Post Trade Compliance

Post-Trade Compliance

Core Concepts

Trade Surveillance Framework

Trade surveillance is the systematic, ongoing monitoring of executed transactions to detect potential violations of securities laws, firm policies, and regulatory rules. A surveillance program operates across multiple time horizons:

• T+0 (same-day) monitoring — Real-time or end-of-day reviews targeting time-sensitive patterns such as front-running (trading ahead of a customer block order), late trading (mutual fund orders placed after the 4:00 p.m. ET NAV pricing cutoff), and marking the close (orders placed to influence the closing price). T+0 alerts require immediate investigation because the regulatory harm is ongoing or the evidence window is narrow.
• T+1 through T+3 monitoring — Next-day and settlement-window reviews for patterns that emerge across a short sequence of events: allocation fairness on block trades, partial fill distribution, and settlement failures. These alerts align with the trade settlement cycle and CAT error correction windows.
• T+N rolling-window monitoring — Longer-horizon reviews (weekly, monthly, quarterly) for patterns that only become visible over time: churning and excessive trading (turnover ratios measured over months), coordinated trading across accounts, systematic favoritism in allocations, and insider trading correlations (trading patterns around earnings announcements or M&A events). Rolling windows must be calibrated to the specific pattern — churning detection typically requires 3-12 months of data, while insider trading correlation windows may span 30-90 days around a material event.

Surveillance scope varies by firm type and business activity. A full-service broker-dealer conducting equities, fixed income, and derivatives trading must maintain surveillance across all asset classes. An RIA managing model portfolios may focus surveillance on allocation fairness, best execution, and personal trading. The surveillance program must cover both customer/client accounts and proprietary/firm accounts.

Alert generation is the process of applying quantitative thresholds, pattern matching rules, or scoring models to transaction data to produce alerts requiring human review. Effective alert generation requires clean, normalized data from multiple sources: order management systems, execution management systems, account master data, market data, and — for insider trading detection — corporate event calendars and restricted lists.

Investigation workflow follows a standard lifecycle:

1. Alert generation
2. Initial triage and prioritization
3. Investigation and fact gathering
4. Disposition (close with no finding, close with finding, escalate)
5. Escalation to senior compliance or legal
6. Regulatory filing if warranted (SAR, STR, or self-report)

Each stage must be documented in a case management system with timestamps, analyst notes, evidence, and supervisory sign-off.

Disposition and escalation decisions are among the most consequential in a compliance program. A disposition of "no finding" must be supported by documented analysis — regulators will review closed alerts during examinations. Escalation criteria should be defined in written procedures: escalate when the pattern is consistent with a securities law violation, when the activity involves a senior person or high-risk account, when the dollar amount exceeds a defined threshold, or when a pattern recurs after a prior warning.

Regulatory filing triggers — Post-trade surveillance may identify activity that requires a SAR filing (for broker-dealers; FinCEN's 2024 rule extending AML program and SAR obligations to covered investment advisers, originally effective January 1, 2026, was postponed to January 1, 2028 by a final rule issued December 2025), an STR (Suspicious Transaction Report, the international equivalent under FATF standards), or a self-report to FINRA or the SEC. The decision to file a SAR based on surveillance findings must be made by the AML Compliance Officer in coordination with the surveillance team. The SAR tipping-off prohibition (31 U.S.C. Section 5318(g)(2)) applies — the subject of the surveillance alert must not be informed of a SAR filing.

Pattern Detection

Surveillance systems must be designed to detect specific prohibited trading patterns. Each pattern has distinct data requirements, detection logic, and evidentiary standards:

Churning / excessive trading — Quantitative metrics include turnover ratio (aggregate purchases divided by average equity, with ratios above 6 presumptively excessive), cost-to-equity ratio (annualized costs as a percentage of average equity, with ratios above 20% generally excessive), and in-and-out trading frequency. Detection requires account-level transaction history, commission and fee data, and the customer's stated investment objectives. Churning surveillance is typically run on a rolling 3-12 month window.

