Equity Market Surveillance Today and the Path Ahead

As prepared for delivery

Good afternoon. Thank you, Wayne [Abernathy], for that kind introduction and for the invitation to speak with you today. It is a pleasure to address this group, which plays such a unique role in facilitating the open discussion of important issues facing our economy and financial system.

Most of you, I assume, invest in the stock market. Many of you invest through mutual funds, but at least some of you probably own individual stocks—perhaps stock of your employer or of your favorite technology firm, perhaps a few exchange-traded funds, or stocks in a portfolio managed by a financial professional.

When you think about those investments, what comes to mind? Probably things like what to buy or sell, when or how often you should trade. Maybe you worry about how those stock positions fit into your overall investment strategy, whether you are getting good advice that meets your financial goals, whether the fees you are paying are reasonable, and so on. These are obviously all important issues.

But today, I would like to talk to you about something you may have never even considered: once you decide to buy or sell a stock, once you click your mouse or hang up the phone—what happens next? There are millions of orders placed every day; how do you know that your order will be treated fairly? How do you know that you will get the number of shares you wanted, at the time you wanted and at the price you wanted?

If you are like most investors, you probably take it on faith that once you enter an order to buy or sell, the rest will take care of itself—relying on your broker, the markets and the regulators overseeing the process to ensure your order is executed fairly. But you may also wonder how all this works, or you may even have your doubts about whether you are getting a good deal.

In fact, if you could step “behind the scenes” and follow your order through its brief life, I think you would see why our capital markets—while by no means perfect—are robust and effective. You would see the extensive and complex effort that is made every day to ensure that your order is treated fairly and processed efficiently. You would see the work that FINRA, together with the Securities and Exchange Commission (SEC), more than a dozen U.S. securities exchanges and the Depository Trust & Clearing Corporation (DTCC), do to protect investors like you and promote the integrity of the markets.

Today, I would like to pull back the curtain on this process and shed some light on what happens once you place an order, and on what we and our fellow regulators do to watch over its execution—what we call market surveillance. And I would like to talk about how this system of surveillance is changing, including with the impending introduction of the consolidated audit trail, a centralized data hub for market regulators that is currently in development.

The State of Our Equity Markets

While market surveillance has never been easy, the American capital markets have grown more complex and more dispersed in recent years. This development is most apparent in the listed equity markets, where millions of Americans invest in stocks issued by all sorts of companies.

In the past, this market operated in a relatively straightforward manner—trading activity in exchange-listed securities was dominated by the listing markets. That meant that if you placed an order in a stock, your order would most likely be executed on the exchange where the stock was listed. For example, as recently as 2005, one exchange executed approximately 80 percent of the share volume in its listed stocks.

Today, trading volume in a listed stock is no longer concentrated on one exchange. Instead, it is spread across many different trading venues. A stock can be traded on one of 12 exchanges, each of which regulates trading in its own market. Or it could be traded off-exchange in the “over-the-counter” (or “OTC”) market. The OTC market is made up of more than 40 alternative trading systems, which are trading platforms operated by broker-dealers. And several hundred more broker-dealers use their own capital to provide liquidity in the OTC market—firms commonly known as wholesalers, block positioners and “internalizers,” which execute customer orders out of inventory. In fact, 38 percent of trading in exchange-listed equity securities occurs in this OTC market, and not on any exchange.

To navigate this diffuse system and to seek the best execution for orders, virtually all trading in the equity markets today is done using computers. Broker-dealers, institutional investors and other market participants from around the world deploy competing algorithmic trading models that decide in milliseconds how and where an order should be routed. Larger orders are often divided into many pieces, which are then routed and rerouted to different trading venues to be executed. For example, one order placed by an institution this past June for around 9,000 shares required more than 6,800 separate steps before it was fully executed.

What does this mean for your order? If you place an order in a stock today, unless you specifically direct it to a particular venue, you really have no idea where it might end up—with an exchange, with an alternative trading system, or maybe with a wholesale broker-dealer. Before execution, that order may pass through several different venues, may be divided, or may be combined with other orders. And this process happens exceptionally fast. It can take but milliseconds for an investor’s order to be accepted, routed and executed, and this happens millions of times a day.

