Embed Size (px)
Citation preview
The Seven Pillars of Market Surveillance 2.0
SURVEILLANCE TOTAL
A combina*on of monitoring and surveillance, involving both data and human
behaviour across mul*ple asset classes and geographies,
helps firms detect early warning signs and an*cipate – or even avoid – anomalous behaviours in the future
SURVEILLANCE TOTAL
A combina*on of monitoring and surveillance, involving both data and human
behaviour across mul*ple asset classes and geographies,
helps firms detect early warning signs and an*cipate – or even avoid – anomalous behaviours in the future
With the growth of headline grabbing scandals…
It’s *me to get SERIOUS
about surveillance
SURVEILLANCE TOTAL
A combina*on of monitoring and surveillance, involving both data and human
behaviour across mul*ple asset classes and geographies,
helps firms detect early warning signs and an*cipate – or even avoid – anomalous behaviours in the future
With the growth of headline grabbing scandals…
It’s *me to get SERIOUS
about surveillance
There are seven key ingredients required to achieve the next genera*on of total
surveillance; or the Seven Pillars of Market
Surveillance 2.0
SURVEILLANCE TOTAL
TOTAL
PILLAR #1 SURVEILLANCE
TOTAL
A single, CONVERGED threat system
Seamlessly monitor across the en*re enterprise, including:
• Market Surveillance • Opera*onal Risk • Market Risk • Trader Profiling
PILLAR #1 SURVEILLANCE
TOTAL
A single, CONVERGED threat system
Seamlessly monitor across the en*re enterprise, including:
• Market Surveillance • Opera*onal Risk • Market Risk • Trader Profiling
PILLAR #1 SURVEILLANCE
1. Comes with sufficient performance at scale to monitor very large volumes of streaming analy*cs, both pre-‐ and post-‐ trade
2. Is open and flexible enough to enable organiza*ons to tailor the monitoring based upon their unique and evolving requirements
3. Is seamlessly pre-‐integrated with… a) Complementary technologies such as enterprise grade integra*on b) Ultra-‐low latency messaging, in-‐memory data management c) Real-‐*me data visualiza*on
… All the raw tools needed to break down monolithic silos.
Prerequisites for SUCCESS
TOTAL
PILLAR #1 SURVEILLANCE
Converge siloed systems such as an*-‐money laundering, opera*onal risk, and trader profiling into a single, monitoring system for a correlated view of all poten*al threats.
TOTAL SURVEILLANCE: PILLAR #2
Past, Present & PredicNve ANALYSIS
TOTAL SURVEILLANCE: PILLAR #2
Past, Present & PredicNve ANALYSIS
Performing analysis on historical data, real-‐*me data, plus predic*ng and warning of threats before they occur or do damage
TOTAL SURVEILLANCE: PILLAR #2
An out of control algo can – and has – bankrupted a trading firm
Past, Present & PredicNve ANALYSIS
Performing analysis on historical data, real-‐*me data, plus predic*ng and warning of threats before they occur or do damage
Analyzing the ‘fire hose’ of market, trade, and social media data to prevent fraud and market manipula*on, using large structured and unstructured data sets
TOTAL
PILLAR #3 SURVEILLANCE
Support for fast, Big Data
Analyzing the ‘fire hose’ of market, trade, and social media data to prevent fraud and market manipula*on, using large structured and unstructured data sets
TOTAL
PILLAR #3 SURVEILLANCE
Support for fast, Big Data
By connec*ng to disparate sources of trading rela*onship informa*on (i.e., IMs, chat rooms, emails, mobile phones, video and audio surveillance) -‐ trader behaviour can be surmised… • Was the trader working unusual hours? • Did she never take a vaca*on? • Did he buy a fishery together with another
FX trader, who happens to be his banks’ client?
Analyzing the ‘fire hose’ of market, trade, and social media data to prevent fraud and market manipula*on, using large structured and unstructured data sets
TOTAL
PILLAR #3 SURVEILLANCE
Support for fast, Big Data
By Including data from social media, email and chat rooms, the tangled web that fraudsters weave becomes more predictable when management can watch the threads crea*ng the web. Fast, Big Data comprises these threads of anomalous human behaviour; Market Surveillance 2.0 grabs and analyses the threads, then creates ac*ons…
TOTAL
PILLAR #4 SURVEILLANCE
Cross-‐asset class monitoring
Monitoring across trading silos for mul*-‐asset
surveillance and across correlated asset classes…
TOTAL
PILLAR #4 SURVEILLANCE
Why do we care? Because events that impact one asset class can and do have a knock-‐on effect on others. EXAMPLE: Between 2007 and 2012, the price of oil was highly correlated to the stock market. On May 5, 2011, the crude oil market experienced its second-‐largest daily drop ever when trading algos repeatedly triggered sell-‐stops. The $13 drop in the price of Brent crude knocked the Dow Jones Industrial Average down by 140 points, or 1.1%. It could have been worse if the oil algos had not been caught and stopped in *me. Today’s markets are becoming more complicated and sophis*cated by the day. Humans simply cannot monitor and react to mul*-‐asset classes at the same *me, while trading at lightning speed.
Cross-‐asset class monitoring
Monitoring across trading silos for mul*-‐asset
surveillance and across correlated asset classes…
TOTAL
PILLAR #4 SURVEILLANCE
…watching for paferns that signal risk or
opportunity, then kicking out real ac*ons to take
Cross-‐asset class monitoring
Monitoring across trading silos for mul*-‐asset
surveillance and across correlated asset classes…
TOTAL
PILLAR #5 SURVEILLANCE
Cross Region Monitoring
Monitoring for risks across geographical and regulatory boundaries and differences…
TOTAL
PILLAR #5 SURVEILLANCE
Cross Region Monitoring
Monitoring for risks across geographical and regulatory boundaries and differences…
Cross border surveillance becomes increasingly cri*cal as financial services firms and investors trade mul*ple asset classes across many countries and disparate regulatory regimes, which can cause confusion and create opportuni*es for error. Regula*ons in different countries (e.g. Dodd-‐Frank vs. MiFID) have similari*es and differences. Regulatory arbitrage is a concern, as trading firms could choose to do business with more lightly regulated regimes; taking extra risks with their company’s and shareholders’ money and reputa*on.
TOTAL
PILLAR #5 SURVEILLANCE
Cross Region Monitoring
Monitoring for risks across geographical and regulatory boundaries and differences…
Cross border surveillance becomes increasingly cri*cal as financial services firms and investors trade mul*ple asset classes across many countries and disparate regulatory regimes, which can cause confusion and create opportuni*es for error. Regula*ons in different countries (e.g. Dodd-‐Frank vs. MiFID) have similari*es and differences. Regulatory arbitrage is a concern, as trading firms could choose to do business with more lightly regulated regimes; taking extra risks with their company’s and shareholders’ money and reputa*on.
…to assure adherence to different regulatory
environments
TOTAL
PILLAR #6 SURVEILLANCE
Known & Unknown Threats
Benchmarking behavior and performance to uncover
previously unknown paferns
TOTAL
PILLAR #6 SURVEILLANCE
Known & Unknown Threats
Benchmarking behavior and performance to uncover
previously unknown paferns
Monitoring for ‘unknowns’ can be achieved by benchmarking behavior that is “normal” over *me and then spoing behavior that deviates from the norm. To spot suspicious behavior could involve digitally monitoring loca*ons and in-‐person interac*ons of traders… their speech and facial expressions, for example
TOTAL
PILLAR #6 SURVEILLANCE
Known & Unknown Threats
Benchmarking behavior and performance to uncover
previously unknown paferns
Monitoring for ‘unknowns’ can be achieved by benchmarking behavior that is “normal” over *me and then spoing behavior that deviates from the norm. To spot suspicious behavior could involve digitally monitoring loca*ons and in-‐person interac*ons of traders… their speech and facial expressions, for example
Cyber-‐terrorism is on the upswing and algorithmic
terrorism, where a well-‐funded criminal or terrorist organiza*on
causes a major market crisis, could be the next itera*on. Only by keeping a close watch on the
markets and the par*cipants involved can these unwanted
behaviors be nipped in the bud
TOTAL
PILLAR #6 SURVEILLANCE
Known & Unknown Threats
Benchmarking behavior and performance to uncover
previously unknown paferns
Monitoring for ‘unknowns’ can be achieved by benchmarking behavior that is “normal” over *me and then spoing behavior that deviates from the norm. To spot suspicious behavior could involve digitally monitoring loca*ons and in-‐person interac*ons of traders… their speech and facial expressions, for example
Monitor for ‘unknown unknowns’, by benchmarking behaviour that is ‘normal’ over *me and spoing behaviour that
deviates from the norm Cyber-‐terrorism is on the upswing and algorithmic
terrorism, where a well-‐funded criminal or terrorist organiza*on
causes a major market crisis, could be the next itera*on. Only by keeping a close watch on the
markets and the par*cipants involved can these unwanted
behaviors be nipped in the bud
TOTAL
PILLAR #7 SURVEILLANCE
Dynamically Evolve Rules
Be ready for the next threat. Control your own surveillance and con*nually adapt your
monitoring
TOTAL
PILLAR #7 SURVEILLANCE
Dynamically Evolve Rules
Be ready for the next threat. Control your own surveillance and con*nually adapt your
monitoring
Once a new unknown behavior is found, it needs to become a ‘known behavior’ and a new rule must be added to the system. It is cri*cal to be able to add new rules dynamically rather than relying on a “shrink-‐wrapped applica*ons” that do not provide this level of flexibility…
TOTAL
PILLAR #7 SURVEILLANCE
Dynamically Evolve Rules
Be ready for the next threat. Control your own surveillance and con*nually adapt your
monitoring
…Since the next episode of an ‘known behavior’ could occur at any *me; it would be complacent to think that because one has been discovered, it won’t happen again.
Once a new unknown behavior is found, it needs to become a ‘known behavior’ and a new rule must be added to the system. It is cri*cal to be able to add new rules dynamically rather than relying on a “shrink-‐wrapped applica*ons” that do not provide this level of flexibility…
TOTAL
PILLAR #7 SURVEILLANCE
Dynamically Evolve Rules
Be ready for the next threat. Control your own surveillance and con*nually adapt your
monitoring
Turn a new unknown behaviour into a known behaviour by dynamically adding new rules to the system
…Since the next episode of an ‘known behavior’ could occur at any *me; it would be complacent to think that because one has been discovered, it won’t happen again.
Once a new unknown behavior is found, it needs to become a ‘known behavior’ and a new rule must be added to the system. It is cri*cal to be able to add new rules dynamically rather than relying on a “shrink-‐wrapped applica*ons” that do not provide this level of flexibility…
The Seven Pillars of Market Surveillance 2.0 1. Converge siloed systems into
a single monitoring system for a correlated view of poten*al threats.
2. Perform “con*nuous analy*cs” to predict what might happen – and prevent it.
3. Check social media, email and chat rooms for anomalous behaviour
4. Monitor all asset classes
5. Assure adherence to regional regulatory
environments
6. Benchmarking “normal” behaviour to spot deviant
behaviour
7. Dynamically add newly discovered “unknown”
behaviour to the system
MEET THE AUTHOR
Theo Hildyard Theo Hildyard is Head of Solu*ons Marke*ng at Solware AG. This team harnesses Solware AG technology to deliver business solu*ons focused on turning big (and streaming) data into meaningful insights for automated decision-‐making. Solu*ons include Algorithmic Trading, FX eCommerce, Market Surveillance, Customer Experience Management, and Con*nuous Monitoring for Governance Risk & Control (iGRC) Get the comprehensive
Total Surveillance White paper