Front-running — Trading in a firm or personal account ahead of a pending customer order that is expected to move the market. Detection requires correlating proprietary/personal trading activity with the timestamps of customer order receipt and execution. Key data elements: order receipt time (from CAT or order management system), execution time, account ownership, and the direction and size of the customer order. Front-running alerts are time-sensitive and should be generated on T+0 or T+1.

Cherry-picking (favorable allocations) — A pattern where an adviser or trader allocates profitable trades to favored accounts and unprofitable trades to disfavored accounts. Detection involves comparing the performance of allocations across accounts within a block trade or across trades over time. Statistical methods include comparing average returns by account against the expected distribution under fair allocation. Cherry-picking is a form of fraud that violates fiduciary duty and Section 10(b) of the Exchange Act.

Insider trading — Trading by persons with access to material non-public information (MNPI) ahead of corporate events such as earnings announcements, M&A transactions, FDA approvals, or regulatory actions. Detection requires correlating trading activity with an events calendar and identifying trades that are unusual in timing, size, or profitability relative to the trader's historical pattern. Insider trading surveillance often relies on restricted list and watch list monitoring, where securities of companies about which the firm possesses MNPI are placed on restricted or watch lists and trading activity is monitored or prohibited.

Layering / spoofing — Placing non-bona fide orders on one side of the order book to create a false impression of supply or demand, then executing on the opposite side and canceling the layered orders. Detection requires order-level data (not just executions) including order submissions, modifications, and cancellations with timestamps. Key indicators: high order-to-execution ratios, rapid cancellation patterns, and consistent profitability on the execution side when layered orders are present.

Wash trading — Simultaneously or near-simultaneously buying and selling the same security with no change in beneficial ownership, creating the appearance of market activity. Detection involves identifying offsetting transactions in the same security, same account (or related accounts), within a narrow time window. Wash trading can also occur across accounts controlled by the same beneficial owner.

Marking the close — Placing orders near the end of the trading session to influence the closing price. Detection requires analyzing order timestamps relative to market close, particularly for securities where the closing price affects portfolio valuations, options settlements, or performance calculations. Key indicator: late-session orders in securities where the firm or its clients have a valuation interest.

Coordinated trading — Multiple accounts trading the same securities in the same direction within a narrow time window, suggesting coordination or common direction. Detection involves clustering analysis across accounts by security, direction, and time, particularly when the accounts share a common adviser, trader, or beneficial owner.

Late trading — Submitting mutual fund orders after the 4:00 p.m. ET NAV pricing cutoff but receiving the current day's NAV. Detection requires comparing order entry timestamps with the 4:00 p.m. cutoff, with attention to time zone differences, system clock accuracy, and any manual order entry processes that could allow backdating.

Best Execution Review

Best execution is the obligation to seek the most favorable terms reasonably available for client transactions. Post-trade best execution review measures execution quality after the fact and identifies systematic deficiencies.

Benchmark comparison — Each execution is compared against one or more benchmarks to measure quality. Common benchmarks include:

• VWAP (Volume-Weighted Average Price) — The average price weighted by volume over a defined period (typically the trading day). Executions below VWAP (for buys) or above VWAP (for sells) indicate favorable execution.
• Arrival price — The mid-quote at the time the order was received. Measures the cost of execution relative to the decision price, capturing both market impact and timing cost.
• Closing price — Used primarily for orders benchmarked to end-of-day pricing, such as index fund rebalancing.
• Implementation shortfall — The difference between the portfolio's paper return (using decision prices) and the actual return (using execution prices), capturing all explicit and implicit costs of execution.

Outlier detection — Identify executions that deviate significantly from the benchmark. Common approaches: flag executions more than a defined number of standard deviations from the mean benchmark deviation, or flag executions where the deviation exceeds a basis-point threshold (e.g., more than 50 basis points worse than VWAP). Outlier thresholds must be calibrated by asset class, order size, and market conditions — a 50 bps deviation may be normal for a small-cap equity but alarming for a large-cap liquid name.

Venue analysis — Compare execution quality across venues (exchanges, ATSs, market makers, OTC dealers) to determine whether the firm's order routing is systematically achieving best execution. Metrics include effective spread, fill rate, speed of execution, and price improvement. Venue analysis should account for order flow characteristics — routing difficult orders to one venue and easy orders to another will skew venue-level statistics.

