Behavior Detection

Understanding Behavior Detection Technology: Emerging Approaches To Dealing With Three Major Consumer Protection Threats

A White Paper Report by Mantas, Inc. April 2003

Understanding Behavior Detection Technology .........................................................................................................................................

Understanding Behavior Detection Technology: Emerging Approaches To Dealing With Three Major Consumer Protection Threats .................................................................................................................................................................................. Executive Summary Good news for consumers and financial services companies: A new generation of "behavior detection" technology means that more and more financial abuses will be detected in the early stages as they are happening, rather than long after a consumer's money is gone and the often unwitting company's reputation is harmed. Identity theft (including a fast-rising practice known as "account takeover"), "rogue" stockbroker abuses (such as churning, front running and shadowing of accounts) and financial marketplace inequities (involving such systemic problems as failure to provide mutual fund breakpoint discounts and unfair prices in the fixed-income securities marketplace) are major problems today for consumers and financial services companies, both of which stand to benefit from the application of the new technology. Behavior detection technology untangles the webs of complex behavior that lie behind such problems as money laundering, stockbroker fraud, and investment marketplace price manipulation. It allows companies to uncover wrongdoing by finding suspicious patterns of behavior hidden within voluminous data. The key to behavior detection technology is its ability to identify suspicious events and related entities over time, separate them from normal everyday events, and then to zero in on the perpetrators. Without this sophisticated tool, it is likely that many suspicious behaviors will go undetected for long periods of time or not be uncovered at all. There are five progressive levels in compliance technology now used by the financial services industry, ranging from the low-tech “Level Zero” manual sampling of data to the full-blown “Level 4” behavior detection technology. Level Four includes all of the techniques and "views" of the lower levels, and adds to them more complex technologies such as “Link Analysis” and "Sequence Matching.” Using these sophisticated technologies, a behavior detection system sifts through millions of pieces of data in order to find hidden relationships between events and entities and evaluates related activity in context to identify potentially suspicious patterns. Level Four technology can identify securities front running, networks of related accounts that may indicate fraud or money laundering, rapid movement of funds, and a sudden escalation in account activity. It will be the key to the early detection and "cracking" of problems that now often escape notice until after the damage is done. While many less sophisticated illegal activities can be detected using Levels One to Three technologies, the most cunning financial abuses will be uncovered only with Level Four techniques. Mantas delivers behavior detection technology to the global financial services industry and is used by some of the best-known names in the industry to deploy technology for broker surveillance, best execution and trading compliance, anti-money laundering compliance, fraud detection, and other purposes. ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 2

Understanding Behavior Detection Technology .........................................................................................................................................

What Is “Behavior Detection” Technology? Behavior detection technology untangles the webs of complex behavior that lie behind such problems as money laundering, stockbroker fraud, and investment marketplace price manipulation. It allows companies to detect wrongdoing by finding suspicious patterns of behavior buried and hidden within voluminous data. Wrongdoers leave behind an electronic trail of data. That data reveal the story of their fraud by recording critical events, such as deposits, withdrawals, wire transfers, account openings, changes in power of attorney, trades, orders, and quotes. The wrongdoers also may use many separate entities to carry out their schemes, establishing accounts under different names using a variety of financial products such as insurance policies or securities, and employing different traders. Data about these events and entities is captured. And data is also captured about when these events take place. The order in which events take place is extremely important, often spelling the difference between fraudulent or innocent behavior. The key to behavior detection technology is its ability to identify suspicious events and entities that build over time, separate them from normal everyday events, and then to zero in on the wrongdoers. Without this sophisticated technology, it is likely that many suspicious behaviors will go undetected for long periods of time or not be uncovered at all. Consider the scenario of a drug dealer seeking to launder large amounts of illicit cash. The criminal knows that if he deposits cash, the bank will file a form tipping off the government to the transaction. So, the drug dealer buys money orders with the cash on the theory that, since money orders are regulated less rigorously, he is less likely to be detected. He also knows that if he buys $3000 or more in money orders at one time, he has to supply an ID. To avoid this, the drug dealer makes the rounds to several convenience stores, and at each he buys five $500 money orders. He then deposits all his money orders at the bank. However, to avoid suspicion, he makes the deposits at several branches over several days and into several accounts. He later consolidates the money into one account and wires it to an account at an offshore bank. Just a few years ago, this seemingly simple form of money laundering was difficult to detect. Today, the technology exists to ferret out this type of hidden money laundering as well as other more complex patterns of fraud. Volumes of Data - The chief challenge to behavior detection is the sheer volume of data that must be scrutinized. By definition, the suspicious behavior in question almost always is composed of many events and entities – for example, many transactions spread over many accounts. Any single transaction in isolation may look completely normal. It is only when that transaction is linked to all the other relevant transactions that it becomes suspicious. A trade by itself looks normal, but in the context of other trades it becomes apparent that it is part of a market manipulation scheme. A bank account by itself looks normal, but when it is linked to other accounts it becomes part of a money-laundering ring. Since the suspicious events and entities are buried in millions of legitimate events and entities, how do you separate the suspicious from the legitimate? The answer – by examining the relationships between the events and entities. For example, relationships must be found among transactions or among accounts. But the number of combinations to examine can quickly escalate into an intractable problem. What is needed is a method of intelligently choosing which relationships to examine and which to filter out. And that is what behavior detection technology does. ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 3

