Regulatory news
What does 23/5 trading mean for my surveillance framework?
Ben Parker
•
Chief Executive Officer & Founder
July 29, 2026
The trading week is set to expand from 80 hours to 115, driven by "rising investor interest in trading U.S. equities during overnight hours."
A 23/5 market runs 23 hours a day, five days a week – a near-continuous equity trading week that pauses only for a one-hour daily technical window, 8:00–9:00 p.m. ET, and stays closed on weekends.
Nasdaq's approved model collapses pre-market, regular, and post-market into a single Day Session (4:00 a.m .– 8:00 p.m. ET) and adds a Night Session (9:00 p.m. – 4:00 a.m. ET). The realistic industry-wide implementation date is December 2026, when the Securities Information Processors (SIPs), which produce the consolidated tape and official NBBO (National Best Bid and Offer), can run overnight. A consolidated, overnight NBBO will give the market a transparent, quoted tape and make best execution enforceable.
23/5 markets will bring a more seamless flow of global capital, accommodating global investor demand and capturing market volume currently residing on fragmented Alternative Trading Systems. But this structural shift is not without technical challenges for surveillance teams.
The shift to 23/5 trading is one of the biggest evolutions in markets for a very long time. Stretching daily volume across an elongated trading week will inevitably create periods of thinner liquidity and amplified volatility. Neither is a new challenge, but both expose limitations of antiquated trade surveillance systems.
Overnight trading volumes are likely to be significantly lower than during core hours. Right now, extended-hours liquidity is a fraction of daytime depth. As of January ‘25, extended-hours trading accounted for just over 11% of all US equity trading. While this number is growing, and continuous trading will likely accelerate that shift, the overnight book itself will likely remain comparatively shallow.
Thinner books move more. With less liquidity to absorb them, individual orders carry greater price impact, so comparatively smaller trades are capable of materially moving a stock overnight. There is no clear read on how US equities will behave overnight under 23/5, but primary data from IOSCO noted that some trading venues experience significant differences in volatility between regular and extended hours. Firms can assume direction, not magnitude: overnight volatility may run higher, and less predictably, varying by session and by name.
The classic abuse typologies, including spoofing, layering and momentum ignition, become easier to execute and harder to detect when order books are thin, which IOSCO says “might require trading venues to increase the sophistication of their market surveillance arrangements”.
Thresholds should adapt to the trading volume and liquidity at the point of execution, not be set once and left. A name trading 100 million shares in core hours warrants a narrower threshold than the same name trading a million overnight, where thinner liquidity implies higher volatility and a wider band of normal movement. This is not the same as simply widening every parameter overnight; it’s context-aware calibration, where thresholds flex continuously in line with trading volume, rather than being reset manually.
"Effective surveillance thresholds should move with market conditions. Liquidity and volume at the point of execution provide a more reliable basis for calibration than static parameters established months or years earlier"
Douglas Moffat, SVP Americas, eflow Global
Instrument-level calibration handles depth; a volatility input handles market-wide moves. When the whole market gaps, as it did when the S&P 500 fell around 11% over two days following the April 2025 tariff announcements, a static threshold risks flagging every name at once and drowning analysts in alerts. A volatility multiplier stacks the firm's threshold on top of the market move: a 5% parameter in a market that has fallen 10% only alerts around the 15% mark. The objective is to surface the delta between the individual name and the broader market move, the genuine anomaly.
Not every technical hit warrants an alert, and firms need a clear, risk-based approach to what counts as material. Someone trading ten dollars of Tesla on both sides carries zero market impact. Technically a hit, but noise. The system should measure the share of the market a participant represents at that point and suppress anything below a client-set floor. What's material is the firm's call, but the filter enforces it at scale.
Calibration isn't a one-off. As overnight liquidity patterns emerge and volatility settles into new norms, firms will need to revisit their thresholds - repeatedly, and often at short notice. The firms that adapt fastest will be the ones that can test parameter changes themselves, in a sandbox, against real historical data, before pushing them live. Being able to model 'what would this threshold have flagged last night?' without waiting on a vendor change request is what turns surveillance from a static setup into something that keeps pace with the market.
Technology surfaces alerts, but people and processes decide what happens next. Many firms already run their surveillance function at the limit in daytime markets, and IOSCO warns that extended hours may demand extra resources to cover additional alerts, "even if not dealt with in real time."
We’ve highlighted this challenge before in our Global Trends in Market Abuse and Trade Surveillance 2026 research. When analysts can't get through the queue, alerts get bulk-closed or auto-escalated. That's usually one of two failures, a system generating too many false positives, or a team too thinly resourced to review them properly, and both at once.
Velocity Clearing, for example, was fined $1m after its surveillance systems generated volumes no one could review. One system produced around 15.2 million alerts for potentially manipulative trading, nearly all closed without investigation; more than 5.2 million were still unreviewed as of early 2025. FINRA found the cause was both structural and human: poorly governed thresholds and a review function so understaffed that, for a time, a single employee handled alerts alongside other duties.While the case predates 23/5 trading, it illustrates how poorly governed surveillance frameworks can quickly overwhelm review teams when alert volumes exceed operational capacity.
These challenges aren’t new to surveillance teams. 23/5 will expose the same deficiencies regulators have been finding in daytime markets: static thresholds, poorly calibrated parameters, under-resourced review. Continuous trading just reduces the margin for error.
That makes this a good moment to look at your surveillance framework with fresh eyes. Not to rebuild it, but to sense-check it.
Come December, firms that can answer those confidently will be well placed to reap the rewards of 23/5 markets.