Despite this complexity, your order is typically executed fairly and efficiently. In fact, there is evidence that, in many respects, these changes to our equity market structure have generally served investors well. Among other things, execution costs have plummeted, liquidity has increased in many products and orders can be more customized. The market is also more resilient because trading can rapidly shift away from a venue that is experiencing operational difficulties, while competition among venues has spurred innovation in products and trading.

Nevertheless, the speed, complexity and diffusion of the markets have also presented new issues for regulators. For one, rapid evolution in the markets has opened new opportunities for potential misconduct. For example, a bad actor who seeks to momentarily manipulate the market to his advantage might now try to hide this misconduct by spreading orders across multiple trading venues, using different markets or products that are tightly linked (such as equities and their related options) or by exploiting an automated function in the market. Regulators can no longer look at just one firm, one venue or one product at a time in isolation.

FINRA’s Role in Market Oversight

All of these developments have made effective market oversight more important than ever. FINRA, working closely with the SEC and the securities exchanges, plays a key role in conducting this oversight today, monitoring for misconduct and intervening promptly when we find it. It is this oversight that helps protect your orders—and those of millions of other Americans—after you click the mouse or hang up the phone.

It is worth pausing here to explain why FINRA plays a role in overseeing this marketplace. The short answer: because we are required to. The SEC, of course, is the federal regulator principally responsible for protecting investors in the securities markets, maintaining market integrity and facilitating capital formation. The SEC operates extensive programs to further this mission, including enforcement, examination and regulatory programs dedicated to overseeing trading and markets. For example, the SEC performs its own analysis of market events and brings enforcement actions against those who engage in market manipulation or fraud.

The work of self-regulatory organizations, or SROs, complements that of the SEC. As an SRO, FINRA has a statutory obligation to oversee the trading activity of its members—some 3,800 registered broker-dealers. The exchanges, which are also SROs, have similar obligations to oversee the trading activity of their members.

This framework dates back to the Securities Exchange Act of 1934, which set forth the self regulatory obligations of exchanges and FINRA with respect to the regulation of their members’ trading activity. Decades ago, the SEC chose to rely on the SROs for most day-to-day surveillance of the markets, subject to active oversight by the SEC. The SEC is in constant communication with the SROs about the markets, particularly in the wake of market-wide events and conducts regular inspections of the SROs’ market surveillance programs.¹ For FINRA, that includes oversight by the FINRA and Securities Industry Oversight (FSIO) office, which is housed in the SEC’s Office of Compliance Inspections and Examinations (OCIE).

We meet our statutory obligations to oversee the trading activity of our member firms in several ways. Among other things, we license and register firms and their employees responsible for trading. We conduct thousands of examinations each year, and every firm is subject to an exam no less than once every four years. We operate a dedicated office to review allegations of serious fraud and significant investor harm. We write and enforce trading, reporting and other rules for our member firms to protect investors and promote market integrity.

On top of all that, we also conduct automated surveillance of the trading activities of our member firms on an ongoing basis using the data we have access to (more on that in a moment). This surveillance looks for abusive activity by tracking orders from the moment they are placed by a customer, through their journey in the market, until they are ultimately executed. The alerts generated by this surveillance are further analyzed and then, if appropriate, form the basis for an examination or enforcement action.

Market Surveillance at FINRA Today

Our market surveillance work consists of three essential elements: aggregating data through our work with the securities exchanges; developing innovative technology and tools; and deploying market and regulatory expertise. Let me take each in turn.

The Data: Collaboration and Aggregation

The foundation of our program is the data we collect and combine to gain as much visibility across as many markets as we can. For FINRA, this task starts with our own Order Audit Trail System, or OATS, which compiles information reported by our member firms. That system enables us to track orders in equity securities from their receipt or initiation at a member firm, through their routing to one or more broker-dealers or exchanges and to their ultimate resolution.

Robust cross-market surveillance, however, requires combining this information with the data collected by our fellow SROs, the exchanges. Over the years, FINRA has been fortunate to enter into Regulatory Services Agreements with 19 exchanges that operate 26 stock and options markets. Through these agreements, and in coordination with the exchanges, FINRA’s surveillance now canvasses 99.5 percent of U.S. stock market trading volume and about 65 percent of U.S. options trading activity.

Additionally, we receive a significant amount of regulatory intelligence from the exchanges—more than 1,100 referrals since 2015, from their own surveillance of their markets. That information helps enrich our surveillance programs and strengthen our coordination.

We have a strong working relationship with all of our client exchanges, and we could not do our work today without that collaboration. The exchanges are the front line regulators for their markets—after all, no one knows their markets better than they do. And where we provide regulatory services to the exchanges, which often includes not only surveillance, but also investigative and enforcement services, they retain and exercise active control of that regulatory work and conduct extensive and meaningful oversight of how we perform those services.

As I alluded to before, in today’s world there is a risk that bad actors might seek to spread their trading activity across different venues and products, and the regulators need to be able to follow that activity. In this environment, collaboration is what makes cross-market and cross-product surveillance possible. Without it, surveillance would be conducted separately among a patchwork of information from individual markets, and neither FINRA nor other SROs would be able to follow trading activity beyond the boundaries of their own data.

Innovative Technology and Tools

Thus, while the markets are increasingly dispersed, FINRA aggregates our and our RSA exchange clients’ data into a single view of cross-market activity. Which leads me to the second element of our surveillance program—how FINRA employs innovative technology and tools to manage all of that data and render it usable.

Most importantly, we now use the “cloud” to do more work, more quickly, at a lower cost and with enhanced security. In the past, when we owned and maintained our own servers to store all of our data, we were constrained by the number of servers in our data center. Whenever we had an influx of data, it could take days to work through. But in 2014, FINRA made the groundbreaking decision to transfer our data to the cloud, which allows us to use whatever number of servers the current surveillance requires.

Today, we process and monitor an average of 37 billion stock and options quotes, trades, orders and related market events every single day. That is nearly 68 million events every minute and 1.1 million events every second of the trading day, occurring across many different trading venues.

That’s just the average—sometimes we get surges in our data intake. For example, on August 24, 2015, a day when trading spiked abruptly, we processed 75 billion records—double the daily average. The cloud allowed us to securely process all that extra data that day without incident. That is because with the cloud we can instantaneously expand our capacity, eliminating the constraints we previously faced with a fixed number of servers. The cloud also enables us to more economically tackle such surges, as we can time our use of computing power to periods when there is less overall demand.

Having the storage and computing power to process this data efficiently is essential, but only one of many challenges we must address to make the data useful. For example, we also undertake extensive work to “normalize” data received from different sources and in different formats into a structure in which like data elements are consistently identified so that the data can be analyzed effectively.

Another technology core to our surveillance are the sophisticated computer programs—what we call “patterns”—that we use to sift through this massive amount of data and to detect potential misconduct. FINRA today runs more than 175 independent patterns, which detect a wide variety of compliance issues and suspicious conduct across markets.

Pattern development takes time, requiring close coordination between surveillance analysts and data scientists to identify the right conduct and to set the appropriate parameters for the program to examine. A new pattern often requires months to develop and test, with a lengthy process to coax the signal from the noise and to minimize false positive results.

Recently, we have been working to enhance and accelerate this process through the use of “machine learning,” by which surveillance analysts identify specific instances of behavior of interest and allow algorithms to “train” themselves to identify additional instances in new data sets. We are using machine learning techniques to build new surveillance patterns, including some set to launch by the end of the year. And some elements of our operational surveillance patterns already rely on machine learning.

To help us navigate the use of machine learning and other advanced data science techniques, FINRA created an external Market Surveillance Advisory Group, composed of leading cross-disciplinary experts from academia and the financial industry. We are grateful for their help and guidance as we look to ensure that our surveillance program continually evolves to take advantage of new technologies and meet emerging challenges.

