Trade Surveillance & Market Integrity for Crypto Exchanges
It runs natively on the exchange stack — the matching engine is the data source, so there is no market-data integration project and no separate vendor feed to license. AML answers who your customers are; trade surveillance answers how participants behave in your markets.
Request a Console Demo
How a Manipulation Pattern Becomes a Closed Case
Five stages, all inside the venue. No export to a third-party analytics tool, no waiting on a nightly file.
Capture every market event
Surveillance consumes the full order lifecycle straight from the matching engine — submissions, amendments, cancellations and fills — with account, session and device context attached. Nothing is sampled or reconstructed.
Detect the manipulation pattern
Rules and behavioural models score conduct against named typologies: spoofing and layering, wash trading, abnormal execution, ramping and cross-market manipulation. Detection runs on live order flow.
Triage the alert queue
Alerts are scored for severity and grouped, so duplicate hits on the same accounts and time window become one investigation instead of six. Each gets an owner and a review clock, and analysts work conduct rather than clearing a list.
Investigate with market replay
Every alert opens onto a replay of the order book as it stood when the alert fired, beside the related account cluster and the evidence collected automatically. Analysts add reasoning and annotations; nobody reassembles the exhibit by hand.
Record the determination and report
Dismiss, warn, restrict or escalate — each outcome is recorded with its justification, its author and its timestamp, and feeds the market-integrity reports your compliance team and your regulator ask for.
The Surveillance Pipeline, End to End
One path from raw order flow to a case file somebody else can read six months later.
Six Manipulation Patterns, Named and Detected
Regulators and buyers both ask which typologies you cover. These are the six families the engine scores, in the language they use.
Spoofing & layering
Orders placed on one side of the book to create a false impression of demand, then cancelled once the market moves. Scored on order-to-cancel ratio, how briefly orders rest, distance from the best price, and the fill that lands on the opposite side.
Wash trading & self-matching
Trades between accounts under common control that manufacture volume without transferring risk. Opposite-side orders are paired, net position change is tested across the linked accounts, and self-matches inside a single account are flagged outright.
Abnormal execution
Execution that does not fit the market or the account behind it: outsized aggression into thin books, repeated marking near a settlement window, quote stuffing, and order rates that degrade the book for everyone else trading it.
Ramping & momentum ignition
Coordinated buying or selling meant to start a price move that others follow. Detection correlates order flow with price impact and watches which accounts quietly reverse position once the move is under way.
Cross-market manipulation
Conduct that only looks wrong when two markets are read together — pressure applied to a spot order book that pays off in the perpetual, or the reverse. Detection runs across every market on the venue, not one book at a time.
Suspicious account clusters
Accounts linked by device fingerprint, funding path, withdrawal address or session timing are grouped into one cluster with a confidence level, so conduct spread thin across many small accounts is scored as a single actor.
Alerts, Replay, Clusters and Cases in One Console
The surveillance console is the product. Everything an analyst needs to decide whether conduct was manipulative sits on one screen, already assembled.
Alert console scored, grouped, assigned
Alerts arrive scored for severity and grouped by accounts and time window, so a burst of related hits becomes one investigation. Filters cover market, typology, severity and age, and every alert carries an owner and a review clock.
- Severity scoring on every alert, tuned per venue
- Duplicate alerts grouped into a single investigation
- Assignment, review clocks and per-analyst workload
- Typology mix visible across the last 24 hours
AML Monitoring vs Trade Surveillance
Both are compliance, and most regulated venues need both — but they read different data, catch different behaviour and usually report to different people. AML monitoring watches customers and funds; trade surveillance watches conduct in your markets.
| # | Question | AML / KYC / KYT monitoring | Trade surveillance |
|---|---|---|---|
| 1 | What it watches | Customers and fundsidentity, source of funds, deposits and withdrawals | Conduct in your marketsorders, cancellations, fills and the accounts behind them |
| 2 | Typical trigger | Sanctions match, risky counterparty, structuring | Spoofing, wash trading, ramping, abnormal execution |
| 3 | Primary data source | KYC records, chain analytics, payment rails | The order lifecycle from the matching engine |
| 4 | Investigation output | Case narrative and suspicious activity report | Case file with market replay and a conduct determination |
| 5 | Who owns it | MLRO and the financial-crime team | Market-integrity or market-surveillance officer |
Escalation, Evidence and an Audit Trail That Holds Up
Detection is the easy half. What a compliance team is judged on is whether every alert was reviewed, by whom, on what evidence, and with what reasoning — and whether that record still makes sense a year later.
