At 12:21:05 PM, a trade surveillance alert appears in an analyst’s queue.
The activity is unusual, but it is not conclusive. A voice call took place a few minutes earlier. A message was exchanged over an electronic communications channel. A market event followed, and the price moved.
Viewed separately, each event may appear unremarkable. Together, they may tell a very different story.
That is the central challenge facing conduct surveillance teams today. Risk rarely announces itself through a single trade, conversation or communication. It emerges in the relationships between them: what was said, what was done, when it happened, who was involved and how one event connects to the next.
Yet at many financial institutions, the evidence needed to identify those relationships remains divided across separate systems, teams and workflows. Trade surveillance generates one set of alerts. Voice surveillance generates another. Electronic communications are reviewed elsewhere. Anti-money laundering teams may hold additional information that could change the interpretation of the activity entirely.
As one participant in a recent webinar on holistic conduct surveillance put it: “It’s all data, and you should be able to connect one with the other.”
The question is no longer whether firms should bring these signals together. It is how they can do so in a way that is practical, controlled, explainable and defensible.
How Surveillance Became Fragmented
Today’s fragmented surveillance environment did not appear overnight. It is the result of systems and controls that evolved to solve different problems at different times.
Voice recording, for example, was not originally designed to uncover complex patterns of misconduct. Recordings were often kept to settle straightforward disputes: Did the trader say buy or sell? Was the order for 15,000 or 50,000? In some trading rooms, traders could replay recent conversations themselves to resolve the issue immediately.
Communications monitoring was similarly limited. Before advanced analytics became available, reviewers might select a recording at random and listen to part of a conversation, hoping to encounter something significant. Trade surveillance, communications monitoring and financial crime controls subsequently developed along separate regulatory, technological and organizational paths.
The silos made sense in their original context. The problem is that they persisted as the nature of trading, communication and conduct risk changed around them.
Employees now communicate across voice, email, messaging platforms, collaboration tools and chat features embedded within business applications. Trading activity spans more products, venues and systems. Relevant information may also sit within HR data, customer records, market data, news events or financial crime systems.
A suspicious trade may be only the starting point. The evidence of intent may sit in a conversation. The proceeds may create a money-laundering concern. A recurring name or relationship may connect the activity to another case.
As another webinar participant observed, communications are often the “smoking gun” in an insider-dealing investigation. A trade alert without its surrounding communications may reveal what happened, but not necessarily why.
Holistic Surveillance Begins Before the Alert
It’s tempting to frame holistic surveillance primarily as a technology project: connect the systems, apply AI and wait for a unified picture to emerge.
Technology matters, but a defensible surveillance program begins much earlier, with governance.
Before a new communications channel is approved, a firm must understand whether activity on that channel can be captured, retained and surveilled. Ownership must be clear. So must the process for approving the channel, managing changes to it, identifying breaches and escalating concerns.
That becomes more difficult as chat and messaging functionality is incorporated into a growing range of applications. A platform may begin as an order management tool and later introduce a communications feature. Unless compliance, technology and business owners are engaged, an institution may not immediately recognize that a new record-keeping or surveillance obligation has been created.
Strong governance should not simply produce a list of prohibited tools. It should create an environment in which employees approach compliance before adopting a new channel.
One webinar participant described this as “positive attitude governance.”
The idea is simple but powerful. When a salesperson or trader asks to communicate through a channel preferred by a client, the first response should be to understand the request and determine whether it can be supported compliantly. When it cannot, the reasons should be clearly explained.
That approach encourages employees to ask before acting. It also reduces the temptation to hide mistakes or move conversations outside approved systems.
People must understand the rules and the consequences of deliberately breaking them. But they must also believe that raising a genuine error is better than allowing it to remain undiscovered. Accountability becomes stronger when it is supported by a culture of transparency rather than fear.
Holistic surveillance, therefore, is not simply about connecting data. It is about connecting governance, culture and accountability to the systems that capture the data.
The Case Should Be the Organizing Principle
Firms do not necessarily need to replace every existing surveillance system to create a more holistic operating model.
Trade surveillance, communications surveillance and AML platforms may continue to perform specialized functions. What matters is whether investigators can bring the resulting information together at the point where decisions are made.
For some organizations, the most practical integration point may be a central data environment. For others, it may be the investigation or case-management layer. An alert created in one system should enable the investigator to retrieve the related communications, trading activity, market events and relevant contextual information without launching a series of disconnected searches.
The investigator should not have to reconstruct the story manually from a collection of isolated clues.
As one panelist stated: “Operating in silos is not appropriate anymore.”
A minimum viable holistic model does not have to be technologically perfect. But it should make cross-channel investigation an expected and repeatable part of the process.
When a trade alert is escalated, analysts should know which other sources must be examined. Voice and electronic communications teams should work closely with trade surveillance. Potential connections to financial crime should be considered rather than treated as someone else’s responsibility. Ownership, escalation and decision-making should be documented.
