CAPITAL MARKETS SURVEILLANCE VENDOR LANDSCAPE THE NEXT WAVE IN TRADE AND COMMUNICATION SURVEILLANCE

Arin Ray, Brad Bailey 06 February 2018

This is an authorized excerpt from a Celent report profiling Capital Market Suveillance vendors. Although the reprint was prepared for NICE Actimize, the vendor had no influence over the analyis. For more information about the full report, please contact Celent at info@celent.com.

CONTENTS

Executive Summary ............................................................................................................ 1 Key Research Questions ................................................................................................. 1

Introduction.......................................................................................................................... 3 Advancing Technology ........................................................................................................ 4

The Need for Third Party Solutions in Surveillance ........................................................ 4 Surveillance Solution Landscape ........................................................................................ 6 Evolution of Surveillance Technology ................................................................................. 8

Breadth of Coverage ....................................................................................................... 8 Analytics ........................................................................................................................ 10 Visualization and Reporting ........................................................................................... 10 Technology .................................................................................................................... 11 Pricing ............................................................................................................................ 11

Surveillance Vendor Profiles ............................................................................................. 12 NICE Actimize ............................................................................................................... 12

Conclusion......................................................................................................................... 16 Leveraging Celent’s Expertise .......................................................................................... 18

Support for Financial Institutions ................................................................................... 18 Support for Vendors ...................................................................................................... 18

Related Celent Research .................................................................................................. 19

EXECUTIVE SUMMARY

KEY RESEARCH QUESTIONS

1 Why is surveillance technology becoming important? 2 How is the

surveillance vendor landscape evolving? 3 How will capital

markets surveillance solutions evolve?

New regulations and growing regulatory scrutiny and enforcements are adding to the pressure on capital markets surveillance operations. Responding to the new regulatory and business demands with traditional technology is challenging, because they rely on siloed operations and rules-based software, and may not be able to meet the challenges of growing scale and complexity.

Capital markets firms are unlikely to invest and build in-house surveillance capabilities because budgets are limited, and surveillance is not considered a competitive differentiator by most of them. We are seeing interesting evolution of third party surveillance solution providers, with incumbent players ramping up their game, new players entering, and partnerships and restructuring taking place in the surveillance vendor ecosystem.

This report highlights the major technology themes emerging in surveillance by analyzing 17 vendor solutions. The list of vendors discussed here is not exhaustive, but offers a good microcosm of the surveillance vendor universe.

Regulations provide the biggest impetus for demand for automated surveillance solution, as well as for further enhancement of vendor solutions. Financial institutions are demanding new functionalities for sophisticated surveillance capabilities, as well as improvements in time to market and cost of ownership of surveillance solutions.

There is a heavy focus on analytics in general, and leveraging AI and machine learning specifically, for enhancing the surveillance solutions across the board. Specific areas that are becoming important include:

• Machine learning to help optimize the analytics models to reduce false positives and increasing efficiency.

• Network analysis to detect suspicious entities and activities by identifying relationships and/or patterns across counterparties and activities.

• Analysis of unstructured data for analyzing documents, news, and communication data.

• Behavior analysis and anomaly detection in structured (trade, metadata in communication) and unstructured (behavior, voice) data. Peer group analysis for benchmarking and detecting anomalies against expected peer group behavior.

• Machine learning for alert scoring, parameter recommendation, system tuning, risk scoring, and segmentation.

• Self-learning analytics for alert generation and resolution.

Cha

pter

: Exe

cutiv

e Su

mm

ary

2

Beyond analytics, improving cross-asset class surveillance is another focus area, both for exchange-traded and OTC markets such as FX, commodities, fixed income, credit, and rates.

Enhancing the integration of communications in trade surveillance algorithms is a top priority for leading vendors. Within communication surveillance specifically, two areas that are big focus are real time monitoring of e-communications, and improving audio communication surveillance capabilities with focus on enhanced voice-speech recognition and analysis. Leading players are looking to add foreign language surveillance capability.

Vendors are also seeking to enhance visualization and reporting capabilities. These include holistic visualization enhancements allowing correlating trade and communications data for holistic view of risk, increased graphing and dashboard capabilities, new reporting suite allowing web-based dashboards, and PDF style reports.

Leading vendors are investing in capabilities that will lower the cost of ownership, for example by simplifying upgrades as well as offering self-development and tuning capabilities. Others are seeking to find new applications in adjacent functions, such as in transaction cost analysis and best execution tools in non-equity markets, analyzing client communication to find opportunities to upsell and cross-sell new products.

Cha

pter

: Int

rodu

ctio

n

3

INTRODUCTION

In the report A New Era in Capital Markets Surveillance: As Far as the AI Can See (November, 2017), we discussed the growing importance of surveillance operations in capital markets. New regulations, and growing regulatory scrutiny and enforcements are vastly expanding the scope of surveillance operations. Regulators are increasingly asking firms to capture intent behind their conduct, which requires aggregation across layers — orders, trades, communication and past behavior and patterns — to build a full picture on how traders are behaving.

Figure 1: Numerous Forces Are Driving the Changes in Surveillance Operations

Source: Celent

Compliance in this dynamic regulatory environment will require new tools and operational arrangements because traditional approach is inadequate in meeting the challenges. Capital markets firms are unlikely to invest and build in-house surveillance capabilities because budgets are limited, and surveillance is not considered a competitive differentiator by most of them.