Understanding Behavior Detection Technology .........................................................................................................................................

There is another important complicating factor: “bad guys” who get smarter and smarter about how to pull off their schemes. If a criminal is caught using one approach, he will use a different and more sophisticated approach the next time. Thus, the problem behavior evolves to outwit older, outdated detection techniques. Technology that fails to constantly evolve and take into account the “advances” among lawbreakers may be rendered all but useless almost from the time it's put in place.

Putting The Theory Into Practice The financial services industry is a major consumer of technology that is used to detect such problem behaviors as money laundering, illegal activities by employees and investment price manipulation. A number of different technology approaches are being used to address compliance problems for banks, insurance companies, brokerage firms and other entities. However, the development of this technology is so new that coverage varies widely and some of America’s largest financial institutions are shielded by extremely sophisticated detection methods, while others may rely upon extremely limited technologies that are either too narrow to detect a full range of potential problems or too elementary to catch the newest and most complex abuses. The problems that the institutions must detect present themselves in “scenarios” or "stories" that range from the fairly simple to the mind-bogglingly complex. For example, some criminals may use an easily detected kind of money laundering scheme while other wrongdoers may devise far more complex schemes with trails that escape all but the most advanced analysis. The financial services industry, therefore, must use systems that combine a range of techniques: rudimentary “tests” to identify simple scenarios and more sophisticated technology to isolate the most complex schemes. The Industry’s Levels of Detection - There are five progressive levels of complexity for compliance technology in use in the financial services industry. »

Level Zero: Sampling with Manual Investigation. At this level, a firm is basically sampling data and manually examining the sampled accounts and transactions, perhaps using some tools to semi-automate the process such as sorting the data in spreadsheets and scanning the sorted data. Only some portion of the data can be examined, the work of spotting important relationships is left to human effort, and the effort is probably spread out over multiple people. This is an “old school” paradigm with obvious drawbacks: while analysts may use some types of technology to pull together information, important data is lost in sampling, and it involves a lot of painstakingly time-consuming work by hand that may not keep up with the crush of information that should be scrutinized. In addition, since the manual effort may be spread out over multiple people, suspicious behaviors may go unnoticed because each analyst only has the chance to examine one aspect of the puzzle and no one analyst ever sees the whole picture.

»

Level One: Single Events and Entities. This level automatically checks all the data, but it examines each piece in isolation and does not consider relationships. The drawback here is that most major “problem behaviors” now involve a sophisticated web of events and entities that unfold over a period of time. Level One will only catch the most blatantly suspicious transactions or accounts – ones that are so suspicious that they stand out by themselves. For example, Level One technology could flag single wire transfers to a person on a terrorist watch list or funds being transferred from one account to a high-risk geography. But the

......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 4

Understanding Behavior Detection Technology .........................................................................................................................................

reality is that most problem behavior transactions look quite innocent in isolation, only taking on an air of suspicion when linked to other related transactions. »

Level Two: Rudimentary Summaries. At this level, the overall behavior of an account is summarized at a coarse-grained level and simple techniques are applied. While some problems may be detected, more sophisticated abuses are likely to evade detection. Level Two technology is appropriate for scenarios in which a simple, high-level measurement on a single account clearly identifies the behavior. Level Two technology could apply a technique such as rule matching to the overall account, directing the software to find all accounts with more than 10 wire transfers and more than $1,000,000 deposited, for example. This level of review could be used to identify excessive debit card activity or large checks, monetary instruments, or funds transfers in large round dollar amounts, or large depreciation in value within one account.