The operating model can also be organized around the risks of an asset class rather than around the system that happened to produce the alert. An analyst responsible for conduct risk in a particular market should be prepared to consider trades, voice and electronic communications together.
One participant summarized that philosophy directly: “I don’t care whether it’s e-comm, voice or trade. It’s all interrelated.”
That is the essence of holistic surveillance. The case (not the source system) becomes the organizing principle.
AI Can Find Connections, but It Cannot Remove Accountability
The volume and variety of surveillance data are making AI increasingly important.
AI can help transcribe voice recordings, analyze unstructured communications, identify entities, reveal relationships and place events into a common timeline. It can support network analysis, highlight unusual behavioral patterns and accelerate the initial review of large alert populations.
That capability has the potential to transform the analyst’s experience.
Instead of spending hours assembling information from multiple systems, an investigator could begin with a consolidated view of the relevant activity. A trade alert could be accompanied by communications from the same period, related market events, previous alerts and known connections between the people or entities involved.
AI may also help surveillance teams move beyond the isolated alert. A single event may not be especially concerning, but a pattern of events could be. Repeated communications with a particular individual, unusual activity at certain times, recurring alerts across a team or links between conduct risk and financial crime data may create a behavioral picture that no individual system could provide.
This is where heat maps, risk scoring and network analysis become valuable. They help teams ask a broader question: Are we looking at an isolated event, or the visible edge of a larger pattern?
But AI does not eliminate the need for control. As one participant emphasized: “AI is an enabler.”
Models must be validated. Data lineage must be understood. Outcomes must be explainable. If AI is used to close or deprioritize alerts, firms need a defensible sampling and quality-assurance process to test whether relevant activity is being missed.
The guiding principle is straightforward: Use, but verify.
An AI-generated answer cannot become a substitute for accountability. Someone must still understand why a decision was reached, whether the supporting data was complete and whether the outcome can withstand internal challenge or regulatory scrutiny.
Better Automation Makes Human Expertise More Important
The arrival of AI does not mean that experienced surveillance analysts become less valuable.
It may mean the opposite.
As first-level review becomes more automated, analysts will spend less time on obvious false positives and more time on ambiguous, complex or previously unknown risks. Those cases will require a deep understanding of products, market structures, trading behavior and the ways misconduct can be concealed.
A system might identify that a trader repeatedly built unusually large positions around a certain time of day. An experienced analyst can determine whether the pattern relates to a legitimate market mechanism, a client workflow or something that deserves further investigation.
AI can surface the relationship. Human expertise establishes its meaning.
The role of the analyst therefore shifts from processing large volumes of alerts toward interpreting evidence, challenging assumptions and assessing intent. The technology can help assemble the story, but the analyst must still decide whether the story makes sense.
That human judgment is also essential when risks cross organizational boundaries. Market abuse may be connected to money laundering. A communications concern may reveal a broader conduct issue. A person appearing in one investigation may have relationships with individuals or entities found elsewhere.
Technology can show that two points are connected. Experienced investigators must determine why that connection matters.
The Smallest Data Problem Can Undermine the Biggest AI Ambition
Discussions about AI-driven surveillance often focus on sophisticated models, natural language processing and behavioral analytics.
But one of the most consequential controls is far less glamorous: the timestamp.
If trading, voice and communications systems record time differently, an apparently unified timeline may be misleading. Events could be placed in the wrong sequence. A communication that occurred before a trade may appear to have happened afterwards. An automated system may miss the connection entirely.
The best analytics cannot compensate for incomplete, poorly governed or inconsistent data.
That is why completeness, data quality and lineage must remain central to a holistic surveillance program. Firms need confidence that the required activity is being captured, that the data arrived when expected and that the information presented to an investigator accurately reflects the underlying source.
AI may make it possible to examine more data than ever before. It also raises the cost of getting that data wrong. When a model acts on inaccurate or incomplete inputs, it can process the error at enormous speed.
A regulatory-ready operating model therefore needs both advanced analytics and disciplined foundations. Innovation and control cannot be treated as competing priorities.
From Fragmented Alerts to a Connected Story
Holistic surveillance is sometimes described as the destination at the end of a technology transformation.
In reality, it is an operating principle.
It means recognizing that conduct risk does not respect the boundaries between systems, teams or regulatory programs. It means giving investigators access to the context surrounding an alert rather than asking them to assess one isolated event at a time. It means combining technology with governance, explainability, data quality and human expertise.
Most importantly, it means changing the question surveillance teams ask. The question is no longer simply: What happened in this trade, call or message? It is: What story do these events tell when we see them together?
The firms that answer that question successfully will be better positioned to identify hidden relationships, investigate complex behavior and demonstrate that their surveillance decisions are based on complete, connected and defensible evidence.
The future of conduct surveillance will not be defined by how many individual alerts a firm can generate. It will be defined by how effectively the organization can turn those alerts into understanding.
Learn More
Want to explore how NICE Actimize’s Holistic Surveillance solution can help connect trade activity with voice and electronic communications, accelerate investigations and support a more defensible conduct surveillance program? Contact us today.