for a stranger, years later, to see what the analyst saw and agree or disagree with the decision. Article 3(8) requires the analysis itself to be documented, as well as "the reasons for submitting or not submitting a STOR" (Delegated Regulation 2016/957, Article 3(8)). A note that says "Reviewed. Model trade. No concerns." records a conclusion without an analysis. The anatomy below is what a note needs to hold up.

Part 5 is the one most notes leave out, and the one that most improves them. Writing down the strongest suspicious reading before closing forces the analyst to look for the evidence that answers it, and shows a reviewer that the question was asked. In Trade Surveillance a Skeptic agent writes that challenge for every case, the decision buttons stay locked until the analyst answers it, and both stay in the file.

Trade surveillance controls: the programme around the note

Controls decide whether a good note is possible. A note can only cite what the analyst could see, and the FCA's published findings show the controls that most often leave analysts blind or uncertain. Its financial crime guide lists as poor practice risk assessments that "are generic, and not based upon the firm's own observations", and as good practice "evidence that the firm's risk assessment informs the design of its surveillance controls" (FCA, FCG 8.2).

Surveillance that fails silently

The worst surveillance failures produce no bad notes, because they produce no alerts. The FCA described three in 2024, and each is a lesson for testing. At Firm A, a new third-party system's insider-dealing model needed news to alert, but "the news feed had not been activated"; no alerts were generated "for over three years", and the firm found out only when the FCA asked about trading it had not reported. At Firm B, a coding mistake in an in-house bond model meant it alerted only if the firm itself traded on the day the price moved, which in illiquid bonds left insider dealing undetected; the model kept producing true positives, which "led the firm to mistakenly believe that the model was working as intended". At Firm C, data from a private order feed was never ingested, and "For several years, the firm mistakenly believed" that activity was being monitored (FCA, Market Watch 79).

The common thread is false comfort: an alert queue that looks normal. That is why a defensible programme tests what the queue cannot show, namely whether a known abuse pattern would have alerted. Its 2026 priorities show the FCA still finding the same three weaknesses: feeds that are incomplete or wrong, alerts poorly calibrated, and models weakly tested and governed (FCA, Wholesale Markets priorities, March 2026). Preventing the first of those starts at implementation.

How do you test surveillance models?

Test four things, on a risk-based schedule, and after every change. The FCA's 2023 peer review of how nine investment banks tested their client order front-running models found four kinds of testing: "parameter calibration", "model logic", "model code" and "data (comprehensiveness and accuracy)". It also found that "Approximately half the firms focused their reviews mainly on parameter calibration", and that some firms split frequent calibration checks from less frequent reviews of logic, code and data (Market Watch 79).

Seeded testing deserves a place in every programme because it tests all four at once. Insert a handful of synthetic orders that should trigger each scenario into a test copy of the day's data, and check that each alerts. The FCA also asks firms to consider whether regression testing is undertaken "when changes are made to other systems that might adversely affect market abuse surveillance systems", and, for third-party systems, "how can firms independently gain comfort that models are operating as intended". A firm that can answer those two questions with evidence has moved past calibration-only testing.

A trade surveillance case study: what a second check finds

A second check finds the errors the maker cannot see in their own note. In the sample firm's review queue, two closes carried flags raised by the agents when they compared each rationale with its sources. One rationale cited an index change on 2 October, while the index notice in the file was dated 6 October. Another said the news was public at 9:00, while the first headline in the file was at 9:14, after the order. Neither was necessarily wrong in its conclusion. Both would have been wrong on the record.

Second review: every close checked, with the agents' flags where rationale and sources disagree

Over the sample week, checkers reviewed 418 closes and returned 11, or 2.6%; the most common reason was missing evidence. That is the measure a head of surveillance should want: not how many alerts were closed, but how many closes failed a check and why. The FCA's financial crime guide expects senior management to get regular information on possible insider dealing and manipulation, and return rates by reason and desk are exactly that.