At the same time, we see interesting evolution of third party surveillance solution providers, with incumbent players ramping up their game, new players entering, and major partnerships and restructuring taking place in the surveillance vendor ecosystem. This is offering low cost and high quality solutions for capital markets firms to quickly implement and easily scale up.

This report highlights the major technology themes emerging in surveillance by analyzing 17 vendor solutions. The list of vendors discussed here are not exhaustive, but offers a good microcosm of the surveillance vendor universe by discussing a mix of different types of players, such as incumbents and startups, global and regional players, trade and communication surveillance solutions, buy and sell side, and market infrastructure focused solutions, and so on.

Regulations

Fines, consent orders, regulatory visits

Pressure from boards, senior management

Expanding scope of

surveillance

Market structure changes

Electronification and digitalisation

Advancements of technology

Cha

pter

: Adv

anci

ng T

echn

olog

y

4

ADVANCING TECHNOLOGY

Responding to the new regulatory and business demands with traditional technology and operating models is challenging, because firms rely on siloed operations and rules-based software, and may not be able to handle the growing scale and complexity. They have also limited capability to conduct surveillance amidst growing electronification of new asset classes and explosion of digital communication.

Artificial intelligence (AI) and machine learning (ML) technology provide opportunities to significantly bolster surveillance operations by offering new insights through advanced analytics, as well as by improving costs and efficiency through automating parts of alert investigation process. The cloud, with its low-cost storage and flexible computing capabilities, can be another potent tool for helping in surveillance.

• Armed with tools leveraging the new technology, capital markets firms are now looking to aggregate communication over several channels, with many ramping up capabilities in surveillance of voice communication.

• More advanced firms are moving toward a holistic surveillance approach, overlaying trade information on top of communication data and even other data that gives them a better view of employee behavior and understanding of intent.

• The next phase will be risk-based surveillance, which will be driven by policy that is more and frequently informed by data and analytics.

THE NEED FOR THIRD PARTY SOLUTIONS IN SURVEILLANCE At this point of capital markets evolution, firms are increasingly seeking to focus in-house resources on building differentiating capabilities, procuring solutions and services in noncore areas from external agents. Surveillance clearly is one of those areas which are not core to a capital markets firm’s operations (unless used in conjunction with CRM, best execution, or transaction cost analytics, which is rare).

Sell side firms have been using third party surveillance solutions for some time, and the buy side is likely to follow suit and not invest scarce resources on developing them in-house. Furthermore, the vendor landscape is maturing, with existing providers upgrading their solutions with advanced analytics and cloud offerings, and new players emerging with cutting-edge solutions. Therefore we expect most firms to use third party solutions for core surveillance operations. The vendor landscape is maturing with

Key Research Question

1

Why is surveillance technology becoming important?

Responding to the new regulatory and business demands with traditional technology is challenging, because firms rely on siloed operations and rules-

based software, and may not be able to handle the growing scale and complexity. They have limited capability to conduct holistic surveillance amidst

growing electronification of new asset classes and explosion of digital communication.

Cha

pter

: Adv

anci

ng T

echn

olog

y

5

existing providers upgrading their solutions with advanced analytics and cloud offerings, and new players emerging.

Cha

pter

: Sur

veilla

nce

Solu

tion

Land

scap

e

6

SURVEILLANCE SOLUTION LANDSCAPE

The capital markets surveillance vendor universe consists of several and different types of players. Table 1 summarizes the vendors discussed in this report.

Table 1: Surveillance Vendor Universe Consists of Various Players

VENDOR SOLUTION VENDOR SOLUTION VENDOR SOLUTION

Aquis Technologies

Aquis Market Surveillance (2014)

Fonetic Automatic Trade Reconstruction (2013)

OneMarketData

OneTick Trade Surveillance (2014)

b-next CMC: Suite (1989)

IBM Surveillance Insight for Financial Services (2016)

Scila Scila Surveillance (2008)

Behavox Behavox Compliance (2015)

Itiviti Itiviti Analyst MAR (2016)

SIA S.p.A SIA-EAGLE (2006)

Bloomberg Bloomberg Vault, Bloomberg Transaction Cost Analysis (2009)

London Stock Exchange (LSE)

UnaVista Transaction Intelligence (to be released in 2018)

Millennium IT Pentagon (2015)

TCS Market Infrastructure solution from TCS BaNCS (2011)

Digital Reasoning

Synthesys® for Conduct Surveillance (2014)

Nasdaq SMARTS Trade Surveillance, SMARTS Market Surveillance (1994)

Trillium Trillium Surveyor (2014)

FIS Protegent Surveillance (2005), Protegent Market Abuse (2012)

NICE Actimize

Markets Surveillance Solution Suite (1999)

Source: Vendors, Celent ( ) indicates the time a solution became available.

Key Research Question

2

How is the surveillance vendor landscape evolving?

Artificial intelligence and machine learning technologies are creating opportunities for their

application in surveillance, bringing entrants to the surveillance vendor landscape. Incumbent vendors are enhancing their solutions with these advanced

analytics to stay ahead.

