Regulatory news
FCA Market Watch 86: Retail brokers' trade surveillance under the spotlight
Ben Parker
•
Chief Executive Officer & Founder
October 15, 2026
The FCA's Market Watch 86 shares the regulator's observations from supervisory visits to seven UK retail brokerage firms.
The latest edition of Market Watch published by the Financial Conduct Authority (FCA) shares the regulator's observations from supervisory visits to seven UK retail brokerage firms. Market Watch 86 examines the systems, controls and governance arrangements these firms use to identify and report potential market abuse – and the findings make for uncomfortable reading.
Retail brokers facilitate significant volumes of retail trading in single-stock equities and play an important role in identifying and reporting potential insider dealing. While insider dealing is their principal market abuse risk, the FCA notes they are also exposed to market manipulation such as pump and dump schemes. The regulator is also clear that, although its findings are drawn from retail brokers, they may be relevant to other types of firms too.
Every firm visited was using an automated surveillance system and had policies and procedures in place. Yet the FCA found material weaknesses in how surveillance processes were designed, implemented and operated in practice. Ten years after UK MAR came into force, the regulator evidently expects these systems to be robust and well established. Instead, it required every firm to take remedial action and, in some cases, used additional supervisory tools including skilled person reviews.
In this blog, we summarise the key findings from Market Watch 86, relate them to our own experiences of working with a large number of retail brokers, and explain how eflow's Trade Surveillance technology helps firms overcome each of the market abuse challenges the FCA identified as part of the project.
The FCA highlighted three overarching weaknesses: poor decision-making when assessing whether activity should be escalated or reported; insufficient understanding of the surveillance systems in use; and senior managers with limited knowledge of key surveillance activities. Collectively, these increase the risk that market abuse goes undetected and that Suspicious Transaction and Order Reports (STORs) are never submitted. The findings fall into four areas.
Under UK MAR, a firm must submit a STOR without delay where it has a reasonable suspicion of market abuse. It does not need proof. Yet several firms set the bar for reasonable suspicion too high, often because of weak procedures, alert review processes and training.
In some cases, firms' internal procedures told analysts not to escalate activity unless they could find a clear link between the client and the issuer of the securities – even where other aggravating factors pointed to suspicion. Others effectively steered analysts towards finding reasons to close alerts, rather than assessing all available information and the balance of aggravating and mitigating factors.
By contrast, firms with well-documented review and escalation procedures, clearly defined roles from alert triage through to STOR submission, and formal analyst training showed far more consistent decision-making.
The FCA expects alert models to be calibrated to a firm's business model and risk profile, including its client base, the instruments it trades and its relevant market abuse risks. It found several cases where this was not the case. Examples included:
The regulator also found individuals responsible for surveillance who could not adequately explain how their systems worked, with some appearing to rely heavily on out-of-the-box vendor settings.
Parameter testing was another weak spot. Most firms did some form of calibration testing, but it was often limited – for example, simply comparing alert volumes with trading volumes, or checking outputs against historical data alone. These firms missed instances where alerts were not triggering as expected. Good practice included "above and below the line" testing at different thresholds, and using synthetic trade data to confirm alerts fire in specific market abuse scenarios. The FCA also stresses the importance of periodically reviewing alert parameters and logic.
Weak governance contributed to many of the issues detailed above. Some senior managers responsible for surveillance had limited understanding of alert triage, investigations, escalation and calibration. In some firms, surveillance responsibilities were split across functions, with no single individual overseeing the end-to-end process. Some senior managers were even unaware of issues identified by their own surveillance teams.
Quality assurance (QA) varied widely, from comprehensive reviews to little or no formal QA. Firms with QA covering analyst work and decision-making throughout the alert review process could spot trends and errors in escalation decisions, and identify where further guidance or training was needed.
Some firms' MARAs failed to reflect key characteristics of their business, such as their client base and the instruments they trade – some had not even differentiated between institutional and retail clients. Others wrongly assumed that simply having an alert in place proved a control was effective.
The firms that got most value from their MARAs assessed control effectiveness using evidence such as QA findings, STOR submissions and alert and calibration reviews. They used their MARAs to identify gaps in surveillance coverage, set remediation priorities and drive enhancements.
The FCA has confirmed that market abuse risks at UK retail brokers remain a supervisory priority, and that it will continue to assess firms' STOR arrangements and surveillance controls. Encouragingly, following remediation, the quality of STORs from the firms that had been visited improved, with clearer and more comprehensive explanations of suspicious activity.
None of the firms that the FCA visited as part of this project lacked surveillance technology. The problems lay in how that technology was configured, understood, tested and governed. eflow's Trade Surveillance system has been engineered to tackle exactly these issues.
