Home
Resources
Wash trading detection at FX/CFD brokers

Guide · Brokers

Detecting wash trades and matched trading between linked accounts at FX/CFD brokers

A working method for surveillance and compliance teams at retail FX and CFD brokers, built on MT5 or MT4 end-of-day data: what regulators mean by wash trades and matched orders, why the pattern appears on a retail book, how to link the accounts, which thresholds to start from, what the case file needs and where the report goes. Regulatory points link to the text they come from.

Reviewed 30 September 2026 · Educational material, not legal advice.

What regulators mean

The DFSA's Markets Brief No. 17 (February 2018) describes a wash trade, drawing on its Code of Market Conduct, as "a sale or purchase of an Investment where there is no change in beneficial interest or market risk, or where the transfer of beneficial interest or market risk is only between parties acting in collusion, resulting in a false appearance of trading activity". The brief places such trades under Article 54(a) of the DIFC Markets Law, which prohibits conduct that results in, or may result in, a false or misleading impression as to the supply of, demand for or price of Investments.

In the UK, Article 12(1)(a) of UK MAR defines manipulation as a transaction, order or other behaviour that gives, or is likely to give, false or misleading signals as to supply, demand or price. Annex I lists as an indicator whether transactions "lead to no change in beneficial ownership". Annex II of Delegated Regulation 2016/522 then names two practices separately:

Wash trades (Section 1, point 3(a)): sale or purchase arrangements "where there is no change in beneficial interests or market risk or where beneficial interest or market risk is transferred between parties who are acting in concert or collusion".
Improper matched orders (Section 1, point 3(c)): transactions resulting from "buy and sell orders to trade at or nearly at the same time, with very similar quantity and similar price, by the same party or different but colluding parties".

Onshore UAE brokers are licensed by the Capital Market Authority (formerly the SCA), which has its own market-conduct rules. This guide does not summarise them; check the current text on the CMA regulations portal.

A retail CFD is an over-the-counter contract with the broker, and a matched pair between two clients rarely reaches a public price. Whether it is market abuse is a question for each case and each regime. Do not rule it out on venue alone: the DFSA's Markets Brief No. 24 says the STOR duty covers securities and derivatives, traded on a venue or over the counter. Much of what brokers find is better described as fraud against the broker or money moved between people, which is an AML matter.

Why it happens on a retail CFD book

On a broker's own book the aim is rarely to move a market price. The usual motives are:

IB rebate farming. The introducer is paid per lot. Two linked accounts trading against each other generate volume with no net risk, and the rebate is profit.
Bonus hedging. One account holds the bonus and takes the losing side; the linked account takes the winning side and withdraws. The bonus absorbs the loss.
Moving money between accounts. One account loses what the other gains, net of spread and commission. If the losing account was funded by a third party and the winning account withdraws to another person, the trades are a transfer channel.
Negative balance protection. In a fast market, one account's loss beyond its equity is written off while the linked account keeps the gain. Retail negative balance protection is a regulatory requirement in some regimes, for example the UK's COBS 22.5.17R.

The detection method is the same for all four. What differs is the evidence that decides which report, if any, follows.

Linking the accounts

Pairs of opposite trades between unrelated clients happen by chance every day on a busy book. The pattern becomes meaningful only when the accounts are linked. Join trade data to these records:

Signal	What to join	Weight
Identity and ownership	Same passport or national ID, same beneficial owner of corporate accounts, shared directors or signatories.	Strong: near proof of common control.
Payment instrument	Same card (BIN and last four, or a token), IBAN, e-wallet or crypto address used by more than one account, for deposits or withdrawals.	Strong.
Device	Same device identifier or fingerprint across logins to the trading terminal or client portal.	Medium to strong.
IP address	Same IP or subnet, especially logins at the same minute.	Weak alone: mobile networks, VPNs and offices put many people behind one address.
Contact details	Same phone number, address, or email pattern.	Medium.
Introducer	Same IB or sub-IB, same referral link.	Context: raises the rebate question.

Score the links rather than treating any one as proof, and keep the record behind each link. The case file will need to show it.

Matching the trades from end-of-day data

MT5 deal history carries the account, symbol, direction, volume, price, time to the millisecond, the position ID and whether the deal opens or closes a position. MT4 history carries open and close times and prices per ticket, to the second. Either is enough.

Within each linked group, pair deals that meet all of these:

Same symbol, opposite direction.
Same volume, or close to it where the accounts split lots differently.
Opening times within a few seconds of each other. Widen the window to a minute or so if clients place orders by hand on two devices.
Repetition. One pair is noise; look for several inside a short period, for example five or more pairs in 72 hours.

