Detection is the sensor. Four layers sit above it.

Detection is the sensor. It reads the public record of settled trades, groups accounts that move as one participant, and runs twelve rules that each answer one narrow question a licence condition requires an operator to monitor.

Every detection carries its evidence and its limits, and names no account. It is deliberately rule-based rather than learned: a rule can be read, argued with, and defended in a meeting, and a finding that cannot survive being argued with is not worth reporting.

We are clear-eyed about what this layer is worth on its own. Detection is the part a competent team could rebuild. Everything below depends on it, and none of the value is in it.

From public data alone, authorised market making is indistinguishable from wash trading. The same accounts, the same two-sided volume, the same interlocking pattern. No amount of better detection separates them, because the information that separates them is not in the data.

It is in the operator's records. Set the observed record against the declaration and the ambiguity resolves in one of two directions. Either the behaviour matches the mandate, and what looked like a finding becomes documented evidence that a control is working. Or something is doing the same thing without a mandate, and that is a finding no one had.

Neither half stands alone. A declaration on its own is unverified. Detection on its own is ambiguous. The checked relationship between them is the product, and it needs a party that is independent of the operator and observing from outside.

A finding with no baseline is hard to act on. Told that a given share of volume is internal to one cluster, the only honest response is to ask what the number usually looks like.

Observing several platforms continuously makes that question answerable: concentration, cluster density, and internal volume share can each be read against a sector baseline rather than in isolation.

This is structurally impossible from inside a single platform. An operator cannot benchmark against competitors whose data they cannot see, and would not be trusted to publish the comparison if they could.

Detection asks whether there is a problem. Supervision asks a different question, and often the more useful one: whether the control that was supposed to catch it did.

Set what independent observation detected against what the operator's own surveillance reported over the same period. The gap between the two is the finding, and it is a finding about the control rather than about the market.

An operator can be clean and still run a monitoring function that would not have noticed if it were not. Nothing inside that operator can establish the difference, because the thing being tested is the instrument doing the testing.

The output of the layers above is only worth what its source is worth. An operator reporting on its own integrity is marking its own work, and an in-house function reporting on the platform it belongs to has the same problem in a quieter form.

Assurance is the same measurement performed by a party with nothing riding on the answer, and reported in a form that survives being read by someone sceptical. That includes reporting what could not be seen, as prominently as what was.

It is also the layer that constrains the other three. A finding we would not defend in front of a hostile reader does not belong in the report, which is why the limits register is published rather than filed.