- A Citi trader meant to sell $58M. He built a $444B basket instead. Controls caught $255B — and $189B still reached the algorithm, which calmly sliced it into orders. $1.4B hit European markets before anyone hit cancel. The fine: $92M. 🧵
- Citi could show the orders. What they couldn't do was reconstruct why their algorithm executed them — or why the risk thresholds sat where they did. That gap, not the fat finger, cost them $92M across three jurisdictions.
- This is the shift most firms missed. Regulators stopped accepting order logs as audit evidence. The question is no longer "do you have controls?" It's "can you reconstruct every decision your algorithm made?" Most can answer the first. Almost none the second.
- In Aug 2025 the FCA reviewed 10 principal trading firms' RTS 6 self-assessments. Findings: out-of-date documentation, no clear inventory of who owns each algorithm, some firms omitting entire RTS 6 elements. The exam stalls at "show me your algorithm inventory."
- The FCA also flagged "variable technical knowledge in compliance" as a systemic weakness. Compliance can read alert reports. They can't interrogate the model's logic or challenge a risk parameter. People who know both CFTC market-access rules and model architecture barely exist.
- Meanwhile the tools drown them. 70% of banks report false-positive rates above 25% in trade surveillance. Alert fatigue isn't a UX gripe — it's how a real manipulation pattern slips through while the team clears noise.
- The top 5 surveillance vendors hold ~55-59% of the market and price for Tier 1 banks: $1-5M+ a year. Mid-market firms carry identical SEC, MiFID II and DORA obligations on a fraction of the budget. That gap is where most non-compliance lives.
- And the wall is moving closer. SEC+CFTC booked a record $25.3B in enforcement in 2024 — the most ever. Now the deadlines stack: EU AI Act high-risk financial AI by Aug 2, 2026, DORA live since Jan 2025, SEBI demanding a unique Algo-ID before any strategy goes live.
- So we build the compliance intelligence layer mid-market firms actually need: explainable algo audits, control mapping across SEC/MiFID II/EU AI Act/DORA, and graduated circuit breakers — multi-tier, not the on/off kind that waved $189B through at Citi. No enterprise lock-in.
- Honest question for compliance and quant teams: if an examiner asked you to reconstruct one algorithm's decision chain for a specific minute last month — could you? Where does it break first? #AlgoTrading #RegTech
- We wrote up the full breakdown — the examiner's sequence, where the vendors stop, and how we close the gap: https://veriprajna.com/solutions/algorithmic-trading-compliance