While we already have a “Marking the Close” alert which monitors closing period activity, the new Closing Lookout Alert is a powerful enhancement to our trade surveillance platform, offering users additional flexibility to calibrate the monitoring of the trading activity during the closing period of a market.

Key Features

Customizable Time Periods: Users can customize the closing, pre-closing, and post-closing periods according to their specific requirements. This flexibility allows for tailored monitoring based on individual market dynamics.

24/7 Coverage for Crypto Markets: In recognition of the continuous nature of cryptocurrency markets, our Closing Lookout Alert supports crypto markets by enabling users to select a proxy closing time, ensuring effective surveillance of crypto ETFs.

Regulatory Context

Our Closing Lookout Alert aligns with regulatory guidelines set forth in Regulation (EU) No 596/2014, also known as the Market Abuse Regulation (MAR), ensuring our customers meet compliance requirements. This alert directly addresses the practices outlined in MAR, including:

Concentrated Trading: Monitoring of trading activity during the closing period to detect any abnormal concentration of trades.

Price Movements: Observing price movements in conjunction with trading volume to identify potential manipulative behavior.

The Closing Lookout Alert exemplifies our dedication to innovation and regulatory compliance, providing an essential tool for detecting and deterring market abuse. With the introduction of Digital Asset ETFs trading in January 2024, our customers are equiped with the ability to monitor trading actrivity during the closing period, safeguarding fair and orderly markets.


For more information contact our sales team.

If a firm has multiple clients of different sizes trading the same product, the original Abnormal Message alert may miss genuine cases. If there is a group of small clients who trade a product in much smaller lots and a group of big clients trading the same product in much larger sizes, the generic alert will continue to fire on the big clients. This alert has been refactored to detect abnormal behavior on Participant/Product level. The old logic has been kept intact with a “Matching Key” parameter added.

Traditionally, customers have been able to trade on either a Request for quote (RFQ) or a Central Limit Order Book (CLOB) based methodology. Each has different characteristics and nuances, which we are now seeing can apply to a single business.

To accommodate these business, we have redesigned the backplane of Market Surveillance to allow customers to store data and run analytic from multiple methodologies in one system. In addition to RFQ and CLOB, other protocols now supported includes Automated Market Maker (AMM) Exchanges and covers Anonymous Trading and Dark Pool techniques.

By avoiding the need for multiple instances, we can now make significant savings for our user base.

The new Insider Trading V3 is now available. Key improvements are:

Smoothed Price move calculation

The new version now handles outliers where one erroneous message with price significantly away from the average causes false triggers to occur. The delta from average is configurable per instance of the alert.

Grouping Trades and Orders

The V3 alert now groups the total value of all partial fills from a single parent order into a single figure which is then compared to the and the Large Value Threshold. When run against orders, the alert will focus only on unexecuted orders to avoid duplicates. This helps reduce false positives and saves time for compliance analysts.

Alert Suppression

Insider Trading now suppresses alerts where the suspicious trades or orders were at a less profitable price. For example, an early day buy of 10 lots at $100 where the instrument closes at $90. The next day sees a news triggered jumps of 10% ($99). The alert will not trigger because the original price was higher than the news triggered jump and so no profit was made. This functionality is optional and can be turned off to track failed insider trading attempts. Additionally, the alert can be run in the sandbox to assess the effect of turning it on or off against known data.

Potential profit calculation

The alert now makes a calculation of potential profit or avoided loss based on the sum of all the fill price and volumes, as well as the price movement in the market. This calculation can then be compared against a customizable value to give an indication of the scale of the insider trading.

This month, we have developed two new alerts for our customers in the Fixed Income space: Quote away from Stream and Quote away from Composite.

The Quote away from Stream alert checks if the Dealer quotes a better/worse price to the client’s RFQ compared to the price it was streaming right before.

Similarly, the Quote away from Composite alert checks if the Dealer quotes a better/worse price to the Client’s RFQ compared to the composite price.

These alerts will catch dealers who consistently stream an attractive price to allure clients and subsequently quote a worse price

Find out more about why we released these features in our blog

Market Surveillance has been enhanced with improvements to the Ramping and Creation of a Floor/Ceiling alerts


The ramping alert can now look for opposite side trades after the price ramp to check if the trigger participant benefited from the price move. In addition, compliance officers can now restrict the time window after a detected ramp in which to look for an opposite side trade as well as selecting the source or segment on which will trigger.

Creation of Floor/Ceiling V2

The creation of a floor or ceiling pattern is detected by evaluating, over a rolling time window, the increase in relative volume of a market participant over a certain threshold, whilst retaining the price at a certain level, below a specified standard deviation with that rolling time window. When configured with a market data source or segment, the trigger participant’s volumes are compared to the entire market’s trading volume during the rolling window. The alert only triggers when this ratio breaches a user defined threshold.

