Editor’s note: This is an educational explainer about how market surveillance generally works on exchanges such as the NZX. It is general information, not investment advice, and does not describe any specific current event, company, or security.
A single large order rarely raises an eyebrow on its own. What actually catches the attention of an exchange’s surveillance team is a pattern: a spike in volume just ahead of a scheduled announcement, a sudden cluster of trades from accounts that have never touched a stock before, or a price move that has no obvious explanation in the public news flow. Understanding how that detection process works, and what happens once it fires, demystifies one of the least visible but most important functions of any regulated market, including New Zealand’s.
How the surveillance system actually watches the market
Every order and trade that passes through the NZX is captured electronically and fed into a surveillance system, a setup common to virtually all developed exchanges. This is not a person staring at a ticker tape. It is software running continuously, comparing real-time activity in every listed security against its own recent trading history and against typical patterns for similar stocks. The system looks for statistical outliers: volume that is many multiples above the norm for a given time of day, price movements that break away from a security’s usual volatility band, unusual concentrations of buy or sell orders from a small number of participants, or order-book behaviour associated with manipulative tactics such as layering (placing orders with no intention of executing them, simply to influence the visible price) or wash trading (trading with oneself, directly or through related accounts, to create the appearance of activity).
Timing matters enormously here. Surveillance systems pay particular attention to trading that occurs shortly before material information becomes public, such as an earnings release, a takeover announcement, or a regulatory decision. A stock that moves sharply in the hours or days before such news, without any public explanation, is a classic pattern that automated alerts are built to catch. That does not mean the movement was necessarily improper; it means it warrants a closer look, because genuine information leakage, insider trading, and coincidence can all produce the same surface pattern.
What happens once an alert is generated
An automated alert is the start of a process, not a conclusion. Exchange surveillance analysts first review the flagged activity to rule out benign explanations: index rebalancing, a large but legitimate institutional order being worked through the market, a market maker adjusting positions, or simple noise around a low-liquidity stock. Many alerts are closed at this stage because the pattern, once examined in context, turns out to have an ordinary cause.
If the activity still looks anomalous after that initial review, the exchange typically moves to a more detailed inquiry. This can include requesting trading records and beneficial ownership information from brokers and market participants, cross-referencing the timing of trades against corporate disclosures and any board or management communications, and checking whether the accounts involved are linked to each other or to the company in question. In New Zealand, the NZX’s own market surveillance function works alongside the Financial Markets Authority (FMA), which holds the statutory powers to investigate suspected market manipulation or insider trading under the Financial Markets Conduct Act. Straightforward listing rule matters, such as a company failing to make timely disclosure, are generally handled by the exchange itself; conduct that may involve criminal or civil liability, such as insider trading, is typically referred to or shared with the FMA.
Why most flags never become public news
The overwhelming majority of surveillance alerts are resolved quietly and never become public, simply because most turn out to have an innocuous explanation, and because investigations that do proceed can take months to complete properly. Regulators generally avoid commenting publicly while a matter is still under review, both to protect the integrity of the inquiry and to avoid unfairly damaging reputations before any wrongdoing is established. Enforcement action, when it does occur, ranges from a private warning or a request for corrective disclosure, through to formal investigation, financial penalties, or referral for prosecution in the most serious cases.
This layered, mostly invisible process is by design. Surveillance exists to preserve confidence that prices reflect genuine supply and demand rather than manipulation, and that confidence depends on the system working continuously in the background rather than only after something has already gone wrong.