OneTick Trade and Market Surveillance
Detect and alert on complex trading patterns and evolving market misconduct activities with OneTick Surveillance.
Upgrade Your Surveillance
OneTick Trade Surveillance gives all clients the power to monitor and protect their trading in both fully hosted and deployed configurations. The OneTick solution is used by tier 1 banks, exchanges and market centers, routing and executing brokers, clearing firms, FCMs, market-makers, retail brokers, and buy-side firms.
OneTick includes coverage of MAR, MiFID II, SEC, FINRA, and IIROC trade surveillance regulation.
Trusted by











Comprehensive Coverage
Specific Misconduct Categorization
Detect a Wide Range of Market Misconduct with OneTick
Spoofing and Layering: The system includes several alert models specifically designed for detecting spoofing and layering activities, including variants that cover important legal cases such as Post and Flip (related to the Igor Oystacher case) and FX Forwards cross-product Layering and Spoofing. It supports detection based on participants' order books, market data, and order book imbalance approaches.
Insider Trading: Detects activities like Position Accumulation (which can be augmented with news, excess return, liquidation, and aggressiveness checks), Insider Trading Pattern alerts, and Conflict of Interest alerts (e.g., wall-crossed traders or directors).
Wash Trading & Cross Trading: Identifies wash trading and cross trading, often associated with money laundering, with customization options for circular trading patterns.
Front-Running: Covers multiple variants, including stop loss trigger, take profit front running, and tailgating/trade-along.
Market Manipulation: Addresses a broad spectrum of price manipulation, such as pump and dump, fix manipulation (including Marking the Close/Open), unusual trader and market activity, and dark price manipulation in dark pools and derivatives.
Other Manipulative Behaviors: Specific alert models also include Advancing The Bid, Cancelled Large Order Followed by an Execution on the Opposite Side, Dark Pool Gaming, Painting The Tape, Pinging, Quote Stuffing, Smoking, Withholding Trades, and many more.
Advanced Analytics & Alert Management
Accuracy & Efficiency
OneTick Uses Advanced Techniques to Improve Alert Accuracy and Efficiency
Machine Learning (ML) and Artificial Intelligence (AI): OneTick leverages ML and AI to reduce false positives and trigger alerts more effectively. This includes self-tuning alert models that automatically adjust parameters based on market conditions, significantly reducing the need for manual tuning.
Alert Scoring with ML: Utilizes ML to score alerts, ranking them based on internal indicators of abusive behavior. This allows analysts to prioritize investigations by focusing on the strongest cases. For SaaS customers, this extends to unsupervised clustering to determine trader cohorts and compare behavior against norms.
Explainability: OneTick prioritizes white-box models for transparency and provides source code for all models (rules-based, statistical, non-linear). For complex LLM-based capabilities, OneTick ensures strict control over inputs and outputs, data access, and provides full traceability.
Dynamic Thresholds: Many alert models feature automatic dynamic adjustment or market-tuning of parameters based on real-time market conditions (e.g., spread, intraday moving windows) or historical profiles, ensuring alerts remain useful across diverse market scenarios without constant manual intervention.
Pattern Alerts: Allows for alerts to be defined on top of other exceptions or alerts, offering flexibility and potentially substituting for multiple overlapping surveillance perimeters for more economical runtime analysis..
Cross-Product & Cross-Market Surveillance
Detect Manipulation Across Correlated Instruments
More Interconnected? More Essential Than Ever: Cross-Product and Cross-Market
OneTick supports cross-product and cross-market monitoring based on both structural correlations (e.g., underlying assets and their derivatives) and non-structural correlations.
The system can ingest externally-supplied correlation matrices or OMD can generate them from market data as a 'correlations factory'. This allows for detecting manipulation across correlated instruments, even if not structurally linked (e.g., correlated chip stocks).
Examples include: "Mini manipulation" alerts (equity/futures underlier and options), Imbalanced Trading (ramping, momentum), and Insider Dealing across issuer products.
Efficient Alert Management & Compliance Workflows
From Detection to Resolution
Flexible Run Modes: Alerts can operate in real-time (CEP) for immediate market disruption events, intraday for most market abuse scenarios, or T+1/daily for multi-day and profile-based alerts like Insider Dealing.
Recording Types: Alerts are a primary output, but the system also generates Exceptions, Pattern Alerts, Reports, and Sanity checks (for data quality issues).
Case Management System (CMS) Integration: Alerts are automatically swept into the fully-featured CMS, which supports dashboard-based workflow design, case merging/unmerging, document attachment, full-text search, auditable comments, and periodic reminder emails.
Tune Dashboards for Calibration: Provides a "sandbox mode" to adjust and test alert parameters without affecting the production environment, allowing users to minimize false positive rates and compare experimental runs.

Intuitive Investigation & Comprehensive Data Handling
The Data Capabilities You Require
Highly performant & customizable user interface with all of the data capabilities you require
Triage Dashboards: Offers web-based dashboards for efficient review, rapid triage, assigning, reviewing, annotating, and archiving alerts. Features include flexible filtering and grouping, contextual visualizations showing order states and market data, and multi-day/multi-quote views.
Order Book Replay (OBR): Provides a dynamic, visual representation of the order book, allowing users to step through interleaved market and firm/customer orders state by state. It can be launched directly from an alert, with the relevant instrument and time range pre-selected, and allows filtering by specific participants. News and alerts can be overlaid on the market timeline for enhanced context.
Smart Compliance Insights Lab (SC(A)IL): A SaaS environment based on JupyterLab for deep compliance investigations. It allows users to ask ad-hoc questions using SQL, Python & Pandas, or natural language (via an AI query assistant), create custom visualizations, and generate aggregate reports. It also supports creating "guest alerts" that integrate into the surveillance system.
Robust Data Ingestion: The OneTick engine supports the simultaneous collection of many real-time data sources, including FIX, Kafka, AMQP, and various proprietary feeds, with high-performance collectors tested at over 500,000 messages per second. It handles diverse data types like reference data, orders, trades, news, and corporate actions.
Data Quality Assurance (QA): The system performs dynamic data QA at several stages, including during loading and normalization, and prior to alert generation. It includes a large set of standard "sanity checks" to assess data quality and completeness, which can be configured to block downstream processing if issues are detected.
Robust Support & Implementation Partnership
Ongoing Support
The OneTick team is here to help you manage your projects with ongoing support.
Project Framework: OMD employs a hybrid project methodology combining elements of Waterfall, Scrum, and Kanban to ensure efficient implementation. There is a strong emphasis on a transparent project framework, providing customers with full access to project management tools like Jira and Confluence to track tasks, participate in planning, and monitor progress.
Comprehensive Support: Includes Product Support (updates, troubleshooting, issue resolution with defined SLAs), Managed Services (24x6 system monitoring and remediation for SaaS/PaaS customers), and Professional Services for customization work. Detailed escalation procedures are in place for complex issues.
Training: Offers various types of training, including business end-user training (triage, deeper investigation, CMS workflows), quantitative developer training (alerts development in Python/OneTick Query Language), and access to the OneTick Academy online learning platform