Cluster View

The Cluster Scorecard view provides a summary of the vital statistics of the cluster as well as an initial visualization of the pattern that was formed by the order and fill messages that comprised the cluster. You can also view the activity in the cluster in the context of the market data at the time.

Clicking the expand button from the in-line review panel of Cluster List View opens the scorecard for the selected cluster:

Cluster Scorecard display

The Cluster Scorecard is organized into the following sections:

Cluster statistics and scorecard metrics

The Cluster Statistics and Scorecard Metrics sections provide general information about the cluster as well as model-specific details.

The lower part of the Cluster Statistics section includes summary details about the cluster. Click the down arrow to the right of the score to expand the statistics.

For configurable models, this also contains the human readable description of why the cluster was triggered:

Audit trail

This section shows the actual order actions from the audit trail with some minor normalization of things like Order Type, Side and Order Action. Rows are color coded by action and side. Click the column selector () above the audit trail to show additional columns.

Audit fields are described in the following table.

Market Replay

The Market Replay section of the Cluster Scorecard lets users view the cluster data overlaid on the market data as it occurred over time. 

Users can display the replay data with the following views:

Ladder view: Replays the market activity in a ladder-like interface as it occurred during the time period covered by the cluster.

Dual Ladder view: Allows viewing market activity in a second instrument to access potential trading impact.

Market Depth Chart: Allows users to view the market movements overlaid on their trading data to show price volatility and volume concentrations in and around the cluster

On the New Feed tab, the Heatmap shows you which traders, accounts, or instruments are generating activity that has a high degree of similarity to regulatory cases. Each rectangle represents a group of clusters using color to indicate the level of risk, and size to indicate the number of clusters. These visual cues help you prioritize your cluster group review based on activity that generates the most risk.

Manage the content displayed in your New Feed tab through the preferences. Here, you can customize your view by setting criteria such as the minimum cluster score, desired cluster status, specific models, and the relevant date range for the clusters you want to see. All these settings can be adjusted in the Preferences tab to meet your specific needs.

Heatmap Display

Interpreting the Heatmap

The Heatmap groups clusters by trader, instrument, or account, and displays these groups as a collection of blocks. TT Score calculates an average risk score for each block based on the clusters in the group represented by that block.

Heatmap Navigation

Navigation tools are located above the Heatmap.

The Market Depth tool is a visualization in TT Trade Surveillance that displays a market snapshot of the instrument. Trade Surveillance displays the market high-low and the book data for the respective instrument of the cluster and displays it in a visualization that provides a snapshot of how the market is trending around the cluster start and end time. The Market Depth tool also displays the trader activity from the scorecard view and marks the respective activity accordingly.

The Market Depth tool is available in the Cluster Scorecard and it is available for all models across Trade Surveillance, including models that don’t have any default graphical representation.

Market Data Sets

The Market Depth visualization mainly consists of three sets of market data:

Bars Data

A total of 12 hours of Bars data (6 hours before and 6 hours after the cluster start time) for the cluster’s instrument is displayed as a candlestick chart showing the price high-low data at the respective times. This data is usually at one-minute granularity. The volume data is also available at the bottom of the candlestick chart. It displays as a stacked bar chart between three volumes: Buy Volume, Sell Volume and Rest Volume.

The candlestick chart and the bar chart are linked together and can be zoomed and scaled together. Multiple selection tools are available to interact with the chart to zoom and scale the axis to view the data.

Book Data

TOB (Top Of Book) data is provided in millisecond granularity. The data is requested initially from the cluster start time and end time. A highlight is drawn on the chart to show the cluster start and end time in the visualization. The Bars data, if present during this time, is overlaid on the book data. You can zoom in and out of the book data. Two action buttons on the top toolbar can be used to subtract (-15 sec) and add (+15 sec) of book data from/to the existing cluster book data that is loaded. This provides a view of the market TOB data, not only during the cluster times, but also immediately before and after the cluster times.

In the above example, the book data drawn within the highlighted area represents the market TOB data and, using the action buttons in the upper right-hand corner, 15 seconds of TOB data are added before and after cluster start times. The Reset to Cluster button on the toolbar quickly takes you to the cluster timestamps if you have zoomed out and lost track of where the cluster is present.

Trader Activity

Trader activity (adds, fills, buys, sells and cancels) are mapped to their respective prices and timeframes and can be displayed in this visualization. By default, only the buy fills and sell fills are selected; other activity is not selected. This trader activity will only be available during the cluster start and end times and no data will be present outside this timeframe.

Trader activity is represented by various shapes and colors. Generally, blue represents buys and red represents sells.

This data provides a visualization of where the trader activity was below/above the TOB and how it effects the market price flow.

To allow for easy detection of problematic groups of clusters in big data sets with disparate customer or trader cluster volumes, the Outlier Chart on the New Feed tab displays the percentage of high-risk clusters within a group’s total clusters.

Manage the content displayed in your New Feed tab through the preferences. Here, you can customize your view by setting criteria such as the minimum cluster score, desired cluster status, specific models, and the relevant date range for the clusters you want to see. All these settings can be adjusted in the Preferences tab to meet your specific needs.

