If you can't explain it, you don't control it: surveillance explainability starts long before AI

The FCA’s latest Market Watch shows having surveillance isn’t enough. If your team can’t explain how it works, you can’t evidence it as a control.

The FCA's latest Market Watch, published this week, sets out what it found when it reviewed the market abuse surveillance arrangements at seven UK retail brokers. Every firm had automated surveillance in place. Every firm had written policies for identifying, investigating and reporting suspicious activity. And yet the FCA found material weaknesses in how those arrangements had been designed, implemented and run.

One finding stands out. The FCA met people responsible for surveillance who could not adequately explain how their systems worked, with some relying on out-of-the-box settings from third-party vendors. The regulator's concern was simple: if nobody understands the system, nobody will spot its weaknesses or challenge them.

That point applies to any surveillance programme, whether the activity being monitored is a trade, a chat, an email or a call. Market abuse rarely shows up in one data set alone, and trade and communications surveillance are two halves of the same obligation. The question every head of compliance should be asking after reading it is not whether they have surveillance. It is whether their team truly understands it.

Explainability is bigger than AI

Most of the industry's conversation about explainability has centred on AI, and rightly so. If a model flags a conversation, a reviewer needs to see why. But the FCA's findings are a reminder that the problem is much older and much wider than machine learning.

Every surveillance system is a long chain of decisions. Which channels are captured. How voice is transcribed and how other languages are translated. Which lexicon terms apply to which desks. Where thresholds sit, what gets sampled and what gets excluded. How an alert is triaged, when it is escalated and what tips it into a STOR. Each of those is a control, and each needs to be explainable in plain terms by the people who operate it and the senior manager accountable for it.

The FCA also noted that some firms treated the existence of an alert as proof of an effective control. It is an easy assumption to make and a hard one to defend. An alert that nobody can explain, and that has never been shown to catch what it was designed to catch, is a configuration rather than a control. The firms that fared better were those that used QA findings, STOR outcomes and calibration reviews to evidence that their controls actually worked.

A practical test is to ask your team to explain, without reaching for vendor documentation, why your highest-volume alerts fire and why the quietest ones almost never do. The second answer is usually the more revealing.

Calibration has to reflect the business you actually run

The FCA found firms using a single price-move threshold across stocks with very different volatility, and others setting a minimum trade value so high that much of their clients' activity was never monitored at all. Neither firm lacked an alert. Both had calibrated it to a business they did not have.

The same thing happens in communications surveillance, often less visibly. One lexicon applied identically to a rates desk and a sales team. A channel left out of scope because volumes looked low or capture only went live recently. A voice sampling rate set during implementation and never revisited. Each of these is a calibration decision, whether or not anyone made it deliberately, and each quietly removes activity from review.

Good calibration starts from the firm's own risk assessment: its clients, instruments, desks, languages and channels. It is then tested properly. The FCA was clear that comparing alert volumes with trading volumes is not enough, because volume tells you a system is busy rather than that it works. It pointed to testing above and below thresholds and to running synthetic scenarios through the system to confirm alerts fire when they should. For communications, that means pushing a realistic conversation through the whole chain, from capture and transcription to alerting and review, and checking it surfaces at the end. And it means doing it again as the business changes, because calibration that was right two years ago may not be right now.

Defaults are where you start, not where you finish

We are a surveillance vendor, and we agree completely with the FCA's comment on out-of-the-box settings.

We build our default lexicons and models to be broadly sensible across many firms. But they cannot know the shorthand on your trading floor, the languages your people switch between, or which clients your sales team speaks to on WhatsApp. A vendor that hands over a system on default settings and walks away has delivered software. It has not helped a firm meet its obligations.

How we work with you

Our view is that a firm should understand and control its surveillance as thoroughly as it would any other critical control, and that a vendor's job is to make that possible rather than to ask for trust.

That starts with architecture. Because VX1 brings capture and communications surveillance together on a single platform, your team can follow a message or call from the moment it is captured through to the alert and the review decision, without the gaps that open up when that journey crosses several vendors.

It continues through implementation. We calibrate with you against your own risk assessment rather than switching on defaults, and we document why each lexicon, rule and threshold is set the way it is, in language your analysts and your accountable senior manager can explain to a supervisor. Where AI is involved, the reasoning behind an alert is visible to the reviewer, and a person makes the decision.

And it carries on after go-live. Businesses change, desks move into new products, new channels come into scope. We work with your team to review and test calibration as that happens, so the system you rely on reflects the business you run today.

The goal is a surveillance programme your team owns rather than one it operates on someone else's behalf. Compliance, on your terms.

Three questions to take into your next surveillance review

Can your team explain why your highest-volume alerts fire, and what would stop them firing? When did you last test your surveillance with a realistic scenario across the whole process, including voice, and confirm it surfaced? And is there one person who can describe the journey from a message being sent to a STOR being filed, across every channel in scope?

If any of those answers is uncertain, the FCA has just made clear how it is likely to view that.

If you would like to talk through how your surveillance is calibrated and tested, our team would be glad to help.

Source: FCA, Market Watch 86, October 2026