Then test the result. Over the matched pairs, the combined profit of the group should be close to minus the spread and commission; the transfer shows as one account's loss matching the other's gain. Add the rebate paid to the introducer on the same volume and any bonus credited, and compare withdrawals with deposits for each account.

Pairing only on the opening leg misses trades that open apart and close together. Test the closing leg too, and the net exposure of the group at each point in time.

False positives

Hedging clients. One person long on one account and short on another, for example because one account runs in netting mode. No money moves to another person, but ask why and record the answer; the same set-up is used for bonus and negative-balance abuse.
Copy trading. Followers open the same trade as the strategy provider at the same moment. Those trades are same-direction, so they should not pair; they do pair when a follower copies in reverse or two providers trade opposite each other. Exclude known provider–follower links, and still check for providers and followers who are the same person.
PAMM and MAM accounts. One master order is allocated across many sub-accounts, producing simultaneous deals of related sizes. Opposite pairs appear when the manager hedges across managed accounts. Exclude by the master–sub-account mapping, not by switching off the rule.
Households and companies. Family members and staff share devices, IP addresses and sometimes cards. The link is real; the question is whether money moves between different beneficial owners.
News spikes. Unrelated clients open opposite positions at round volumes in the same second after a release. Require linkage before pairing.

What the case file needs

The CBUAE's STR guidance, section 3.3 asks a narrative to answer who, what, when, where, why and how. For a wash-trading case that means:

The accounts, their owners, and each link between them with the record that shows it (document, payment instrument, device).
The matched pairs listed one by one: tickets, times, volumes, prices and profit of each leg. Totals alone are not enough.
Profit and loss moved between the accounts, and the net result for the firm.
The introducer on the accounts and the rebate paid on the matched volume; any bonus credited.
Deposits and withdrawals of each account, with payment instruments and any third party.
What the firm did: withdrawal hold, account restriction, rebate withheld.
The analyst's reasoning, the reviewer's decision and the reason for it, including a decision not to report.

Where the report goes

The route depends on what the suspicion is and on the licence:

Regime	Market-abuse suspicion	Money-laundering suspicion
DIFC (DFSA)	STOR to the DFSA through its online form (Markets Brief No. 24).	STR or SAR to the UAE FIU through goAML (Federal Decree-Law No. 10 of 2025, Article 18), then a notification to the DFSA under AML Rule 13.3.1.
UAE onshore	Check the CMA's rules (regulations portal).	STR or SAR to the UAE FIU through goAML (Article 18). See the goAML STR filing guide.
UK (FCA)	STOR to the FCA "without delay" (UK MAR Article 16(2)).	SAR to the UK FIU at the National Crime Agency.
Türkiye	Not covered in this guide.	Suspicious transaction report (ŞİB) to MASAK. See the MASAK STR guide.

One case can need both columns. Rebate farming between linked accounts funded by a third party can be manipulation for STOR purposes and laundering for STR purposes; the two duties are separate. The DFSA STOR vs STR explainer sets them side by side.

Where Marqib fits

The pilot build has a deterministic wash-trading rule. It links accounts through a shared beneficial-owner identifier, pairs opposite trades of identical size in the same instrument executed within 2 seconds of each other, and raises an alert at 5 pairs inside 72 hours (critical at 20). These thresholds are editable on the tuning page. Linkage in the default rule is by beneficial owner; device and IP links are not part of it.

The case lists the pairs, shared funding sources, withdrawals requested after the activity and the introducer paid on the volume, and drafts an STR narrative from those rows for a reviewer to approve. See the brokers page or the red flags checklist.

Sources

Questions

Is a wash trade between two retail CFD accounts market abuse?

It depends on the regime and the facts. The DFSA says its STOR duty covers derivatives and over-the-counter trading as well as listed securities, so venue alone does not rule it out. Many broker cases are better described as fraud against the broker or money moved between people, which is an AML question.

What is the difference between a wash trade and an improper matched order?

In the UK text, a wash trade involves no change in beneficial interest or market risk, or a transfer only between colluding parties. Improper matched orders are buy and sell orders entered at or nearly at the same time, with very similar quantity and price, by the same party or colluding parties.

Can we detect it without device data?

Yes. Identity documents, beneficial owners and payment instruments link most groups. Device and IP data add coverage for accounts opened under different names.

Does a client hedging across his own accounts count?

No money moves to another person, but the same set-up is used for bonus and negative-balance abuse. Ask the client why, record the answer, and watch the accounts' funding and withdrawals.

Should we tell the client why the account is restricted?

Keep messages neutral and agreed with compliance. Telling a client that a report has been or will be made is tipping-off, a criminal offence under Article 29 of the UAE AML law and prohibited by DFSA rules for STORs.