Licensed FX, CFD and securities brokers

Trade surveillance for FX/CFD brokers

Connect the broker’s trade, payment and customer records. Review selected patterns with the records behind each alert, then document the decision. Start with files; validate beta connections and deployment with your own team.

Capabilities and roadmap →

Synthetic example · not a live run · MQB-260926-006 · SPOOFINGSCORE 0.89
E1Prepared sample — order and client records
E2Rule hit — 212 EURUSD orders in 40 min, 209 cancelled < 3 s
E3Fill check — 9 fills, all on the opposite side
E4Client — Example Client 06 · synthetic account
E5⚑ Pattern — selected cancellation pattern for investigation
E6Draft — STR narrative written from evidence rows E1–E18
Illustrated output · case file and reporting draft for human review
Why brokers

From scattered records to a documented review.

Watch every pair of accounts.

Marqib checks for matching trades between accounts sharing a beneficial-owner reference. The investigation view adds available device and funding links, so the reviewer can inspect the relationships and underlying records.

See the introducing partner behind flagged trades.

Where trade records contain an introducing-partner reference, the case can show it alongside matched trading. Marqib does not calculate the partner’s commission or reconcile a rebate ledger. Establishing earnings requires the broker’s own commission records.

Prepare a reporting draft from the case.

Keep the supporting records, reasons and reporting draft together. Evidence-reference checks do not prove that a sentence is correct. Your authorised reviewer verifies the content, the applicable report and local format, and submits through the authority’s system.

Operating model

Connect the records. Review the case.

Rules highlight selected patterns and keep their supporting records together. Your team checks the explanation and decides what to do.

01

Connect your data

Start with customer, trade and payment files. Optional adapters are tested with your firm’s accounts.

02

See what needs attention

Rules and screening identify selected patterns. Each case shows the records and thresholds behind the alert.

03

Review and document

Review the evidence and record the decision. An analyst’s proposal is reviewed by a different MLRO. Your authorised team checks and submits the reporting draft.

A clear view of the product.

See what you can review in the pilot and what we are planning next.

In the pilot build

Monitor, investigate, document

Selected risk rules, source records, case decisions and an audit trail. Analysts propose; a different MLRO reviews.

Locally checked · awaiting release

Keep decision-time evidence

Saved evidence versions, data-quality controls and changed-proposal review have local checks. Release and final verification are pending.

Validate with your firm

Connect your existing systems

Trading, KYC and crypto adapters need validation with your own accounts. Reporting exports are drafts.

Planned

Complete more of the investigation

Feed reconciliation, document requests, deeper relationship review and rule observation before decisions.

Capabilities and roadmap →

Coverage

Coverage for a brokerage book.

Rules are deterministic and tunable per firm; firm-specific rules are built without code and approved by an MLRO. Clients and payment counterparties are screened against UN, OFAC, EU and UK sanctions lists. A language model never decides what is suspicious; where enabled, it only rewrites the reasoning from the same evidence table. KYC and screening results from Sumsub, ComplyAdvantage Mesh or Veriff (beta) feed the customer risk score.

Market abuseWash tradingOpposite trades of equal size and instrument between accounts with the same beneficial-owner reference. Shared device or funding details provide investigation context.
Market abuseSpoofing and layeringOrder bursts cancelled within seconds with fills on the opposite side.
AMLThird-party fundingDeposits from a counterparty other than the account holder; relative-name heuristics reduce noise.
AMLDormant reactivationLong-idle account, new device or country, bank-detail change and a withdrawal in the same hour.
AMLStructuringRepeated deposits just under the enhanced-due-diligence threshold, followed by a crypto or wire withdrawal.
AMLPass-throughDeposit, little or no trading, then withdrawal to a different destination.
Platform abuseBonus abuseLinked accounts that received bonuses repeatedly open opposite positions of similar size. A related pending withdrawal can be marked held inside Marqib; external action requires integration.
Platform abuseLatency arbitrageMany round trips held for seconds, mostly profitable, beating other clients in the same instrument; high severity right after sharp price moves.
Data

Start with files. Validate each connection.

Start with client, trade and payment CSV files. Check the available fields, supported currencies and rule coverage before the first scan. Scheduled file feeds and beta MT5, cTrader and back-office adapters require configuration and validation with your account.

