The Financial Conduct Authority is not some bloke in a suit skimming spreadsheets. It is, at its core, a data operation. A surveillance machine that ingests billions of rows of trade data every day, runs it through pattern-matching engines, and flags anomalies for human review. The FCA market surveillance RegTech UK stack is one of the more quietly impressive pieces of financial infrastructure most people have never thought about. And because most people haven’t thought about it, some clever operators have found the seams.
This is a technical breakdown. We’re going into the plumbing: how data flows in, what the detection logic looks like, and where the logic quietly falls apart.
Where the Data Actually Comes From
Under the UK’s retained version of MiFID II (now domesticated into the UK Markets in Financial Instruments framework post-Brexit), firms are required to report executed trades to Approved Reporting Mechanisms (ARMs). Think of ARMs as glorified relay nodes: brokers and trading venues funnel their transaction reports through providers like Unavista (London Stock Exchange Group), Tradeweb, or DTCC Derivatives Repository. These ARMs then pipe standardised records straight into the FCA’s Transaction Reporting system.
Each report is a structured data packet covering around 65 fields: financial instrument identifier (ISIN or AII), price, quantity, execution time (to microsecond precision), trader identifiers, counterparty LEI codes, and a bunch of venue and capacity flags. The FCA reportedly processes north of 10 million transaction reports on a busy day. That is not a small firehose.
On the derivatives side, trade repositories (TRs) like DTCC and ICE Trade Vault handle EMIR reporting, pushing position-level data and lifecycle events into a separate regulatory channel. The FCA cross-references both streams. At least in theory.
The Algorithmic Surveillance Layer
Once the data lands, it doesn’t sit in a queue waiting for a compliance officer to manually check it. The FCA runs a suite of automated surveillance tools that operate across several abuse typologies defined under the UK Market Abuse Regulation (UK MAR). The main categories they’re scanning for are insider trading, market manipulation (including layering, spoofing, and ramping), and wash trading.
The detection logic for each works differently.
For insider trading, the system primarily looks at pre-announcement positioning. It maps trades executed in the window before a price-sensitive event (earnings, M&A announcements, regulatory decisions) against the identity of the counterparties. Unusually large directional trades by accounts with demonstrable proximity to material non-public information trigger a case. The challenge is that correlation is not causation, and the FCA’s false positive rate here is notoriously high, which means a lot of cases get opened and quietly shelved.
For layering and spoofing, which is where things get genuinely technical, the system analyses order book events at millisecond resolution. Layering involves placing large visible orders on one side of the book to push price, then cancelling them once your actual order fills on the other side. The surveillance engine looks for high order-to-trade ratios, short order lifetimes, and directional asymmetry between placed and executed volume. This is the kind of detection logic that was pioneered by exchanges like NASDAQ and the London Stock Exchange’s own surveillance platforms before regulators built their own versions.
Where the Detection Logic Has Gaps
Here’s where it gets interesting. The FCA’s infrastructure, however impressive in scope, has structural weaknesses that aren’t exactly secret in quantitative finance circles.
The first is latency in cross-venue data fusion. UK equity trades can execute across multiple venues simultaneously: the London Stock Exchange, CBOE Europe, Aquis Exchange, dark pools, and systematic internalisers. The FCA’s surveillance has to correlate activity across all of them to detect coordinated manipulation. Because ARM submission windows allow for T+1 reporting in some cases, a spoofing pattern that spans venues may not look suspicious in any single dataset but screams manipulation when you look at the whole picture. By the time the full picture is assembled, the pattern has already resolved and the money is moved.
The second gap is derivatives-to-spot linkage. Sophisticated manipulation increasingly starts in less-liquid derivatives markets, where a small position can move a reference price that then triggers payoffs in a much larger physical or structured product. The EMIR reporting stream and the MiFIR transaction reporting stream are not natively joined in real time. Analysts at the FCA can request cross-referenced queries, but there’s no live, automated alert firing across that seam. That’s a known problem.
Third is the identity obfuscation layer. LEI codes (Legal Entity Identifiers) are supposed to make counterparty identification trivial. In practice, complex fund structures involving multiple SPVs across Jersey, Cayman, and Luxembourg can make beneficial ownership genuinely ambiguous at the point of reporting. The FCA can issue formal information requests and use their powers under FSMA 2000 to compel disclosure, but that’s a reactive process, not a real-time detection capability.
The FCA has acknowledged some of these limitations publicly. Their 2023 and 2024 market cleanliness statistics showed that UK equity markets have actually improved on some traditional insider trading metrics, but the regulator has also flagged concerns about shifting abuse patterns into derivatives and less-regulated instruments. You can read more about the FCA’s market cleanliness work directly on their market abuse regulatory hub.
The RegTech Vendors Plugging the Gaps
Because the FCA can’t build everything internally, a whole ecosystem of RegTech vendors has grown up around the problem. Firms like Behavox, NICE Actimize, and Nasdaq’s own Surveillance platform sell directly to trading firms and banks for their internal compliance functions. Some of these platforms now use machine learning models trained on historical enforcement actions to score new order patterns probabilistically.
The irony is that firms subject to FCA oversight are running surveillance technology that, in some cases, is more sophisticated than what the regulator itself is running. A major bank’s internal spoofing detection can fire an alert within seconds of a suspicious pattern. The FCA’s equivalent system may not see the same data at the same fidelity until reports are submitted and ingested, which could be hours later on a high-volume day.
What the Future of FCA Market Surveillance Looks Like
The FCA has been making noises about its data strategy for a while now. Their Transforming Data Collection programme (TDC), running in collaboration with the Bank of England, is specifically aimed at modernising how regulators ingest, validate, and use financial data. The aspiration is closer to real-time regulatory reporting rather than the current batch submission model. If it lands properly, some of those cross-venue and derivatives linkage gaps could be genuinely closed.
There’s also increasing interest in using graph-based analytics for network analysis: mapping the connections between traders, accounts, and counterparties across time to surface unusual clustering. It’s the same approach fraud teams at banks use for financial crime detection, applied to market structure data.
Whether the FCA builds that capability internally or procures it from the RegTech market is an open question. Given the pace of hiring in the public sector versus the private sector for quant and data engineering talent, my money is on procurement. Either way, the surveillance net is getting tighter. Slowly. And the people who understand exactly how it works, and where it currently doesn’t, are watching very carefully.
Frequently Asked Questions
What is the FCA's market surveillance system and how does it work?
The FCA runs automated surveillance systems that ingest trade data reported via Approved Reporting Mechanisms under MiFID II/MiFIR rules. The system applies algorithmic detection logic to flag suspicious patterns like spoofing, layering, and insider trading positioning, which are then reviewed by enforcement teams.
What is RegTech and why does it matter for UK financial regulation?
RegTech (Regulatory Technology) refers to software and data systems used to comply with and enforce financial regulations. In the UK, it includes the reporting infrastructure firms use to submit trades to the FCA and the surveillance platforms the regulator uses to detect market abuse at scale.
How does the FCA detect spoofing and layering in UK markets?
The FCA’s surveillance tools analyse order book data at millisecond resolution, looking for high order-to-trade ratios, extremely short order lifetimes, and patterns where large visible orders are placed and cancelled in coordination with actual executions on the opposite side. This is technically complex and generates significant false positives.
What are the biggest gaps in the FCA's market abuse detection?
The main weaknesses include latency in fusing data across multiple trading venues, the lack of real-time linkage between EMIR derivatives reporting and MiFIR equity transaction reports, and difficulty piercing complex fund structures to identify beneficial ownership at the point of surveillance.
Leave a Reply