»

Level Three: Sophisticated Summaries. Here, finer-grained summaries find account nuances by breaking down account transactions into complex subsets. If a suspicious behavior involves only a small subset of the account’s transactions, it can get lost in the noise when looking at the overall behavior of the account (rudimentary summaries), but finer-grained summaries catch these nuances. This type of analysis is more sophisticated than what is described in Level Two, enabling analysts to detect potential abuse within an account. For example, this level of review could identify a pattern of monetary instruments within one account that are just under reporting thresholds or multiple checks or instruments in the same amount. This level of review still is not able to identify hidden account relationships, analyze behavior across accounts, or identify important and potentially suspicious sequential patterns. Those types of behaviors require Level Four analysis, which can be referred to as “behavior detection technology.”

»

Level Four: Behavior Detection Technology. Each of the preceding levels of review encompasses the techniques of the earlier level and then builds on it. Level Four review, behavior detection technology, includes all of the techniques and "views" of the lower levels, and adds to them more complex algorithms such as “Link Analysis” and "Sequence Matching.” Using these sophisticated technologies, a behavior detection system sifts through millions of pieces of data in order to find relationships between events and entities that on the surface do not appear related and evaluates potentially related activity in sequence to identify potentially suspicious patterns. Level Four technology can identify securities front running, networks of related accounts that may indicate fraud or money laundering, rapid movement of funds, and a sudden escalation in account activity. While many less sophisticated illegal activities can be detected using Levels One to Three technologies, the most insidious behavior scenarios will only be uncovered using Level Four techniques.

A Closer Look at “Level 4” Technology How does “Level Four” or behavior detection technology work? Consider the case of Mantas, where the behavior detection platform relies upon specially designed Link Analysis and Sequence Matching algorithms designed to find hidden relationships and suspicious patterns such as those described below. ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 5

Understanding Behavior Detection Technology .........................................................................................................................................

“Link Analysis” finds hidden links between accounts and then pieces this information into larger webs of interrelated accounts. At the simplest level, consider the three accounts shown in the following diagram: The first two accounts are linked by a common address. The second two accounts are linked by a shared cell phone number. Thus, all three accounts are linked together. While this example focuses on a very small (and simple) group of accounts, the principal at work is the same when vastly larger webs of accounts are detected. Accounts may be linked in much more subtle ways, such as sharing a common beneficiary, or evidence that the parties involved do business with each other such as writing checks or wiring funds to each other. Once a group of linked accounts is found, their behavior can be examined as a group, which can unmask previously hidden suspicious patterns of behavior. This technology is particularly applicable for problems where “rings” of perpetrators are involved. “Sequence Matching” is employed when a particular order of events (such as those transpiring over a period of time) contains some important clue that points to a hidden relationship or relationships. For example, a stock trader who receives a large customer order may try to trade ahead of that order because she believes it will move the market and giver her an instant profit. The following sequence of events within a short period of time can indicate that the trader is exploiting inside information about an order and taking advantage of a customer: 1.

A customer places a large order.

2.

A trader places an order in the same security, which is executed in a personal account.

3.

The large customer trade is executed.

4.

The price of that security changes.

4 3 2 1

These events in a different order would be entirely innocent. In this particular example, Sequence Matching defines a problem series of events or behaviors in advance and then searches for any occurrence of a tell-tale sequence among the thousands of trades and orders taking place in a particular day. Because criminals, money launderers, and con artists constantly adapt their behavior to get around the existing detection systems, their problem behavior grows ever more complex, spread out over time, and difficult to detect. As criminals vary their behaviors to defeat simpler and older detection methods, compliance officials at financial services firms must employ more and more sophisticated technology – such as behavior detection technology and techniques such as Link Analysis and Sequence Matching – in order to expose hidden relationships and uncover what otherwise most likely would have remained covered tracks.

Three Major Consumer Protection Threats ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 6

Understanding Behavior Detection Technology .........................................................................................................................................

The power of “behavior detection” technology is best appreciated when it is seen in action. The technology is used by financial services firms to protect their own bottom lines and reputations, as well as the financial well-being of the consumers who are their customers. As a leader in the field of behavior detection technology, Mantas has identified three consumer protection challenges that illustrate the increasing complexity of problem behavior and the practical, day-to-day benefits that will arise from the wider application of the new generation of behavior detection technology. Problem 1: “Rogue Broker” Abuses - For years, brokerage firms had to rely upon “low” or “no” tech solutions to detect problem broker behavior that ranges from front running trades ahead of clients and shadowing customer accounts and cases in which a broker engages in excessive trading (churning) in a client’s account in order to generate illicit commission income. In recent years, concern has grown about so-called “rogue brokers” who may employ often difficult-to-detect schemes to enrich themselves at the expense of investors, or who appear to have placed their clients in unsuitable investments leading to media horror stories about retirees losing their life savings when high-tech stocks tumbled. These abuses and others can take a major toll on the life savings of investors, particularly those who are not savvy about how to manage their relationships with financial professionals. While it is true that investors who discover they have been cheated can resort to arbitration venues to recover some or all of their losses, the reality is that some investors don’t recover their money for a variety of reasons and even when the investors are made whole, such proceedings are enormously embarrassing for the brokerage firms involved. Even if the conduct is entirely the fault of just one “rogue broker” or a handful of like individuals, it is the broker-dealer that suffers the black eye in terms of negative media coverage. Behavior detection technology is now being used to identify as early as possible the risks that a brokerage firm may face due to unsuitable investment recommendations, illicit broker activity and other employee malfeasance. Some examples of the type of behavior that can be uncovered by advanced behavior detection technology are the following: »

Churning and active trading. Churning is defined as excessive trading in a brokerage account, undertaken by a broker in order to increase that broker's commissions. Similar practices which can also have a negative impact on investors are twisting, encouraging an investor trade shares of similar mutual funds to drive up commissions, and encouraging active trading in general. Commissions can add up quickly and eat into investors' profits - or contribute to their losses. In addition, churning and active trading can increase investors' tax bills through repeated sales. Behavior detection technology can identify many different patterns of behavior that may indicate this type of problem behavior. For example, behavior detection technology identifies accounts in which brokers have encouraged investors to buy and sell mutual fund shares within relatively short periods. Behavior detection technology also isolates patterns of activity that may identify a broker encouraging a customer to engage in short-term trading. In the case of advisor-managed accounts, behavior detection technology detects individual accounts for which the advisory fees are disproportionately large relative to the size of the account as well as groups of accounts managed by the same advisor that all appear to be engaged in active trading that may not be beneficial for the investors. Any of these scenarios may indicate that an investment professional is encouraging potentially harmful short-term or excessive trading.

»

Shadowing of customer accounts. Investors who are considered to be “in the know” may be unaware that one or more financial professionals are copying their investment behavior or their accounts. This “shadowing” may take place in the name of the financial professional or in a proxy account. By analyzing all trades carried out by all customers and all employees, it is possible for behavior detection technology to hone in on links showing similar or identical trades in a short period of time. Behavior detection technology uses

......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 7

Understanding Behavior Detection Technology .........................................................................................................................................

Sequence Matching to identify patterns of activity that may indicate account shadowing is taking place. Using Link Analysis, behavior detection technology can also track down a hidden account that a broker or employee may be using for these rogue trades. The high volume of daily trading activity at almost any brokerage firm makes it a requirement to use this kind of sophisticated technology to find problems like this. Neither manual surveillance nor lower level technology can provide the comprehensive detection necessary to truly protect investors and firms from this type of abuse. »

Front running. This problem occurs when a broker or other employee aware of a single order large enough to move the price of a security may attempt to profit by trading ahead of that order in his or her own account or that of a family member. In a more sophisticated and complex version of front running, some unscrupulous traders may use their inside knowledge of a coming trade by taking a position in a related investment. For example, if a broker or employee knows of a large order that will potentially raise the price of a certain security, that trader could take a position in an option on that security, knowing that he or she can benefit from the expected price increase. Behavior detection technology has the complex algorithms and scalable capabilities needed to monitor all activity and detect this cross market or cross product abuse. Behavior detection technology uses Sequence Matching and other techniques to analyze what data is available, which tends to be more limited for such instruments as options and derivatives, then uses proprietary risk metrics analysis to determine which accounts to analyze for trading that may, in the context of the execution data, indicate this type of abuse.

»

Cherry picking. This refers to investment advisors who place a large block trade for a certain security, then allocate those shares unfairly among their clients. In these cases, the advisor waits to allocate the shares until after there has been a move in the price. The advisor may then assign shares that have already gone up in price to a few favored accounts, while shares of securities that go down in price are allocated to others. The advisor may even engage in short-term trading and then decide how to allocate profits and losses to client accounts. Behavior detection technology analyzes all of an advisor’s trades and identifies any patterns that may indicate cherry picking is taking place.

