Market and trade surveillance: expert insights on data, calibration, and emerging tech
Per Friberg, Senior Financial Crime Surveillance Officer at Trapets, shares his insights on some of the most common challenges faced by surveillance professionals.
Each day brings new trading patterns, emerging risks, and regulatory updates that demand attention and precision from surveillance teams. As new challenges come up, so do the questions: about data, calibration, technology, and how to stay ahead of criminals.
In this article, Per Friberg, Senior Financial Crime Surveillance Officer at Trapets, shares his insights on some of the most common challenges faced by surveillance professionals.
From identifying the right data sources and fine-tuning alerts across asset classes, to exploring how new technologies are shaping effective surveillance and compliance, Per offers a practical view from inside the field.
With a background in investment banking and extensive experience as a sales trader of European and US equities and derivatives, Per brings both market expertise and investigative depth. He has served as a criminal investigator of market abuse at the Swedish Economic Crime Authority and at the National Anti-Corruption Unit (NOA) within the Swedish Police Authority.
If you missed the first part of this series, you can read it here: Expert answers your market and trade surveillance questions, where we explored questions around market manipulation, insider trading, and best practices for market and trade surveillance.
What data is essential for effective trade surveillance?
For effective trade surveillance, you need public market data, that being everything that happens in the stock exchange market, as well as private order and trade data, such as end customer information, order times and order types, account numbers, order conditions and so on.
When using our solution for market and trade surveillance, you’ll need two types of data files: one with public market data and one with private order and trade data. By combining and analysing these datasets, the system identifies patterns and generates alerts based on pre-defined trigger conditions.
How should firms calibrate surveillance parameters for different asset classes and trading strategies?
Each asset class comes with its own trading patterns, risks, and regulatory expectations, meaning one calibration approach won’t fit all. Firms should review their alert settings regularly to ensure they reflect actual trading activity, regulatory expectations, and market conditions.
Equity trading
For firms offering equity trading, the focus should be on identifying the most common market abuse patterns, such as: pump and dump, trash and cash, order book layering, ping orders, marking the open or close, front running, trades outside the spread, wash trades, ramping, intraday price movements, aggressive orders, pre-arranged trading, underlying derivative trades, late withdrawals, spoofing, repeatedly changing last paid, momentum ignition, and insider trading patterns.
These alerts are available in Trapets Market and Trade Surveillance, supporting firms in meeting their obligations with precision and confidence.
Crypto trading
For firms trading in crypto assets, calibration should align with the Markets in Crypto-Assets Regulation (MiCA). Crypto trading differs from traditional instruments in several ways. Most notably, it runs 24/7, without opening or closing hours, while transactions can also act as both a payment and a transfer of the asset itself.
Because of these unique features, it’s crucial that market surveillance and transaction monitoring teams collaborate closely. Aligning alert triggers and sharing insights across these functions will strengthen oversight and help firms maintain compliance.
What emerging technologies should firms monitor for future surveillance capabilities?
I’d say communication surveillance, AI, and cross-team collaboration are some common emerging trends we see in market and trade surveillance.
Communication surveillance
As digital communication channels expand, monitoring interactions across email, phone, messaging apps, and trading platforms is becoming more important. Communication surveillance between a firm's employees and its customers, and between different firms and market actors helps identify potential misconduct and insider risks.
Artificial intelligence and data analysis
AI will most likely be used to assess news content and connect the right financial instrument with the news. For example, AI tools will determine whether news about a listed company is likely to influence its share price or market sentiment. AI can also be applied to behavioural analysis, identifying unusual trading patterns or deviations from an individual’s typical activity.
Collaboration across compliance functions
As crypto-assets become regulated under MiCA, collaboration between market surveillance and anti-money laundering (AML) functions will become even more critical. Shared data, aligned processes, and coordinated investigations will help firms monitor crypto activity more effectively and meet regulatory expectations.
How should firms approach surveillance for alternative trading systems and dark pools?
Surveillance for dark pools presents some unique challenges. Unlike traditional exchanges, dark pools don't display order books publicly, meaning that participants can place orders without visibility into others’ activity.
Because of this, market data within dark pools is limited until trades are executed. Firms can’t monitor order-level activity in real time, which means surveillance must focus on analysing executed trades rather than the order flow itself.
Effective monitoring therefore relies on post-trade analysis: identifying unusual price movements, repeated counterparties, or execution patterns that could suggest manipulation or inside trading. Integrating data from dark pools with other trading venues helps compliance teams gain a fuller picture of trading behaviour.
How do surveillance requirements differ for buy-side vs sell-side firms?
Surveillance requirements vary depending on whether a firm operates on the buy-side or sell-side, as each faces different trading behaviours and market abuse risks.
Buy-side firms, such as asset or fund managers, typically manage collective investment funds rather than serving private individual clients. This structure means they are generally exposed to a lower volume of potentially abusive activity compared to sell-side institutions.
However, risks still exist. A fund manager could use the fund’s large holdings to influence market prices and benefit the fund’s net asset value (NAV). Because of this, buy-side surveillance should focus on scenarios related to price manipulation and valuation influence, rather than the wider spectrum of retail or client-driven trading alerts.
Sell-side firms, including brokers and investment banks, execute trades on behalf of private and corporate clients. This creates a broader risk landscape, as trading activity can vary widely in scale, intent, and strategy.
Surveillance for sell-side firms should therefore include a broader set of alert triggers that capture potential cases of market manipulation, insider trading, wash trades, spoofing, and other client-driven risks.
Interested in learning how Trapets can help you improve your surveillance processes? Read more about our solution for market and trade surveillance.