The Market Watcher: AI in Financial Surveillance

Financial-market surveillance is not a single anomaly detector. It is an evidence system that must connect orders, executions, cancellations, positions, communications, reference data, employee access, news, and the changing state of a market. AI can make that system faster and more sensitive, but it can also produce a larger, less explainable alert queue. The useful question in 2026 is therefore not “Can a model spot unusual activity?” It is “Can a supervised process turn a weak signal into a reproducible case without losing market context?”

The regulatory baseline remains firm. In the United States, the SEC’s Market Access Rule FAQ says automated errors can compound rapidly, risk controls must operate before order entry, and a broker-dealer remains responsible when third-party technology is involved. FINRA’s 2026 Regulatory Oversight Report highlights manipulative trading, generative AI, the Consolidated Audit Trail, and market-access controls. These are jurisdiction-specific sources, not universal legal advice, but they express a durable operating principle: automation does not transfer accountability.

What AI changes—and what it does not

Traditional surveillance uses rules such as order-to-trade ratios, price or volume moves, cancel timing, account relationships, and watch-list matches. Those rules are valuable because investigators can explain them, but each rule sees only a narrow slice of behavior. Machine learning can add three capabilities:

Sequence analysis: compare the order of events, not just isolated values. A model can distinguish normal liquidity provision from repeated layering-like sequences around price moves.
Entity and graph analysis: connect accounts, devices, employees, issuers, counterparties, and communications that would otherwise sit in separate systems.
Contextual triage: summarize why an alert fired, retrieve relevant policies, cluster related alerts, and rank cases by expected harm and evidence completeness.

None of these capabilities determines intent. A pattern resembling spoofing may be a faulty algorithm, a legitimate strategy under unusual volatility, or manipulation. A communications model can identify coded language or a sudden shift in tone, but it cannot infer misconduct safely without trade, role, policy, and temporal context. AI should produce a reviewable hypothesis, not a verdict.

The BIS working paper on AI for monitoring financial markets illustrates the distinction. Its research system learns from more than 100 daily indicators, forecasts deviations in euro-yen triangular arbitrage, and uses variable importance to guide an LLM-based news search. The authors report out-of-sample case studies for 2021–2024, including the March 2023 banking strains. It is a research prototype and the authors’ view, not a regulatory requirement or proof that the same method generalizes to firm-level abuse surveillance.

The mechanism: from event stream to evidence bundle

A defensible architecture separates detection, enrichment, decision support, and case disposition.

First, normalize the event stream. Every order and execution needs stable identifiers, synchronized timestamps, venue and instrument mappings, lifecycle state, trader or algorithm ownership, and a record of amendments. Communications need participant, channel, retention class, language, and access metadata. Late, duplicated, or incorrectly joined events can look like misconduct.

Second, compute transparent features. Examples include distance from the touch, cancel latency, participation rate, realized price impact, marking-the-close windows, concentration by account family, and communication proximity to a trade. Store the feature values and calculation version used for every alert.

Third, run several detectors. Rules catch known typologies; sequence or graph models find variants; peer-group models expose behavior unusual for a comparable desk, instrument, or market regime. Agreement among independent signals can raise priority. Disagreement is also useful: it may reveal a data or threshold problem.

Fourth, enrich without rewriting history. Add public news, corporate actions, volatility regime, relevant policy, account relationships, and prior reviewed cases. Preserve the original event data and retrieval results. A generated summary must cite the underlying records rather than become the evidence itself.

Finally, route the case. A human investigator confirms or rejects the hypothesis, records rationale, requests information, and escalates when required. Disposition labels feed controlled evaluation, not automatic online learning. This mirrors the evidence discipline described in our guide to evidence-first AI automation.

Scenario: a suspected layering pattern during a volatile open

Imagine a surveillance system flags an account that repeatedly places large sell orders away from the best offer, cancels them, and buys on the opposite side as the price rises. A simplistic model ranks it as high-risk. A credible workflow asks a sequence of harder questions.

Was the account running a registered market-making strategy? Were the cancellations responses to a rapidly moving quote? Did the displayed size materially alter the order book? Were the buys economically connected to the displayed sells? Did the same sequence recur across days or linked accounts? Did a system incident affect cancel messages? Were there communications indicating intent? Did other market participants behave similarly during the same volatility window?

The case screen should show an event timeline, book-state snapshots, feature calculations, related accounts, communications hits, data-quality warnings, and the exact model and rule versions. The investigator should be able to replay the sequence without asking a data scientist to reconstruct it.

If the system only generates a persuasive paragraph, it has failed. The paragraph may accelerate orientation, but the durable product is the linked evidence bundle and the documented decision. For the same reason, alerts should integrate with AI data-quality observability: a feed gap, clock drift, or mapping change must reduce confidence before investigators spend time on it.

A practical implementation framework

Start with one abuse typology and one business line, then make the operating contract explicit.

1. Define the surveillance obligation

Map the applicable laws, venue rules, internal policies, products, customers, and jurisdictions. Define what the system detects, what remains covered by existing controls, who reviews alerts, and what evidence must be retained. Do not copy a typology from another market without validating market structure.

2. Establish a data contract

For every field, name the system of record, owner, expected latency, completeness threshold, permitted use, and retention period. Test clock synchronization, lifecycle reconstruction, employee and account mappings, and corporate-action adjustments. A detector should fail closed or visibly degrade when critical inputs are absent.