Market and Regulatory Expertise

Of course, this data and technology depend entirely on the market and regulatory expertise of our staff—the critical third element of our surveillance program. Our patterns are built with technology, but are designed by—and depend on—FINRA analysts and data scientists with the expertise to know what kinds of market behavior are suggestive of misconduct and how to identify that behavior in a market that moves in milliseconds. We are greatly assisted in this difficult task by the experience and market expertise of our exchange clients, who also monitor their own markets.

Every day, we are searching for the proverbial needle in a haystack. What are the needles, and how might they affect customer orders? Let me give you some examples.

• We look for signs of market manipulation, such as “front running,” which is when a broker improperly takes advantage of information regarding an imminent trade by its customer that has the potential to move the price of that security.
• We look for “wash” trading, or prearranged trading, which is when someone trades against himself to deceive other market participants or to gain some other benefit, or arranges to trade against another counterparty to move money between accounts.
• We look for “layering,” when a market participant enters orders that he does not intend to execute, in order to create the impression of heavy buying or selling pressure, which can, in turn, ignite false momentum in the market that the person, or in reality an algorithm programmed by a person, can take advantage of.
• We look for a variety of other abusive trading algorithms that create false momentum in the market. Some of these have flashy names like “spoofing,” “auto ex,” and “algo gaming,” but they all seek to achieve profitable trades by the market manipulator at artificially advantageous prices.
• We look for anything that indicates that customer orders are not being handled properly. This can include indications that customer orders are being executed at inferior prices or that they are not being executed fully and promptly, or that a broker-dealer is executing its own proprietary orders ahead of a customer order.
• And we look for any other violation of FINRA or SEC rules, such as SEC Regulation M, which is designed to prevent manipulation by individuals with an interest in the outcome of an offering, or SEC Regulation SHO, which is designed to regulate the reporting and execution of short sales.

Our surveillance patterns generate alerts for these or other potential violations that we then use to take action to protect investors and the market. When we detect a potential violation, for example, we may send an examination team to the firm involved to take a closer look, whether as part of our own oversight responsibilities or as part of our work for the exchanges. If necessary, we will then bring enforcement action either alone or in partnership with the exchanges—or, if the target of our investigation is beyond our collective jurisdiction, we will make a referral to the SEC or other authorities.

Last year, our Market Regulation Department made over 500 referrals to the SEC on behalf of FINRA and our exchange clients related to potential abusive trading strategies or other rule violations. And that number does not include referrals made to the SEC or other agencies by other FINRA offices, including referrals related to insider trading, fraud and other matters.²

As I have described, the increased interconnectedness of the markets coupled with the diffusion of market share has created a situation where activity on one market immediately impacts other markets. So, when FINRA surveils the markets today, we are looking at the larger picture. We look across products, such as stocks and options. We look across firms, to try to detect if multiple actors may be working together, or if an actor may be using multiple accounts across different firms. And we look at trading across days, weeks and months, using highly sophisticated analytics to spot unusual or suspicious patterns over time.

The data we have assembled with the exchanges, combined with our powerful analytics programs, enable us to detect cross-market and cross product activities that were previously cloaked by the complexities of the market. This aspect of surveillance has become essential. In the second quarter of 2017, more than half—54 percent—of our cross-market equity alerts identified potential manipulative activity by two or more market participants acting together. Almost three-quarters—74 percent—of our cross-market equity alerts identified potential manipulation by a market participant acting across multiple markets.

Continuous Improvement

These figures highlight how the constantly evolving nature of the market and of potential misconduct requires FINRA, our fellow regulators and our member firms to continuously improve our surveillance efforts. To that end, we recently launched a new cross market surveillance pattern that supplements our existing surveillance to more closely focus on detecting “ramping” at the open and close of trading—generally the two busiest times of the trading day. These patterns detect when a market participant takes actions to artificially increase the price of a stock and to give the impression of heavy trading activity in order to make a profit.

Another area of focus for us is the development of an additional suite of cross-market surveillance patterns to more closely monitor trading in exchange-traded products (ETPs). ETPs, such as exchange-traded funds, have grown tremendously popular, accounting last year for about 30 percent of all U.S. stock trading by value (and 23 percent by share volume). New patterns would provide broader surveillance of this rapidly growing asset class, detect potential problematic behaviors unique to specific subcategories of ETPs and highlight potential gaming activity among ETPs, their components, related ETPs and options on ETPs.

