Trade surveillance where every alert arrives as a cited case file, and every close is checked by a second person
Every alert closed with a cited case file, and a second reviewer on every close.
See one case, screen by screen ↓Trade surveillance is the work of reviewing a firm's orders and trades for market abuse — insider trading (insider dealing, in MAR's words), front running, spoofing and layering, marking the close, information barrier breaches — and closing or reporting each alert with a reason a regulator will accept. Botminds Trade Surveillance builds a cited case file for every alert from the orders, news and chats behind it, so the analyst decides, a second person checks every close and the Head of Surveillance approves every report.
AI in asset management: a buyer's guide to agentic AI for investment managers →
Updated
Trade surveillance on the buy side is no longer optional. An asset manager that arranges or executes trades must detect and report suspicious orders and transactions without delay under EU and UK MAR Article 16, and a US adviser must enforce written policies against misuse of material nonpublic information under Advisers Act Section 204A. A large manager's surveillance engine raises over a thousand alerts a month — trading before news, front running, information barrier, spoofing and layering, marking the close — and most of them are false positives that still need a reason a regulator will accept.
The alert says what pattern fired, never why the order existed. So the analyst pulls the order and its audit history from the OMS, the algorithm log from the EMS, the PM's instruction or the rebalance ticket, the news and issuer disclosures — often in Japanese, German or Korean — the trader's chats, emails and recorded calls from a separate archive, and the watch, restricted and insider lists. Then they write a free-text close-out note that only a sample of reviewers ever check. That is where the hour goes, and why an examiner finds closes with no evidence behind them.
Estimated split for one alert, gathering by hand against judging a case file the agents assembled.
Eight agents build every case before anyone opens it; an analyst decides and a second person checks.
Quillfield Capital's Asia Equity desk bought 180,000 Hoshida Precision shares 22 minutes before the company raised its full-year forecast. The surveillance engine's Asia batch raised alert TS-26-104417 at 08:00 London. It is Thursday, October 15, 2026. Here is what happens next, screen by screen, in the working solution.
Elif's home shows 214 open alerts, all 214 assembled as cases; 38 need judgment because the agents could not reach 85% confidence; 4 suggested escalations plus 1 escalated; 26 due today. Hoshida Precision tops the list: agents suggest close at 93%, and the Skeptic agent has one question for her. She asks the agents what they closed overnight.
“The agents close nothing on their own. Overnight they drafted 171 suggested closes for analysts to decide, and 42 analyst closes from yesterday wait for a checker.”
The case opens as an intraday chart in Tokyo time with a scrubber. Batch 3 releases at 14:10:06, the 64 fills land on the line at an average of ¥2,431.50, the broker's chat appears at 14:05 and Ren Takeda's reply at 14:07, and the forecast upgrade pins at 14:32. The close is ¥2,618, up 7.6%, a paper gain of $223,800. Below, the Case writer's narrative cites every sentence to one of 10 sources.
“Written by the Case writer · every sentence cited.”
Elif opens source S8, Hoshida's timely disclosure at 14:32:00 JST. The Japanese original sits beside the English: operating profit revised from ¥34.9 billion to ¥41.2 billion, up 18.1%. The only earlier item is a sector note at 13:42 that does not mention Hoshida. The Peer agent's source shows the order split 62.2% / 22.8% / 15.0% across three accounts, matching model weight and account size.
The News agent never paraphrases a source without showing the original.
The order came from model rebalance ticket RB-20261014-0442, which PM Aiko Sato created at 7:05 p.m. Singapore time the evening before and Investment Risk approved at 7:22 p.m., with release fixed at 14:10 JST, batch 3 of 4. Elif asks whether anyone changed it. The Order agent answers at 98%, citing the order audit log and the algorithm log.
“No. The release time was set when the order was staged at 08:20:14 JST and the scheduler released it at 14:10:06. The audit log shows no amendment to quantity, price, time or strategy.”
The Skeptic agent's challenge blocks the decision: the broker asked about volume 27 minutes before the headline, and participation rose from 9% to 14% between 14:20 and 14:27. Elif answers from the algorithm log — catch-up engaged automatically because the batch was 6.4% behind schedule, with no manual change, and 14% stayed under the 15% cap. The decision buttons open. She closes with R01, the rationale the Case writer drafted, and Grace Whitfield named as checker.
“I reviewed the sources, I have no conflict with this desk or trader, and this decision is mine.”