3. Build a labeled review set

Use adjudicated historical cases, synthetic edge cases, and normal activity from multiple regimes. Separate “alert was worth reviewing” from “misconduct confirmed.” Include difficult negatives such as market making, hedging, corrections, auctions, outages, and news-driven volatility.

4. Evaluate the whole queue

Precision and recall are not enough. Measure alert volume by desk and product, concentration among entities, median investigation time, evidence completeness, duplicate rate, data-failure rate, and outcome consistency between reviewers. Compare against the current control in shadow mode.

5. Constrain generative features

Retrieval should be limited to approved sources. Generated case narratives must include record-level citations and clear uncertainty. Do not allow a language model to change risk scores, close cases, contact a customer, submit a regulatory report, or alter retention data without authorized workflow controls.

6. Govern changes

Threshold, feature, model, prompt, and data-source changes need versioning, testing, approval, rollback, and an effective date. Maintain an inventory of vendor dependencies. FINRA’s Market Access Rule section emphasizes documented annual effectiveness reviews and holistic post-trade surveillance across systems; that is a useful control-design reference even when a deployment is outside its direct scope.

Risks that deserve explicit controls

False positives and automation bias: A high score can anchor an investigator. Hide neither the model’s uncertainty nor the base rate, and require independent reasoning in disposition notes.

Blind spots: Models learn the reviewed past. New instruments, venues, tactics, or market regimes can move outside that distribution. Combine adaptive analysis with rules, threat intelligence, and periodic typology workshops.

Data leakage and privilege: Communications and employee data are sensitive. Enforce purpose limitation, role-based access, jurisdictional retention rules, redaction, and access logs. Separate legal privilege and restricted matters.

Adversarial behavior: Traders may probe visible thresholds or spread activity across accounts and venues. Rotate some review samples, evaluate graph and temporal aggregation, and avoid exposing detection logic broadly.

Vendor opacity: A vendor score does not satisfy the institution’s responsibility. Require data lineage, test access, incident notification, change notices, performance by segment, subcontractor visibility, and an exit plan.

Cross-market fragmentation: The IOSCO thematic review of market surveillance calls for authorities to review and update surveillance capabilities as technology and trading evolve. A firm should similarly test whether separate venue or asset-class controls miss a pattern visible only when records are aggregated.

Metrics and release gates

A production release should pass predetermined gates:

critical event completeness and timestamp accuracy meet the data contract;
every alert can be reconstructed from immutable source records;
performance is reported across products, desks, liquidity bands, market regimes, and relevant customer groups;
shadow-mode alert volume stays within investigator capacity;
high-severity known cases are detected within the required latency;
false-positive reduction does not come from suppressing difficult segments;
generated summaries cite evidence and pass factual-consistency sampling;
reviewer disagreement and override rates are investigated;
data outage, vendor failure, and rollback drills succeed;
compliance, surveillance, model risk, security, privacy, legal, and business owners sign the release record.

After launch, track queue age, time to first review, time to disposition, repeat alerts, reopen rate, downstream escalations, regulator or audit findings, drift by feature and entity cohort, and investigator feedback. A falling alert count is not automatically an improvement; it may signal a broken feed or an over-aggressive threshold.

Decision framework: assist, recommend, or act

Use increasing evidence and decreasing consequence to decide the permitted level of automation.

Assist: retrieve records, build timelines, translate permitted communications, summarize policies, and cluster duplicates.
Recommend: rank alerts, suggest a typology, identify missing evidence, or propose the next investigative step.
Act under a deterministic rule: route a case, apply a legal hold, or pause an internal workflow only when the authority, conditions, logging, and appeal path are explicit.
Keep human authority: allegation, employee discipline, client restriction, suspicious-activity decision, regulatory filing, and other materially consequential determinations.

High-performing surveillance is less about replacing investigators than giving them a reliable view of a fragmented market. Good AI agent observability makes every retrieval, transformation, recommendation, and override visible.

Frequently asked questions

Can AI prove market manipulation?

No. It can surface patterns and organize evidence. Intent and legal conclusions require context, investigation, and the applicable legal standard.

Should firms replace rules with machine learning?

Usually not. Rules provide transparent coverage for known scenarios; machine learning adds prioritization and discovery. A layered system is easier to test and defend.

Is a low false-positive rate the main goal?

No. Optimize the entire control: meaningful coverage, timely review, evidence quality, investigator capacity, and consistent decisions. A low rate created by missing risky behavior is dangerous.

Can a third-party surveillance platform own compliance accountability?

No. Providers can supply tools and expertise, but regulated firms retain responsibilities defined by applicable law and supervision. Validate the tool on the firm’s data and operating context.

How often should a model be recalibrated?

There is no universal interval. Monitor data and outcome drift continuously, review thresholds on a risk-based schedule, and require controlled validation before changes. Market events and product launches may trigger an immediate review.

The 2026 takeaway

AI makes financial surveillance more useful when it compresses evidence gathering, links fragmented signals, and exposes uncertainty. It becomes dangerous when a score or fluent narrative is treated as a finding. Build the system around reconstructable events, bounded recommendations, accountable investigators, and measured release gates. That is how a market watcher becomes a control rather than another source of noise.

Source notes

Sources reviewed and current as of July 30, 2026: