Escalation Upon Discovery of Prohibited Activity
Quick Answer
When a supervisor discovers indications of prohibited trading activity (alerts, exception reports, customer complaints, employee tips), the supervisor must recognize, investigate, and escalate. Internal escalation flows from the trading desk supervisor to the CCO, legal, and senior management. External escalation includes Form U4 amendments for AP-level disclosures, regulatory event reporting for regulatory and disciplinary events, and SAR filings for AML or fraud concerns. Manipulation or front-running discoveries require freezing trading, preserving electronic communications, order tickets, and surveillance records, and documenting the investigation under the broker-dealer books-and-records rules. A supervisor's failure to escalate is itself a supervisory-system failure independent of the underlying violation.
The trading-desk supervisor is the firm's first line of defense against prohibited activity. The duty is not just to monitor but to act on what monitoring reveals. The Series 24 exam tests the escalation pathway as a process: how the supervisor identifies a problem, who gets notified, what gets preserved, and how the firm protects itself against a supervisory-failure charge.
What Triggers Escalation
A supervisor must recognize indications of prohibited activity from multiple sources:
| Source | Examples |
|---|---|
| Alerts and exception reports | Trade-surveillance flags for spoofing patterns, marking-the-close, layering, near-breakpoint orders, just-under wash-trade thresholds |
| Customer complaints | Complaints about fills, missed price improvement, unauthorized trades |
| Employee tips | Whistleblower reports from other traders, operations staff, or compliance |
| Regulatory inquiries | FINRA blue-sheet requests, SEC subpoenas, exchange surveillance referrals |
| Self-discovery | A trader's own escalation of an error or a suspected colleague misconduct |
The supervisor cannot ignore a credible indication on the ground that the underlying activity has not been definitively proven. The duty is to investigate, not to wait until proof emerges on its own.
The Three-Step Supervisory Response
Under the FINRA supervisory-system requirement and the conduct rules covered in this unit, the supervisor's response has three steps:
Step 1: Recognize
- Read exception reports promptly and completely
- Take customer complaints seriously, even if they appear minor
- Treat employee tips as credible until proven otherwise
A supervisor who dismisses a credible indication has already failed Step 1.
Step 2: Investigate
- Interview employees involved (the trader, the operations team, any witnesses)
- Pull tickets and trade records for the time period in question
- Review communications: emails, chats, recorded phone lines (if applicable under the Taping Rule)
- Cross-reference with trade-surveillance alerts, trade-blotter exceptions, and best-execution review
The investigation must be documented. Memos, interview notes, and the disposition memo are required.
Step 3: Escalate
Based on the investigation, the supervisor escalates as appropriate.
Internal Escalation Pathway
| Step | Recipient | Trigger |
|---|---|---|
| 1 | Trading desk supervisor (the principal) | Initial finding |
| 2 | CCO (Chief Compliance Officer) | Confirmed concern requiring compliance review |
| 3 | Legal | Potential rule violation requiring legal analysis |
| 4 | Senior management | Material findings affecting firm-level decisions or external reporting |
| 5 | Audit committee / board | Where required by firm governance or external reporting obligations |
A small finding may stop at the CCO; a large finding may go all the way to the board. The supervisor's duty is to escalate at the appropriate level, not to make all judgment calls alone.
Exam Tip: Gotchas
- A supervisor's failure to escalate is itself a supervisory-system failure, separate from the underlying trading violation. A supervisor who knew of a Manning rule violation and did not escalate has violated the supervisory-system requirement in addition to whatever liability attaches to the trader and firm under the Manning rule.
- Documentation of escalation is the supervisor's primary defense. Email, log entry, compliance memo: any contemporaneous record of the escalation protects the supervisor from a supervisory-failure charge.
External Escalation and Reporting
Some findings trigger external reporting obligations:
| Trigger | Filing | Rule |
|---|---|---|
| Regulatory or disciplinary event affecting an associated person (criminal charge, regulatory action, customer complaint) | Form U4 amendment | FINRA registration rules, filed via Web CRD |
| Member firm disclosure events (regulatory action against the firm, written customer complaint alleging theft of $5,000+, etc.) | Regulatory event reporting | Filed quarterly or within 30 days depending on subsection |
| AML or fraud concerns | Suspicious Activity Report (SAR) | FinCEN filing; referenced by the FINRA AML compliance program rule |
| Manipulation or insider-trading patterns | Referral to FINRA, SEC, or the listing exchange | Supervisory escalation, exchange referrals |
A supervisor who learns of a customer claim alleging theft of $5,000 or more from a securities account has an external reporting obligation under the regulatory event reporting requirement, independent of any FINRA action. A pattern of unexplained large cash transactions triggers a SAR even if no individual transaction looks problematic.
Special Procedures for Manipulation or Front-Running Discoveries
When a supervisor discovers manipulation or front-running, the response includes additional procedural steps:
Freeze Trading
The supervisor should freeze trading in the affected accounts or by the affected trader pending investigation. A trader suspected of manipulation cannot be allowed to continue trading in the affected security.
Preserve Records
The supervisor must preserve:
- Electronic communications (email, chat, recorded calls)
- Order tickets (paper and electronic)
- Trade blotter entries
- Surveillance alerts and exception reports
- Risk system snapshots (positions, P&L) at the time of the activity
Preservation must be immediate. The firm's IT and compliance teams should be alerted to apply a litigation hold on relevant data.
Document the Investigation
Under the broker-dealer books-and-records rules, the firm must memorialize:
- The investigation steps taken
- The findings
- The disposition (e.g., trader terminated, trade canceled, regulatory referral made)
Order tickets, blue sheets (regulatory data requests), and communications must be retained under the applicable broker-dealer retention periods.
Exam Tip: Gotchas
- A supervisor must FREEZE trading when manipulation or front-running is discovered. Continuing to allow the trader to operate while the investigation proceeds compounds the supervisor's exposure.
- Records must be preserved IMMEDIATELY upon discovery, not at the conclusion of the investigation. A litigation hold protects against spoliation claims if the matter goes to enforcement.
How Escalation Connects to the Supervisory-System Requirement
The FINRA supervisory-system requirement is the umbrella supervisory rule. It requires every member firm to establish, maintain, and enforce a system for supervising the activities of associated persons that is reasonably designed to achieve compliance with applicable rules.
Failure to escalate is a supervisory-system violation in two ways:
- Failure to detect: if the firm's surveillance and exception-report system did not generate the alert that should have triggered escalation, the firm has failed to maintain a reasonably designed system
- Failure to act on detection: if the supervisor received the alert and did not escalate, the supervisor has failed to enforce the supervisory system
A trader who manipulates the market faces publication-of-transactions, fraudulent-trading, and Manning rule charges. The firm faces supervisory-system charges if either layer (detection or escalation) failed. The supervisor faces personal supervisory-system charges if the supervisor knew and did not act.
Think of it this way: Escalation is the bridge between detection and action. The exam tests this bridge constantly because a firm that detects but does not escalate is, from a regulatory perspective, the same as a firm that did not detect at all. The supervisor's job is to make sure the bridge is intact.
Exam Tip: Gotchas
- The supervisory-system requirement is the umbrella under which every Function 4 conduct rule sits. A Manning rule violation by a trader, undetected or unescalated by the supervisor, is also a supervisory-system violation by the firm and the supervisor.
- The "reasonably designed" standard means the firm cannot defend by showing the violation was rare. If the supervisory system would not have caught the violation under any reasonable design, that is itself the failure.
- Personal liability under the supervisory-system requirement attaches to the supervisor, not just the firm. A principal who failed to escalate can be sanctioned individually.