1. Purpose
This document describes trading, order, account and blockchain activity that IDSX may identify as unusual and subject to enhanced surveillance or review. Its purposes are to identify disorderly or abusive activity and patterns inconsistent with normal behaviour, support investigation, fair markets and detection of manipulation, misuse of information or coordination, and support the wider Market Surveillance Framework.
2. Unusual Activity Does Not Automatically Mean Misconduct
Unusual activity is not necessarily improper. An alert indicates a need for review; it does not establish a Rule breach or create a presumption of misconduct. Assess alerts in market context and available information. Legitimate trading may generate alerts.
3. Risk-Based Monitoring
Thresholds may vary by liquidity, market capitalisation, volume, active investors, free float, ownership concentration, price, volatility, listing age, Market Maker participation and security characteristics.
4. Price Movement Alerts
Alerts may reflect rapid increases or declines, repeated gaps, moves beyond historical volatility, unexplained changes, unusual movement near open or close, or rapid reversals.
5. Volume Alerts
Review may be triggered by volume materially above history, short-term concentration, volume from few accounts, repeated large trades, turnover unusual relative to free float or patterns inconsistent with recent trading.
6. Price and Volume Combination
Elevated priority may apply to rapid moves with unusual buying or selling, activity driven by connected accounts, or abnormal volume before material Issuer announcements.
7. Order Entry Monitoring
IDSX may review unusually large or repeated orders, rapid submissions, repeated amendments, concentrated price levels and sizes materially different from normal market behaviour.
8. Order Cancellation Monitoring
Review may consider orders placed and immediately cancelled, high cancellation-to-execution ratios, large orders cancelled when opposing interest appears, cancellation following opposite-side movement, and patterns apparently intended to influence depth.
9. Spoofing Indicators
Potential indicators include visible orders without genuine execution intent, rapid cancellation, simultaneous execution on the other side, repeated patterns and orders apparently designed to mislead about supply or demand.
10. Layering Indicators
Potential layering includes orders at multiple price levels that create apparent pressure, cancellation after opposite-side execution, repeated directional patterns and behaviour inconsistent with genuine execution intent.
11. Self-Trading Monitoring
IDSX may monitor trades where both sides appear under common beneficial ownership, control, accounts, funding or withdrawal sources, wallets or coordinated timing. Self-trading alone does not establish misconduct.
12. Wash Trading Indicators
Potential wash trading may involve no meaningful beneficial-owner change, artificial volume, trades between controlled accounts, securities returning to the original owner, or apparent creation of misleading liquidity or interest.
13. Matched Order Monitoring
IDSX may review apparently coordinated orders matching in price, quantity, closely aligned timing, repeated counterparties, linked beneficial owners or recurring execution patterns.
14. Circular Trading
Securities may pass through related accounts and return directly or indirectly to their original owner or control group. Review may follow apparent volume manufacture, ownership concealment, price manipulation, false liquidity or circumvention of surveillance.
15. Concentrated Trading
IDSX may review activity disproportionately generated by one account or owner, a Broker, Trading Participant, related-account group or small number of wallets. Concentration alone does not establish misconduct.
16. New Listing Monitoring
Recently admitted securities may receive enhanced monitoring for extreme initial volatility, concentrated buying, rapid movement from offering price, related-party activity, abrupt liquidity changes, abnormal Market Maker behaviour and significant post-admission blockchain transfers.
17. Low-Liquidity Securities
Thresholds may reflect normal spread, typical trade size, depth, active holders, Market Maker activity, free float and ownership concentration. Distinguish ordinary illiquidity from artificial price formation.
18. Activity Before Material Announcements
Trading shortly before earnings, capital raising, mergers, acquisitions, disposals, control changes, major contracts, regulatory developments, insolvency, dividends or other material disclosures may receive additional review.
19. Activity After Material Announcements
Review may consider concentrated trading, accounts positioned beforehand, rapid price movement, coordinated orders or evidence of prior knowledge.
20. Market Maker Monitoring
Review may be triggered by sudden quote withdrawal, unexplained spread widening, related-account trade concentration, artificial support, quoting inconsistent with obligations, sensitive-period liquidity withdrawal or patterns inconsistent with ordinary market making.
21. Broker-Level Monitoring
IDSX may identify activity concentrated through a Broker, including repeated suspicious accounts, abnormal cancellations, related-party trading, account-opening patterns, high-risk wallet activity, customer concentration or recurring alerts.
22. Trading Participant Monitoring
Enhanced surveillance may apply to abnormal messaging, unusual algorithmic behaviour, excessive cancellations, repeated breaches, unusual client concentration or recurring manipulation indicators.
23. Algorithmic Trading Monitoring
Automated flow may be assessed for excessive frequency, runaway algorithms, repetition, abnormal order-to-trade ratios, rapid cancellations, feedback loops, extreme price impact and unexpected reactions to market events.
24. Rapid Position Reversal
Review may follow aggressive accumulation that materially moves price and is rapidly sold or reversed, potentially indicating momentum ignition, pump-and-dump or other manipulation.
25. Large Order Monitoring
A large order may receive review if it materially affects liquidity or depth, is repeatedly entered and cancelled, causes significant movement, is inconsistent with account activity or links to other unusual conduct.
26. Small Trades with Large Price Impact
In illiquid securities, monitor repeated small trades with material price impact, progressively higher purchases, trades setting a reference price, valuation-time trades or small trades followed by larger trades benefiting from the price.
27. Marking the Close
Potential indicators include near-close trades materially changing closing price, repeated activity by one account, low-volume trades with disproportionate impact and activity linked to valuation or benchmarks.
28. Marking the Open
Similar monitoring may apply to activity apparently intended to influence opening prices or auctions.
29. Abnormal Spread Behaviour
IDSX may monitor sudden spread widening or narrowing, artificial best-bid or offer movements, unusual Market Maker quotes and spread movement inconsistent with available information.
30. Order Book Imbalance
Review may be triggered by unusually concentrated sides, large orders lacking execution intent, sudden depth changes, imbalances disappearing after opposite-side execution or coordination among connected accounts.
31. Blockchain Transfer Monitoring
For on-chain securities, indicators may include large transfers, rapid movement across wallets, related-wallet transfers, transfers near trading, newly created wallets, inconsistency with known ownership, and restricted or unapproved wallets.
32. Wallet Clustering Alerts
Wallets may be treated as potentially related where analytics indicate shared funding or withdrawal addresses, repeated patterns, identical timing, custody links, transfer sequences or other connections. These indicators do not prove common ownership.
33. Circular Token Transfers
IDSX may review securities moving among wallets and returning to the original or related wallet, owner or account, potentially concealing ownership, manufacturing activity or circumventing transfer rules.
34. Unusual Off-Market Transfers
Review may apply to transfers materially changing concentration, involving related parties, near corporate events, bypassing ordinary trading, involving unusual consideration or connected to later market activity.
35. Minting Alerts
Unusual supply changes may create high-priority alerts, including minting outside approved issuance, unexpected increases, unauthorised minting, inconsistency with Issuer records or unexplained repeated mint-and-burn activity.
36. Burning Alerts
Review may follow unexpected cancellation affecting circulating supply or holdings, lacking a recognised corporate action, involving unusual administration or creating reconciliation differences.
37. Administrative Wallet Monitoring
Privileged wallet actions may receive enhanced surveillance, including minting, burning, freezing or unfreezing, forced transfers, upgrades, whitelist changes and changes to transfer restrictions.
38. Wallet Whitelist Changes
Unusual approvals may include bulk changes, rapid approval and removal, approvals just before significant transfers, bypassing ordinary KYC or involving restricted jurisdictions or high-risk accounts.
39. Settlement Anomalies
IDSX may monitor repeated settlement failure or delay, delivery to unexpected wallets, unrelated third-party payment, cancellation after execution and reconciliation differences.
40. Account Funding Patterns
Where available, review may consider large pre-trade deposits, rapid post-profit withdrawals, third-party funding, common sources for multiple accounts, funding inconsistent with known activity and digital-asset funding from higher-risk wallets.
41. Related-Party Activity
Related-person trading may receive additional review when it materially affects price or volume, occurs around corporate events, does not meaningfully change ownership or lacks clear economic rationale.
42. Issuer-Connected Accounts
Accounts of directors, senior managers, controlling holders, employees, Sponsors, Underwriters, advisers or other Issuer-connected persons may receive enhanced monitoring around material events.
43. Promotional Activity
Trading associated with social campaigns, paid promotions, misleading commentary, sudden retail interest or rapid appreciation followed by concentrated selling may be reviewed.
44. Cross-Account Behaviour
Patterns may emerge only across related accounts, including coordinated entry, rotating buying, coordinated selling, artificial price maintenance or spreading activity to avoid thresholds.
45. Structuring to Avoid Monitoring
IDSX may investigate apparent avoidance through split orders, multiple accounts or wallets, alternating Brokers or dividing transfers into smaller amounts.
46. Surveillance Escalation
An alert may be closed where a clear legitimate explanation exists, sent for analyst review or enhanced monitoring, lead to information requests, formal investigation or interim restrictions, or be referred under Enforcement Rules.
47. Information Requests
IDSX may request transaction purpose, Client instructions, beneficial ownership, routing, account relationships, wallet ownership, funding, strategy, communications and other relevant records.
48. Legitimate Explanations
Possible explanations include portfolio rebalancing, hedging, Market Maker activity, corporate actions, institutional trades, Client liquidation, technical error, news, liquidity conditions or other genuine investment activity.
49. Surveillance Thresholds Are Confidential
Specific thresholds, algorithms and detection logic may remain confidential to prevent avoidance. This document does not disclose exact thresholds.
50. No Safe Harbour
Failure to trigger an automated alert does not establish compliance. IDSX may investigate any conduct raising market-integrity concerns.
51. Human Review
Trained personnel may assess market context, Client circumstances, security characteristics, legitimate strategies, Issuer information, related activity and Participant explanations.
52. Relationship with Market Surveillance Framework
This document forms part of the IDSX Market Surveillance Framework, which establishes overall structure; this document describes activity categories that may receive enhanced attention.
53. Relationship with Market Conduct Rules
An alert alone does not establish breach of Market Conduct Rules. Evidence indicating prohibited conduct may be escalated for investigation or enforcement.
54. Relationship with KYC / AML Monitoring
Trading patterns may also raise financial-crime concerns. Where legally permitted, relevant alerts may be shared with AML/CFT or compliance functions.
55. Relationship with Digital Securities Rules
Unusual blockchain, wallet, minting, burning or administrative activity may also require review under Digital Securities Rules.
56. Amendments
IDSX may amend or expand scenarios in response to new abuse techniques, market conditions, technology, Digital Security structures, surveillance experience or regulatory developments.
57. Effective Date
These requirements take effect on the date determined and published by IDSX.
IDSX · Unusual Trading Monitoring — Version 1.0