post-trade-compliance

What this skill does

# Post-Trade Compliance

## Purpose
Guide the design and implementation of post-trade compliance monitoring and trade surveillance systems. Covers trade surveillance pattern detection, best execution review, allocation fairness analysis, exception-based monitoring workflows, insider trading detection, market manipulation surveillance, and regulatory reporting triggers. Enables building systems that detect compliance violations after execution and satisfy ongoing surveillance obligations.

## Layer
11 — Trading Operations (Order Lifecycle & Execution)

## Direction
retrospective

## When to Use
- Designing or enhancing a trade surveillance program for a broker-dealer or investment adviser
- Building alert logic to detect churning, front-running, cherry-picking, or other prohibited trading patterns
- Implementing post-trade best execution review processes and quarterly committee reporting
- Evaluating allocation fairness across accounts, including pro-rata verification and dispersion analysis
- Designing exception-based monitoring workflows with alert generation, investigation, escalation, and disposition
- Detecting insider trading patterns by correlating trading activity with material non-public information events
- Identifying market manipulation behaviors such as layering, spoofing, wash trading, and marking the close
- Building personal trading surveillance systems for employee preclearance, holding periods, and blackout enforcement
- Determining when post-trade activity triggers regulatory reporting obligations (SAR, 13H, blue sheets, CAT)
- Tuning surveillance alert thresholds to balance detection sensitivity against false positive rates
- Preparing surveillance documentation and case files for regulatory examinations
- Establishing SLA-driven investigation workflows with aging dashboards and escalation paths

## Core Concepts

### Trade Surveillance Framework
Trade surveillance is the systematic, ongoing monitoring of executed transactions to detect potential violations of securities laws, firm policies, and regulatory rules. A surveillance program operates across multiple time horizons:

- **T+0 (same-day) monitoring** — Real-time or end-of-day reviews targeting time-sensitive patterns such as front-running (trading ahead of a customer block order), late trading (mutual fund orders placed after the 4:00 p.m. ET NAV pricing cutoff), and marking the close (orders placed to influence the closing price). T+0 alerts require immediate investigation because the regulatory harm is ongoing or the evidence window is narrow.
- **T+1 through T+3 monitoring** — Next-day and settlement-window reviews for patterns that emerge across a short sequence of events: allocation fairness on block trades, partial fill distribution, and settlement failures. These alerts align with the trade settlement cycle and CAT error correction windows.
- **T+N rolling-window monitoring** — Longer-horizon reviews (weekly, monthly, quarterly) for patterns that only become visible over time: churning and excessive trading (turnover ratios measured over months), coordinated trading across accounts, systematic favoritism in allocations, and insider trading correlations (trading patterns around earnings announcements or M&A events). Rolling windows must be calibrated to the specific pattern — churning detection typically requires 3-12 months of data, while insider trading correlation windows may span 30-90 days around a material event.

**Surveillance scope** varies by firm type and business activity. A full-service broker-dealer conducting equities, fixed income, and derivatives trading must maintain surveillance across all asset classes. An RIA managing model portfolios may focus surveillance on allocation fairness, best execution, and personal trading. The surveillance program must cover both customer/client accounts and proprietary/firm accounts.

**Alert generation** is the process of applying quantitative thresholds, pattern matching rules, or scoring models to transaction data to produce alerts requiring human review. Effective alert generation requires clean, normalized data from multiple sources: order management systems, execution management systems, account master data, market data, and — for insider trading detection — corporate event calendars and restricted lists.

**Investigation workflow** follows a standard lifecycle:

1. Alert generation
2. Initial triage and prioritization
3. Investigation and fact gathering
4. Disposition (close with no finding, close with finding, escalate)
5. Escalation to senior compliance or legal
6. Regulatory filing if warranted (SAR, STR, or self-report)

Each stage must be documented in a case management system with timestamps, analyst notes, evidence, and supervisory sign-off.

**Disposition and escalation** decisions are among the most consequential in a compliance program. A disposition of "no finding" must be supported by documented analysis — regulators will review closed alerts during examinations. Escalation criteria should be defined in written procedures: escalate when the pattern is consistent with a securities law violation, when the activity involves a senior person or high-risk account, when the dollar amount exceeds a defined threshold, or when a pattern recurs after a prior warning.

**Regulatory filing triggers** — Post-trade surveillance may identify activity that requires a SAR filing (for broker-dealers and, effective January 1, 2026, covered investment advisers), an STR (Suspicious Transaction Report, the international equivalent under FATF standards), or a self-report to FINRA or the SEC. The decision to file a SAR based on surveillance findings must be made by the AML Compliance Officer in coordination with the surveillance team. The SAR tipping-off prohibition (31 U.S.C. Section 5318(g)(2)) applies — the subject of the surveillance alert must not be informed of a SAR filing.

### Pattern Detection
Surveillance systems must be designed to detect specific prohibited trading patterns. Each pattern has distinct data requirements, detection logic, and evidentiary standards:

**Churning / excessive trading** — Quantitative metrics include turnover ratio (aggregate purchases divided by average equity, with ratios above 6 presumptively excessive), cost-to-equity ratio (annualized costs as a percentage of average equity, with ratios above 20% generally excessive), and in-and-out trading frequency. Detection requires account-level transaction history, commission and fee data, and the customer's stated investment objectives. Churning surveillance is typically run on a rolling 3-12 month window.

**Front-running** — Trading in a firm or personal account ahead of a pending customer order that is expected to move the market. Detection requires correlating proprietary/personal trading activity with the timestamps of customer order receipt and execution. Key data elements: order receipt time (from CAT or order management system), execution time, account ownership, and the direction and size of the customer order. Front-running alerts are time-sensitive and should be generated on T+0 or T+1.

**Cherry-picking (favorable allocations)** — A pattern where an adviser or trader allocates profitable trades to favored accounts and unprofitable trades to disfavored accounts. Detection involves comparing the performance of allocations across accounts within a block trade or across trades over time. Statistical methods include comparing average returns by account against the expected distribution under fair allocation. Cherry-picking is a form of fraud that violates fiduciary duty and Section 10(b) of the Exchange Act.

**Insider trading** — Trading by persons with access to material non-public information (MNPI) ahead of corporate events such as earnings announcements, M&A transactions, FDA approvals, or regulatory actions. Detection requires correlating trading activity with an events calendar and identifying trades that are unusual in timi