Cha

pter

: Sur

veilla

nce

Solu

tion

Land

scap

e

7

As can be seen from this table, some solutions such as those from b-next, NICE Actimize, and Nasdaq SMARTS have been around for decades. This space is also witnessing entrants such as Itiviti, Behavox, Trillium, Digital Reasoning, and Aquis Technologies in the last two to three years. Recent entry into this space by leading technology and markets solution providers, such as IBM, highlights the significant and growing opportunity in surveillance technology and solutions.

Company’s Backgrounds Also noteworthy from Table 1 is the fact that various types of companies are engaged in the provision of surveillance software to the capital markets industry.

• On one hand, there are large conglomerates such as IBM and TCS whose expertise and geographic presence span several geographies and industries.

• There are financial services / capital markets focused players such as FIS, Bloomberg, Nasdaq, and London Stock Exchange Group, which have a large suite of capital markets and trading-related solutions and operate in many countries.

• A segment in this group consists of risk and compliance focused players such as NICE Actimize, which offers surveillance solutions as part of its suite of offerings.

• There are also surveillance focused players such as Behavox, Digital Reasoning, and Scila, many of which have emerged in recent years owing to the growing opportunities in surveillance.

The companies in our sample are spread across the globe.

• Most of the companies are headquartered in key global financial centers of London, New York and their neighborhood; examples include Aquis, Behavox, Bloomberg, IBM, LSE, Nasdaq, NICE Actimize, and OneMarketData.

• Some are headquartered in regional hubs such as Milan (SIA), Madrid (Fonetic), Stockholm (Itiviti, Scila), and Herford, Germany (b-next).

• Most of the companies have presence in over 10 countries; large players such as Bloomberg, FIS, Nasdaq, and NICE Actimize are present in many more countries.

Smaller and dedicated surveillance focused players have between 30 to 200 staff; larger players have hundreds or close to thousand staff, while the large conglomerates have many more, some in hundreds of thousands.

Cha

pter

: Evo

lutio

n of

Sur

veilla

nce

Tech

nolo

gy

8

EVOLUTION OF SURVEILLANCE TECHNOLOGY

Surveillance solutions traditionally relied on trade surveillance that operated on a post-trade (typically T+1) basis. Suspicious incidents of market abuse are detected through detection scenarios, for which the solutions have traditionally provided extensive libraries. Over time the solutions added analytics for improved performance, alert and case management workflows for operational improvements, visualization tools such as graphs and dashboards, and reporting capabilities.

The main challenge with such systems is alert management and reduction of false positives, which can be prohibitively costly. Vendors and banks have been leveraging analytics to improve costs and efficiencies, adding real-time monitoring capabilities to be proactive, and order and quote surveillance capabilities to execution data to form a more complete picture of trade and conduct. Communication surveillance capabilities were rudimentary for a long time, being mostly limited to random sampling of voice data, and lexicon-based search on communication data with no automated capability to combine them with trading information.

Surveillance solutions have undergone vast improvement compared to those used even a few years ago, and incorporate many enhancements addressing the shortcomings.

BREADTH OF COVERAGE The realms of surveillance solutions have traditionally focused on surveillance of trades, mostly for exchange-traded and electronically traded other instruments, and mainly for sell side and market infrastructure players. But that is rapidly changing, and the coverage of surveillance solutions is vastly expanding beyond the traditional boundaries, as can be seen from Table 2. Some of the classification in this table may be more aspirational at this stage, since many vendors are in the process of ramping up their capabilities; in general we see a definite trend across the spectrum of vendors adding functionalities and asset class support to expand their breadth of coverage.

Functional Coverage Specifically, we see a growing trend of surveillance solution providers adding communication surveillance capabilities, even though capabilities differ in terms of extent and scope — electronic vs. audio communication, metadata analysis vs. content analysis, and lexicon-based vs. context analysis. Leading players are going a step further by combining trade and communication surveillance capabilities to analyze trader behavior and conduct in greater details for holistic and proactive compliance.

Target Segment Coverage Similarly the buy side is increasingly coming under the radar, especially as regulations increase surveillance requirements for buy side firms, and traditionally sell side-focused providers sense opportunities. It should be mentioned, sell side (and market infrastructure) players still constitute overwhelming proportion of client base for many providers at present, but most of them are aggressively going after buy side players, as evident from their development and marketing strategies as well as from recent announcements of partnerships, and acquisitions.

Asset class coverage The scope of asset class coverage is also expanding. FX is a key new asset class due to its growing electronification, and recent revelations of market abuse cases. Fixed income should be the next focus area. Commodities, especially energy and other instruments, are also key asset classes from a surveillance perspective. Increasingly, cross-asset surveillance is becoming very important, as electronification and superior analytics allow firms to engage in cross-asset trading, and by extension the potential for market abuse

Cha

pter

: Evo

lutio

n of

Sur

veilla

nce

Tech

nolo

gy

9

involving multiple correlated asset classes. Today’s surveillance solutions come with integrated capabilities across asset classes, with well developed libraries of extensive detection scenarios specific to asset classes, markets and market participants, and market abuse types.

Table 2: Breadth of Coverage of Surveillance Solutions Is Expanding

VENDOR

COMPONENTS TARGET SEGMENTS ASSET CLASS

Trade Communi

cation Buy Side

Sell Side

Market Infra

EQ

FI

FX

ETD

OTC

D

Com

m

Aquis Technologies

b-next

Behavox

Bloomberg

Digital Reasoning

FIS

Fonetic

IBM

Itiviti

LSE (Millennium IT Pentagon)

LSE (Unavista Transaction Intelligence)

Nasdaq

NICE Actimize

OneMarketData

Scila

SIA S.p.A

TCS

Trillium

Source: Vendors, Celent EQ = equities; FI = fiixed income FX = foreign exchange, ETD = exchange-traded derivatives; OTCD = over the counter derivatives; Comm = commodities. Offering through Digital Reasoning-Nasdaq partnership.

