This session at the premium surveillance event for finance featured expert practitioner comment from: Alasdair Amos, Global Surveillance Optimisation Lead, Natixis; Rebecca Butler, Head of Group Surveillance, NatWest; Malcolm Day, head of Central Trade Surveillance, BofA.

The session began with an audience survey question – how confident are you that your surveillance is capturing all the venues used by your front office?

• Certain that all are captured – 2%.
• Confident they are mostly captured with a few exceptions – 23%.
• Not confident and it is likely a number are not captured – 42%.
• Certain that many venues are not captured – 20%.
• Don’t know – 14%.

One of the panellists was asked about the lessons we should learn from the OCC enforcement on JPM Chase earlier this year. The response was that it is abundantly clear that getting this wrong is very expensive, and that even trying to mitigate this pain by self-reporting and being timely can still result in a severe penalty.

Firms need to take this seriously and by implication this means senior management. It has previously been a real challenge to secure proper budget for critical compliance investment – this sort of enforcement makes that approach look very short-sighted.

Another panellist said we need to take hints from regulators earlier and this case most in the industry knew there were problems here before this infamous fine. It is a shame that it requires something this significant to stir firms into change and activity. Previous market watches from the UK FCA had alluded to this, mentioning venue GUIs and such like. FINRA has been referring to the same. Regulators have been reasonable, but there is a limit to their patience. 

It is evident that some high in management are missing the bigger picture. Recordkeeping and data completeness seems to be neglected. 

The JPM enforcement mentioned above offers some worthy insights for surveillance teams. The end-to-end obligation is put sharply in focus here – the problem is not just one for Surveillance. There are roles and responsibilities around the collation and capture and supervision of the data that go beyond the compliance team. There is a vital need for a complete and accurate inventory of venues used. This is not a compliance responsibility. It is evident that some high in management are missing the bigger picture. Recordkeeping and data completeness seems to be neglected. 

Another panellist questioned what the motivators for the business are. They always want a new stream of liquidity. It is vital to record who is using this, their route to the venue, and this check needs to be constantly refreshed. It might not be best to ask each line of business, the better approach might be to find the venue and then find the route to the business line and the way it is accessed.

The moderator asked how many venues each of the panel’s firms use. The three said on last count: 100; 300; 400. Most firms have created a new process to address this topical concern, establishing the status quo and creating the right checks and balances before a new venue is onboarded. 

One of the panel stated that usually most issues compliance faces are historic but this is a live one that requires more interaction between the business and the control functions. It is essential that both agree how to define what a venue is, and to ensure that a process is established that allows for any risk acceptance (and records of that) if the volume and risk is low and within the risk appetite of that business.

Data capture

The moderator asked what steps are necessary to ensure proper data capture. One talked about a business controls office which relies on very manual checks that they are now trying to automate. It is a ‘gargantuan’ task across the various desks and geographies, where it is easy to slip and miss some gaps. There is considerable complexity and variety of data types – the unknown unknows are real. This defies a total automated process.

The task is made harder by how difficult it is to get data from certain venues at the outset. Delivery and format variety add to this complexity and some of the panel said not all venues had been cooperative since this standout enforcement came through. Even when the data is received, it is hard to reconcile that what they have given is indeed everything required.

In some cases, the firms have had to threaten pulling their involvement if the venue(s) will not help! Some have seen this as an opportunity to add value and are playing ball, but withdrawing can have regulatory implications related to best execution, liquidity and competition considerations. A panellist risked inciting the audience by daring to wish for MiFID III and better data standardisation and venue regulation! Another panellist said we might need to see more fines dished out to get real motivation here. 

The moderator asked what due process the banks are undergoing to complete venue capture. Compliance is working with the front office to identify the list of venues once defining what makes a venue is agreed. This can span trading platforms and the interaction in these such as IOIs, quotes, messages, RFQs, order books, streaming quotes, price taking activity, market making and so on.

A not inconsiderable task is moving the data into the process and system for it to then be pushed into surveillance.

The priority is to recordkeep everything, but a risk lens can help to break this need down. It is important to decide on what data types (pre, actual and post) need to be captured. Then a governance process can be devised between compliance and front office tech teams. Many firms are still in a diagnosis phase on this.

Then the problem will move into one of treatment. A not inconsiderable task is moving the data into the process and system for it to then be pushed into surveillance. The process must establish at the outset what the plan is for the venue and the business justification, the aspirational volumes, P&L and costs. These early plans will need to be checked iteratively and there needs to be responsibility assigned for this.

The attestation tool was debated as to its effectiveness for venue identification. The compliance experts felt that front office can be blasé about signing these off when there is no retribution or they get signed by someone inappropriate. 

The audience was asked another survey question: what statement best describes the maturity of your approach to venue governance?

• Leading – all key aspects are in place – 0%.
• Well advanced – few areas are left still to implement – 15%.
• In progress – some good practice in place but a number of aspects still being developed – 50%.
• Immature – many key aspects are not in place – 23%.
• Don’t know – 12%.

The moderator asked if AI can help here. One of the panel said that the technology function can help as there must be a settlement trail to track once trades are complete. This feed into systems can be used to gatekeep once a new venue is live. AI could in theory be used as an analyst to verify data completeness. Until this is realistic, a very manual and heavy governance process is the only alternative. The tech teams must offer a better approach in the end-to-end process than the current excel-based control environment. 

The comms could also be used as a trigger for control checks as they are probably an indicator of activity and can be used to assign to a current venue inventory. The panel debated the requirement for timeliness in surveillance as required by MiFID II (T+1).

The panel agreed that key stakeholders need to be involved at the start of the process, be part-owners, and understand the downside in a collaborative environment. It might work better to try and leverage existing projects, data sets and budgets already under way at bigger institutions. 

The final recommendation was to look at root causes and not try to put a band-aid on the issue (as many did with trade reporting where surveillance got neglected). Any short-term approach will break. This one needs to be done right to avoid more enforcement.

Due to Chatham House restrictions, this summary does not attribute any comments to the individuals. It is also not a full transcription of the session, but contains the sense of it as interpreted and reported by the GRIP subject matter expert who attended.