Built for the Obligations Your Licence Puts on You
Coiny provides the surveillance software and the investigation workflow. It does not provide legal advice, regulatory licensing, or certification that a venue is compliant — the determination stays with your compliance team, and the audit trail exists so that team can evidence it. Coverage is designed to support market-abuse obligations such as those introduced by MiCA.
Where Surveillance Sits in the Coiny Stack
Market-conduct surveillance is one layer of a compliance programme. These are the pieces around it.
Teams Accountable for What Happens in the Market
Surveillance is bought by the person who has to answer for conduct on the venue — not by the person who has to run the matching engine.
Market-integrity officers
Typology coverage they can name in a regulatory conversation, and a case file that still reads clearly six months later.
Heads of compliance at exchange operators
Market-abuse monitoring in place before a licence review asks for it, without a six-figure vendor contract attached.
White-label operators launching a venue
Need surveillance switched on from day one, because a new venue attracts its first manipulative actors long before it attracts serious volume.
Derivatives and multi-market venues
Cross-market detection, because conduct on a spot book that pays off in a perpetual is invisible to a tool reading one market.
Trade Surveillance FAQ
AML monitoring watches who your customers are and where their funds come from, while trade surveillance watches how participants behave in your markets. Anti-money-laundering and know-your-customer systems screen identity, sanctions exposure and transaction flows; trade surveillance reads the order lifecycle for manipulation such as spoofing and wash trading. Coiny Exchange ships both, and most regulated venues need both — they answer different questions and are usually owned by different teams.
Wash trading is trading between accounts under common control that creates the appearance of volume without transferring any real risk. Exchanges detect it by pairing opposite-side orders that meet each other, testing whether the accounts involved end the sequence with an unchanged net position, and linking those accounts through shared devices, funding paths or session timing. Coiny Exchange's surveillance scores all three signals together and opens one investigation for the pair.
Spoofing is placing orders with no intention of trading them, to create a false impression of supply or demand, then cancelling once the market reacts. Layering is the same behaviour spread across several price levels at once. Coiny Exchange's surveillance detects it from order-to-cancel ratios, how briefly orders rest, how far they sit from the best price, and whether a fill lands on the opposite side just before the orders are withdrawn.
Market replay reconstructs the order book exactly as it stood while an alert was firing, so an analyst can watch the conduct happen instead of reading it out of a log. In Coiny Exchange's surveillance console every alert opens onto its replay window, with the subject's orders, amendments, cancellations and fills marked on the timeline alongside the related account cluster and the evidence already collected for the case.
Suspicious account clusters are groups of accounts that behave as a single actor, identified from signals the exchange already holds: shared device fingerprints, common funding paths, overlapping withdrawal addresses, correlated session times and repeated opposite-side order pairing. Coiny Exchange scores those links into a cluster with a confidence level, so conduct deliberately spread thin across many small accounts is investigated as one case rather than dismissed as noise.
Trade surveillance on Coiny Exchange runs across every market a venue operates — spot, margin and derivatives — from one detection engine. That matters because some manipulation only looks wrong when two markets are read together, such as pressure applied to a spot order book that pays off in the corresponding perpetual contract. Cross-market patterns raise a single correlated alert instead of two unrelated ones that nobody joins up.
Trade surveillance software does not make an exchange compliant; it gives the exchange the evidence and the workflow that a compliance programme runs on. Coiny Exchange provides the detection engine, the investigation console, the case record and the reporting, designed to support market-abuse obligations such as those in MiCA. Licensing, legal interpretation and every conduct determination remain with your own compliance team and advisers.
Ready to See Manipulation Detected on Your Own Markets?
Book a walkthrough of the alert console, market replay, account clustering and case management — and we will map the typologies to the markets you actually run.
Book a Demo