Master program · Risk, Controls & Surveillance

Detect the trade. Reconstruct the behaviour. Prove the case.

Master energy and commodity trade surveillance across REMIT, MAR, physical markets, derivatives, ETRM data and surveillance analytics. Build detection models, investigate suspicious behaviour, and work through realistic gas, power, LNG, crude and emissions cases.

REMIT · MAR · Physical & financial manipulation · Surveillance analytics · ETRM · Investigations

Enrol or enquire See the 130 chapters

130 chapters · 11 modules · Python + SQL labs · synthetic trading data · end-to-end capstone

The problem

A suspicious energy trade rarely tells the whole story

An order may look legitimate. A physical nomination may look legitimate. A profitable derivatives position may look legitimate. Correlate them and the picture can change completely.

Order behaviour× Physical asset behaviour× Market movement× Position× P&L

This programme teaches you to reconstruct that picture - and to tell the difference between behaviour that is suspicious and behaviour that merely looks unusual.

How surveillance works

From raw activity to escalation

OrdersTradesPositionsP&L NominationsAsset dataMarket dataCommunications
→
Surveillance engine ↓ Alert ↓ Investigation ↓ False positiveEscalate

Every chapter answers the same six questions: what happened, what data reveals it, the detection logic, the false positives, the investigation, and the disposition.

What you will investigate

Six families of abuse

Spoofing & layering

Order-book behaviour and cancellation patterns.

Wash & circular trading

Related entities and artificial volume.

Marking the close

Trading around settlement and benchmark windows.

Physical withholding

Asset availability, capacity and financial benefit.

Gas & power manipulation

Nominations, storage, congestion and dispatch.

Cross-market manipulation

Physical, futures, OTC and related positions.

The build

Don't just study surveillance. Build it.

Students build progressively from raw trading data to a functioning surveillance workflow. By the end you hold working artefacts, not lecture notes.

PythonSQLKafkaPostgreSQLClickHouseMachine learningGraph analyticsETRM
  • Commodity surveillance data model
  • Order-book reconstruction engine
  • Spoofing detector
  • Wash-trade detector
  • Marking-the-close detector
  • Physical-withholding detector
  • Position and P&L correlation engine
  • Trader behaviour model
  • Graph-based relationship detector
  • Alert risk-scoring engine
  • Investigation case pack
  • Mini surveillance platform
The capstone

The NorthStar case

Rather than 130 disconnected examples, the programme follows one fictional firm - NorthStar Energy Trading, with desks in European gas, power, LNG, crude and emissions, and fifteen traders. Relationships between orders, trades, assets, nominations, positions, prices, P&L and communications emerge slowly across the course.

€18.7Mprofit
4traders
3markets
27surveillance alerts

Was it sophisticated trading - or market manipulation?

Fictional training scenario. NorthStar Energy Trading, its traders, figures and alerts are invented for teaching purposes. This is not a real enforcement case and does not describe any actual firm, person or investigation.

Students receive orders, executions, positions, market prices, storage and nomination data, physical asset activity and simulated communications. The task is to reconstruct the case and defend the conclusion. Some alerts are genuine abuse. Some are false positives. Some look innocent alone and become suspicious only when correlated.

Curriculum

11 modules · 130 chapters

The design principle is cumulative: chapter 130 should be impossible to complete properly without the artefacts built in the chapters before it. Market structure, then regulation, data, detection, physical markets, cross-market relationships, analytics, alerts, investigation, technology, and finally the capstone.

M0 Surveillance Desk Primer Ch 1–8 · 8 chapters

Establish the end-to-end mental model before any regulation or code.

Lab: investigate your first simplified suspicious trade

  1. What a Commodity Trade Surveillance Function Actually Does
  2. Front Office → ETRM → Surveillance → Compliance → Regulator
  3. Orders, Executions, Trades, Positions and Physical Operations
  4. Financial vs Physical Commodity Surveillance
  5. Anatomy of a Surveillance Alert
  6. From Alert to Investigation to Case Closure
  7. False Positive vs Suspicious Behaviour
  8. End-to-End Surveillance Operating Model
M1 Market Abuse & Regulatory Foundations Ch 9–20 · 12 chapters

Current REMIT, not the 2011 framework treated as static.

  1. Why Commodity Markets Need Surveillance
  2. Market Manipulation Fundamentals
  3. Attempted Market Manipulation
  4. Insider Trading
  5. Inside Information
  6. REMIT Architecture
  7. Revised REMIT and the New Surveillance Landscape
  8. MAR and Commodity Derivatives
  9. REMIT vs MAR
  10. ACER, NRAs, Exchanges and Market Operators
  11. Suspicious Transaction/Order Reporting
  12. Building a Regulatory Control Matrix
M2 Trading & Surveillance Data Ch 21–32 · 12 chapters

The surveillance data foundation everything later depends on.

Build: canonical surveillance data model

  1. Order Lifecycle
  2. Execution Lifecycle
  3. Trade Lifecycle
  4. Amendments and Cancellations
  5. Order-Book Reconstruction
  6. Trader and Account Hierarchies
  7. Instrument and Contract Reference Data
  8. Market Data and Tick Data
  9. Position Data
  10. P&L Data
  11. Physical/Nomination Data
  12. Creating the Surveillance Golden Record
M3 Order & Trade Manipulation Ch 33–47 · 15 chapters

The first detection library: order and trade manipulation patterns.

