TT Trade Surveillance

Cluster Scorecard

Cluster Scorecard

The Cluster Scorecard view provides a summary of the vital statistics of the cluster as well as an initial visualization of the pattern that was formed by the order and fill messages that comprised the cluster. You can laos view the activity in the cluster in the context of the market data at the time.

Clicking the Inspect button in the Actions column of the Cluster List View opens the scorecard for the selected cluster.

Cluster Scorecard display

The Cluster Scorecard is organized into the following sections.

Sections include:

  1. Cluster Statistics and Scorecard Metrics: Displays statistics and metrics for the trading activity analyzed within the cluster.
  2. Filled Positions and Working Orders: For the Spoofing model, displays the trading activity and volume of contracts traded within the cluster over a period of time. The trading details at each time interval is displayed when hovering over the chart. Note: The Abusive Messaging and Marking the Close models each have their own chart in the cluster scorecard.
  3. Market replay: Provides different time-based views of the trading activity overlaid with market data in a ladder view or a macro view.
  4. Audit Messages: Shows the actual order actions and fills from the audit trail. Rows are color coded by action and side. Click each row to display the order history or fill details.
  5. Review: Allows you to review a cluster.

Cluster statistics and scorecard metrics

The Cluster Statistics and Scorecard Metrics sections provide general information about the cluster as well as model-specific details.

The lower part of the Cluster Statistics section includes summary details about the cluster.

Statistics include:

  • Total Events: Total number of messages sent and received
  • Placed Orders: Number of orders submitted
  • Canceled Orders: Number of orders canceled
  • Partial Fills: Number of partial fills received
  • Modified Orders: Number of order modified
  • Complete Fills: Number of fully-filled orders
  • Rejected Orders: Number of order rejected
  • Buy Filled Volume: Number of Buy contracts traded
  • Sell Filled Volume: Number of Sell contracts traded
  • Duration: Length of time covered by the cluster

The Scorecard Metrics section shows model-specific information.

TT Trade Surveillance uses the following models to analyze data for problematic trading patterns:

  • Abusive Messaging: Quote stuffing schemes designed to introduce predictable latency into an exchange's quoting engine or malfunctioning algorithms that might cause market disruptions.
  • Automated Collusive Spoofing: Patterns of manipulative or disruptive trading activity by multiple traders working together to automatically submit a number of orders for which they have no intention of executing in an attempt to move the market.
  • Automated Spoofing: Patterns of manipulative or disruptive trading activity that involve the automated placement of a number of orders for which a trader has no intention of executing in an attempt to move the market.
  • Collusive Spoofing: Patterns of manipulative or disruptive trading activity by multiple traders working together to place a number of orders for which they have no intention of executing in an attempt to move the market.
  • Cross Trading: A cross trade occurs when a buy order and a sell order for the same instrument are entered for different accounts under the same management, such as a broker or portfolio manager.
  • Exchange Messaging Rate Limits: Instances where traders exceeded the exchange message rate limit for a set period of time during a trading session.
  • Influencing the Open: Instances where indirect wash trades occurred at the open of trading in violation of exchange rules.
  • Marking the Close: Trading activity intended to manipulate the settlement price of an instrument during its settlement period.
  • Momentum Ignition: Behaviors that indicate an attempt to create an artificial price movement with aggressive orders followed by an attempt to capitalize on such movement.
  • Pinging: The entry of multiple small orders intended to discover hidden book depth followed by a series of order actions designed to force the large order to trade at less desirable prices.
  • Price Ramping: Behavior that may be an attempt to create artificial price movement with aggressive orders.
  • Spoofing: Patterns of manipulative or disruptive trading activity that involve the placement of a number of orders for which a trader has no intention of executing in an attempt to move the market.
  • Wash Account: The same account ID is both the buyer and seller in the same transaction.
  • Wash Trader: The same trader ID is both the buyer and seller in the same transaction.
  • Dominance at Open: A single trader's orders make up the majority of the disclosed market volume of an instrument during the first 15 minutes of the current trading session.
  • Order Book Dominance: A single trader's working orders make up the majority of the disclosed market volume of an instrument at any time during a trading session.

Filled positions and working orders

The Spoofing chart shows the buys and sells (working and filled) along with Iceberg (disclosed) volume and markers when the trader is flipping the market.

You can hover the mouse over a spot the chart to view the trading details in the audit trail.

Audit trail

This section shows the actual order actions from the audit trail with some minor normalization of things like Order Type, Side and Order Action. Rows are color coded by action and side. Click the column selector () above the audit trail to show additional columns.

Audit fields are described in the following table.

Field Description
Timestamp Date and time the order was submitted.
Order ID Unique TT order ID for internal tracking.
Transaction ID The transaction identifier generated by and received from the Exchange.
Action Type of order or fill action on the execution report.
Side The side of trade (Buy or Sell).
Price Order price
Order Qty Order quantity
Leaves Qty Remaining order quantity
Position The user's position. Positive numbers indicate a long position. Negative numbers indicate a short position.
Type The order type. Supported order types vary by exchange.
TIF The order Time-In-Force restriction. Supported TIFs vary by exchange.
Account Account ID associated with the order.
Exchanges Time For messages going to the exchange, this represents when the message is sent to the exchange from the order server. For messages received from the exchange, this represents when the message is sent from the order server to the rest of the TT platform.
Exch ID Exchange defined execution identifier.
Order ID Unique TT order ID for internal tracking.
User ID The TT platform user identifier.
CAT Crossing Action Type
Modifier The modifier applied to the order. Example: Stop, If Touched, Trailing Stop, Trailing IT, Trailing Limit, Machine Gun
Order Status State of the order on the execution report.
Working Quantity The total order quantity working in the market.
Modifier The modifier applied to the order. Example: Stop, If Touched, Trailing Stop, Trailing IT, Trailing Limit, Machine Gun
Agressorindicator Indicates an aggressive order: true or false.
Parent ID Parent order identifier.
CustOrderCapacity/td> The FIX Tag 1031 value on the order message.
ManualOrderIndicator/td> Indication of manual or automated order entry. Sent to the exchange in FIX Tag 1028.
AvgPx Average price of the filled order.
BrokerId Identifier of the broker submitting the order.
RefreshQty The amount to refresh the displayed quantity at the exchange, typically set on Iceberg orders.
Source Shows where the order originated from.
TrdMatchId The user's trade match prevention identifier.
Exec Type Type of order or fill action on the execution report.
DisplayQty The amount of the order to be publicly displayed at the exchange, typically set on iceberg orders.
LastQty The amount filled on the order.
CumQty The total quantity filled.
MinQty The minimum quantity to be executed.
TradeType The type of trade submitted.
AlgoId For TT synthetic and algorithm orders, the identifier of the algorithm controlling the order.
CrossId Self match prevention identifier provided by the exchange.
CurrUserId identifier of the user who last touched an orders.
ExecInst Execution instruction.
StopPx Price at which price-triggered orders were executed.
SenderSubId Identifier of the user submitting the trade. Value of FIX Tag 50.
AccountOverride Account sent to the exchange as the clearing account.
EchoDc1 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc10 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc2 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc3 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc4 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc5 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc6 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc7 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc8 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
EchoDc9 Customer-defined text field that can be populated by FIX client applications. The value is not sent to the exchange, but remains visible in TT.
Giveup The giveup party account.
LastPx Price of this fill.
LegCumQty The total quantity filled for the leg.
OmaParentOrderId Unique TT Order ID for an OMA parent order.
OrdRejReason Reason the order was rejected at the exchange.
OrderOrigination Identifies the origin of the order.
OrderSequence Order message sequence number.
SecondaryExecId Unique TT execution ID for the execution type.
SecondaryOrderId Identifier for the party accepting the order.
SyntheticType Type of synthetic parent order.
TextA Optional, user-defined text value. Remains on the order in the TT system.
TextB Optional, user-defined text value. Remains on the order in the TT system.
TextC Read-only, customer-defined text value set by FIX client applications. The value is not sent to the exchange.
Text Optional, user-defined text value. Remains on submitted orders for tracking purposes in the TT system, but is not routed to the exchange.

Order history

You can view the life cycle of a selected order in your cluster by clicking an order event row in the Audit Messages section. The order history appears under displays beneath the selected order.

This order history includes the following columns:

Field Description
Time Date and time the order was submitted.
Exch Exchange defined execution identifier.
Exec Type Type of order or fill action on the execution report.
Order Type The order type. Supported order types vary by exchange.
Order Status The order status at the exchange.
Order ID Unique TT order ID for internal tracking.
B/S The side of trade (Buy or Sell).
Price The order price.
Last Price The last traded price.
OrdQty Order quantity
FillQty Filled Order quantity
RemQty Remaining order quantity
TIF The order Time-In-Force restriction. Supported TIFs vary by exchange.
Acct Account used to submit the order.