Problem 2: Identity Theft “Account Takeover” - Identity theft a major emerging problem for American consumers. The FBI calls identity theft one of the fastest growing crimes in the United States and estimates that 500,000 to 700,000 Americans become identity theft victims each year. The number one complaint category for the Federal Trade Commission in 2002 was “identity theft/fraud.” Behavior detection technology is an important new weapon in the war against identity theft. There are several identity theft problem categories that include different kinds of fraudulent activities, each representing its own set of problems for financial services institutions, their customers, and law enforcement. “Account takeover” is a major headache for banks and their customers. Experts agree that the early detection of illicit activity that signals possible identity theft (e.g., intercepted checks or compromised PINs) can provide the key to minimizing the losses that a consumer or financial institution would otherwise suffer. Swift, front-end detection is an opportunity for the bank to alert the customer to the possibility of compromised accounts or identity theft or signal law enforcement to possible misdeeds, thereby enabling the customer to protect or minimize losses associated with other potentially compromised accounts or giving law enforcement information that may help catch crooks or fraudsters. “Account takeover” typically involves a con artist gaining information about a consumer’s financial account and then making changes in the administrative information associated with the account. In some cases, this type of activity involves collusion with bank employees. For example, the swindler may engineer a change to the mailing address or arrange to have him or herself given signature authority on the account. The “takeover artist” then drains the account through a series of electronic ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 8

Understanding Behavior Detection Technology .........................................................................................................................................

withdrawals, checks or wire disbursements. Behavior detection technology isolates instances in which administrative changes to an account are followed by a disbursement from the account, particularly withdrawals in amounts or sequences that appear unusual for the consumer involved. In some cases, a crook may take over an account in order to use it for other illegal purposes, such as money laundering. In looking for instances of “account takeover,” behavior detection technology focuses on such factors as: »

Change in behavior. A sudden increase in the frequency or volume of transaction activity may be suspicious and warrant additional investigation. Behavior detection technology analyzes the transaction activity and detects significant changes from the typical behavior of an account. Behavior changes often are scrutinized in combination with instances of account balance declines.

»

Rapid depreciation of funds. The sudden depreciation of funds within an account can signal account takeover or another form of fraud. Behavior detection technology can detect this type of activity and alert compliance analysts to fraud that might otherwise go undetected until the customer receives his or her bank statement. As described above, behavior detection technology also looks for instances where changes in behavior are accompanied by declines in account balances or where an administrative change to an account is followed by a disbursement from the account, especially if the withdrawals are in amounts or sequences that appear unusual for the account.

»

Escalation in inactive account activity. An account that has been dormant, then suddenly becomes active, may be the target of account takeover or identity theft fraudsters. Behavior detection technology will alert compliance officials to an emerging pattern of increased activity so it can be investigated to determine whether the behavior is legitimate customer activity – or fraud.

Many law enforcement officials and regulators are quick to point out that what is often described as “identity theft” is simple fraud, though it often is conducted through sophisticated electronic means. For example, a con artist may steal your debit card and then use your “secret” PIN number to conduct what is known as “suspect return activity.” A pattern of excessive purchase and/or return activity associated with a debit card may indicate attempts to launder funds, perpetrate fraud, or may indicate account takeover. In addition, use of debit cards in certain geographies may be of interest, particularly if this is a change in behavior for the debit cardholder. Behavior detection technology monitors debit card use to detect this type of activity, especially if it represents a change in behavior as compared with the average or typical movement of the account during a set period of time. Behavior detection technology also identifies other, similar types of patterns and behavior that may indicate fraud, such as multiple or recurring addresses. In opening multiple accounts, members of fraud rings may utilize the same addresses, phone numbers, PIN numbers or other information on some accounts. For example, two accounts may share a phone number, one of those accounts may share a PIN number with a third account, that third account may have a lot of journals with a fourth account, and so on. Behavior detection technology finds all of those different hidden connections and connects the dots to identify the network of fraudulent accounts. The technology can also identify accounts that share any information with previously identified fraudulent accounts so returning fraudsters can be stopped early and proactively. Problem 3: Investment Marketplace Inequities - The problem of “rogue brokers” outlined above focuses on instances where individual financial professionals try to evade detection as they “game” the system at the expense of customers’ bottom lines and the reputations of their employers. But investors also face more systemic problems at financial institutions that are now being addressed through the application of behavior detection technology. In these cases, development of advanced behavior detection technology now enables firms to constantly and ......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 9

Understanding Behavior Detection Technology .........................................................................................................................................

comprehensively monitor the treatment of investors (as well as such issues as their own proprietary trade execution) and move quickly and proactively to prevent problems that could harm investors and the firm’s own reputation as well as to improve customer service and the firm’s performance. Examples of emerging investing marketplace inequities that can be addressed through behavior detection technology include the following: »

