If you are a surveillance or compliance officer, regardless of what sector you work in, you often see yourself as the referee at a sports match. You essentially represent the chief expert in the laws of the game – and it’s your responsibility to ’wave the yellow card’ when a player breaks these rules.

With the World Cup now in full swing, not only are the referees front and centre of the action being broadcast to billions worldwide, so is the surveillance technology they’re using. Called the Video Assistant Referee (VAR), the technology is being used to aid referees by alerts in catching any rule breaking that may have been missed by the referee. In addition, this allows any offender to be removed from the game anytime during the match itself. In other words, so-called real-time monitoring and disciplinary action.

As both avid football fans and surveillance officers, this honestly doesn’t get any more exciting for us – even more so, since we too are also now using machine learning for surveilling our Nordic markets across four countries.

Looking at the evolution of trading over the past 10 years, it is evident there has been a massive shift in how trading is conducted. It is faster, the order-to-trade ratio has increased significantly (i.e. ratio of total volume of all posted orders to the number of orders filled), and the average trade size has decreased.

Consequently, the amount of data that needs to be assessed when monitoring the markets is far larger than it was ten years ago. The analysis when investigating abnormal trading activity is more complex and requires more time from surveillance teams, investment firms, buy-side firms, exchanges and regulators, in their constant battle in identifying anomalies and separating true positives from a larger pools of false positives. In other words, separating the wheat (the good trades) from the chaff (the potentially rule-breaking trades). The need for surveillance tools that increase the quality and efficiency of the workflow has never been greater.

When you’re a surveillance officer, you are often faced with incredibly high volumes of trading and volatile market conditions. So it is extremely important surveillance teams are able to prioritise their work and extract trading activity that needs immediate attention (e.g. trading incidents such as fat finger mistakes and potential leakage of inside information). This can involve days where you have macroeconomic events effecting the whole market as such. Having a machine indicating what activity stands out in a market wide movement, provides you the opportunity to react faster on trading incidents and a tool to identify abusive patterns in a more precise manner.  

When we deployed machine learning algorithms into the surveillance software we operate, this was based off of the assessment of historical alerts created manually by our surveillance analysts. The new algorithms then leveraged these alerts and matched them with a set of factors that prevailed when the alerts were triggered. Depending on what the algorithm can deduct from historical alert handling, a predictive model was constructed – where the algorithm scores the likelihood of incoming alerts being true positives. The alert scoring is currently used within several different areas.

Prioritising alerts in hectic periods

The machine learning enabled alert scoring provides crucial support when it is most needed. The approach allows the Surveillance teams to spend their time more efficiently, and handle time critical matters with higher quality, in a swift manner. The opening of the market, or situations with increased market wide volatility, are examples of moments which have a higher likelihood of triggering a large amount of alerts, and consequently a larger number of false positives. There is a higher risk the activity that needs immediate attention will take longer to identify. The use of the machine learning alert scoring, to help prioritise a certain alert over another, allows the Surveillance teams to keep the required level of efficiency even if the ”noise” increases.    

Alert handling quality controls

In our ongoing work to improve the quality of alert assessment, and the ability to identify abusive trading patterns, it is imperative we review and control our own work. Alert scoring with machine learning can assist in identifying situations where there are deviations between the outcome of an analyst’s investigation and the predicted score. This is a useful supplement for managers in the quality assurance process, as the outliers from how certain situations have been handled during investigations are good indications of areas that potentially need improvement and more focus. 

Evaluating current alert logic

As market structure changes, trading behaviour evolves, and this creates a challenge for surveillance teams to identify alerts where the logic is insufficient, outdated or not predictive. This is indicated by cases where both the surveillance analysts and predicted alert score is continually low. This allows the teams to develop an alert portfolio that is more efficient, with more high quality alerts, and provides a tool to ensure future quality of the alert portfolio.

All the three areas above drive us toward developing algorithms which are more precise, and to find new ways and opportunities to enhance our efficiency and capability to combat market abuse.

The introduction of machine learning has also driven process improvement. Increasing the precision of the alerts scoring, implies the processes and procedures for alert handling have to be clear and robust. Furthermore, this leads to a higher level of consistency in the outcome of similar events handled by different Surveillance team members and consequently leads to the alert scoring algorithms being able to predict true positives more effectively.

A natural next step from this initiative will be to leverage the accrued knowledge from alert scoring to help diagnose parameter and logic improvements – automatically suggested via machine learning techniques.

The amount of data that needs to be assessed when monitoring the markets is far larger than before, and abusive practices are getting more complex, requiring more time from the Surveillance teams to analyse. We are working towards the introduction of new styles of alert which leverage statistical and machine learning techniques to identify manipulative behaviour with more ‘fuzzy’ constraints. Ultimately, this approach will aid us in the discovery of new patterns of sophisticated market abuse and make the game of markets safer, stronger and better.

Andreas Gustafsson is General Counsel of Europe, Nasdaq

Jimmy Kvarnström is Deputy General Counsel of Europe, Nasdaq

Eldin Kozica is Acting Head of Trade Surveillance, Nasdaq Nordic