To broaden the impact of our surveillance efforts, we also have put certain information from our programs in the hands of member firms in order to allow them to take steps to proactively address compliance issues. Overall, we provide members with online access to 43 different reports on a broad range of compliance data. These new report cards do not reflect conclusions that violations have occurred. Rather, they indicate potential problems that a firm needs to review.

Last year, 15,000 users at FINRA member firms accessed these reports more than 300,000 times—and they are being used by firms to make a meaningful difference in compliance. To provide one example of the impact of these reports, in April 2016, FINRA started issuing reports for “layering” activity. These reports are derived from the alerts generated by our surveillance systems and enable firms to pinpoint times when we see red flags occurring in orders that they handle. By April 2017, we saw an 82 percent reduction in the number of layering exceptions in our surveillance alerts.

Some of the relevant firms may not have previously been aware of such activity, as only one part of the strategy may have been routed through their firm, so giving them specific information that potentially problematic activity was running through their systems gave them the ability to take action to address the issue long before FINRA can complete a formal investigation.

The Consolidated Audit Trail and the Path Ahead

Even as FINRA was substantially expanding and improving its market surveillance infrastructure and working with exchanges to aggregate data and coordinate cross-market oversight, the SEC began a process to mandate the creation of a consolidated audit trail—the CAT—as a way to require that a variety of important market data be brought together into one centralized database that the SEC, FINRA and the exchanges can all access.

In 2012, the SEC directed the exchanges and FINRA to work together to develop and operate the CAT, and last year the SEC approved an implementation plan. In January 2017, the securities exchanges selected Thesys to serve as the processor for the CAT. (Full disclosure: FINRA bid unsuccessfully to become the processor.)

FINRA supports the CAT, and we believe it has the potential to further enhance and expand current market oversight activities in important ways. We are actively engaged with our fellow SROs in helping implement the CAT in the most efficient and effective way possible within the parameters established by the SEC and the approved plan.

Some have asked, what is the difference between the information that FINRA collects today and the information that will be collected under the CAT?

• First, the CAT will mandate the consolidation of trading information by all securities exchanges and FINRA, and that information will be collected and held by the plan processor, not FINRA; today, trading information is aggregated by FINRA through contractual relationships with exchanges that account for over 99 percent of the listed equity market.
• Second, the CAT will require the submission of more information from market participants than is currently aggregated, including certain information related to listed options and orders originated by market makers, and in some cases will better tie together the details of how customer orders work their way through the market.
• And third, the CAT will include information regarding the identity of customers trading in the markets, including personally identifiable information, or PII, of individual investors, which is not available today to any SRO in a centralized audit trail.

Implementing the SEC-approved plan is a complex process and there are a number of issues coming to the forefront now that the CAT is becoming reality. For example, the allocation of costs for building the CAT is currently being debated in the SEC rule filing process, and concerns have been raised about whether the benefits of including PII in the CAT are justified given the potential risks of data breaches or loss.

Although these and other implementation issues are important, for today I want to focus on the implications of CAT for our overall system of market oversight.

One big change that the CAT will bring about is universal access to market information by securities regulators. While today FINRA and the various exchanges each has access to information that the others do not, once the CAT is implemented all SROs and the SEC will have access to all CAT information.³ The exchanges will not need FINRA’s data, and FINRA will not need the exchanges’ data, to oversee the markets. That raises the question of who will do what types of market oversight in the post-CAT world. Will the SEC, all 20 active stock and options exchanges and FINRA all be reviewing the same data in the CAT? Having many watchful eyes on the data may help regulators spot potential problems, but also may raise cost concerns, especially if those costs are passed along to investors.

In any event, what happens when any one regulator spots something that requires follow up? If everyone is reviewing the same activity, will 20 active exchanges, FINRA and the SEC all separately be responsible for investigating instances of suspicious behavior and then bringing disciplinary actions if warranted?

