Dinosaur’s 2,194 CFD trades excluded from automation generated 2,916 later alerts

Dinosaur Merchant Bank’s surveillance gap was not merely a missing feed that became harmless once connected. A new direct-market-access platform excluded 2,194 CFD trades with about $3.05 billion of underlying notional from automated monitoring between June and October 2024. When the firm later replayed the activity through its rules, the data generated 2,916 alerts—more alerts than trades—and led to multiple retrospective suspicious transaction and order reports.[1][2]

The alert count reconstructs the scale of the review. Of the 2,916 alerts, 2,723 related to potential insider dealing and 193 to potential market manipulation. Those are surveillance signals, not findings that 2,916 abuses occurred. One trade can trigger more than one scenario, and most alerts can be closed after investigation. But the volume shows how much triage the firm had postponed while the automated system was blind to the new platform.[1][2]

The failure began before the first trade

Dinosaur introduced the platform on June 1, 2024. The FCA found that the firm had not performed an adequate market-abuse risk assessment or change-control review before launch. The new order flow increased CFD activity sharply—weekly trade volumes rose by about 45%—yet the data were not ingested into the automated surveillance system. The business gained capacity faster than its control environment gained visibility.[1]

This is a deployment failure rather than a claim that surveillance technology did not exist. Dinosaur already had an automated system. The problem was that the new platform’s orders and trades did not reach it. A control can be sophisticated on paper and ineffective in production if a new data source is outside its perimeter. The relevant test is completeness: can the firm reconcile every trading venue, platform and order state to the records the surveillance engine actually receives?[1][2]

Manual review remained, but the FCA concluded it was not an adequate substitute. Human reviewers cannot reliably recreate automated pattern detection across billions of dollars of activity without complete data, calibrated scenarios and documented escalation. The risk was especially acute for CFDs because suspicious conduct may be visible in the referenced shares or other underlying instruments while the economic position is taken through a derivative.[1][2]

Connecting the feed did not finish the remediation

Dinosaur identified the ingestion problem and began feeding the new platform’s data into surveillance on October 8, 2024. That closed one gap: future trades could enter the system. The FCA’s relevant period nevertheless continued until May 6, 2025 because the firm’s alert parameters, written procedures, risk assessment, governance and management information remained deficient. Data availability and effective detection were separate milestones.[1]

The distinction is central to the case. A system can receive every trade and still miss suspicious behaviour if thresholds are inappropriate, reference data are incomplete, scenarios do not fit the product, or reviewers lack escalation rules. The final notice says Dinosaur did not properly recalibrate the surveillance after the sharp change in activity and did not promptly perform a comprehensive lookback. The defect therefore moved from missing data to inadequate use of data.[1]

Full remediation included external expertise, revised procedures, a market-abuse risk assessment, improved management information, specialist personnel and a replacement or enhanced surveillance arrangement. Dinosaur ultimately stopped selling CFDs in May 2025. The cessation reduced future exposure in that business, but it did not erase the duty to review historical activity and submit reports where reasonable suspicion arose.[1][2]

An alert is a question, not a verdict

The 2,723 insider-dealing alerts do not mean 2,723 customers traded on inside information. Surveillance scenarios often compare timing, price movement, announcements, account history and linked activity. They are designed to be sensitive enough to surface conduct for investigation, accepting that many alerts will be false positives. Likewise, a market-manipulation alert can flag patterns such as layering or unusual order cancellation without proving intent.[1][2]

A STOR has a higher significance but still is not a conviction. UK rules require firms to notify the FCA when they have reasonable suspicion of insider dealing, market manipulation or attempted misconduct. The regulator then decides whether further inquiry is warranted. Dinosaur’s retrospective submissions show that some replayed activity crossed its reporting threshold; the final notice does not identify the accounts or state that the suspicions were substantiated.[1]

The alert-to-trade ratio also needs care. Dividing 2,916 by 2,194 gives about 1.33, but this is not an “abuse rate.” One trade may trigger several rules, and an alert may draw on multiple trades or orders. The useful conclusion is operational: the lookback created a review population larger than the number of omitted trades, demonstrating how expensive delayed surveillance can become.[1]

The notional figure is large but not customer loss

The $3.05 billion figure is described as the corresponding value of underlying assets for the CFD trades. It is not cash deposited, broker revenue or money lost by customers. CFDs create economic exposure with margin that can be much smaller than the underlying notional. The average $1.39 million per trade therefore indicates surveillance scale, not the average cash payment or realised profit.[1][2]

This denominator matters for the sanction too. The FCA calculated relevant revenue of about £3.577 million for its penalty methodology. The £338,000 settled fine was 9.45% of that amount; without the 30% settlement discount it would have been £482,900, or 13.5%. Comparing the fine with the $3.05 billion notional would make it appear almost negligible, but notional trading exposure was not the revenue base the FCA used.[1][2]

The governance signal is the missing reconciliation

A robust change process would inventory the data needed for each control before launch, test end-to-end ingestion, reconcile platform totals to the surveillance population and obtain accountable approval. After launch, daily or weekly completeness reports should reveal a zero-count feed or an unexpected break in volumes. The FCA’s findings indicate that Dinosaur’s board information and formal procedures did not surface the problem quickly enough.[1]

The case also shows why business growth can itself be a risk indicator. A 45% rise in activity increases the number of events to monitor and can alter the normal patterns against which scenarios are calibrated. Thresholds suitable for a smaller book may either flood reviewers with false positives or fail to capture new concentrations. Surveillance capacity and rule performance need to scale with the platform, not follow months later.[1]

Dinosaur cooperated fully, implemented remediation and received the settlement discount. Companies House records show the firm remains active, while the FCA says it ceased CFD sales in May 2025. Those mitigating facts belong beside the breach. The notice concerns the effectiveness of a specific surveillance framework and period; it is not a finding that the firm or its clients committed the underlying market abuse represented by the alerts.[1][2][3]

What the retrospective alerts establish

The replay proved that the missing activity was capable of generating a large body of surveillance work once the system was properly engaged. It did not prove that every alert should have been filed in real time or that every suspected trade would have been stopped. Surveillance generally detects and reports; it does not guarantee prevention. The counterfactual is that a functioning process would have placed those questions before reviewers close to the trading date, when evidence and context were fresher.[1]

The strongest conclusion is therefore about control latency. Dinosaur launched a platform, increased CFD activity and allowed $3.05 billion of referenced notional to pass outside automated monitoring. Connecting the feed four months later solved only the first layer; effective calibration and governance took until the following May. The 2,916 retrospective alerts quantify the review burden created by that delay without turning suspicion into guilt.[1][2]

Report an error or submit an update