Outlier Chart display

Interpreting the Outlier Chart

The Outlier Chart displays every entity’s percentage of clusters with a score above a threshold defined by the user. The default score threshold is set to 75.

Outlier Chart navigation and filters

Navigation and filters are located above the Outlier Chart.

On the All Clusters tab, you can search all of your cluster data. To start your search, click on the Create Filter button:

A dialog box displays in which you can apply filters for multiple criteria to get to the data set you are looking for:

This includes filters for Score Range, Date Range, Status, Assignee, Classification, Models, and Product Types.

The New Feed tab is the starting point for your surveillance activities, serving as your prioritized “To-Do” list.

The Cluster List view shows individual clusters. Each row of this sortable list is highlighted with a color to indicate the severity of that cluster’s risk score.

The Cluster List displays the following:

Other fields:

Managing the New Feed Tab

Manage the content displayed in your New Feed tab through the preferences. Here, you can customize your view by setting criteria such as the minimum cluster score, desired cluster status, specific models, and the relevant date range for the clusters you want to see. All these settings can be adjusted in the Preferences tab to meet your specific needs.

Cluster List navigation and quick filters

The top right section has some metric cards for quick navigation.

Cluster Growth: Shows the number of clusters that have been generated in the last 24 hours

My Assignment: Shows all the clusters assigned to the current user. This is a quick and easy way to view your workload. The clusters here are filtered for the last 30 days only.

SLA Breached: Shows all the clusters that have been in the “New” state for over 24 hours.

Note: Where not applicable, Admin users can turn off the SLAs for the company under preferences settings

Filtering, Arranging, and Sorting the Cluster List

Users can filter and sort on almost all the columns in the New Feed page. Simply click on the three lines on the right-hand side of any column:

This will bring up the Column Settings menu, where users can:

Arrange the columns: Pin the selected column, Autosize the selected columns or all columns, or reset the column settings.

Add filters:  Some filters will allow mult-select, some will have free text entry.

Manage the columns: Add or remove columns from the view

This view provides an invaluable tool for market analysts and surveillance teams, extending far beyond simple observation of instruments. By simultaneously presenting the order book depth for two related instruments, the Dual Ladder facilitates the overlay of granular transactional data, offering profound insights into a trader’s behavior and market impact. Analysts can precisely track how a trader’s orders affect the liquidity and price formation within one or both order books. This includes:

This comprehensive visualization is particularly helpful in the detection and investigation of market abuse patterns, such as spoofing, layering, and other manipulative trading clusters. The ability to see the transactional footprint directly against the backdrop of real-time order book depth for potentially linked instruments drastically reduces the time and complexity involved in identifying suspicious activity and building a strong evidentiary chain.

Ladder view

The Ladder view is a research tool that provides users with a frame-by-frame replay of the trading activity overlaid with Level 2 market data on a ladder-style interface. The ladder is 10 ticks deep and displays all market data, including the orders for each relevant participant in the order book. Users can stop, start and rewind the playback of the activity within a given cluster in order to gain a precise understanding of the sequence of events that occurred in the order book and how the trader’s orders impacted the market.

The ladder view includes the following:

Click Play to watch the market react as the order activity in the audit messages are replayed. As the market replays, a vertical bar tracks the progress in the graph and the audit messages are added as they occur. The Audit Message section lists the history of every audit message generated from the start of the replay to the current point in time of the market replay. You can start, stop and rewind the activity to help get a clearer picture of potentially problematic trading activity.

The market replay includes the following:

Working order display in the Ladder view

When working orders are shown in the market replay, the corresponding cell in the working orders Work column contains abbreviations and colors to assist you in tracking and managing your working orders. The text and colors vary based on order type and order status. Refer to the following table for a description of the abbreviations and colors that appear in the working orders column.

Work Column Display	Description
	Appears for working buy or sell orders. The cell is highlighted blue for buy orders, red for sell orders or yellow when the price level contains both buy and sell orders. Abbreviations include:W — Working order quantity.B — Order quantity bought.S — Order quantity sold.E — Sum of order quantities when a price level has both buy and sell orders.
	Appears when TT order types (e.g., TT Time Sliced) or native order types (Iceberg) with disclosed and undisclosed quantities were submitted. The cell is highlighted blue for buy orders, red for sell orders or yellow when the price level contains both buy and sell orders. Abbreviations include:W — Working order quantity.B — Order quantity bought.S — Order quantity sold.E — Sum of order quantities when a price level has both buy and sell orders.D — Disclosed order quantity.U — Undisclosed order quantity

Dual Ladder View

The Dual Ladder View allows users to compare and view a related instrument in a second ladder in addition to the ladder from any Trade Surveillance cluster. When enabled, users can view the trader’s activity in the cluster specific instrument while loading any instrument in a second ladder.

The second ladder displays market activity that occurs at the same time as the first ladder. This allows you to review the potential market impact of the trader’s activity in a similar, related product, or to demonstrate that the user’s activity in the cluster was due to a change in market conditions in a separate instrument.

To view a second instrument in Dual Ladder View: