Chapter 19 Exercises: Market Surveillance: Detecting Manipulation and Abuse

Exercise 1: MAR Classification — Is This Manipulation?

Objective: Apply the MAR Article 12 framework to classify trading scenarios, identify applicable typologies, and determine whether a legitimate defense or safe harbor might apply.

Background: The ability to distinguish legitimate trading activity from market manipulation is the foundational skill of a surveillance analyst. Many behaviors that appear suspicious in isolation have innocent explanations; many behaviors that appear normal in isolation become problematic when viewed in pattern or in context. This exercise develops the analytical judgment needed to make that distinction.

Instructions: For each scenario below, answer the following questions:

1. Which MAR prohibition — if any — is potentially implicated? (Insider dealing, unlawful disclosure, transaction-based manipulation, information-based manipulation, benchmark manipulation, or none.)
2. What additional facts would you want to know before forming a definitive view?
3. Is any MAR safe harbor or legitimate behavior defense potentially applicable?
4. What is your preliminary assessment: (a) likely manipulation; (b) possibly manipulation — further investigation required; (c) likely legitimate — no reasonable grounds for suspicion.

Scenario A — The Pre-Earnings Purchase

Natasha works in the legal department of a pharmaceutical company. Two weeks before the company is due to publish its quarterly results, she learns during a meeting with the CFO that revenues have significantly exceeded market expectations. The following day, she purchases £12,000 of the company's shares through her personal trading account. Three weeks later, after the results are published and the share price rises 18%, she sells the shares at a profit.

Scenario B — The Aggressive Close

A proprietary trading firm that specializes in exchange-traded funds (ETFs) accumulates significant buy orders in a basket of FTSE 100 stocks in the final 25 minutes of trading on the last business day of each quarter. The firm's desk head explains that this activity is driven by end-of-quarter index rebalancing flows and client hedging demand. The trading pattern has been consistent for eighteen months. The closing prices on the flagged days tend to be 10-20 basis points higher than where the stocks were trading at 15:30.

Scenario C — The Cancelled Bond Orders

A corporate bond trader places and cancels twelve large buy orders (EUR 3-5 million each) in an Italian government bond over the course of a single session. The cancellations occur within 5 to 30 seconds of placement. The trader's average execution size in the same session is EUR 400,000. There are no executed sell orders in the same instrument on the same day, and the trader's position data shows a pre-existing net long position in Italian government bonds.

Scenario D — The Forum Post

An anonymous user on a UK investment forum posts an enthusiastic thread about a small-cap technology company listed on AIM, claiming to have "inside knowledge" of a major contract win expected to be announced imminently. The post is written in general terms with no specific names or dates. The company's share price rises 8% in the two days following the post. Three weeks later, no contract announcement has been made. Investigation reveals the forum account was registered from an IP address associated with a director of the company.

Scenario E — The EURIBOR Submission

A treasury desk trader at a large European bank sends an instant message to the bank's money market desk, which is responsible for submitting the bank's EURIBOR panel rates each day. The message reads: "Any chance we can get a high fix today? I've got a chunky long on 3m receiver swaps that would benefit from a slightly higher setting." The money market desk does not respond, and the bank's submission that day is in line with its historical average.

Exercise 2: STOR Drafting Exercise

Objective: Draft a Suspicious Transaction and Order Report (STOR) narrative that meets FCA quality standards.

Background: The FCA has repeatedly noted in Market Watch publications that the quality of STORs varies significantly across firms, and that high-quality STORs — those that clearly identify the grounds for suspicion, provide relevant data, and identify the MAR provision engaged — are materially more useful to the FCA's Market Oversight team than brief, conclusory reports.

Instructions: Using the Cornerstone CG-4412 scenario from Section 19.7 of the chapter, draft the STOR narrative section. Your narrative should:

1. Identify the firm reporting (use "Cornerstone Financial Group" as the reporting firm)
2. Identify the instrument(s) and the period of suspicious activity
3. Identify the person(s) or account(s) involved, to the extent known
4. Describe the suspicious behavior with specific reference to the data: cancel ratio, session count, order sizes, execution pattern
5. Explain the grounds for suspicion: why the business explanation offered was not satisfactory
6. Identify the MAR provision(s) you believe to be engaged
7. Note any additional evidence submitted as attachments

Format guidance: Your narrative should be 350-500 words. Use factual, precise language. Avoid conclusory statements such as "this is clearly spoofing" — instead, describe the facts and explain why they give rise to reasonable grounds for suspicion. This is the FCA's preferred approach.

Extension question: The FCA's STOR portal asks whether the firm sought a business explanation from the trader or desk. Cornerstone did seek an explanation (from the desk head) but not directly from the trader. Write two to three sentences explaining why the firm chose this approach and documenting the reasoning for the compliance file.

Exercise 3: Cancel Ratio Analysis from Order Data

Objective: Compute a trader's cancel ratio and related metrics from a raw order data extract and assess whether the pattern warrants escalation under a standard surveillance rulebook.

Background: This exercise simulates the data analysis step that a surveillance analyst would perform when reviewing an alert generated by the automated system. The analysis requires computing cancel ratios, assessing size asymmetry, and identifying directional patterns.

Order Data Extract — Trader ID: LN-7731, Instrument: XS2345678901 (EUR 5% Corp Bond 2028), Session: 14 November 2024

Part A: Metric Computation

Calculate the following metrics for Trader LN-7731 in this session:

1. Total orders placed (count)
2. Total orders cancelled (count)
3. Cancel ratio (cancelled / placed)
4. Mean quantity of cancelled orders (EUR)
5. Mean quantity of executed orders (EUR)
6. Size asymmetry ratio (mean cancelled / mean executed)
7. Of the buy orders that were placed then cancelled, how many were followed within 20 seconds by a sell execution? Express as a count and as a percentage.
8. For each cycle where a large buy was cancelled and a sell executed, compute the price difference (sell execution price minus buy order price). What is the average price improvement?

Part B: Surveillance Threshold Assessment

Your firm's surveillance rulebook specifies the following alert triggers for EUR corporate bonds:

• Cancel ratio > 0.80: MEDIUM alert
• Cancel ratio > 0.85 AND size asymmetry ratio > 5.0: HIGH alert
• Cancel ratio > 0.85 AND size asymmetry ratio > 5.0 AND directional asymmetry (flagged buy cancellations followed by sell executions > 60% of cycles): automatic escalation to Head of Compliance

Based on your calculations from Part A, determine which threshold(s) are triggered and what the appropriate escalation action is.

Part C: Alternative Hypothesis

ORD-011 — a buy order for EUR 3 million — was placed and executed (not cancelled). Write two to three sentences explaining how this single execution affects your assessment of the LN-7731 pattern. Does it undermine the spoofing hypothesis? Why or why not?

Part D: Additional Data Request

List three additional pieces of data or information you would request before forming a STOR/no-STOR recommendation, and explain what each piece of data would tell you.

Exercise 4: Coding Exercise — Extending SpooingDetector with Layering Detection

Objective: Extend the surveillance platform from Section 19.6 with a new LayeringDetector class that identifies multi-level order stacking and rapid cancellation patterns.

Background: Layering is a variant of spoofing in which multiple orders are placed simultaneously at different price levels on one side of the market to create the appearance of a deep, liquid order book. The orders are all cancelled once the price has moved sufficiently. Unlike simple spoofing (one large order), layering involves coordinated multiple orders that together create a false impression of supply or demand depth.

Signature of layering: - Multiple orders placed within a short time window on the same side (e.g., buy side) at different but progressively lower price levels - These orders collectively account for a significant fraction of the visible order book depth - All orders are cancelled within a defined window (e.g., 30 seconds) - Following the cancellation, an order on the opposite side (e.g., sell) is executed

Your task:

Implement a LayeringDetector class that:

1. Groups orders by trader and instrument
2. Identifies "layering events": windows in which N or more limit orders on the same side are placed within a defined time window (e.g., 10 seconds), at distinct price levels, followed by cancellation of all N orders within a defined cancellation window (e.g., 30 seconds after the first placement), followed by an execution in the opposite direction within a further window (e.g., 20 seconds after the last cancellation)
3. Computes a layering score based on: - Number of layers (more layers = higher score) - Total notional of cancelled orders vs. total notional of executions (higher ratio = higher score) - Frequency of layering events per session (more events = higher score)
4. Returns SurveillanceAlert objects consistent with the platform's existing interface

Starter code:

from dataclasses import dataclass
from datetime import datetime, timedelta
from typing import Optional
import pandas as pd
import numpy as np
import uuid

# Re-use OrderEvent, SurveillanceAlert, ManipulationTypology, AlertSeverity
# from the chapter's surveillance platform implementation

class LayeringDetector:
    """
    Detects layering patterns: multiple coordinated limit orders at
    different price levels on one side of the market, all cancelled
    after creating a false order book impression, followed by opposite-side
    execution.
    """

    def __init__(
        self,
        min_layers: int = 3,
        layer_placement_window_seconds: int = 10,
        cancellation_window_seconds: int = 30,
        execution_follow_window_seconds: int = 20,
        min_notional_ratio: float = 3.0,
    ):
        # TODO: Store parameters
        pass

    def _find_layering_events(
        self,
        side_orders: pd.DataFrame,
        all_orders: pd.DataFrame,
    ) -> list[dict]:
        """
        Identify windows that match the layering pattern on a given side.

        Returns a list of event dicts, each containing:
        - event_start: datetime of first layer order
        - event_end: datetime of last cancellation
        - layer_count: number of distinct price levels in the layer
        - total_cancelled_notional: sum of cancelled order quantities
        - execution: the opposite-side execution that followed (if any)
        """
        # TODO: Implement layering event detection logic
        pass

    def analyze(self, orders: list) -> list:
        """
        Analyze order events for layering patterns.
        Returns a list of SurveillanceAlert objects.
        """
        # TODO: Implement full analysis loop
        pass

Questions to address in your implementation comments:

1. How do you distinguish between legitimate market making (placing multiple bids at different levels in a liquid market) and layering? What additional context would your detector need to reduce false positives in market-making contexts?

2. Your min_layers parameter requires N or more orders. How would you handle a case where a trader consistently places exactly N-1 layers, apparently to stay just below the detection threshold? What change to the detector logic would address this?

3. Modify the SurveillancePlatform.process_session method to include your LayeringDetector in the detection pipeline. Run it against the build_sample_orders() data from the chapter. Does it generate any alerts? Why or why not?

Exercise 5: Research Exercise — FCA MAR Enforcement Actions

Objective: Analyze real FCA enforcement actions under the market abuse framework to identify the factual patterns, investigative methods, and regulatory reasoning that underpin STOR-to-enforcement pipelines.

Background: The FCA publishes Final Notices for all enforcement actions on its website. These documents are primary sources for understanding what the regulator considers to constitute market abuse, how it detects and investigates manipulation, and what penalties it considers proportionate. Reading enforcement notices is one of the most effective ways to calibrate surveillance judgment.

Instructions:

Using the FCA's published Final Notices database (available at fca.org.uk/news/final-notices), identify and analyze three enforcement actions relating to market abuse (MAR or the predecessor Market Abuse Directive) from the period 2016 to the present day. At least one action should involve a firm (not an individual), and at least one should involve trading in a non-equity instrument (bonds, derivatives, or commodities).

For each enforcement action, prepare a one-page analysis covering:

Part A: Factual Summary 1. Who was the subject of the action? (Individual, firm, or both?) 2. What instruments were involved? 3. What was the duration of the alleged abusive activity? 4. What type of market abuse was alleged? (Insider dealing, manipulation, benchmark manipulation, etc.) 5. What was the total penalty imposed?

Part B: Detection and Investigation 1. How was the abuse initially detected? (Surveillance alert, STOR from another firm, whistleblower, routine supervision, international cooperation?) 2. What evidence did the FCA rely on in establishing the case? (Order data, communications, witness evidence, position data?) 3. Were communications — voice, email, or instant message — central to the evidence?

Part C: Regulatory Reasoning 1. What specific conduct did the FCA find to constitute market manipulation or insider dealing? 2. Did the subject raise any legitimate business explanation or safe harbor defense? If so, why did the FCA reject it? 3. What factors did the FCA consider in setting the penalty level? (Seriousness, financial benefit, cooperation, personal circumstances?)

Part D: Surveillance Implications 1. If you were running the surveillance program at the subject firm (or at a comparable firm), what specific alert rules or behavioral patterns would you implement or adjust in response to this enforcement action? 2. What data streams were most important in detecting or proving the abuse? Does your firm's current surveillance architecture capture those streams? 3. Write one paragraph explaining how this enforcement action would be used to update your firm's MAR training materials.

Recommended starting points (do not limit your research to these):

• FCA Final Notice: Corrado Abbattista (2016) — insider dealing in equity derivatives
• FCA Final Notice: Aviva Investors Global Services Limited (2019) — market manipulation, fixed income
• FCA Final Notice: R v Abbott, Connors, Merchant, Parr (2020) — criminal insider dealing prosecution
• FCA Final Notice: BGC Brokers LP (2018) — market abuse in UK gilts market
• ESMA enforcement actions published via the ESMA convergence database (for EU MAR cases post-2016)

Submission format: Three separate one-page analyses (approximately 500-600 words each). Include the case name, Final Notice date, and FCA reference number at the top of each analysis.