TradeWatch: Trade and Communications Surveillance
Trade anomalies cross-referenced against surrounding communications, where the design principle is that almost everything ingested must stay unreadable.
Client
Financial Institution, Regulated Trading Desk
Industry
Capital Markets · Surveillance
Duration
9 months
Year
2025
Background
Detecting market abuse means finding a handful of events inside trade and communication volumes that no review team can read. The obligation to look is not discretionary, and neither is the obligation to retain what was looked at. The practical result in most institutions is sampling: reviewing a fraction and hoping the fraction is representative.
The Challenge
A system that ingests every message a trading desk sends is one configuration change away from being a tool for reading employees' communications at will. That is a different system from the one anyone agreed to, and the people subject to it are entitled to assume it does not exist. The engineering requirement was that unflagged content be inaccessible not by permission but by construction, including to the surveillance team operating the platform.
Our Solution
SageWare built the detection and review platform. Trade activity is scored for pattern anomalies and cross-referenced with language signal from the communications surrounding the same window, so a flag is a correlation rather than a keyword hit. Only material that trips a detection is decrypted into a reviewable case; everything else remains encrypted at rest with no interface that exposes it. Retention runs on write-once storage. Every investigator action against a case is recorded on immutable logs, so the people conducting surveillance are subject to the same audit as the people being surveilled.
Key Deliverables
- Unflagged material inaccessible by construction, including to the surveillance team
- Flags produced by correlating trade patterns with surrounding communications
- Write-once retention with tiering driven by obligation rather than access patterns
- Investigator actions recorded on immutable logs alongside the activity under review
Results & Impact
How We Did It
01
Access Model First
Designed what could be reachable and by whom before any detection logic, because retrofitting that boundary onto a working system is not possible.
02
Trade Anomaly Detection
Built pattern detection across trading activity, establishing the windows that would later be correlated against communications.
03
Communications Correlation
Added language signal over the surrounding communications so a flag reflects a correlation rather than a term appearing in isolation.
04
Retention & Audit
Implemented write-once retention and immutable access logging, covering investigator activity as well as the activity under review.
Decisions & Trade-offs
Almost everything ingested must stay unreadable
The straightforward build gives the surveillance team a search box over everything, and it would have been the most requested feature in the room. It also makes the platform a general-purpose tool for reading colleagues’ messages, which is not what it was sanctioned to be. Only material that trips a detection becomes readable; the rest has no interface at all. Ad-hoc investigation is impossible by construction, and that limitation is the property that makes the system defensible to the people living under it.
The people watching are watched
Surveillance platforms concentrate access in a small team who are, structurally, the least observed people in the building. Every investigator action against a case is written to immutable logs reviewable independently of that team. It introduces friction into investigations and it was not universally popular. An audit trail that stops at the auditors is not an audit trail.
Retention is an obligation, so tiering is a design concern
Because everything is retained for a fixed period regardless of whether it was ever reviewed, storage cost is not something to optimise afterwards. It is a first-order constraint on the architecture. Material under active review sits hot; the long tail moves to write-once cold storage on a schedule tied to the obligation rather than to access patterns. It makes retrieving something old slower, which is the correct trade for data nobody expects to read.
Scope & Boundaries
We built the detection, correlation, case and audit layers. What constitutes a reportable event and what happens after a case is opened were the client’s compliance function to define. We deliberately did not build a general search capability over ingested communications, and said so in writing at the outset.
Next Case Study
The Neith
E-commerce · Fashion & Design