Cha

pter

: Evo

lutio

n of

Sur

veilla

nce

Tech

nolo

gy

10

ANALYTICS Advanced analytics plays a critical role in surveillance. Advanced statistical analytics involving trade and order level structured data has been improving over time, while we are seeing revolution in communication and behavior analytics in recent times.

Many providers have developed extensive communication analytics, especially electronic communication across multiple channels, with some offering the ability to overlay trade and communication data for analysis. In this, they are leveraging natural language processing (NLP) techniques to analyze information embedded in communication and documents. Vendors are now working on voice communication seeking to improve voice-speech detection and analysis capabilities.

Link and network analysis that leverage machine learning are used to identify relationships between events, people, places, and organizations. Such networks and graphs connect a trader with his or her favorite salespersons, locations he or she visits, or the currencies he or she trades.

Many vendors leverage big data technology to integrate information from multiple data sources, such as trading data, electronic communication, and voice recordings, resulting in learning models that are continuously updated. Such systems can learn from anomalies in data by comparing employee behavior with self, population, and affinity groups. Cognitive reasoning is leveraged to correlate the causality of semantic events to predict potential upcoming risk.

These allows capital markets firms to profile traders on their behaviors, such as products they sell the most, communications they have, channels they use, keywords they say, behavioral traits such as whispering, laughing, cursing, counterparties they interact with, etc. Such capabilities also allow user institutions to calculate risk scores from abnormalities in traders’ normal behavior and activities.

Supervised and/or unsupervised learning methods are used to improve system performance and reduce false positives. The set of alerts generated by the systems are prioritized based on their relevance and risk scores, which are then investigated by compliance analysts. Most vendors have developed proprietary case management and necessary workflows for this, while some integrated with third party case management tools. Furthermore, some solutions allow creation of different lists — watchlists, repeat offenders, and high risk traders, as well as whitelists — for more effective and risk-based surveillance, at the same time minimizing false positives.

VISUALIZATION AND REPORTING Information and alerts are delivered through visualization tools, which have also seen great improvements recently. Visualization tools mainly contain information for alert investigation; some vendors also offer visualization tools for operational metrics.

Visualization tools for alert investigation contain information on trades (e.g., top counterparties traded, top products traded), communications (e.g., top/bottom counterparties talked with, communications performed by department), and are typically represented using charts, relationship graph, order book dashboard, 3D chart, statistical summaries, and much more. These are usually applied in real time or for any given time period. These can also be applied on both instruments and market participants. Some vendors offer ability to mix various types of data for example trading, e-coms, voice recordings, news, market events, CRM and HR data, etc., to offer a holistic and granular picture.

Cha

pter

: Evo

lutio

n of

Sur

veilla

nce

Tech

nolo

gy

11

Visualization tools for operational metrics display alert and case statistics (e.g., age, open, closed, escalated), alert history, and analyst and team metrics in tabular as well as through graphs for comparison.

Most vendors offer significant configurability options for business users to create or change their dashboards with necessary visualization tools and audit trail features. Most surveillance solutions come with reporting tools, while others offer integration with business intelligence tools for reporting

TECHNOLOGY Advanced analytics such as artificial intelligence and machine learning require rethinking technology used in surveillance, and vendors are leveraging big data in that regard. Different approaches are being followed by different players for storing, querying, and analyzing large volumes of tick-level trade data and communication data at real or near real time. Some use high-volume storage on a Cassandra cluster, indexing/querying on elastic search cluster, and file storage on a shared file system with paths stored in Cassandra. Some vendors use APIs, streaming analytics for scaling at petabytes with near linear processing capability. Use of open architecture framework for flexible integration, and distributed storage and processing to allow for horizontal scaling, are also features seen among vendors.

Implementation Most vendors offer in-house deployment, hosted or cloud version, as well as hybrid option. Some offer managed service — either first line of surveillance or fully managed surveillance. Some large vendors noted seeing a strong shift toward preference for cloud deployment in recent years mainly due to improved security and low costs, but others think the move to the cloud is still tepid. Some general trends emerge:

• More specifically, high volume low latency trading firms prefer local installations. • Tiers 1 and 2 usually demand on premise for control and customization, while broker-

dealers and retail banks prefer cloud due to cost advantages. • Buy side firms and some midsize sell side firms are more open to the cloud. • Some firms that previously refused cloud solutions are at least considering managed

service solutions.

Choice of deployment model determines time to market; for most vendors on-premise installation takes between three and six months. For large clients (e.g., a major stock exchange) it can be much higher — close to a year — due to higher complexities. Since surveillance solution can be tied to an adjacent function for some providers (e.g., market data, transaction reporting tool), they claim to be able to go live within a week.

PRICING Deployment model is also a determinant for pricing, though there are several other factors involved as well. Different providers offer one or more of the following options:

• One-time implementation fee and a recurring license and support fee, based on complexity of technical infrastructure, coverage of markets/asset classes, and geographical locations.

