Explainable surveillance and disclosure analytics for capital markets

The challenge

Market-surveillance teams see more alerts than they have analysts. Rules tuned to miss nothing bury the cases that matter under false positives, and an analyst who cannot see why an alert fired cannot defend closing it or escalating it.

Disclosure carries a second risk. A press release and the financial statements it summarises can tell different stories, and connecting the two by hand takes days per company.

What we built

• Trade surveillance. Detection of front-running, pump-and-dump and marking-the-close patterns against statistical baselines for each instrument. Every alert carries the evidence that triggered it, and analyst decisions feed back to suppress repeat false positives.
• Market replay. A replay engine runs historical market data through the alert logic, so supervisors can test a rule change before it goes live.
• Disclosure intelligence. AI extraction reads financial statements from PDF filings. Fifteen forensic and earnings-quality tests run on the result, including Benford's law and profit against operating cash flow, and a 21-module check compares press-release claims with the statements.
• Market research. Regime detection, causality analysis between stocks and backtesting on Egyptian Exchange data, used to research and validate surveillance models.

What the disclosure checks find

In a public analysis of a listed bank's annual results, the press release described strong performance and a jump in profit. The disclosure checks traced 37% of total net income to foreign-exchange trading rather than core banking. FX gains depend on inflation and currency movements and are hard to repeat, so the finding changes how the headline profit should be read. Every number came from the bank's own published statements; the work was in connecting them automatically.

Architecture

Streaming consumers load market data into SingleStore, a distributed SQL engine. Processing workers compute features and alerts, Redis serves analyst views, and separate development and production stacks run side by side on Azure. The surveillance and disclosure products are taken to market with our partner SignifAI.