Review program and committee — The systematic best-execution review program and best execution committee framework (quarterly reviews, committee composition, minutes, routing-arrangement evaluation) are owned by the trade-execution skill (trading-operations). Post-trade surveillance contributes the surveillance-side inputs: outlier executions flagged against benchmarks, venue-level exception statistics, and trend data feeding the committee's review.

Allocation Fairness

When a single order is executed on behalf of multiple accounts (a block trade), the resulting executions must be allocated fairly. Allocation fairness monitoring detects systematic patterns of favoritism.

Pro-rata allocation verification — The standard method for block trade allocation is pro rata, where each participating account receives shares in proportion to its intended participation. Post-trade monitoring verifies that actual allocations match the pro-rata methodology by comparing each account's allocation percentage to its intended participation percentage. Deviations must be documented and justified (e.g., rounding, minimum lot sizes, odd-lot avoidance).

Dispersion analysis — Measures the distribution of execution prices across accounts within a block trade. In a fair allocation, all accounts should receive approximately the same average execution price. Dispersion analysis flags block trades where certain accounts received systematically better prices than others. The analysis should account for legitimate reasons for dispersion, such as different allocation methods (average price vs. sequential fill) and account-level constraints.

Systematic favoritism detection — Extends cherry-picking analysis across time to detect patterns where specific accounts consistently receive more favorable allocations. Statistical approaches include:

1. Comparing each account's average allocation quality (measured as deviation from benchmark) against the group mean over a rolling period
2. Rank-ordering accounts by allocation quality and testing whether the ranking is correlated with account type (e.g., proprietary accounts, performance-fee accounts, or accounts of firm principals)
3. Regression analysis testing whether account characteristics predict allocation quality after controlling for order characteristics

IPO allocation rules — FINRA Rules 5130 and 5131 restrict the allocation of new issues (IPOs, secondary offerings) to certain persons, including broker-dealer personnel, portfolio managers, and their immediate family members. Post-trade surveillance must verify that IPO allocations do not flow to restricted persons. Rule 5131 also prohibits quid pro quo allocations (conditioning allocations on the receipt of excessive compensation) and spinning (allocating hot IPOs to executives of investment banking clients).

Trade rotation monitoring — For firms that use a rotation system (where the first account to receive an allocation rotates across trades), post-trade monitoring verifies that the rotation is being followed. Deviations from the rotation schedule should be flagged and investigated.

Partial fill allocation — When a block order is only partially filled, the partial fill must be allocated fairly. Post-trade monitoring verifies that partial fills are allocated pro rata (or according to the firm's stated methodology) rather than being concentrated in favored accounts. Partial fill allocation is a common area of cherry-picking because partial fills on profitable trades are particularly valuable.

Exception-Based Monitoring

Exception-based monitoring is the operational framework for managing the volume of alerts generated by surveillance systems.

Alert tuning — Surveillance systems generate alerts based on thresholds and rules. Alert tuning is the ongoing process of adjusting these parameters to optimize the trade-off between sensitivity (catching real violations) and specificity (minimizing false positives). A system that generates too many false positives overwhelms investigators and leads to alert fatigue, causing real violations to be missed. A system that is too conservative misses violations. Tuning involves analyzing historical alert data: review disposition outcomes (what percentage of alerts resulted in findings?), adjust thresholds based on statistical analysis, and implement machine learning or scoring models to prioritize alerts by risk.

Alert prioritization — Not all alerts are equally urgent or significant. Prioritization frameworks assign risk scores based on factors such as:

• The severity of the potential violation (insider trading is more serious than a minor allocation deviation)
• The dollar amount involved
• The account type (customer, proprietary, employee)
• The individual involved (senior personnel, repeat offenders)
• The time sensitivity (front-running requires immediate review)

High-priority alerts should be routed to senior investigators with defined response-time SLAs.

Investigation workflow — The standard investigation lifecycle is:

1. Alert receipt — the alert is generated and assigned to an investigator.
2. Initial triage — the investigator reviews the alert details and determines whether the alert warrants a

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: JoelLewis
• Source: JoelLewis/finance_skills
• License: MIT

Install and usage instructions live in the source repository linked above.