• Flat fee and monthly/ annual subscription, typically based on number of users, number of traders, and/or message volumes.

• The range of pricing for on-premise installation can vary between US$100,000 and $1 million, though for a typical mid-large bank it is likely to be between US$300,000 and $700,000.

Cha

pter

: Sur

veilla

nce

Vend

or P

rofil

es

12

SURVEILLANCE VENDOR PROFILES

While they all cater to the surveillance functions within capital markets, the solutions discussed in this report have their unique background, DNA, sweet spots, functional and technical attributes, and target segments. This section discusses in detail the different surveillance solutions covered in this report in alphabetical order.

NICE ACTIMIZE Markets Surveillance Solution Suite

Company Background NICE Actimize is an expert provider of financial crime (AML/fraud), compliance, and risk management solutions to the financial services industry. It provides enterprisewide software solutions for financial institutions active in retail and commercial banking, securities and capital markets, insurance, as well as to regulators and governments. The company was founded in 1999 and is headquartered in Hoboken, New Jersey, USA, with over 1,000 professionals spread across offices in Australia, Brazil, China, France, Germany, Hong Kong, India, Israel, Japan, Mexico, Netherlands, Philippines, Singapore, South Africa, Spain, Switzerland, and United Kingdom.

Solution Originally launched in 1999, NICE Actimize’s Markets Surveillance Solution Suite is targeted for use by institutional sell side firms, as well as buy side firms including hedge funds and long-only asset managers. It supports surveillance of trading in all major asset classes including equities, fixed income, FX, futures, options, other exchange-traded and OTC derivatives, swaps, and commodities. The suite of solutions consists of:

• Markets surveillance for analyzing trade and market data to detect market manipulation and insider trading,

• Communications surveillance for analyzing voice and e-communications across all channels and devices.

• Holistic Behavioral Analytics (HBA) for identifying risky entities and individuals in order to uncover conduct related threats. HBA analyzes behavior and patterns over time, and leverages structured and unstructured data including trade and communications data.

Markets Surveillance: The Actimize Markets Surveillance solution includes more than 100 out-of-the box detection scenarios, which are periodically updated as per business and regulatory changes. The full spectrum of detection scenarios are available for a broad range of instruments and asset classes including those traded on Swaps Execution Facilities (SEFs), multilateral Trading Facilities (MTFs), and Organized Trading Facilities (OTFs). It includes algorithms for detecting different types of market abuse (front running, layering, momentum ignition, wash) and insider trading by analyzing structured data. Each algorithm has multiple detection scenarios such as front running of same instrument or between related instruments or including composite product.

NICE Actimize also offers a solution for communication surveillance — for both electronic and voice communication. Combining its trade and communication surveillance capabilities it has developed a trade reconstruction module, which can quickly reconstruct trades by aggregating order and execution level information with relevant communication information through its patented correlation analysis. According to Actimize, it has reduced reconstruction time from two days to eight minutes for a user client.

Cha

pter

: Sur

veilla

nce

Vend

or P

rofil

es

13

Holistic Surveillance: Additionally the Actimize solution has the capability to identify individuals and entities (accounts, trading desk, counterparty) that pose a risk to the firm through its Holistic Behavioral Analytics. HBA creates profiles of an individual’s or entity’s “normal” behavior across multiple risk factors such as changes in method of communication, increases in cancellations, trading outside of normal hours, changes in P&L, and missed trainings. These factors are based on trades, communications, alerts, and other data sources (HR, access log, etc.). Anomaly detection models (statistics and unsupervised machine learning) are used to identify deviations from normal behavior (of individuals or peers). Individuals and entities are assigned a cumulative risk score based on their deviation from normal behavior for each risk factor. Banks can use Actimize’s out-of-the box risk factors and also create firm-specific ones via Actimize’s XML interface. Each firm can set their measurement scale and score value for each risk factor. A heat map highlights the risk score for each individual enabling an analyst to instantly identify suspicious individuals. Behavioral Analytics data is correlated with traditional alerts in the same case manager, providing the analyst with additional context while assessing an alert.

Predictive analytics enables authorized users to provide their feedback and classify or highlight issues. Network analytics can flag internal and external communications, and identify interactions which don’t follow normal communication patterns using unsupervised ML techniques, and anomaly detection models.

Case Management and Reporting: The solution incorporates Risk Case Manager (RCM), a fully integrated, web-based case manager for efficient alert management, ad hoc investigation, and audit trail functionality. RCM delivers scored and filtered alerts to authorized staff, including all relevant alert information, and routs the alerts according to the firm’s procedures, tracking and auditing alerts through resolution along with providing evidence of principal review. Depending on their role and authority level, compliance managers may reassign, escalate, or process alerts from a personalized list or a common queue. RCM’s review features enable users to modify the status and score of alerts, attach notes and other documentation, and determine resolution.

NICE Actimize offers standard management reports as well as ad hoc ones using its Detection and Research Tool (DART); its capabilities include plain language queries, query by example, real-time instant feedback, and one-click query automation. Every query can be shared with other investigators in a single click for easy knowledge sharing across an organization.

Visualization: Actimize Market Visualization (AMV) displays transactions, alerts, and market news overlaid on top of graphical market data. This tool allows users to perform full ad hoc investigations and quickly identify issues and spot anomalies. Firms can also create their own Behavioral Analytics dashboards.