The challenge: Analysts applying too high a threshold for suspicious activity, closing alerts without weighing up all the available information, and inconsistent decisions across the team.
How eflow helps: Every alert generated by eflow's technology comes with the full context an analyst needs to make a balanced judgement: a high-level summary, the infringing entities and instrument, the test parameters that triggered it, and every infringing record. Trade data is automatically enriched from the eflow Market Data Store, which curates data from more than 250 sources, and plotted against news and market data, so aggravating factors such as pre-announcement trading are clear to see. Drill-down links take analysts straight to the history of specific traders, clients and instruments.
PATH AI Analyst, eflow's explainable AI assistant, lets analysts query the system in plain English – for example, pulling every alert linked to a particular client – and summarises activity with clear reasoning. Crucially, it provides clear and auditable explanations of its responses, with every result referencing the source data it is based on. The integrated case management tool then lets teams add notes, categorise alerts using their own definitions, escalate to colleagues and record outcomes, creating a consistent, documented route from triage to STOR.
The challenge: Flat price move thresholds that ignore volatility, minimum notional values that exclude large parts of client activity, and staff who can't explain how their alerts work.
How eflow helps: eflow's technology is designed to be configured around each firm's business model, risk profile and trading activity. The system's conditional parameters allow different values to apply based on conditions such as an instrument's volatility, trading volume and liquidity, using configurable bands – so an insider dealing alert can treat a thinly traded small cap very differently from a FTSE 100 stock. Alerts and parameters can also be set specifically for different asset classes, risk profiles and client types, allowing firms to differentiate between retail and institutional clients.
Each alert shows exactly which test parameters captured it, and volatility and volume data can be used to support calibration decisions. That transparency, combined with direct access to eflow's onboarding specialists, customer success managers and technical experts, means compliance teams understand how and why their alerts trigger – rather than relying on 'black box' AI to make decisions for them.
The challenge: Limited calibration testing that compares alert volumes with trading volumes, and fails to spot alerts that aren't triggering.
How eflow helps: The eflow Sandbox lets firms test and refine their system configuration using their own historical data, without affecting the live system. Teams can adjust parameters for as many alert types as needed and see a side-by-side comparison of original and sandbox results, including a breakdown of alerts that would be generated under the new settings that are not present in production. This makes "above and below the line" analysis straightforward, showing precisely what a tighter or looser threshold would catch or miss. Once satisfied, users can promote changes to the live system in a single step.
Testing starts on day one. As part of eflow's onboarding process, all client systems undergo rigorous User Acceptance Testing managed by product specialists and the client's team before go-live. This helps to ensure that data feeds and alert logic work as intended from the outset.
The challenge: Senior managers with limited understanding of surveillance activities, fragmented responsibilities, and inconsistent or absent QA.
How eflow helps: eflow's preset and customisable reports give senior management clear, timely management information on alert volumes, escalations and outcomes, so they can challenge whether internal processes are working effectively. Internal activity logs show how the compliance team is interacting with the system, and a full historical log of every parameter change provides a transparent record of how the system has been calibrated over time.
Because investigations, escalations and decisions are all recorded in one place, QA reviewers can easily assess analyst decision-making, identify trends and errors, and pinpoint where additional guidance or training is needed – exactly the kind of oversight the FCA highlighted as good practice.
The challenge: Risk assessments that don't reflect the business, and the assumption that having an alert in place means a control is effective.
How eflow helps: eflow monitors for all market manipulation and insider dealing typologies across all major traditional and crypto asset classes, giving firms the coverage to address every risk their MARA identifies – including pump and dump schemes alongside insider dealing. More importantly, the data the system generates – alert outcomes, STOR submissions, parameter reviews and Sandbox test results – gives firms the evidence they need to assess whether each control is genuinely effective. That evidence can feed directly back into the MARA, helping firms identify coverage gaps, set remediation priorities and demonstrate continuous improvement to the FCA.
Market Watch 86 is a clear reminder that implementing a trade surveillance system is not the same as having effective an effective one. A decade after UK MAR came into force, the FCA expects firms to understand how their alerts work, calibrate them to their own business, test them rigorously, govern them properly and make sound, consistent decisions on what to report.
With retail brokers named as an ongoing supervisory priority – and the regulator signaling that it will be applying the same expectations more widely – now is the time for firms to review their arrangements against the points raised in this Market Watch, and to ask whether their trade surveillance technology genuinely meets the standards expected by the regulator.
If your firm is looking to strengthen its market abuse surveillance with a solution built for today's regulatory expectations, book a consultation with eflow today.