As it stands today, if you are a broker-dealer, and if FINRA sees something of concern in the data, we will knock on your door—on behalf of ourselves and our exchange clients—and ask about your trading. What is causing the observed behavior? What is your trading strategy? If there are no good answers to those questions, we will start an investigation and, if necessary, an enforcement proceeding. In the post-CAT world, when multiple SROs and the SEC have ready access to this data, will that broker-dealer also have to field questions from multiple regulators asking the same questions about that same trade? As the CEO of an organization that is committed to reducing unnecessary regulatory duplication, I think these are very important issues that require careful consideration.

While the CAT has the potential to improve our oversight systems, it also has the potential to impose unnecessary burdens on our markets and the industry if we do not pay close attention to avoiding supervisory fragmentation or duplication. So it is important that the SEC, FINRA and the exchanges work together to assess and define what market oversight should look like after the CAT is implemented.

When we at FINRA think about this question, we believe there are three key principles that should define the future order of market oversight: comprehensiveness, efficiency and effectiveness.

Let me touch briefly on each in turn.

First, oversight in the post-CAT world must remain comprehensive, looking across markets and across products to the fullest extent possible. As I noted earlier, the dispersed, interconnected nature of today’s trading increases the risk of misconduct that can occur through multiple venues and products. Market surveillance and related oversight must also operate across these venues and products. That is why, at some point, futures data should be incorporated into the surveillance system.

Second, oversight in the post-CAT world must be efficient. It must strive to avoid duplication, regulatory gaps, or undue burdens and it should be standardized where possible in order to reduce unnecessary costs and promote consistent outcomes.

Finally, and most importantly for investors and the markets, the new regulatory regime must be effective and credible. U.S. securities markets are incredibly dynamic, and surveillance in the post-CAT world must be no less quick to embrace new developments in technology, such as machine learning, in order to innovate and adapt to these developments, including new products and market practices. It must leverage the extensive knowledge and experience of each SRO to do our collective work better. And it needs to be supported by fair, effective and appropriately resourced examination, investigative and enforcement programs in order to credibly identify, deter and punish misconduct.

In short, as we transition to a post-CAT world, we must not lose sight of the benefits that can be achieved when FINRA and the exchanges work closely to achieve coordinated cross-market and cross-product surveillance, examination and enforcement coverage of the U.S. securities markets, while minimizing regulatory duplication and unnecessary costs or burdens on market participants.

Conclusion

FINRA believes strongly in regulatory collaboration, and with our exchange clients we have worked to build out a regulatory ecosystem that provides a framework for addressing the challenges and opportunities ahead.

While CAT has the potential to disrupt that ecosystem, I am confident that with leadership and guidance from the SEC, we will be able to construct a coordinated oversight model for the post-CAT world that is comprehensive, efficient and effective—one that gives you confidence that when you place your order to buy or sell a security, regulators are watching what happens behind the curtain to ensure that your order is executed fairly. Our nation’s capital markets and investors deserve no less.

And, while I am sure our system of market oversight will continue to evolve, I am also certain that one thing will remain the same: FINRA’s mission to protect all investors and promote the integrity of the markets.

Thank you.

 

---

1 The SEC has said that “SROs are required to expend sufficient resources, in terms of both staff and technology, to support their surveillance functions.” Securities and Exchange Commission, Concept Release: Request for Comment on Nasdaq Petition Relating to the Regulation of Nasdaq-Listed Securities, Exchange Act Release No. 34-47849 (May 14, 2003) available at http://sec.gov/rules/concept/34-47849.htm.

2 FINRA also monitors the integrity of the data being reported. The timeliness, accuracy and integrity of market data is a critical component of our surveillance program and for the investors and market participants that rely on it to make their trading decisions. Our surveillance program monitors: the timeliness of trades reported to FINRA’s transaction reporting systems; the accuracy of specific data elements in reports made to our various audit trail and other reporting systems; and the accuracy of executed market volume advertisements that market participants report to third-party systems.

3 While individual exchanges currently have access to their own markets’ equity and options order book information and consolidated quotation and transaction information, they do not have access to OATS reports.