Description

A focused course, tailored for you

The Trading Fraud Manager's Surveillance and SAR Playbook

Tune the surveillance rule set, document the alert-to-SAR chain, and brief the SRO without scrambling.

An alert that didn't fire yesterday is the alert the SRO asks about next quarter. The trading fraud manager owns the rule set, the disposition standard, and the SAR narrative that ties them together.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Trading fraud at a US retail broker-dealer sits on a stack: a real-time surveillance engine producing a few hundred alerts a week, a disposition standard that has to survive a FINRA exam, a SAR pipeline that touches BSA officers and FinCEN, and an SRO information-sharing channel that turns one firm's pattern into everyone's review. The trading fraud manager is the person who keeps that stack honest. The work is rule tuning that has to be defended in writing, alert dispositions that have to look the same on a slow Tuesday and a busy month-end, SAR narratives that have to read clearly to an investigator who has never seen your order-management system, and 314(b) sharing requests that have to come back with something usable. None of it is taught well anywhere. This course is the missing manual.

What you walk away with

Tune surveillance rules for wash trading, spoofing, layering, marking-the-close, and momentum ignition with a back-test methodology that defends the parameter choice in writing.
Run an alert-to-disposition workflow that produces consistent investigation notes whether the alert lands at 9:31 or 15:58.
Draft SAR narratives that read clearly to a FinCEN reviewer who has never seen your case-management system.
Operate the 314(a) and 314(b) information-sharing channels so the requests you send come back with usable detail and the requests you receive are closed within the regulatory clock.
Brief the surveillance committee, the BSA officer, and the SRO examiner with the same source-of-truth documentation set.

The 12 modules

Module 1. The surveillance-rule library and parameter ownership

Inventory every rule running in your detection engine: wash trade, spoofing, layering, marking-the-close, momentum ignition, manipulative cross, pre-arranged trading. For each rule, document the parameter set, the legal-basis citation (FINRA 5210, 6140, SEA 10b-5), the historical false-positive rate, and the named owner. The output is a rule register the surveillance committee signs once a quarter and an examiner can read in one sitting.

Module 2. Back-testing a parameter change so it holds up in writing

When the wash-trade rule misses a pattern at market open, the response is not a quiet parameter tweak. It is a back-test against the prior 30 to 90 days of order flow, a documented true-positive and false-positive comparison, a sign-off from the surveillance committee, and a dated change-control record. This module gives you the back-test data structure, the sign-off template, and the change-control note that ties the parameter to the alert that triggered the review.

Module 3. Wash trading and self-trade prevention in low-float and options markets

Wash patterns hide in low-float equities and listed options because the price impact is small and the account linkages are not obvious. This module walks the typology, the order-book signatures the engine should detect, the cross-account linkage tests, the self-trade-prevention defaults that should be set at the OMS layer, and the case studies where rule sets missed a pattern that the SRO later asked about.

Module 4. Spoofing, layering, and momentum-ignition detection

Cover the post-Dodd-Frank manipulation rules, the order-event sequences that mark each pattern, the time windows that matter (sub-second for spoofing, multi-second for layering), and the visualisation that lets an investigator see the cancellation cluster without scrolling through raw FIX. Includes the parameter set that distinguishes a legitimate liquidity-provider cancellation rate from a manipulative one.

Module 5. Marking-the-close and benchmark-influence patterns

The closing-cross window is the highest-stakes minute of the day for benchmark-tracking strategies and the favourite window for closing-price influence. This module covers the order-flow signatures, the volume-weighted comparison against benchmark days, the alert tuning that handles index-rebalance days without false positives, and the disposition note structure for a marking-the-close investigation.

Module 6. The alert-to-disposition standard

Every alert closes one of four ways: false positive with documented rationale, true positive routed to enhanced review, SAR-eligible, or referred to the SRO. The standard is the playbook for getting there consistently. Includes the disposition-note template, the supervisor-review cadence, the QA sample rate, and the metrics the surveillance committee tracks (median time-to-disposition, percentage of alerts reopened, SAR-conversion rate).

Module 7. Writing a SAR narrative a FinCEN reviewer can read

A SAR that names accounts, dates, instruments, and the suspected typology in plain English gets actioned. A SAR that buries the pattern in vendor jargon does not. This module gives you the narrative skeleton, the do-not-write list, the supporting-document index that satisfies the BSA officer's review, and the SAR-amendment process for when new facts arrive after filing.

Module 8. BSA officer interface and FinCEN filing mechanics

The trading fraud manager drafts; the BSA officer files. This module covers the handoff: the case package the BSA officer expects, the timing requirements (30-day initial, 60-day continuing-activity), the FinCEN BSA E-Filing system mechanics, and the audit trail that proves the filing decision was made in good faith if the regulator later asks why a particular pattern was not reported.

Module 9. FinCEN 314(a) and 314(b) information sharing

314(a) is the law-enforcement query channel the firm has to clear within the regulatory clock. 314(b) is the inter-firm sharing channel that turns one firm's pattern into a multi-firm picture. This module walks the 314(a) clearing workflow, the 314(b) registration and request format, the kinds of requests that return usable information, and the privacy-and-confidentiality controls that keep the sharing channel safe.

