Trade Surveillance models aim to detect a wide variety of market abuse behaviors. The complexity of algorithms and the huge volume of data these models use potentially make maintaining and updating these models a cumbersome task.
One of the key issues with Trade Surveillance models is the excessive amount of noise or false positives. The techniques listed below can help financial institutions reduce false positives and help assess risk associated with alerts. The basic idea is to categorize and prioritize alerts based on their risk.
Scoring or risk ranking techniques
1. Historical severity analysis or Management Information (MI)-based assessment
The models are classified by geography and asset class, and historic MI is assessed to help identify least performing and best performing alerts. Criteria are frequency of escalation, percentage of false positives and asset class importance. Low quality alerts are identified as a low risk score for a period of time and reviewed periodically, ideally every three months. Models with consistent low performance can either be switched off, or the thresholds can be enhanced to reduce false positive alerts.
2. Threshold enhancement
Thresholds can be divided into the following categories: numerical, percentage, date and time, alphanumeric characters or words, exception lists or values. Threshold analysis looks at the performance of Trade Surveillance model alerts at different levels, and identifies ideal values for better quality alerts. The enhancement for numeric and percentage values could be made more scientific using statistical analysis. Procedures like linear programming, regression analysis and multivariate enhancement can be used. Alphanumeric character values and date time values require better understanding of asset classes and model characteristics. In some situations a simple trial and error method may work. Having a good testing environment could help accelerate finding ideal values. As in the previous case, threshold enhancement should be reviewed on a periodic basis.
3. Proximity Assessment
One way of providing risk intensity to alerts is to use a proximity parameter to generate alerts. The intensity is determined by the difference of the triggered value and the assigned threshold. Alerts with a trigger value close to the threshold (or, alternately, where proximity to threshold is low) are marked with low intensity. For alerts where the trigger value differs substantially from the threshold value, intensity is considered high. Bands of values should be devised around a threshold level to specify an intensity score. Exponential or Fibonacci scoring usually is used to emphasize the outlying alerts.
4. Replacing individual alerts with patterns
Some surveillance systems provide the facility to assign static intensity parameter to all alerts that are generated. Multiple alerts generated by single or multiple Trade Surveillance models, on the same trade, client, trader or trading book for a specified period (e.g., one day), can be assimilated into a pattern alert with higher intensity. The individual alerts that constitute the pattern can be automatically suppressed, and analysts can focus more on higher intensity pattern alerts. As above, the severity or intensity can use exponential or Fibonacci series to help accentuate the risk levels.
Most Trade Surveillance models and thresholds can use more than one of the above noted techniques. The list above, though not exhaustive, provides some useful pointers to tackle one of the most prevalent problems with Trade Surveillance Models, that of accurately, efficiently maintaining and updating them.
Capital markets are complex and dynamic. Trade Surveillance models require frequent validation and adjustment to keep them fit for purpose. Externalities like market volatility, macro-economic events and changing business behaviors are expected to affect any enhancement technique. Other, additional methods may help to reduce these impacts and will be discussed in future blog posts.