Dinosaur’s missing surveillance feed shows why falling alert counts need a trading-volume check

Dinosaur Merchant Bank's CFD trading activity increased sharply after it introduced a new direct-market-access order system in June 2024, but the management information presented to senior leaders showed fewer surveillance alerts. The contradiction was not a sign that trading had become cleaner. The Financial Conduct Authority later found that the new feed had not been connected to the automated surveillance system at all.[1][2]

During the omitted period, 2,194 trades with an underlying notional value of approximately $3.05 billion bypassed automated review. When Dinosaur later processed the trades retrospectively, they generated 2,916 alerts—more alerts than trades because a single trade can trigger more than one scenario. Of those alerts, 2,723 related to potential insider dealing and 193 to potential manipulation. An alert is a screening signal, not a finding that market abuse occurred.[1]

Trading rose while alerts fell

The FCA says the new order-management system caused average weekly CFD trades to increase by 45% compared with the previous six months. Yet between June and September 2024, the number of alerts reported in monthly management information fell by 42%. Senior management was therefore seeing a direction of travel that was inconsistent with the expanded trading flow.[1]

The firm's reports did not include comparative prior-month alert data or a control designed to reconcile every trading feed with surveillance coverage. Without that context, a falling alert count could appear benign. In reality, an entire stream of orders and executions was absent. The episode shows why alert totals cannot be interpreted without denominators such as trade count, notional value, client count and system coverage.[1]

A simple alert-to-trade calculation further illustrates the gap. The retrospective run produced 2,916 alerts from 2,194 trades, or about 1.33 alerts for each omitted trade. That ratio does not mean every trade was suspicious; multiple scenarios can flag one trade, and alerts can be false positives. It does show that the missing feed contained activity highly relevant to the surveillance programme rather than a set of transactions that would probably have generated no review work.[1]

The missing data covered $3.05 billion of notional

The average underlying notional per omitted trade was about $1.39 million when the FCA's aggregate figure is divided by the trade count. That average is a scale indicator, not the cash invested or loss exposure on each CFD. CFD notional can substantially exceed margin posted, and the distribution may be highly uneven. The proper conclusion is that a material volume of leveraged market exposure was outside automated surveillance.[1]

The FCA's press release places the uncaptured trading between June and October 2024. The final notice gives the detailed relevant period and chronology. Dinosaur discovered the issue after the FCA asked about activity by two clients in September. The firm identified the feed problem on 24 September and connected the data on 8 October, but the regulator found that broader deficiencies were not fully remediated until May 2025.[1][2]

A feed error became a governance failure

A technology integration failure can occur even in a well-designed control environment. The FCA's criticism extended beyond the initial omission. Dinosaur lacked an effective process to verify that all trade sources were ingested, did not have adequate written procedures for alert review until December 2024 and relied on manual arrangements that were not sufficient for the scale and nature of the business.[1]

The monthly reporting weakness was especially consequential. If management had been shown trading volumes alongside alert rates and prior-period comparisons, a 45% increase in activity combined with a 42% fall in alerts should have prompted an immediate coverage challenge. The absence of that reconciliation allowed a counterintuitive trend to pass without timely escalation.[1]

The FCA also criticised the delay after discovery. Connecting the feed did not resolve the backlog or all underlying control weaknesses. The firm had to reconstruct the missing period, review thousands of retrospective alerts and decide whether suspicious-transaction and order reports should be submitted. The final notice says multiple retrospective STORs were made.[1]

The alerts are not findings of insider dealing

The 2,723 insider-dealing alerts and 193 manipulation alerts are scenario outputs. They indicate that trades met configured patterns requiring review, not that 2,916 abusive events occurred. Surveillance systems are deliberately sensitive and can produce duplicates and false positives. A human or enhanced review is needed before a firm decides whether it has a reasonable suspicion requiring a report to the FCA.[1]