Cha

pter

: Sur

veilla

nce

Vend

or P

rofil

es

14

Figure 2: NICE Actimize Trade Reconstruction Timeline

Source: NICE Actimize

Technology and Pricing Main technology features of the Actimize Surveillance Suite include:

• A powerful profiling engine is heart of HBA which aggregates data, optimizes the data loading process, creates entity profiles, and stores historical profiles. Multidimensional profiles are calculated for entities (account, trader, desk, etc.) on a daily basis.

• A patented correlation engine enables firms to assemble all communications related to a trade, reconstruct the trade allowing analysis of the full lifecycle of an order, understand the intent behind a trade, and address regulatory needs.

• The AMV capabilities support tick-by-tick replay of market spreads and prices, market snapshot, and on-click access to market replay visualization from alert details

• Statistical function and unsupervised machine learning models are used to identify deviations from normal behavior. Natural language processing techniques are used to identify and analyze text in over 23 languages.

• Users can configure the models from the RCM user interface using a list-based module, such as modify and tune tolerances, update and override solution default thresholds / score factors, and add inclusions or exclusions based on the model.

• A Self Development Kit allows firms to leverage the Actimize Framework analytics and extend the out-of-the box coverage to include firm-specific rules. It accelerates rule creation by providing sample rule templates, display widgets, and rule context creator.

• The Market Surveillance solution provides out of box integration with the HBA solution. With a click of the mouse, firms using both Actimize’s on-premises markets surveillance and HBA can view alerts generated by traditional analytics and the behavioral data associated with them together in RCM.

• Actimize’s Hadoop enablement pack provides capabilities to archive data to Hadoop as well as leverage data in Hadoop for its visualization solutions such as DART and Actimize Visual Analytics.

Actimize Market Surveillance is a highly scalable solution, and able to process thousands of transactions per minute; it processes 30–35 million orders per day for its largest client. The solution listens in to operational data streams and only fully processes those

Cha

pter

: Sur

veilla

nce

Vend

or P

rofil

es

15

transactions which impact defined models. The analytical models process the data incrementally for each product by applying the relevant rules. Given a group of products (e.g., IBM stock, EUR, USD, etc.), and a set of detection rules (Wash, Front Running, etc.), the solution will process each product once and apply all the detection rules. After it completes all the detection rules for a given product, it moves on to the next product, thereby optimizing efficiency by requiring that data for a given product be processed only once independent of the number of detection rules being applied.

NICE Actimize supports on premise, cloud, or hybrid mode of deployment; large Tier I banks typically demand the control and customization afforded by an on-premises solution, whereas firms with limited IT resources or that don’t want to make a capital expenditure are more likely to choose a cloud-based solution. Cloud deployments can be up and running in a few weeks, while large on-premises deployments can take a few months or longer. Cloud deployments are priced on an annual subscription basis, while on-premise installations are priced on a flat fee basis (term or perpetual model). NICE Actimize has a range of solutions and price points that are appropriate for small, medium, and large sell and buy side firms.

Clients and Outlook NICE Actimize Market Surveillance Solution is being used by close to 75 financial institutions, with the majority of them from the sell side; these clients are spread across the globe including Australia, Belgium, Canada, Denmark, France, Germany, Japan, Russia, Switzerland, the UK, and the US.

Going forward NICE Actimize plans to enhance the surveillance solutions in a number of ways including expanding regulatory coverage, improving recently launched behavioral analytics based on customer feedback, enhancing holistic visualization capabilities, improving advanced analytics to optimize precision and enable detection of new types of risks, network analytics, and incorporating Big Data support to enable customers to leverage all data in their organization, improve performance, and lower storage costs. Specifically, supervised machine learning models will leverage the users’ feedback to analyze firm data and find similar cases which follow similar trading/communication patterns and weren’t identified by the traditional analytics. Network analytics will build and maintain relationships between different entities (e.g., traders, counterparties, etc.) using communication patterns and other data (e.g., HR data, CRM data, etc.) to uncover changes in trading or communication patterns which may indicate suspicious behavior.

Additionally NICE Actimize will introduce Autonomous Financial Crime Management (AFCM) approach to its surveillance solutions in 2018. This method creates a seamless connection to data from any source at any volume, and quickly turns raw data into intelligence. AFCM offers a unified view of risk through targeted utilization of advanced analytics and robotic process automation and helps in mitigating various types of financial crime-related risks with greater speed and accuracy.

NICE Actimize is one of the leading providers of software solutions for operational risk management with decades of experience in this field. Its single platform for surveillance across all asset classes, lines of business, and regulatory jurisdictions along with an integrated case management is being used by leading banks in the industry, and is regularly improved by NICE Actimize. The new holistic surveillance capabilities combining trade, communication, and various other types of data along with advanced behavioral analytical capabilities are in line with the evolution of surveillance practices at leading financial institutions. Multiple firms are already using the NICE Actimize solution for conducting holistic surveillance, and we expect this trend to see wider adoption going forward.

Cha

pter

: Con

clus

ion

16

CONCLUSION

Drivers Influencing the Future of Surveillance Solutions Regulations such as MAR, MiFID, Dodd-Frank trade reconstruction rules, Solvency II, BCBS239, and SMR provide the biggest impetus for demand for automated surveillance solution, as well as for enhancement of vendor solutions. Beyond regulatory mandates for strengthening surveillance requirements specifically, some of the new regulations are also reshaping market structure and trading behavior in key asset classes, which is also driving the need for sophisticated surveillance solutions.