The case now reads “Closed · waiting for checker”. Grace opens it and sees the maker, the reason code, that the Skeptic was answered and kept in the file, and the agents' check that every statement in the rationale matches a cited source. She ticks her own statement and approves and signs. Had she made the close herself, rule C1 would refuse her.
“I checked the rationale against the sources and agree with the close.”
The queue lists every alert with what happened, the model and desk, and what the agents suggest: needs judgment, suggest close or suggest escalate, each with a confidence and a reason. The agents grouped 96 look-alikes — scheduled rebalances and programs whose release was fixed before the news. Each was checked one by one; Elif can close them as a set, and a checker samples 10.
High-yield PM Oliver Haines was wall-crossed on Brevane's restructuring on October 8. On October 13 he messaged equity trader Lukas Brandt in German and they spoke on a recorded line for 4 minutes; Lukas then sold 410,000 shares, the European Equity Fund's whole holding, at €18.42. The ad hoc announcement took the shares to €14.18, down 23.0%: €1.74 million of loss avoided. The Skeptic's innocent explanation, a 25% trim from the risk model, was answered: the sale was 100% of the holding. Elif escalated at 8:12 a.m. with E02.
Recorded call transcript: “I can't tell you anything specific, but I'd be careful with the position this week.”
The Case writer drafted STR-26-0031 from the case file on the MAR Article 16 template of Delegated Regulation (EU) 2016/957: reporting entity, transaction and order, nature of the suspicion, persons involved, attachments — every field linked to its source, the innocent explanation considered and rejected. Sofia Lindgren, Deputy General Counsel, approved the wording at 9:05 a.m. The clock reads 1 h 28 min against an internal target of one business day.
“Approval needs the Head of Surveillance or the CCO. The analyst who escalated cannot approve.”
The Brevane wall-crossing restricted the European High Yield team only, so the equity desk could trade after the call. The Case writer proposes a rule: a wall-crossing restricts every desk that trades any security of the issuer, until the information is public. Today it would widen three restrictions — Calder Bancorp, Moravia Chemie and Pinecrest Mining. It waits for Jonathan to approve or reject.
“…and would have blocked the Brevane sale at order entry.”
The same alert queue, seen by four of the people who carry it — what their day looked like, and what it looks like now.
Eight agents build every case before anyone opens it; an analyst decides and a second person checks.
Takes alerts from the surveillance engine and exceptions from the order management system, removes duplicates, links related alerts and routes each one by desk and the conflict rules.
Pulls the order, fills, allocations, amendments, algorithm log and the PM's instruction or model rebalance ticket.
Finds headlines and issuer disclosures around the trade in the original language, with English beside them and timestamps to the second.
Reads the trader's and PM's chats, emails and recorded calls in the case window, in any language.
Compares the trade with the firm's other flow — the same model, other accounts, the desk's history — and with market volume.
Argues the other side: the best innocent explanation before an escalation, the strongest case for abuse before a close.
Writes the case narrative and the draft decision, and drafts suspicious transaction and order reports and the CCO's monthly summary — every sentence cited.
Measures how often each alert model finds something real and proposes threshold changes with a six-month backtest.
Decide and sign every close. The agents propose; a named person decides.
Ask on the home screen or inside a case, in plain words. The agent that holds the evidence answers, with its confidence and the sources it read.
What did the agents close overnight?
The agents close nothing on their own. Overnight they drafted 171 suggested closes for analysts to decide, and 42 analyst closes from yesterday wait for a checker. The 96 look-alike alerts can be closed as one set, with a 10-alert sample for the checker.
Did anyone change the release time?
No. The release time was set when the order was staged at 08:20:14 JST and the scheduler released it at 14:10:06. The audit log shows no amendment to quantity, price, time or strategy, and the algorithm log shows no manual intervention.
Translate the broker chat
At 14:05:22 the broker wrote: “Heavy volume in Hoshida this afternoon. Anything going on?” Ren replied in English at 14:07:03: “No view, model trade today, working it on VWAP.” The broker answered “Understood.” Original and English are side by side in the source.
Why wasn't Brevane restricted for equities?
The wall-crossing restricted the European High Yield team only, as the barrier rule then required. The agents have proposed a firm-wide rule for the Chief Compliance Officer to approve: a wall-crossing restricts every desk that trades the issuer.
13 screens from the working solution, on its sample data. Pick one to see it large.
