Detection, Prevention, Deterrence (oh my! )

It is gratifying to see the serious attention that regulators, traders, brokers and the buyside are paying to market surveillance today. It was not always the case. The credit crisis began a domino-effect market crash that rang alarm bells and woke them up; then the flash crash jolted them like a cup of three-shot espresso on an empty stomach.  But, despite the attention and the good-spirited attempts to put monitoring and surveillance into place globally, the changing face of regulations can create fragmented and inconsistent results.

Market surveillance today resembles a patchwork quilt, some programs monitor in real time and others look backward, said Miranda Mizen, Principal of TABB Group in a paper entitled Dynamic Surveillance: Detection, Prevention, and Deterrence.  Brokers' internal risk controls are differentiated from their clients' - for those that actually use pre-trade risk controls on their clients, not all do yet. Exchanges have varying surveillance programs and have operated in a siloed environment, with disparate procedures and processes causing a disconnect with their colleagues.

Mizen said that the drive to create more dynamic, comprehensive programs and techniques boils down to three core objectives: detection, prevention, and deterrence.

Detection of market abuse while, after, or even before it happens will help to bring back investor confidence.  Prevention of fat finger trades and rogue algorithms entering the market will go a long way to avoiding more flash crashes, or even splash crashes across asset classes. Prevention is rapidly becoming the domain of brokers, which sit squarely in the middle between order flow and trading venues.

Deterrence via real-time monitoring, fines and convictions should help to clamp down on market abuse. Although it will never be completely stamped out as long as it seems profitable, new policing techniques will up the ante so abusers will also have to up their game, said Mizen.

Consistent, viable market surveillance across the board has to include regulators, exchanges and ECNs, brokers and buyside firms in order to be effective. Sophisticated real-time surveillance is crucial for monitoring market patterns, for checking sponsored access clients' credit risk, for balancing position limits. It needs to be coupled with historical surveillance in order to compare market movements and flag possible abusive patterns.

The demand for sophisticated real-time surveillance adds to, rather than replaces, historical views, and the two increasingly overlap. Both are essential. For example, a client's credit risk needs constant monitoring (real-time) for sponsored access, but the global credit risk may not be verified until the overnight processes (historical) have run, said Mizen in her paper.

Real-time and historical pattern detection can also complement each other. If there is market activity several standard deviations from the norm within a two-minute window it could raise an intra-day red flag to the regulator, yet concluded to be non-abusive. If, however, this same activity surfaces at the broker along with correlated activity in another asset class during an overnight data crunch - it looks more suspicious. Real-time or historical, surveillance of flow and markets needs to be programmed tightly enough so that the patterns are not falsely alerting officials.

Mizen said that of the three - detection, prevention and deterrence - prevention needs the most focus to protect markets and prevent disruptive, destructive order flow.  If using a combination of sophisticated real-time and historical surveillance tools can prevent another flash crash, stop market abuse in its tracks, and help to catch and punish wrongdoers it will go a long way to bringing back investor confidence.

-Dan