Furthermore, recent instances of heavy fines due to revelations of market abuse incidents are adding pressure on capital markets firms to act right and act fast in upgrading surveillance operations. Not surprisingly, vendors report seeing demands for new functionalities from their client institutions for sophisticated surveillance capabilities. In addition to new functionalities, financial institutions are demanding improvements in time to market, and cost of ownership of surveillance solutions.

Regulatory and client demands are converging with technology innovation where developments in AI, behaviural analysis, voice and phonetic analysis, and cloud computing are enabling vendors to innovate and add capabilities.

Surveillance Solutions Advancing Through Advanced Analytics Synthesizing the roadmap for several vendor solutions, we see a heavy focus on analytics in general, and leveraging AI and machine learning specifically, for enhancing the solutions across the board. Specific areas of interest include:

• Machine learning using adaptive learning to help optimize the analytics models over time to reduce false positives and negatives.

• Network analytics to automate detection of suspicious entities and activities by identifying relationships and/or patterns across traders, counterparties, and related activities.

• Analysis of unstructured data for analyzing communication data. • Self-learning analytics for alert generation and resolution. • Behavior analysis and anomaly detection in structured (trade, metadata in

communication) and unstructured (behavior, voice) data. • Peer group analysis for benchmarking and detecting anomalies against expected

behavior.

Key Research Question

3

How will capital markets surveillance solutions evolve?

There is a heavy focus on analytics in general, and leveraging AI and machine learning specifically, for enhancing surveillance solutions. Improving cross-

asset class surveillance is another focus area, as is integrating communications with trade surveillance.

Leading vendors are investing in capabilities that will lower the cost of ownership, while some are seeking new applications in adjacent functions.

Cha

pter

: Con

clus

ion

17

• Machine learning for alert scoring, parameter recommendation, system tuning, risk scoring, and segmentation.

Beyond analytics, iimproving cross-asset class surveillance is another focus area for some vendors, especially relating to FX, commodities, fixed Income, and credit and rates.

Enhancing the integration of communications in trade surveillance algorithms is a top priority for some vendors. In this they are looking to leverage extensive archival data to pair trade and communication data for analyzing, tuning, and optimizing their solutions.

Within communication surveillance specifically, two areas that are big focus are real time monitoring of e-communications, and improving audio communication surveillance capabilities with focus on enhance voice-speech recognition and analysis. Leading players are looking to add foreign language surveillance capability.

Vendors are also seeking to enhance visualization and reporting capabilities. For example, holistic visualization enhancements allowing correlating trade and communications data to identify risk patterns and provide a holistic view of risk, increased graphing and dashboard capabilities, and new reporting suite allowing web-based dashboards and PDF-style reports to increase user choice of reporting and improved visualization are some of the specific initiatives in this regard.

Leading vendors are investing in capabilities that will lower the cost of ownership, for example by simplifying upgrades as well as through self-development capabilities. Some are developing applications in adjacent functions, such as in transaction cost analysis and finding best execution opportunities in all nonequity markets, improving client communication and potential for upsell and cross-sell of new products.

Was this report useful to you? Please send any comments, questions, or suggestions for upcoming research topics to info@celent.com.

Cha

pter

: Lev

erag

ing

Cel

ent’s

Exp

ertis

e

18

LEVERAGING CELENT’S EXPERTISE

If you found this report valuable, you might consider engaging with Celent for custom analysis and research. Our collective experience and the knowledge we gained while working on this report can help you streamline the creation, refinement, or execution of your strategies.

SUPPORT FOR FINANCIAL INSTITUTIONS Typical projects we support related to Finance & Risk include:

Vendor short listing and selection. We perform discovery specific to you and your business to better understand your unique needs. We then create and administer a custom RFI to selected vendors to assist you in making rapid and accurate vendor choices.

Business practice evaluations. We spend time evaluating your business processes, particularly in Finance & Risk. Based on our knowledge of the market, we identify potential process or technology constraints and provide clear insights that will help you implement industry best practices.

IT and business strategy creation. We collect perspectives from your executive team, your front line business and IT staff, and your customers. We then analyze your current position, institutional capabilities, and technology against your goals. If necessary, we help you reformulate your technology and business plans to address short-term and long-term needs.

SUPPORT FOR VENDORS We provide services that help you refine your product and service offerings. Examples include:

Product and service strategy evaluation. We help you assess your market position in terms of functionality, technology, and services. Our strategy workshops will help you target the right customers and map your offerings to their needs.

Market messaging and collateral review. Based on our extensive experience with your potential clients, we assess your marketing and sales materials — including your website and any collateral.

Cha

pter

: Rel

ated

Cel

ent R

esea

rch

19

RELATED CELENT RESEARCH

A New Era in Capital Markets Surveillance: As Far as the AI Can See November 2017

Innovation in AML Technology: New Tools for Optimizing Compliance Efficiency December 2017

Innovation in Capital Market FX Technology November 2017

Next Generation of Post-Trade Technology: Evolution to Revolution July 2017

Innovation in Compliance Technology: Emerging Themes and Vendor Solutions June 2017

Rearchitecting the Capital Markets: The Cloud Cometh May 2017

The Cloud Comes of Age in Capital Markets: All Clear for More Cloud December 2016

Treating Cyber-Risk as an Operational Risk: Governance, Framework, Processes, and Technologies October 2016

Artificial Intelligence in KYC-AML: Enabling the next Level of Operational Efficiency August 2016

Emerging Solutions in Anti-Money Laundering Technology May 2015

Cha

pter

: Rel

ated

Cel

ent R

esea

rch

20

Copyright Notice

Prepared by

Celent, a division of Oliver Wyman, Inc.