Who does what, how fast, with which reasons and where the records live. Only the administrator changes these; changes to agents and models also need the Head of Surveillance's approval.
| Setting | Default | Choose from |
|---|---|---|
| Alert review | 5 business days | Warn at 24 hours left · escalates to the checker |
| Second review | 2 business days | Every close checked · look-alike sets sampled at 10% |
| Report after escalation | Without delay · internal target 1 business day | Warn at 4 hours · Head of Surveillance and the CCO |
| Confidence bar to suggest a close | 85% | Below it, “needs judgment” · agents never close |
| Reason codes | Close R01–R07 · Escalate E01–E05 · Return K1–K5 | e.g. R01 Scheduled or systematic order · R05 Permitted cross at the independent price (Rule 17a-7) · E02 Possible information barrier breach |
| Segregation of duties | Rules C1–C6 on | Maker never checker · no desk sat on in 12 months · reports approved by the Head of Surveillance or the CCO |
| Data residency | Each entity in its region | US East · UK South · Singapore · cross-region reads logged with the reason |
| Retention | 7 years | Above 5 years (Rule 204-2, Delegated Regulation 2016/957) and 6 years (Rule 17a-4) · legal hold overrides |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (FCA STOR statistics for 2024 — 4,528 reports, over 87% for suspected insider dealing; SEC settled action, August 2024 — a $1.8 million penalty against an investment adviser with no information barrier between credit portfolio managers and CLO traders; Regulation (EU) No 596/2014 Article 16 and Commission Delegated Regulation (EU) 2016/957). People, firms, funds, issuers and securities named on this page are fictional — characters and sample data in the working solution, at Quillfield Capital.
Trade surveillance is the work of reviewing a firm's orders and trades for market abuse — insider trading (insider dealing, in MAR's words), front running, spoofing and layering, marking the close, information barrier breaches — and closing or reporting each alert with a reason a regulator will accept. Botminds Trade Surveillance builds a cited case file for every alert from the orders, news and chats behind it, so the analyst decides, a second person checks every close and the Head of Surveillance approves every report.
It does not hide alerts; it makes each one fast to decide. Every alert arrives as an assembled case with a suggested decision, and look-alikes such as scheduled rebalances are grouped to close as a set with a checker's sample. The Tuning agent proposes threshold changes with a backtest: in the working solution, marking-the-close alerts fall from 204 to 126 a month with all 3 past true positives still caught, once the Head of Surveillance approves.
A STOR is a suspicious transaction and order report: under MAR Article 16, a firm that professionally arranges or executes transactions must send one to its regulator without delay when it reasonably suspects insider dealing or market manipulation. When an analyst escalates, the Case writer drafts it from the cited case file on the template of Delegated Regulation (EU) 2016/957, or an internal MNPI review for a US adviser under Advisers Act Section 204A, so STOR reporting starts from evidence already cited. Legal reviews it, only the Head of Surveillance or the CCO can approve it, and the analyst who escalated cannot.
No. It takes the alerts your surveillance engine already raises and the exceptions from your order management system, and builds the case around each one. The alert models keep running in the engine; the solution measures each model's productive rate and proposes backtested changes.
Yes. The News agent keeps headlines and issuer disclosures in their original language with English beside them, timestamped to the second, and the Comms agent reads chats, emails and recorded calls in any language. In the working solution that includes Japanese disclosures, German chats and a German ad hoc announcement.
Every case is checked against the watch, restricted and insider lists, wall-crossings and personal-trading declarations. When the agents find a gap — in the working solution, a wall-crossing that restricted one team while another desk traded the issuer — they propose a barrier rule for the Chief Compliance Officer to approve.
Yes. The agents never close, escalate or file. The analyst decides with a reason code after answering the Skeptic agent, a second person checks every close, and the Head of Surveillance approves every report and every model change. Every action is on an audit trail that cannot be edited.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your surveillance procedures, reason codes, roles and a sample of past alerts — and it goes live once every quality gate has passed. First-time setup connects the systems, maps desks, sets roles and reason codes, and runs a dry run on last month's alerts.
Mandate rules live in a day, not two weeks, each read twice, tested and cited.
1-min demoInvestment Guideline MonitoringOf 412 overnight alerts, 9 reach a person, and every close cites its clause and approver.
1-min demoSEC Marketing Rule ComplianceEvery claim proven to its record, every local version checked, approved the same day.
1-min demoWe'll run Trade Surveillance on a sample of your own alerts, with the orders, news and chats behind them.