Market Replay

The Market Replay section of the Cluster Scorecard lets users view the cluster data overlaid on the market data as it occurred over time. Click Load MD Trader to display the market replay ladder and playback controls.

Users can display the replay data with the following views:

  • Ladder view: Replays the market activity in a ladder-like interface as it occurred during the time period covered by the cluster.
  • Dual Ladder view: Allows viewing market activity in a second instrument to access potential trading impact.

Ladder view

The Ladder view is a research tool that provides users with a frame-by-frame replay of the trading activity overlaid with Level 2 market data on a ladder-style interface. The ladder is 10 ticks deep and displays all market data, including the orders for each relevant participant in the order book. Users can stop, start and rewind the playback of the activity within a given cluster in order to gain a precise understanding of the sequence of events that occurred in the order book and how the trader’s orders impacted the market.

The ladder view includes the following:

  1. Interactive display of the market ladder for the specified time frame.
  2. Graph of trading activity showing buy and sell orders along with a bar indicating the current time in the replay.
  3. List of Audit Trail messages that comprise the activity included in the Market Replay.

Click Play to watch the market react as the order activity in the audit messages are replayed. As the market replays, a vertical bar tracks the progress in the graph and the audit messages are added as they occur. The Audit Message section lists the history of every audit message generated from the start of the replay to the current point in time of the market replay. You can start, stop and rewind the activity to help get a clearer picture of potentially problematic trading activity.

The market replay includes the following:

  1. Total number of frames in the replay and the frame number currently being displayed.
  2. Interactive controls to play and rewind trading activity in the ladder.
  3. Price ladder and state of the market at the indicated time.
  4. The trader's working, displayed, undisclosed, and filled quantity at a price level.

Working order display in the Ladder view

When working orders are shown in the market replay, the corresponding cell in the working orders Work column contains abbreviations and colors to assist you in tracking and managing your working orders. The text and colors vary based on order type and order status. Refer to the following table for a description of the abbreviations and colors that appear in the working orders column.

Work Column Display

Description

Appears for working buy or sell orders. The cell is highlighted blue for buy orders, red for sell orders or yellow when the price level contains both buy and sell orders. Abbreviations include:

  • W — Working order quantity.
  • B — Order quantity bought.
  • S — Order quantity sold.
  • E — Sum of order quantities when a price level has both buy and sell orders.

Appears when TT order types (e.g., TT Time Sliced) or native order types (Iceberg) with disclosed and undisclosed quantities were submitted. The cell is highlighted blue for buy orders, red for sell orders or yellow when the price level contains both buy and sell orders. Abbreviations include:

  • W — Working order quantity.
  • B — Order quantity bought.
  • S — Order quantity sold.
  • E — Sum of order quantities when a price level has both buy and sell orders.
  • D — Disclosed order quantity.
  • U — Undisclosed order quantity

Dual Ladder View

The Dual Ladder View allows users to compare and view a related instrument in a second ladder in addition to the ladder from any Trade Surveillance cluster. When enabled, users can view the trader's activity in the cluster specific instrument while loading any instrument in a second ladder.

The second ladder displays market activity that occurs at the same time as the first ladder. This allows you to review the potential market impact of the trader's activity in a similar, related product, or to demonstrate that the user's activity in the cluster was due to a change in market conditions in a separate instrument.

To view a second instrument in Dual Ladder View:

  1. Open the cluster you wish to review and click the Load MD Trader button.

  2. Above the MD Trader, click the Compare button.

  3. A Market Explorer window opens allowing you to find and select the product you wish to compare.Note: You must have market data enabled for the exchange and products you want to compare.

  4. Press the Select Instrument button. The second ladder appears showing market data from the new instrument.

Cluster scorecard review

The scorecard contains a Review button that launches the Review Sidebar for recording dispositions, viewing disposition history, and opening investigations.

Cluster review

From within the Review Sidebar you can:

  1. Enter a disposition for this cluster group.
  2. View the review history for this cluster group
  3. Add this cluster to an existing investigation or create a new investigation to which to add this cluster.