Module 10. SRO examination readiness for the surveillance function

FINRA Department of Market Regulation examinations focus on the rule library, the disposition standard, the alert-handling timeliness, the SAR-conversion rate, and the change-control record. This module gives you the examination-readiness checklist, the document inventory the examiner asks for, the surveillance committee minutes structure, and the response template for the inevitable parameter-tuning question.

Module 11. Vendor-engine governance and detection-coverage assurance

If the detection engine is third-party, you still own the coverage. This module covers the vendor-rule coverage map against the regulatory typology list, the parameter-change governance for vendor rules, the SOC 2 and model-risk review the BSA officer expects, and the detection-coverage assurance test you run quarterly to confirm the engine is catching what it claims to catch.

Module 12. The surveillance manager's operating rhythm

A weekly alert-disposition review, a monthly QA sample, a quarterly rule-library refresh, a semi-annual back-test, an annual surveillance-policy refresh, and a continuous SRO-sharing channel. This module pulls the rhythm together with the calendar, the meeting agendas, the metrics that go to the surveillance committee, and the personal-development track for the manager (Series 24, ACAMS, CFE) so the role keeps maturing alongside the regulation.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 2 is the one to read the day after a rule misses a pattern at market open. It is the back-test and change-control discipline that turns a tuning into a defensible decision.

Modules 3 through 5 are the typology library. Read them when a new pattern appears in the SRO's regulatory notices or when the surveillance committee asks why a specific rule is set the way it is.

Modules 6 and 7 are the disposition standard and the SAR narrative. They are the daily craft of the role and the artefacts the examiner reads first.

Modules 10 and 11 are the examination-readiness and vendor-governance modules. They are the ones to keep in arm's reach in the quarter before a FINRA cycle exam.

What you get with this course

Twelve written modules, each with the rule-library template, the back-test data structure, the disposition note template, the SAR narrative skeleton, and worked examples on equities and listed options.
Downloadable rule register, alert-disposition standard, SAR narrative skeleton, 314(b) request template, surveillance committee minutes structure, and examination-readiness document inventory.
Hand-built implementation playbook tuned to your detection engine, your case-management system, and your firm's order-management output.
Access in the Art of Service learning environment.
30-day money-back guarantee.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: learning environment account provisioned and implementation playbook delivered alongside.

Week 1: complete the rule library and parameter ownership module, produce the firm's rule register.

Weeks 2 to 4: work through the typology modules in the order the next surveillance committee cycle needs them.

Week 6: run the first quarterly back-test using the module 2 structure.

Quarterly: refresh the rule register and the examination-readiness document inventory.

Before and after

Before

Surveillance is reactive. Rule changes happen quietly. SAR narratives read differently depending on who drafted them. The FINRA exam request letter triggers a two-week document scramble.

After

Surveillance is a documented discipline. Every rule has an owner, a parameter rationale, and a back-test history. Dispositions look the same on a busy month-end and a quiet Tuesday. SAR narratives read clearly. The examination request letter triggers a document handoff, not a scramble.

What happens if you do not address this

Undocumented parameter changes are the single most-cited finding in FINRA Department of Market Regulation exams of surveillance functions. The risk is not that the engine misses a pattern. The risk is that the engine misses a pattern, the change-control record is thin, and the firm cannot show the supervisory diligence the rule requires.

Who it is for

Trading fraud manager, surveillance manager, market-abuse analyst, or BSA/AML investigator at a US broker-dealer, prime broker, or wealth platform. Owns or contributes to the surveillance-rule library, alert disposition standard, SAR narrative, and SRO information-sharing workflow. Comfortable reading order-management and detection-engine output. Has FINRA Series 7 and Series 24 or equivalent, or is working toward them.

Who this is NOT for. Not for retail compliance generalists with no surveillance-engine exposure, not for fixed-income credit-risk specialists, not for fraud analysts whose remit is account takeover and identity fraud rather than market-abuse patterns. Not a primer on options mechanics or market microstructure.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 12 to 18 hours of reading across the twelve modules. The implementation playbook is a separate working document the manager uses across the next two quarters.

Why $199 is the right number

FINRA's continuing-education catalogue covers the rules. ACAMS covers the BSA layer. SIFMA produces good roundtable summaries. None of them give you the rule-library template, the back-test data structure, the disposition standard, and the SAR narrative skeleton in one place written for the trading fraud manager who has to do the work on Monday morning.

FAQ

Does the course assume a specific surveillance engine?

No. The rule definitions and parameter logic are engine-agnostic. The implementation playbook is tuned to whichever engine you run.

Is the SAR module written for the BSA officer or for the surveillance manager?

For the surveillance manager who drafts. The handoff to the BSA officer is module 8.

Does it cover crypto or futures surveillance?

No. The scope is US equities and listed options. The typology library will extend to other asset classes in a future version.

How current is the regulatory citation set?

Citations track the current FINRA rule book and the most recent Department of Market Regulation guidance available at provisioning time. The implementation playbook is dated.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.