Market Watch 86

Under UK MAR, a firm must submit a STOR without delay where it has a reasonable suspicion of market abuse. Firms do not need to find proof that market abuse has taken place before submitting a STOR.

Several firms applied a threshold for reasonable suspicion that was too high. This was often due to weaknesses in their procedures, alert review processes and training.  

For example, some firms’ procedures directed analysts not to escalate potentially suspicious activity where they could not identify evidence of a clear link between a client and the issuer of the securities. This was the case even in the presence of other factors that could indicate suspicion (aggravating factors).  

Some firms’ procedures steered analysts to find reasons to close an alert, rather than consider all available information, weighing aggravating and mitigating factors, and considering their significance.

These weaknesses increased the risk that potentially suspicious activity would not be assessed consistently or escalated and reported where appropriate.

Firms with well-documented policies and procedures for reviewing and escalating alerts typically showed more consistent alert triage and decision-making. These included factors to consider during investigations and how to assess whether there were reasonable grounds for suspicion. They also defined roles and responsibilities throughout the process, from alert triage through to STOR submission. Additionally, they were supported by formalised analyst training to ensure procedures were understood and followed.

Effective surveillance needs alert models to be calibrated with consideration of the firm’s business model and risk profile. This includes the nature of its client base, the financial instruments it trades, and relevant market abuse risks.  

We identified several cases where alert calibrations were not suitably tailored to the firm’s business, creating a risk that suspicious activity might not be identified.

For example, some firms used a flat price move threshold in their insider dealing alerting without considering if this was appropriate for stocks with different price volatility, such as large cap versus small cap. Others applied a minimum notional trade value parameter that was set too high, resulting in a significant proportion of client trading activity being excluded from monitoring.  

Firms need to understand how their surveillance systems operate. This includes alert logic, how alerts are calibrated and the circumstances in which alerts are expected to trigger. We found examples where individuals responsible for surveillance could not adequately explain how their systems worked. Some appeared to rely on out-of-the-box settings provided by third-party vendors. This increased the risk that weaknesses in surveillance arrangements would not be identified or challenged.

Alert calibration testing is vital for effective surveillance and provides assurance that alerts are being generated as expected. While most firms undertook some form of testing, it was often limited. For example, some firms relied on simple testing metrics such as comparing alert volumes to trading volumes or using historical trading data alone to check alert outputs. These firms failed to identify instances where alerts were not triggering as expected.  

Firms should ensure that calibration testing provides assurance that alerts are operating effectively and identifying potentially suspicious activity. Good practice included testing alerts at different thresholds through ‘above’ and ‘below the line’ testing, to evaluate whether alert parameters were calibrated appropriately. Other approaches included using synthetic trade data to test whether alerts would trigger as expected in specific market abuse scenarios, providing additional assurance surveillance controls were operating effectively.

It is important to periodically review alert parameters and logic to ensure they remain effective.

Weak governance and oversight arrangements contributed to several of the issues discussed. These included poor alert calibration and incorrect and inconsistent decision-making during investigations. Effective governance requires senior management having sufficient oversight of surveillance activities to be able to challenge whether arrangements are effective and the firm is meeting its regulatory obligations.

Some senior managers responsible for overseeing surveillance had limited understanding of key surveillance activities such as alert triage, investigations, escalation processes and alert calibration. There were also examples where surveillance responsibilities were split across different functions without one individual having oversight of end-to-end activities. In some cases, senior managers were unaware of issues identified by surveillance teams and failed to ensure they were promptly resolved.

Quality Assurance (QA) provides comfort that alerts, escalation decisions and STOR submissions are reviewed consistently and effectively, helping firms identify errors and maintain high-quality reporting. We observed significant differences in how firms approached QA, ranging from comprehensive reviews to limited or no formal QA.  

Firms with QA processes that provided oversight of analyst work and decision-making throughout the alert review and escalation process were able to identify trends in analysts’ alert escalation decisions and errors. This highlighted where additional guidance or training may be required.

We have previously discussed the benefits of a suitably granular MARA to identify all relevant market abuse risks, implement appropriate controls and ensure effective surveillance coverage.  

We observed instances where firms had not considered all relevant characteristics of their business model, such as the nature of its client base and financial instruments they trade. For example, some firms had not differentiated between institutional and retail clients.  

Some firms mistakenly assumed that having an alert in place was evidence of an effective control, capable of mitigating risk. Firms that assessed control effectiveness using information such as QA findings, STOR submissions, and alert and calibration reviews were better placed to identify weaknesses in their controls and areas requiring enhancement.  

There was significant variance in how firms made use of their MARAs. Firms derived the greatest value where they were utilised to identify gaps in surveillance coverage and control effectiveness. They also used their MARAs to inform remediation priorities and drive enhancements.