Surveillance

The surveillance service monitors every executed trade in real-time via a post-trade hook. It detects market abuse patterns and generates alerts for compliance review. Alerts are queryable via the admin API.

Detection Patterns

Wash Trading

Detects circular trade patterns where the same account executes matching buy and sell orders on the same symbol with the same quantity within a 5-minute window.

Large Trade Alerts

Flags trades with notional value exceeding a configurable threshold.

Structuring Detection

Identifies potential structuring (smurfing) where multiple transactions are placed just below the Currency Transaction Report (CTR) threshold to avoid reporting requirements.

Velocity Monitoring

Detects abnormally high trading frequency for a single account.

Price Spike Detection

Uses second-derivative analysis to detect parabolic/exponential price movements. The algorithm splits the observation window into two halves, computes the rate of price change in each half, and triggers if:

1. Total price change exceeds the spike threshold (default 10%), or
2. Acceleration (rate-of-change increase) exceeds the acceleration threshold (default 5%) and total move exceeds half the spike threshold

Alert Structure

Each alert contains:

Alert Types

KYT Configuration

The Know Your Transaction (KYT) configuration is tunable at runtime via surveillance.Service.SetKYTConfig():

cfg := surveillance.KYTConfig{
    CTRThreshold:        10000,     // USD
    LargeTradeThreshold: 100000,    // USD
    VelocityWindow:      1 * time.Hour,
    VelocityMaxTrades:   50,
    StructuringWindow:   24 * time.Hour,
    StructuringMinTxns:  3,
    PriceSpikeWindow:    5 * time.Minute,
    PriceSpikeMaxPct:    10.0,      // percent
    PriceSpikeAccelPct:  5.0,       // percent
}
svc.SetKYTConfig(cfg)

Admin Endpoints

Alerts with severity high or critical should be escalated to compliance for potential SAR filing with FinCEN.

Alert Lifecycle

Detection -> Alert Created (open)
                |
         Investigation (investigating)
                |
    +-----------+-----------+
    |           |           |
 Escalated   Resolved    Filed
 (to legal)  (false pos)  (SAR/STR)