  1. Spoofing
  2. Layering
  3. Wash Trading
  4. Self-Trading
  5. Pre-arranged Trading
  6. Circular Trading
  7. Painting the Tape
  8. Marking the Close
  9. Momentum Ignition
  10. Quote Stuffing
  11. Abusive Order Cancellation
  12. Artificial Price Formation
  13. Benchmark Manipulation
  14. Collusive Behaviour
  15. Manipulation Pattern Comparison Lab
M4 Physical Energy Market Manipulation Ch 48–62 · 15 chapters

The signature module. Where this stops resembling a banking course.

  1. Why Physical Energy Surveillance Is Different
  2. Generator Capacity Withholding
  3. Economic Withholding
  4. Physical Withholding
  5. Pipeline Capacity Manipulation
  6. Gas Nomination Behaviour
  7. Storage Injection/Withdrawal Manipulation
  8. LNG Cargo Behaviour
  9. Transmission Congestion
  10. Power Dispatch and Outages
  11. False Availability Information
  12. Physical Asset → Price Relationship
  13. Physical Position → Financial Benefit
  14. Cross-Commodity Physical Manipulation
  15. Building a Physical-Market Surveillance Model
M5 Gas, Power, LNG & Commodity Cases Ch 63–74 · 12 chapters

Desk-specific investigations across gas, power, LNG, crude and emissions.

  1. TTF Surveillance
  2. NBP Surveillance
  3. European Power Markets
  4. Intraday Power Manipulation
  5. Day-Ahead Market Behaviour
  6. Gas Storage Case
  7. Pipeline Capacity Case
  8. LNG Cargo Diversion Case
  9. Crude Oil Benchmark Case
  10. Emissions Market Case
  11. Freight/Commodity Interaction
  12. Cross-Market Case Reconstruction
M6 Cross-Market Surveillance Ch 75–84 · 10 chapters

Behaviour that only becomes visible when markets are correlated.

  1. Physical vs Futures Positions
  2. Spot vs Forward Manipulation
  3. Futures vs OTC
  4. Exchange vs Bilateral Trading
  5. Commodity vs FX
  6. Commodity vs Freight
  7. Commodity vs Emissions
  8. Related Accounts
  9. Beneficial Ownership and Entity Networks
  10. Cross-Market Manipulation Detection
M7 Surveillance Analytics Ch 85–99 · 15 chapters

Rules, statistics, behaviour profiling, graph analytics and ML. Python and SQL throughout.

  1. Rule-Based Surveillance
  2. Threshold Design
  3. Time-Window Detection
  4. Statistical Baselines
  5. Z-Scores and Anomalies
  6. Trader Behaviour Profiling
  7. Peer-Group Analysis
  8. Time-Series Detection
  9. Order-Book Features
  10. Position/P&L Features
  11. Physical Behaviour Features
  12. Graph Analytics
  13. Machine Learning for Surveillance
  14. Explainable AI for Alerts
  15. Model Validation and Backtesting
M8 Alert & Investigation Management Ch 100–109 · 10 chapters

From alert generation through evidence to documented disposition.

  1. Alert Generation
  2. Alert Prioritisation
  3. Risk Scoring
  4. Evidence Collection
  5. Timeline Reconstruction
  6. Trader Behaviour Analysis
  7. Communications Correlation
  8. Investigator Notes
  9. Escalation and Case Governance
  10. Closing and Documenting an Investigation
M9 ETRM & Surveillance Architecture Ch 110–119 · 10 chapters

The architecture that carries all of it in production.

  1. ETRM as Surveillance Source
  2. Trade Capture Integration
  3. Market Data Integration
  4. Position/P&L Integration
  5. Physical Operations Integration
  6. Kafka/Event Architecture
  7. Surveillance Lakehouse
  8. ClickHouse Surveillance Analytics
  9. Detection Microservices
  10. Case Management Architecture
M10 Capstone Ch 120–130 · 11 chapters

The NorthStar case. Everything built in chapters 1 to 129 is needed here.

  1. Capstone Introduction
  2. Synthetic Energy Trading Firm
  3. Traders and Desk Structure
  4. Market Dataset
  5. Order Dataset
  6. ETRM Trade Dataset
  7. Position/P&L Dataset
  8. Physical Operations Dataset
  9. Hidden Manipulation Scenarios
  10. Conduct the Investigation
  11. Produce the Final Surveillance Case Report
Who it is for

Surveillance is a cross-functional job

The programme assumes no prior surveillance experience, but does assume comfort with data. Python and SQL are used throughout rather than taught from zero.

Trade surveillance analystsREMIT analystsCommodity complianceETRM business analystsEnergy tradersRisk analystsSurveillance developersData engineersConsultants
How it is delivered

Three ways to take Energy & Commodity Trade Surveillance & Market Abuse

Self-paced is a document-and-media programme with lifetime access - no live sessions. Cohort and enterprise add live instructor-led training. Mentorship is not offered in any tier.
Feature Self-paced Cohort Enterprise
Format Written chapters, video explainers and podcasts Everything in self-paced, plus scheduled live sessions Everything in cohort, delivered privately to your team
Live sessions None Scheduled, instructor-led Scheduled, instructor-led, private
Mentorship Not offered Not offered Not offered
Access Lifetime Lifetime Lifetime for every enrolled seat
Pace Entirely your own Guided schedule with a peer group Agreed with your desk
Tailoring Fixed curriculum Fixed curriculum Sequenced to your markets, systems and governance
Best for Individuals learning around a job Individuals who want structure and deadlines Desks building the same capability together
For individuals

Get the programme guide

The full chapter list, what each module covers, and how the tiers compare - sent to your inbox as a PDF.

For teams

Run this for my desk

Private delivery for your desk, sequenced to your markets and systems. Tell us the team and we will scope it.

Run this for my desk

Build it, don't just study it

Enrol, request the full curriculum, or talk to us about running it for a team.

Enrol or enquire All training programmes