Copyright © 2018 Celent, a division of Oliver Wyman, Inc., which is a wholly owned subsidiary of Marsh & McLennan Companies [NYSE: MMC]. All rights reserved. This report may not be reproduced, copied or redistributed, in whole or in part, in any form or by any means, without the written permission of Celent, a division of Oliver Wyman (“Celent”) and Celent accepts no liability whatsoever for the actions of third parties in this respect. Celent and any third party content providers whose content is included in this report are the sole copyright owners of the content in this report. Any third party content in this report has been included by Celent with the permission of the relevant content owner. Any use of this report by any third party is strictly prohibited without a license expressly granted by Celent. Any use of third party content included in this report is strictly prohibited without the express permission of the relevant content owner This report is not intended for general circulation, nor is it to be used, reproduced, copied, quoted or distributed by third parties for any purpose other than those that may be set forth herein without the prior written permission of Celent. Neither all nor any part of the contents of this report, or any opinions expressed herein, shall be disseminated to the public through advertising media, public relations, news media, sales media, mail, direct transmittal, or any other public means of communications, without the prior written consent of Celent. Any violation of Celent’s rights in this report will be enforced to the fullest extent of the law, including the pursuit of monetary damages and injunctive relief in the event of any breach of the foregoing restrictions.

This report is not a substitute for tailored professional advice on how a specific financial institution should execute its strategy. This report is not investment advice and should not be relied on for such advice or as a substitute for consultation with professional accountants, tax, legal or financial advisers. Celent has made every effort to use reliable, up-to-date and comprehensive information and analysis, but all information is provided without warranty of any kind, express or implied. Information furnished by others, upon which all or portions of this report are based, is believed to be reliable but has not been verified, and no warranty is given as to the accuracy of such information. Public information and industry and statistical data, are from sources we deem to be reliable; however, we make no representation as to the accuracy or completeness of such information and have accepted the information without further verification.

Celent disclaims any responsibility to update the information or conclusions in this report. Celent accepts no liability for any loss arising from any action taken or refrained from as a result of information contained in this report or any reports or sources of information referred to herein, or for any consequential, special or similar damages even if advised of the possibility of such damages.

There are no third party beneficiaries with respect to this report, and we accept no liability to any third party. The opinions expressed herein are valid only for the purpose stated herein and as of the date of this report.

No responsibility is taken for changes in market conditions or laws or regulations and no obligation is assumed to revise this report to reflect changes, events or conditions, which occur subsequent to the date hereof.

For more information please contact info@celent.com or:

Arin Ray aray@celent.com Brad Bailey bbailey@celent.com AMERICAS EUROPE ASIA

USA

200 Clarendon Street, 12th Floor Boston, MA 02116

Tel.: +1.617.262.3120 Fax: +1.617.262.3121

France

28, avenue Victor Hugo Paris Cedex 16 75783

Tel.: +33.1.73.04.46.20 Fax: +33.1.45.02.30.01

Japan

The Imperial Hotel Tower, 13th Floor 1-1-1 Uchisaiwai-cho Chiyoda-ku, Tokyo 100-0011

Tel: +81.3.3500.3023 Fax: +81.3.3500.3059

USA

1166 Avenue of the Americas New York, NY 10036

Tel.: +1.212.541.8100 Fax: +1.212.541.8957

United Kingdom

55 Baker Street London W1U 8EW

Tel.: +44.20.7333.8333 Fax: +44.20.7333.8334

China

Beijing Kerry Centre South Tower, 15th Floor 1 Guanghua Road Chaoyang, Beijing 100022

Tel: +86.10.8520.0350 Fax: +86.10.8520.0349

USA

Four Embarcadero Center, Suite 1100 San Francisco, CA 94111

Tel.: +1.415.743.7900 Fax: +1.415.743.7950

Italy

Galleria San Babila 4B Milan 20122

Tel.: +39.02.305.771 Fax: +39.02.303.040.44

Singapore

8 Marina View #09-07 Asia Square Tower 1 Singapore 018960

Tel.: +65.9168.3998 Fax: +65.6327.5406

Brazil

Av. Doutor Chucri Zaidan, 920 – 4º andar Market Place Tower I São Paulo SP 04578-903

Tel.: +55.11.5501.1100 Fax: +55.11.5501.1110

Canada

1981 McGill College Avenue Montréal, Québec H3A 3T5

Tel.: +1.514.499.0461

Spain

Paseo de la Castellana 216 Pl. 13 Madrid 28046

Tel.: +34.91.531.79.00 Fax: +34.91.531.79.09

Switzerland

Tessinerplatz 5 Zurich 8027

Tel.: +41.44.5533.333

South Korea

Youngpoong Building, 22nd Floor 33 Seorin-dong, Jongno-gu Seoul 110-752 Tel.: +82.10.3019.1417 Fax: +82.2.399.5534