16Compliance and Market Abuse

In August 2022 the UK’s Financial Conduct Authority fined Citigroup Global Markets £12.6 million because, when the Market Abuse Regulation extended the duty to monitor orders as well as trades in 2016, the firm did not properly implement it: it took eighteen months to identify and assess the market abuse risks its business was exposed to, and in the meantime it could not effectively monitor its trading for certain types of insider dealing and market manipulation. Nobody was accused of abusing the market. The failure was significant gaps in the firm’s surveillance: for some kinds of abuse no alert would have been generated, so nobody could have read one. Compliance is a function that must see the trading before it can judge it.

16.1 The rulebook a trader lives under

A trader’s conduct is bounded by two prohibitions and the duties that support them. The prohibitions are on using information others do not have and on distorting prices; Book 9 described the manipulative patterns (spoofing, layering, marking the close, momentum ignition, benchmark manipulation) and Book 3 wash trading. This chapter is about the function that keeps a firm on the right side of them.

16.2 Surveillance as a function

Book 15 built the trade surveillance system: detectors that score orders and trades, surveillance alerts, triage, and the communications archive. The compliance function owns what happens next: which detectors run on which businesses, where their thresholds sit, who reviews the alerts, and what is reported.

The hook’s failure was coverage: detectors that were not run cannot alert. The subtler failure is capacity. Every detector has a threshold; below it nothing is reviewed, above it every alert waits for an analyst. Set it low and the queue floods, and analysts reviewing in the order alerts arrive see mostly noise; set it high and true cases never alert.

def triage(score, label, alert_rate, capacity, order="arrival"):
    score, label = np.asarray(score, float), np.asarray(label)
    thr = np.quantile(score, 1 - alert_rate)
    alerted = np.nonzero(score > thr)[0]
    a, tp = len(alerted), int(label[alerted].sum())
    reviewed = min(a, capacity)
    if order == "score":
        top = alerted[np.argsort(-score[alerted], kind="stable")[:reviewed]]
        found = float(label[top].sum())
    else:
        found = tp * reviewed / a if a else 0.0
    return {"threshold": float(thr), "alerts": a, "true_alerts": tp, "reviewed": reviewed, "found": found,
            "missed": int(label.sum()) - found}


def best_rate(score, label, capacity, rates, order="arrival"):
    res = {r: triage(score, label, r, capacity, order)["found"] for r in rates}
    return max(res, key=res.get), res

16.3 Tutorial: the alert queue and the pre-clearance desk

With 50 analyst hours the best alert rate is 0.8%, just under the capacity rate of $100/11\,600=0.86\%$, and the queue finds 65 of the 100 planted cases. At the default rate of 5% the detector alerts on 580 account-days, 89 of them true, but analysts reading the first 100 in arrival order find 15 on average: 85% of the abuse is missed, not by the detector, which flagged most of it, but by the queue (Figure 16.2). Tripling the hours moves the best rate to 2.5% and the true cases found to 81; at the default rate it finds 46. Reviewing in score order instead of arrival order recovers what the threshold loses: 66 found at the default rate with 50 hours, 81 with 150. A naive detector, the order-to-trade ratio, finds none of the 100 at any threshold, because the market makers of Book 9 cancel more than any spoofer.

16.4 Personal dealing

Employees who know what the firm is about to trade, or what a client is about to announce, can profit from it in their own accounts. The rules are older than algorithmic trading and apply to everyone with access.

def preclear(req, lists, firm_trades, holdings, insiders=frozenset(), rules=None):
    """req: (employee, symbol, side, day), side +1 buy / -1 sell; firm_trades: {symbol: sorted days};
    holdings: {(employee, symbol): day bought}; insiders: set of (employee, symbol) on the insider list that day."""
    rules = rules or Rules()
    emp, sym, side, day = req
    if lists.on("restricted", sym, day):
        return False, "restricted list"
    if lists.on("watch", sym, day):
        return False, "watch list"
    if (emp, sym) in insiders:
        return False, "insider"
    if any(day - rules.blackout_days <= t <= day for t in firm_trades.get(sym, ())):
        return False, "firm traded recently"
    bought = holdings.get((emp, sym))
    if side < 0 and bought is not None and day - bought < rules.holding_days:
        return False, "holding period"
    return True, "approved"

Of the year’s 1 215 requests, 964 (79.3%) were approved. Of the 251 refusals, 202 (80.5%) were for names the firm had traded in the previous two days, the front-running rule; 23 were for restricted names, 5 for names on the watch list, 6 for sales within the 30-day holding period, and 15 were requests by wall-crossed employees in the names of their projects, every one of the planted requests refused. The watch-list refusals show the list’s cost: an employee refused for a reason compliance cannot give learns that something is happening in the name. A firm can reduce that signal by giving no reasons for any refusal, or by monitoring watch-list names instead of refusing trades in them.

16.5 Information barriers, insider lists and wall-crossing

A firm that advises issuers, lends to them or underwrites their securities holds inside information in one part and trades in another. It keeps them apart with barriers, and it records who crosses them.

A crossed person is on the insider list for the project’s issuer from the moment they are crossed until the information is made public or loses its significance (the project is cleansed); pre-clearance refuses their trades in the name throughout, and surveillance watches the name across the firm. The records serve two purposes: they make the controls work, and they are what the firm shows its regulator when a trade in the name is questioned. A market sounding under the regulation’s rules is the same act performed on an outside investor, with the same consent and records.

16.6 Build: the compliance engine

16.7 Exercises

16.8 Problem: The Alert Queue

16.9 Interview questions