That distinction protects both accuracy and fairness. It would be wrong to convert the retrospective alert count into a claim about client misconduct. The regulatory failure was the absence and delay of detection capability itself. The potential consequence was that suspicious behaviour could have gone unrecognised or unreported during the relevant period.[2][1]

The firm's response and sanction

The FCA imposed a £338,000 penalty after a 30% settlement discount; without the discount, the penalty would have been £482,900. The regulator credited Dinosaur's cooperation. The company stopped selling CFDs in May 2025, and the final notice records that all CFD positions had been closed by July. The enforcement process reached a public outcome about nine months after opening, which the FCA highlighted as evidence of faster case handling.[2][1]

The closure of the business line limits forward-looking customer exposure but does not make the control lesson historical. Brokers routinely add platforms, liquidity connections, white labels and direct-market-access feeds. Every new source creates a data-lineage question: can the firm prove that every order, modification, cancellation and execution reaches the surveillance engine completely and on time?[1]

A control test the industry can reproduce

A practical control lesson from the case is a three-way reconciliation. Firms should compare trading activity, ingested-event counts and alert output by source system. A sharp movement in any one measure should be explained against the other two. Management information should include current and prior periods, coverage status for each feed, unresolved ingestion exceptions and the age of unreviewed alerts.[1]

Dinosaur's numbers demonstrate why. Average weekly trading rose 45% against the prior six months, while June–September alerts were 42% below the preceding four months, and a later complete run generated 2,916 alerts from the missing 2,194 trades. Each number alone can be misread. Together, they establish that the alert decline was a surveillance blind spot, not evidence of lower risk.[1]

The failure could have been detected through data lineage

Every execution channel should have a documented path from source system to surveillance engine, including field mapping, time synchronisation, rejection handling and daily completeness checks. A control can compare order and trade counts at the source with events accepted downstream. Any difference should produce an exception that cannot be closed without evidence.[1]

The Dinosaur case suggests that implementation testing focused insufficiently on end-to-end coverage. A system can be live for customers while its regulatory data path is incomplete. Operational acceptance should therefore require separate sign-off from trading, technology, compliance and surveillance, with test trades proving that each relevant scenario can be generated and reviewed.[1]

Management information needs rates, not just counts

An alert total is difficult to interpret without trading volume. An alert rate per thousand trades, per client and per unit of notional would have made the June-to-September divergence visible. The same dashboard should show changes in product, leverage, geography and concentration because a stable alert rate can still conceal greater risk if activity shifts into more sensitive instruments.[1]

Prior-period comparisons are equally important. A one-month figure can look plausible in isolation; a trend line can show that it is inconsistent with business growth. The FCA's finding that reports lacked prior-month context turns a reporting design choice into part of the control failure.[1]

The enforcement economics

The penalty and the $3.05 billion notional measure different things and use different currencies. The notional shows the scale of trading omitted from automated surveillance; it is not a customer-loss figure or a monetary base from which the sanction can be mechanically derived. The FCA’s notice supplies the enforcement and mitigation analysis.[1]

Dinosaur later stopped selling CFDs and closed remaining positions. The notice records that chronology, but it does not quantify a business-exit cost or establish that the fine caused the closure. The final notice’s documented control failings provide the basis of the analysis.[1]

The FCA recognised the firm’s cooperation and the settlement discount. Those mitigating factors belong alongside the control findings. The retrospective alerts remain potential issues requiring assessment, and the notice does not establish that every alert represented abusive trading or that customers lost the underlying notional.[1]

The case is more significant than a software configuration mistake. A new execution channel changed the scale of the business, while the monitoring information used by management moved in the opposite direction and lacked the comparisons needed to challenge it. The missing feed then produced a larger alert workload than the number of underlying trades.[1]

That is the defensible conclusion of the record: $3.05 billion of notional trading went through a blind spot; retrospective processing produced 2,916 alerts; and governance failed to detect the contradiction between rising activity and falling surveillance output. The FCA made no finding in the notice that all those trades were abusive, and the article should not imply one.[1][2]

Report an error or submit an update