Skip to content
Cadre
Agent packs

Markets · Agent pack

New pack

Trade surveillance monitoring

Cadre pack · Lookout

Applies named surveillance rules and raises episodes that warrant deeper review.

Demonstrated on representative cases. Source coverage, thresholds, policy interpretation, escalation design, and performance require institution-specific validation.

Operating dossier

The job, permitted decisions, and owner

Mandate

Examines one supplied account-and-symbol window with deterministic detectors for spoofing, layering, wash trading, marking the close, and insider timing, then records whether the evidence warrants an alert.

Case arrives with
Window · Account · Window · Symbol · Window · From · Window · To
Allowed outcomes
Monitor · Open Case · Refer To Tribunal
Where it fits
Trade Surveillance
Decision logic
  1. 01Examines a supplied window of an account's orders and trades with defined detection rules, then records whether the evidence warrants an alert.
  2. 02Assesses the named manipulation typologies — spoofing, layering, wash trades, marking the close, trading ahead of news — using recorded measures rather than an unsupported impression.
  3. 03Treats alert quality as part of the job: representative clean and legitimate-but-noisy windows should remain unalerted, with the reason recorded.
  4. 04Evaluation cases include legitimate look-alikes — a parent order worked in mostly filled slices, two-way volatility, and trading before immaterial news — so those facts alone do not establish misconduct.
  5. 05Evidence is id-level or it is not evidence; patterns that look real but are contestable go to adversarial adjudication rather than a unilateral verdict.
Must not
Invent missing evidence or act outside the permitted outcomes.
Human owner
Ambiguous episodes and investigation ownership
Evidence retained
Structured outcome, observed path, and the source evidence used.

Case and record

One case, from supplied evidence to recorded decision

Supplied case

Representative case dataSynthetic or simulated data
Window · Account
ACC-CLEAN
Window · Symbol
FLUX
Window · From
1,782,147,540,000
Window · To
1,782,148,500,000
View the case data

Case key clean-volatility

{
  "window": {
    "account": "ACC-CLEAN",
    "symbol": "FLUX",
    "from": 1782147540000,
    "to": 1782148500000
  }
}

Evaluation and limits

Evaluation coverage and stopping points

Published evaluation map

Expected decisions, boundaries, and costly failure modes.

These cases show what the pack is asked to decide, when it should stop, and which plausible errors the evaluation is meant to expose. They are not a reliability score or independent validation.

Expected and borderline behavior

Routine judgments, close calls, and named stopping points.

  • FLUX two-way volatility, both sides fill, no self-match, no close burst, no news edge

    no alert.

    Case key

    clean-volatility
  • ACME layered non-bona-fide sells cancelled near the touch, high order-to-trade ratio, small genuine buy fills

    spoofing.

    Case key

    spoofing
  • Same ACME footprint assessed as layering

    cancelled sells stacked across multiple price levels on one side.

    Case key

    layering
  • ORBT concentrated buy ~6 minutes before a material FDA-approval headline, unwound after the pop

    insider timing.

    Case key

    insider-timing

Boundary and misuse cases

Plausible inputs that could produce a costly or overconfident decision.

  • VOLT genuine large parent order worked in child slices that mostly fill, one repriced cancel away from the touch, low order-to-trade ratio. Superficially resembles layering; must NOT false-alert.

    Case key

    noisy-but-legit

Operating fit

Workflow placement and validation

Operating pattern

Monitor broadly, investigate selectively

Use broad monitoring to find episodes that merit attention, then reserve deep investigation for the ones that meet clear criteria.

Decision sequence and workflow placement
  1. 01Observe the stream
  2. 02Run named checks
  3. 03Assemble an episode
  4. 04Apply escalation criteria
  5. 05Hand off supporting evidence

Wider workflows

Trade Surveillance·Surveillance monitoring
Pattern guide

Institution-specific validation

These questions remain open until the pack is fitted to an institution.

Validation questions
  • Policy and legal interpretation
  • Source coverage, quality, and freshness
  • Thresholds and exception calibration
  • Integration and degraded-mode behavior
  • Human approval and escalation design
  • Performance on the institution’s own case mix
Inputs, actions, and outcomes
Give it
  • Window · Account
  • Window · Symbol
  • Window · From
  • Window · To
It does
  • Get ordersget_orders
  • Get executionsget_executions
  • Get bookget_book
  • Get printsget_prints
  • Get news windowsget_news_windows
  • Signal spoofingsignal_spoofing
  • Signal layeringsignal_layering
  • Signal washsignal_wash
  • Signal marking closesignal_marking_close
  • Signal insider timingsignal_insider_timing
  • Raise alertcommitraise_alert
It returns · Action
  • Monitor
  • Open Case
  • Refer To Tribunal
Related packs

Related packs

Market-surveillance adjudication

Also in Trade Surveillance · Tribunal