How To Detect Wash Trading and Market Manipulation

Regulators across the globe are stepping up their efforts to detect market manipulation, making it even more essential for financial institutions to follow suit to ensure they do not miss hidden risk.

Director of Enforcement and Market Oversight at the Financial Conduct Authority (FCA), Mark Steward, recently highlighted how the FCA was willing to take on the hardest cases in the market manipulation space. He explained that given the corrosive nature of market manipulation to market integrity, the FCA is using a 60:40 split to focus on both insider dealing and market manipulation cases.

The Commodity Futures Trading Commission (CFTC) stated it now has new tools to help the regulator rapidly analyze trades and detect suspicious transactions. In an interview, CFTC Enforcement Director James McDonald explains the CFTC can now “develop a case without traders knowing we’re looking at them [as] the evidence is in the data”.

A surge in surveillance alerts

The current environment and move to remote working have resulted in several new challenges. It has kept market conduct at the front and center of regulators’ minds. It is critical that financial institutions perform risk assessments to understand which activities they need to adapt or surveil with greater scrutiny. They must determine if they have the right monitoring and tools in place, and if they have calibrated models for new risks or even variations of the same risk in line with the current environment.

“Whilst the fundamentals of the market abuse offenses are constant, the ways in which the risk may manifest are not. The manner of surveilling for them must, therefore, also change.”

Julia Hoggett, Director of Market Oversight at FCA

The FCA also recently stated it was aware that increased market volumes and volatility have caused a surge in the number of surveillance alerts in several markets. The regulator provided the following guidance:

Firms should ensure that their approach is tailored to the risks they are exposed to and does not diminish the appropriateness and effectiveness of their surveillance. This may include subsequent thematic analysis, or a retrospective review focusing on areas that are either higher risk or may have been masked due to the volumes of alerts. (Read the full newsletter here)

What are wash trades and why are they a problem?

Wash trades – also known as matched trades, wash sales, matched order, mirror trades when done across jurisdictions, etc. – is a misconduct behavior that has been seen and punished many times over the years.

There can be legitimate reasons for wash trades to be performed but often there is less innocent motivation and intent. Usually, they are fictitious trades that give the appearance that authentic purchases and sales have been made, but where the trades have been entered without the intent to take a bona fide market position or without the intent to execute bona fide transactions.

This behavior can mislead the market and give a misleading impression about the liquidity and supply of a financial instrument.

Financial criminals have used this process to move funds out of high-risk jurisdictions and use complex structures designed to obfuscate the connection between the parties involved. As highlighted in the FCA Thematic Review Understanding the Money Laundering Risks in the Capital Markets, central platforms that offer direct market access (DMA) and trades done off market where the other party of the trade can be specified are particularly susceptible.

This method has also been used by traders in the past to provide kickbacks to brokers in return for gifts and entertainment. This also allowed brokers to improve the profitability of their books and ultimately their personal remuneration through bonus payments. These types of payments can create a risk of loss to other market users, such as competitor brokers, investment banks, and their respective clients and undermines the proper function of the market.

In a 2019 report to the SEC, Bitwise Asset Management suggested that 95% of Bitcoin (BTC) trading volume in 2018 being reported globally on the unregulated cryptocurrency exchanges is “fake.” This also pointed to trading volumes being inflated to give the appearance of liquidity and market activity, attracting new users to the exchange. Recent publications by the CFTC and the DOJ show a lot has changed since then but, this evidence demonstrates that in the early days of the crypto asset world, the behavior moves from more regulated products to those where the regulation is lagging.

How do wash trades work?

A wash trade is a term that is used to describe a pattern of behavior that involves a purchase and sale of securities that match in price, size, and time of execution, and which involves no change in beneficial ownership or transfer of risk.

Wash trades are one of the categories that the FICC Markets Standards Board (FMSB) cited in the Behavioural Clusters Analysis report. Case studies within the report evidence that this behavior:

• Is jurisdictionally and geographically neutral. They can happen anywhere;
• Can occur in different asset classes. As we see in the crypto asset world, the behavior moves from more regulated products to those where the regulation is lagging;
• Can adapt to new technologies and market structures.

Most market-leading trade surveillance tools have scenarios that look exactly for this, where each side of the trade is the same entity and there is no economic rationale or obvious reason to support this activity.

However, there are numerous variations to the basic wash trade and without more advanced scenarios, risk is currently going undetected.

This could include collusive behavior or pre-arranged trading such as:

• Transactions between accounts or entities that are controlled by a single person;
• Transactions between socially connected parties or that have hidden connections (not identified through the KYC & CDD processes).

Or the two legs of a wash trade may be different in value and/or volume and the time between the legs may not be simultaneous.

The right technology can detect wash trades

Mark Steward stated market manipulation cases are “often more complex and difficult to investigate than insider dealing or other types of market abuse because they are not transactional or involve opportunistic trading; perpetrators often work in groups, in an organized way, using sophisticated techniques, over extended time periods”.

To detect complex risk, organizations must leverage data using entity resolution and network analytics.

Entity resolution brings together accurate, reliable, and the most up-to-date information from internal and external sources to create a single dynamic view of an entity. Knowing and understanding who or what an entity is, and how much risk they could present, is critical to ensure the right monitoring is then applied.

Network analytics is used to identify all real-world relationships to the entity, including social connections and those less obvious or even hidden connections that are not apparent through internal data alone.

Case studies with network examples

The following examples are focused on the monitoring of trading of over the counter (OTC) stocks that are thinly traded.

1. Would be detected by existing trade surveillance tool

This example shows a suspicious trade that would be detected using current surveillance tools. It shows a Sell trade (1) that is shortly followed by a Buy trade (2) by the same company for the same price a volume. With no economic rationale or change of ownership, this would be alerted as suspicious.

2. No alert generated for this single trade using an existing surveillance tool

When looking at these two trades in isolation, no alert would be generated as neither look suspicious.

3. Unlikely to be detected by existing trade surveillance tool

However, even with seven subsequent trades, when looking at each trade in isolation, an alert would not be generated. This example could be indicative of collusion but existing tools wouldn’t raise this behavior as suspicious due to monitoring transactions in isolation, rather than as part of a network or behavior over an extended period of time.

4. Using external data and analytics to generate alerts for previously hidden risk

The following animation shows how the same behavior would be flagged as risky when integrating external data, which shows the UBOs of Client 1 and Client 2 are in fact the same. Looking at the trades in their wider context is critical to finding hidden risk, which would be missed when looking at trades in isolation.

It’s time to uncover hidden risk

It is likely that if undetected, this type of behavior will increase when the defenses are vulnerable, such as during the current remote working environment. This provides the perfect opportunity for financial criminals, but monitoring teams are struggling to manage the volume of alerts or adjust models quickly enough to reflect the current risk exposure.

Quantexa’s contextual monitoring approach to surveillance identifies previously undetected suspicious trades between connected parties and uses models that apply % variance on price and volume, monitor trades done over extended time windows, and identifies unusual patterns of behavior that occur over time.