The FCA recently published Market Watch 86 highlighting a number of deficiencies in the systems, controls and governance over market abuse regulation (MAR). This follows supervisory visits to seven large retail oriented broker-dealers with high volumes of single-stock equities playing an important role in identifying and reporting potential insider dealing and exposure to other forms of market manipulation.
Ten years after the introduction of MAR, FCA expects that by now, its market surveillance obligations should be well established pointing to earlier deficiencies highlighted in Market Watch 69 (2022) and Market Watch 73 (2023).
FCA emphasises that while the visits focused on retail brokers, the findings may apply more generally across financial services.
Material Weaknesses
All seven of the firms reviewed had automated surveillance systems with policies and procedures for identifying, investigating and reporting market abuse but material weaknesses were observed across design, implementation and operations.
Several firms set the threshold for reporting suspicious activity too high. Some procedures discouraged escalation without a clear client–issuer connection, even where other evidence warranted suspicion; others encouraged analysts to find reasons to close alerts. The FCA reiterates that a Suspicious Transaction and Order Report (STOR) requires reasonable suspicion, not proof. Clear investigation procedures and analyst training supported more consistent decisions.Some surveillance staff could not adequately explain their systems’ alert logic or calibration. Reliance on vendor defaults compounded the problem: uniform price-movement thresholds ignored differences in stock volatility, while excessive minimum trade values excluded substantial client activity. In his response, eflow CEO and founder Ben Parker writes: “The problems lay in how that technology was configured, understood, tested and governed.”
Senior managers’ limited understanding of investigations, escalation and calibration weakened their ability to challenge surveillance performance. Responsibilities were sometimes fragmented, with nobody overseeing the complete process, and managers were occasionally unaware of problems their teams had identified. Quality assurance helped expose inconsistent decisions and training needs. Calum Douglas, Head of Presales at VoxSmart, argues that each surveillance control “needs to be explainable in plain terms by the people who operate it and the senior manager accountable for it.”
Calibrate to Business Profile
The FCA found alert settings that did not reflect firms’ trading activity and risks. Some brokers applied a single price-movement threshold across stocks with different volatility, while others set minimum trade values so high that substantial client activity fell outside monitoring. Staff responsible for surveillance could not always explain the alert logic or calibration, limiting their ability to identify and challenge weaknesses.
Testing often failed to expose these gaps. Comparing alert volumes with trading volumes, or checking outputs against historical trades alone, left some firms unaware that alerts were not triggering as expected. The FCA highlights testing above and below existing thresholds and using synthetic trades to establish whether specific abuse scenarios would generate alerts. Periodic reviews of parameters and logic should help ensure surveillance remains effective as the business changes.
VoxSmart’s Douglas, extends this principle to communications surveillance, arguing for realistic conversations to be tested through capture, transcription, alerting and review. His observation captures the limitation of volume-based checks: “volume tells you a system is busy rather than that it works.”
Governance and Oversight
Weak governance contributed to poor calibration and inconsistent investigation decisions. Some senior managers lacked sufficient understanding of surveillance to challenge its effectiveness, while fragmented responsibilities left nobody overseeing the complete process. Quality assurance ranged from comprehensive reviews to little or none. Firms that reviewed analysts’ work throughout investigation and escalation were better able to identify decision-making errors and target further guidance or training.
Market abuse risk assessments (MARA) also lacked sufficient detail. Some firms failed to distinguish between retail and institutional clients or account for the instruments they traded. Others treated the existence of an alert as evidence that a risk was adequately controlled. The FCA found greater value where firms used quality assurance findings, STOR submissions and calibration reviews to assess control effectiveness, identify coverage gaps and prioritise improvements.
These findings place an emphasis on demonstrating how controls perform. VoxSmart’s Douglas describes an unexplained and untested alert as “a configuration rather than a control”. His distinction reinforces the need for risk assessments to draw on operational evidence and for managers to understand what that evidence reveals about surveillance weaknesses.
Subscribe to our newsletter
