FCA Market Watch 86 Exposes Gaps in Market Abuse Surveillance

Ten years after the Market Abuse Regulation (MAR) was introduced, the FCA continues to communicate a consistent message: firms should have effective, risk-based market abuse surveillance arrangements in place.

Market Watch 86 is noteworthy not because it introduces new expectations, but because the FCA revisits long-standing themes from previous Market Watch publications and tests them against firms’ real-world practices. Its findings show that documented surveillance arrangements do not necessarily operate effectively in practice.

As part of its review, the FCA examined the systems, controls, and governance arrangements used by seven retail brokers to identify and report potential market abuse. This included alert investigation and decision-making, surveillance system calibration and testing, escalation, and senior management oversight.

Although every firm had automated surveillance systems and documented procedures, the FCA identified material weaknesses at all seven firms and required remedial action.

This publication is less about new guidance and more about accountability. Firms cannot rely on having surveillance arrangements documented on paper. They must be able to demonstrate that those arrangements work in practice.

While the review focused on retail brokers, the FCA states that its observations may also be relevant to other types of firms.

Effective Surveillance Requires More Than Technology

One of the clearest findings relates to STORs.

Several firms had raised the threshold for reporting beyond what the regulation requires. Analysts were often directed to seek evidence that would prove misconduct before escalating concerns. In some cases, procedures appeared to steer analysts towards closing alerts rather than considering all available information, including aggravating and mitigating factors.

The FCA’s position remains unchanged. Under UK MAR, firms must submit a STOR without delay when they have reasonable suspicion of market abuse. Firms do not need proof that market abuse has occurred before submitting a STOR.

This distinction matters because surveillance is designed to identify potential misconduct, not conclusively establish it. When firms apply an unnecessarily high threshold, genuine concerns may never be escalated, increasing regulatory risk.

Firms with stronger alert triage and decision-making practices shared several common characteristics:

• Defined escalation procedures
• Clear ownership of investigations
• Documented decision-making processes
• Formal analyst training programmes

Effective surveillance depends as much on governance and process as it does on technology.

Market Abuse Surveillance Must Reflect the Firm’s Risk Profile

Market abuse surveillance is only as effective as the assumptions built into it.

The FCA identified examples where firms applied the same thresholds across securities with very different volatility profiles. In other cases, minimum trade values were set so high that significant amounts of client activity fell outside monitoring altogether.

Some firms also struggled to explain how their surveillance models operated or why certain thresholds had been selected.

This is a common challenge. The FCA identified cases where firms appeared to rely on out-of-the-box settings provided by third-party vendors without adequately understanding or challenging how their surveillance systems operated. If a regulator challenges a particular alert threshold, firms should be able to explain what behaviour it is designed to identify and why it remains appropriate. If they cannot do so, the calibration may require further review.

Surveillance Testing Must Show That Alerts Work as Intended

Testing emerged as another area where firms fell short.

Some firms focused primarily on alert volumes, comparing them against trading activity or historical trends. Useful as management information, these metrics do not necessarily demonstrate that surveillance is identifying the behaviours it was designed to detect.

The FCA highlighted stronger practices such as:

• Performing “above-the-line” and “below-the-line” testing
• Using synthetic trade data
• Simulating specific abuse scenarios
• Reviewing parameters regularly
• Assessing whether alerts trigger as intended

Testing should provide assurance that surveillance alerts operate as intended and identify potentially suspicious activity.

Governance Remains the Foundation

Weak governance and oversight contributed to many of the weaknesses identified by the FCA.

Senior managers at some firms had limited visibility over alert triage, investigations, escalation decisions, and calibration reviews. Responsibility was often dispersed across multiple teams, with no single individual providing oversight of the end-to-end process.

By contrast, firms with stronger frameworks demonstrated:

• Clear senior ownership
• Effective quality assurance processes
• Consistent escalation frameworks
• Ongoing training and feedback
• Regular management reporting

Quality assurance was particularly important. Structured reviews helped identify recurring issues, improve consistency, and target training more effectively.

Market Abuse Risk Assessments Must Inform Surveillance Controls

The FCA also returned to a familiar theme: the market abuse risk assessment (MARA).

Some firms failed to consider important characteristics of their business model when assessing risk. Others appeared to treat the existence of surveillance alerts as evidence that controls were effective.

A robust market abuse risk assessment should shape surveillance design, testing priorities, calibration decisions, and remediation plans.

The FCA highlighted positive examples where firms used quality assurance findings, STOR submissions, and alert and calibration reviews to identify control weaknesses and close coverage gaps. That approach transforms a risk assessment from a compliance exercise into a practical risk management tool.

Consistency Should Not Be Mistaken for Complacency

It would be easy to dismiss Market Watch 86 as a repeat of previous FCA messaging. However, the publication reinforces expectations that the regulator has communicated consistently over several years. More importantly, it shows the FCA testing whether firms’ surveillance arrangements operate effectively in practice.

For compliance leaders, the question is no longer whether guidance exists. The question is whether the firm can demonstrate that its surveillance programme is appropriately designed, calibrated, tested, governed, and aligned to its risk profile.

Independent challenge can help firms identify blind spots, benchmark practices, and demonstrate robust oversight.

Strengthen Market Abuse Surveillance with a Risk-Based Framework

Market Watch 86 reinforces a simple message: having surveillance arrangements in place is not the same as demonstrating that they operate effectively. Firms need to understand their market abuse risks and demonstrate that their surveillance controls work effectively in practice.

ACA’s Market Abuse Risk Framework helps firms assess risk, identify control gaps, and strengthen their surveillance arrangements through a combination of advisory expertise, ComplianceAlpha^® technology, and managed services.

If the FCA’s findings have raised questions about your firm’s surveillance arrangements, speak with ACA about assessing your current framework and prioritising practical improvements.