FCA warns firms on market surveillance failures

What does this mean?

The FCA reminds firms they must have effective arrangements, systems and procedures in place to detect and report suspicious activity. These should be appropriate and proportionate to the scale, size and nature of their business activities. This includes how firms govern, implement, test, review and rectify issues with the functioning of the technical systems which they use to deliver market monitoring and surveillance arrangements.

The FCA is aware of problems with surveillance alerts not working as intended and assumed by the firm. This might be because the setup was done incorrectly, or because not all the necessary data for effective monitoring has been collected.

According to the FCA, the failures could impact: 

• An entire section of a firm’s activity, such as a segment of business sent to a particular exchange, might not be monitored.

• An alert scenario could be partially effective, generating alerts, but not for all instances where it is intended to.

• An alert scenario for a specific type of market abuse could be completely ineffective, with alert generation impossible, due to inadequate testing before and after implementation.

The FCA also highlights examples where surveillance failures have happened due to a lack of testing post the implementation of new systems, as well as failures in design, implementation and coding stages. 

The regulator notes that in extreme cases, firms have been unaware of faults for over two years. The failures have occurred with both third-party systems and those designed in-house.

The FCA also shares its findings from a peer review of firms’ testing of front-running surveillance models. The findings include: 

• Most firms reviewed had formal procedures describing the frequency of testing, which elements of their surveillance model were subject to review, and the form of the review.

• Most firms undertook an annual test of some kind. These included parameter calibration, model logic, model code and data comprehensiveness. 

• Approximately half of the firms focused their review on parameter calibration.

• A small portion of the firms used a risk based approach, where the frequency of testing was dependent on the inherent risk of the relevant market abuse type.

What do firms need to do?

Alert model tailoring: Effective surveillance programs encourage tailored alert models, but firms need to consider and mitigate any potential operational risks at the alert level.

Testing for assurance: Second line and internal audit testing can provide assurance on monitoring effectiveness.

Governance focus: According to the FCA, many firms lack adequate focus on governance, with some experiencing delays due to complex, multi-step approval processes. Firms should consider how they can approve their governance structures.

Simplification consideration: Firms should assess if their governance complexity actually yields efficient and effective outcomes.

Proactive vigilance: Firms must proactively prevent surveillance failures and manage associated risks, especially with upcoming innovations like artificial intelligence in surveillance, which will require governance to adapt and remain effective.

Next steps

The FCA continues to monitor firms to ensure they comply with the market abuse surveillance obligations.