The Conversation That Changes the Case
Consider what that conversation before the order might reveal. A client gave an instruction that explains the trade’s timing and size. A trader mentioned information that raises questions about what they knew. Or the discussion had nothing to do with the transaction.Each possibility takes the investigation in a different direction. To work out which holds up, the investigator needs to place the conversation alongside the orders, cancellations and executions that followed.Sometimes, the conversation is where the inquiry begins. A concerning message may prompt a look back at trades that never triggered an alert. What appeared routine in the trading data may deserve closer scrutiny once the investigator knows what was said.This is where separate surveillance systems become a real obstacle. The investigator moves between tools, repeats searches and reconciles timestamps. An employee appears under one identifier in a trading system and another in a communications archive. Related alerts land in different queues, leaving different reviewers examining pieces of the same case.A shared timeline can make those relationships easier to see. But even a convincing sequence of events can be misleading if a crucial record never reached surveillance.Missing Records Can Leave Surveillance Gaps
An investigator can question a message they have found. A message missing from surveillance is harder to challenge, because there may be nothing to suggest it ever existed.The same problem applies to market data. Alerts keep arriving, reviews continue and the system appears to be working. Meanwhile, part of the activity the firm believes it is monitoring may be outside its view.The FCA documented exactly this kind of problem in Market Watch 79. One firm’s insider-dealing model depended on a news feed that had never been activated. The failure lasted more than three years. Another firm believed activity from a particular venue was being monitored when it was not. Alerts generated from other activity helped sustain that mistaken confidence.[1]Communications surveillance has suffered similar failures. In a 2024 action against TD Bank, the CFTC found that problems in its message-ingestion process left certain communications for hundreds of swap-dealer personnel outside surveillance over five years. Weaknesses in monitoring and testing allowed the gap to persist.[2]For an investigator trying to understand a trade, these failures have a direct consequence: the available evidence may tell only part of what happened.Firms therefore need a way to establish whether expected records are arriving, being associated with the right people and accounts and reaching the models intended to evaluate them. When something drops out, the surveillance team needs to know.Otherwise, a case can look ready to close simply because the information that would have changed the assessment was never available.Why Was the Case Closed?
Finding the relevant records brings the investigator closer to an answer. It does not settle what those records mean.A conversation just before a trade may warrant attention, but timing alone does not establish misconduct. A phrase that sounds incriminating in isolation may read differently in the full exchange. An apparently reassuring client instruction may leave other questions unresolved.The investigator has to weigh those possibilities and leave a record of the reasoning. If an instruction explains the activity, the case should identify it and show why. If a message heightens concern, the record should explain what changed and what action followed.That is also where regulatory scrutiny becomes especially relevant. FINRA’s 2026 regulatory oversight report identifies weaknesses including poorly designed or documented surveillance parameters, reviews that miss patterns across customers or alert types and failures to document alert-review findings. It also highlights the need to reevaluate controls as business activity and markets change.[3]Imagine revisiting a closed case six months later. The original investigator has moved to another team, and a regulator wants to understand the decision. “Reviewed and closed” offers little help.The case needs to show what triggered the alert, which evidence was examined and why the explanation was accepted. Relevant model settings and analyst notes should be accessible alongside the underlying records.Preserving those connections makes the investigation understandable to someone who was not there when the decision was made.Using AI to Find Related Evidence
Much of the effort described so far goes into finding and connecting information. An investigator may know which employee and instrument to search for, yet still face thousands of messages and a long sequence of orders across venues.AI can help narrow that search. It can identify references to people, accounts and instruments within communications, locate potentially related market activity and help assemble the sequence for review. Connected alerts can be brought together before different investigators spend time pursuing the same matter separately.In the opening example, AI might surface the conversation preceding the unusual order and place it beside the subsequent trading activity. The investigator can then examine a potentially important connection much earlier.The value depends on being able to check that connection. Did the message refer to the same instrument? Did the summary preserve the meaning of the exchange? Does the broader conversation support the interpretation?Investigators need to move easily from a summary to the original message and from a suggested relationship to the underlying trades. An ambiguous reference should remain open to challenge.With that access, AI can help investigators get to the substance of a case sooner while keeping their assessment grounded in evidence they can examine.When Regulators Revisit a Case
By the time the investigation closes, the firm should be able to take another reviewer through what happened without sending them back through every search and system.The trading sequence should connect to the relevant conversations. The investigator’s conclusions should connect to the evidence supporting them. Any unresolved gaps should be visible, so a later reviewer understands the limits of the assessment.That is the practical test when a regulator asks about a trade: can the firm explain what it knew, how it evaluated the activity and why it acted as it did?NICE Actimize’s Capital Markets Surveillance solution supports this approach by bringing together market surveillance, communications intelligence, trade reconstruction and case management. It helps firms investigate related activity together and preserve the evidence behind their decisions.The unusual order may ultimately warrant escalation. The conversation may explain it. What matters is that the firm can follow the evidence far enough to make that judgment, and show its work when someone asks why.For more on this approach, read the NICE Actimize Capital Markets Surveillance brochure.Sources[1] Financial Conduct Authority, “Market Watch 79,” May 9, 2024.https://www.fca.org.uk/publications/newsletters/market-watch-79[2] Commodity Futures Trading Commission, “CFTC Orders TD Bank to Pay $4 Million for Supervision Failures Impacting its Electronic Communications Surveillance System,” Release No. 8944-24, August 14, 2024.
https://www.cftc.gov/PressRoom/PressReleases/8944-24[3] Financial Industry Regulatory Authority, “Manipulative Trading,” 2026 FINRA Annual Regulatory Oversight Report.
https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/manipulative-trading