  • trades.csv deal ticket, login, timestamp, symbol, side, volume, price, IB partner.
  • orders.csv pending orders with placement, fill and cancellation times (for spoofing).
  • transactions.csv deposits and withdrawals with channel, counterparty name and reference, status.
  • clients.csv KYC extract: type, country, beneficial-owner reference, occupation, expected turnover.
  • bonuses.csv optional; bonus and credit operations (client, time, amount, campaign, bonus or credit) for the bonus-abuse rule.
  • logins.csv · bank_changes.csv optional; enable dormant-reactivation and bank-change rules.

All integrations and their status →

01

Morning queue

Cases ranked by severity, with internal holds where a rule calls for review. A case hold alone does not stop an external payout. Optional notifications carry case identifiers and a link.

02

Case file

Why this alert, condition by condition with the threshold in force and the value observed; every evidence row, the subject's recent transactions, and the draft narrative, with rule text and model text side by side. Each reviewer works in English, Arabic or Turkish; the case record itself stays as it was recorded.

03

Filing

Evidence pack and hash-chained decision log, with goAML XML and MASAK ŞİB export drafts. Local schema, indicator codes and sector fields require validation. Submission and receipt reconciliation are outside this workflow.

Platform data

What we read from MT5, cTrader and the back office, and why it matters.

Marqib works from the files MT5 Manager, cTrader and the back office already export at end of day, or pulls the same records through a connector (beta). Either way there is no plug-in on the trading server and no change to execution.

Deals

Ticket, login, symbol, side, volume, price and time to the millisecond. Enough to pair opposite trades between accounts and measure holding times.

Orders

Placement, modification and cancellation times. Spoofing and layering are only visible in orders that never filled.

Groups and agents

Group and introducing-partner references, where present in the trade data. They add context to matched trades. Commission amounts and rebate-ledger reconciliation require the broker’s separate records and are not calculated by Marqib.

Logins

IP and device references can link accounts for review. A shared reference alone does not establish common control or beneficial ownership.

Balance, bonus and credit operations

Deposits and withdrawals as booked on each account, and bonus or credit operations. The bonus-abuse rule uses them to see which linked accounts received a bonus before they traded against each other.

MT5 connector (beta)

Instead of files, Marqib can pull clients, deals, deposits and withdrawals, bonus and credit operations (optional) and order history from the broker's MT5 server through the MT5 Web API, on a schedule and incrementally; reading the same period twice creates no duplicates. Beta: validated against your MT5 server during the pilot. Payer names and bank details for deposits still come from a CSV file or the real-time API. MT4 works through files; a direct connector is planned.

cTrader connector (beta)

Accounts and closed positions through the cTrader WebServices API, on a schedule. Balance and bonus history come from cTrader exports, so the latency-arbitrage and bonus-abuse rules also run on cTrader books. Orders are not available this way, so spoofing checks need order files.

Back office and cashier (beta)

Beta Praxis Cashier and B2Core adapters can supply available payer, masked payment and pending-withdrawal records. Account fields and permissions need validation. Marqib records an internal hold; an external payout restriction needs a separately validated integration.

B-book context

Why a B-book broker needs its own surveillance.

Where a broker internalises client trades, its own records are important for reviewing account-to-account patterns. Matching trades alone do not establish manipulation or an AML offence.

Marqib checks selected patterns in the loaded trade, funding and customer records. Reviewers inspect the supporting records and decide what further investigation is needed.

Platform abuse

Bonus abuse and latency arbitrage.

Latency-arbitrage checks rebuild short round trips from trades and compare them with the available instrument benchmark. Bonus-abuse checks review opposite positions among linked accounts that received bonuses. Both depend on required source fields and configured thresholds. Internal holds and recommendations require review; neither rule establishes an offence or enforces the broker’s terms externally.

Bonus abuse and latency arbitrage guide →

How it works, in short

What a reviewer, an auditor and an information-security team can check.

Pilot programme

Agree a bounded pilot on your records.

Agree the use case, source fields, reporting jurisdiction and named reviewers before starting. Validate connections and deployment with your team. Timing and acceptance measures are set in the pilot proposal; the example tour is not a performance result.

Scope and fee agreed before starting
Timing and commercial terms are set in the written pilot proposal.