New Pump and Dump alert

Pump and dump is a scheme that attempts to boost the price of a security through misleading and exaggerated statements. After driving up the price of a security, the perpetrators of this scheme will reverse their positions at a higher price than the security was when they purchased it. Trash and Cash is the reverse pattern, pushing down a security, buying low and selling high, once the price has normalised.

Our new Pump and Dump/Trash and Cash alert will be a day analytics with no inter-day lookbacks focusing primarily on Equity and ETD markets. After receiving feedback from several clients, we have made significant improvements to the underlying alert logic, including referencing market data to further weed out false positives.

The new alert detects any significant increase in market volumes and then checks for significant market price increase/decrease from the previous intervals. Users can control both these parameters with customised thresholds.

The alert then checks for Buy and Sell trades prior to the detected interval by the same participant and calculates net Buy (Pump)/Sell (Trash) positions. These net positions are then cross checked with their closing positions in the ‘dump’ or ‘cash’ period to see if there was any potential profit made. These net positions are also used to check if these trades were significant enough to move the market.

KRM22 is pleased to announce the release of its new Market Intelligence (MI) Dashboards for its Market Surveillance tool which will be available to all KRM22 Surveillance customers on the Global Risk Platform. The Dashboards are designed to present important surveillance KPIs in a single place, share insights with c-level executives in an effective way, and allow the management to make quick and data-driven decisions based on real-time information.

The information gained will empower senior compliance staff and managers to get a clearer picture of their surveillance operations, identify trends, determine what kind of KPI management improvements are needed, and generate actionable insights across their surveillance program. We have prepared 2 standard management dashboard templates that can be used to further develop more personalized dashboards suited to our client’s specific business needs.

The Alerts Dashboard gives an overview of alerts raised in the last business day broken down by Alert type (Insider Trading, spoofing etc) in a pie-chart alongside a trending line chart for preceding week which quickly allows customers to capture any suspicious trends arising in trading behaviour. Users can also drill down into alerts to identify the players that triggered them and the instruments they triggered on.

The Participant Dashboard gives a high-level summary of the alert activity of market participants including Traders, Accounts, Clients and others. A trending line chart of your top 10 Accounts/Traders can quickly help identify consistent suspicious behavior by certain individuals and help management keep a keener eye on such individuals.

We believe that these dashboards, can not only help catch market abuse, but also help prevent it by picking up on unusual patterns. Putting clear, actionable information into the hands of senior compliance staff and management.

If you wish to know more about how to get access to these dashboards, please get in touch with Rishav Bose (rishav@krm22.com) or Dan Carter (dan@krm22.com).

This month we have enriched the available data across Alerts and Case Management to give users greater insight and flexibility when analysing activity. We have also expanded the available data sets that can be exported to support better reporting of business intelligence.

Alert Details report now enriched with the “Conclusion” field

The Alert details report is a widely used feature and lets users extract a detailed reporting of alerts broken down by type, trader, security, instrument type and so on. Following customer feedback, we have now added the “conclusion” field to this report. The conclusion field contains the comments of the analyst who closed the alert and is quite important in determining why the alert was closed and maintaining a proper audit trail.

Additional Categories within the Alert & Cases Status and Classification dropdowns

We have added additional options to our alerts and case status drop-down menus. Additionally, we have made these drop-down choices customisable giving the users more flexibility when it comes to their case management workflows.

Data View – Export DailyTotals

Users can now export the data in the Daily Totals window. The daily totals button in DataView brings up a box which displays message totals by count, volume and value. This summary can provide helpful insight into trading activity, for example, showing lists for the top 10 securities/brokers/clients/traders by count, volume and value, and can be used to provide important business intelligence to management.

If you have any questions or would like a demonstration of the new features please reach out to Rishav@krm.22.com.

Our Market Surveillance solution includes 50 Market Abuse and Operational alerts. Alerts have been carefully designed with algorithms and rules to improve the effectiveness of the suspicious trading alerts generated.

In the latest release, we have invested heavily in evolving and providing additional functionality to our order book replay and trade reconstruction, known as the “Order View” module within the KRM22 Market Surveillance application. The “Order View” enhancements provide even further context and indicators to users when investigating potential cases of market abuse.

The key additions are as follows:

  • Additional data fields and history for each order being “replayed” in the sequence to provide an even greater level of detail and understanding of the events being investigated.
  • Incorporation of level 2 market data alongside level 1 market data and the flexibility to configure the relevant levels of market depth required for the “replay” on a per playback basis.

The above features significantly enhance the “Order View” functionality within the application allowing users to configure a custom level of market depth relevant to their investigation, based on liquidity at the time, instrument or client etc along with providing more data points for each order to be able to easily identify the orders owner and what the intentions behind that order could have been by being able to view the full lifecycle of the order in one view.