Two excuses the FCA does not accept

When surveillance falls short, firms reach for the same two explanations, and the FCA has rejected both in writing. The first is that everyone else has the same problem. The FCA said it has seen "firms using questionable rationales to reconcile themselves to their potential failure to meet their obligations under MAR", including the view that "their own failings can be excused by a perception that some of their peers are failing in the same way", and that it "will not necessarily accept failures to comply with MAR on the basis that multiple firms are in a similar position" (FCA, Market Watch 56).

The second is that the person responsible is new. On its supervisory visits the FCA reviews "the firm's compliance with the STOR regime, rather than employees' compliance with their individual regulatory obligations", so it considers an employee's time in the role "to be of limited relevance" and "will not generally treat it as mitigating the firm's failings". For a new head of surveillance, that makes the inherited file the first thing to read: the closes, the tests and the annual reviews of the predecessor's years are the firm's record, and the regulator will treat them as such.

Who checks the checkers: second line, internal audit and governance

A programme needs someone outside it to test it, and governance that is quick enough to fix what they find. The FCA suggests that "Testing by the second line and internal audit may help firms gain comfort about the effectiveness of their monitoring", and it also warned against the opposite failure: "Some firms have complex governance arrangements where approvals and validations go through multiple steps, taking significant time", and firms "should consider whether intricacy and volume in governance necessarily delivers timely, efficient and effective outcomes" (FCA, Market Watch 79).

The practical balance is a small number of named approvers with evidence in front of them. A threshold change should reach one approver with its backtest attached, not five committees with a slide. An internal audit of surveillance should pick closes at random and re-perform them from the sources, which is only possible if the sources were kept with the close. And the annual review the Delegated Regulation requires should read the year's test results, return rates and model changes, so that it reviews the system's performance, not just its documents.

Trade surveillance system best practices for records

Keep each decision with its evidence, unchangeable, for at least five years. The Delegated Regulation sets five years for the analysis and reasons, and five years for the documentation of the arrangements and their changes. Regulators testing a close will want the sources as they stood at the time, not as they stand now, which is why copies matter: a news item can be edited and a chat can be deleted.

In Trade Surveillance, every action by people and agents, with who, what, when, why and on what evidence, is chained by fingerprint and cannot be edited; records stay in each entity's region for seven years, with legal hold, and export in one step for a regulator or internal audit. The point is not the length. It is that a close made today can be shown, unchanged, with its sources, when the question comes. For the reports themselves, see FCA STOR reporting; for the cost of running this programme, the trade surveillance system comparison. To see it on your own alerts, start at Trade Surveillance.

Questions people ask

What is a trade surveillance program?

It is the whole set of arrangements a firm uses to detect and report market abuse: a risk assessment, scenarios and thresholds, data feeds, alert review procedures, quality checks, training and an annual review. Delegated Regulation 2016/957 requires it to be appropriate and proportionate to the firm's business and documented in writing.

How often should trade surveillance models be tested?

At least once a year as part of the annual review the rules require, and after any change to the model or to systems that feed it. The FCA found that most banks in its 2023 peer review ran an annual test of some type, and that some used a risk-based approach, testing high-risk scenarios more often.

Should every closed alert be checked by a second person?

The rules do not say every close; they require effective arrangements and an appropriate level of human analysis. Sampling is common. Checking every close, as Trade Surveillance does with a sampled check for grouped look-alikes, gives a return rate per analyst and per reason that sampling cannot.

How long must trade surveillance records be kept?

Five years under Delegated Regulation 2016/957 for the analysis and reasons behind every examined order or transaction, and for documentation of the surveillance arrangements. Other rules, such as US recordkeeping rules, may require different periods for the underlying records.

What is a productive alert?

A common internal measure is the share of alerts that lead to an escalation or a recorded finding. In Trade Surveillance's sample firm it ranged from 0.4% for momentum ignition to 9.8% for information barrier alerts; a model that never produces a productive alert should be tested, not just tuned down.