Mutual fund breakpoints. The issue of price fairness for mutual funds is a major concern for the roughly half of American households that hold such funds. The recent controversy over mutual fund “breakpoints” focuses, in part, on the issue of whether or not investors are being sold the class of mutual fund shares that are appropriate – or suitable – for them. Breakpoints are commission discounts typically offered on larger investments in what are known as the Class A shares of mutual funds. In some cases, a broker may recommend Class B shares – which result in a higher commission – when an investor would pay lower commissions for Class A shares due to the level of an individual or household investment. Or, a broker may sell the investor Class A shares but fail to provide the appropriate discounts that should have resulted from the combination of personal fund shares and retirement plan shares for an individual, spouse and family accounts. This may be done intentionally or it may result from a broker not knowing what investments have been made by an individual or household. Behavior detection technology analyzes all transactions and can also link together household accounts to ensure that investors get the correct price for shares. In addition, by analyzing all of a household's investments, behavior detection technology can also identify cases where an investor may have been sold unsuitable shares for his or her own situation or any patterns that may suggest an intentional avoidance of a price breakpoint. In all cases, the technology is identifying patterns of activity that suggest a broker is not meeting his or her responsibility to customers and to the firm.

»

Fixed-income investment pricing. Fixed-income investors include both individual and institutional investors and as a result of the market downturn of the last few years, more individual investors have turned to bonds. Stock or equities investors operate in a liquid and transparent market where they can easily see the price being charged for a share, as well as all of the relevant information that leads to that price. But in the fixed income marketplace, there is simply far less information available and even the savviest investors can have difficulty understanding pricing and trading of bonds. Behavior detection technology can help firms analyze what information is available for the benefit of the firm and its customers. For example, bond firms adopt and maintain policies to comply with securities regulations that limit the amount by which the price of a bond can be “marked up.” The lack of marketplace transparency can, however, make it difficult to determine whether such policies are being maintained. The complex algorithms deployed by behavior detection technology are able to analyze what information is available in order to help firms identify inappropriate price mark ups and even help improve price performance, which can be a competitive benefit. Behavior detection technology can also help firms to identify potential customer favoritism by accessing and analyzing data on all of a firm's proprietary trades including those done for customers, then comparing trades done for individual customers to look for any potential signs of favoritism, as well as comparing the prices to trades taking place outside the firm.

»

“Leakage” of analyst reports. There has been much attention paid recently to the very real potential for abuse when the dividing line is breached between the research and the investment divisions within a firm. One issue that has arisen is the question of whether some traders have had access to research reports before they are publicly disseminated and chosen to misuse that information for trading in their own or a related account. Behavior detection technology helps firms build another safeguard into the wall that should separate these two areas. The technology analyzes trades against the firm's restricted lists and its gray lists (which limits trading based on pending research reports on individual companies as well as reports on investment and trading strategies). The firm can rely on behavior detection technology to monitor behavior against the policies it has in place that bar such

......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 10

Understanding Behavior Detection Technology .........................................................................................................................................

activity. This type of protection helps firms meet their compliance requirements and also sends an internal and external message that violations of these laws will not be tolerated – or overlooked. About Mantas Compliance, Operational Risk, and Relationship Management In the mid-1990s, the Mantas team, then a business unit of SRA International, began work for the National Association of Securities Dealers (NASD). That first Mantas product is still used today by the NASD to monitor all trading on Nasdaq and selected global markets, looking proactively for any sequences of quotes and trades that may signal a potential violation, and reconstructing market transactions using data gathered in real-time throughout the trading day. Since that time, Mantas has continued to focus on developing and enhancing behavior detection technology for the global financial services industry and been hired by some of the best-known names in the industry to deploy technology for broker surveillance, best execution and trading compliance, money laundering and fraud detection, and other purposes. Behavior Detection Platform - The Mantas Behavior Detection Platform is a Web-enabled, end-toend solution that brings together the data from firms’ existing legacy systems – with market data as necessary – providing for enterprise-wide data monitoring and analysis. The platform can scale up or down to meet the needs of global financial services corporations as well as national and regional firms or single lines of business or geographic locations. Behavior detection technology gives financial institutions the ability to automatically monitor and analyze customer, account, and transaction information across the entire organization for a complete and accurate picture of behaviors of interest. As a result, it's now possible to detect suspect behavior early enough to mitigate risk, report and prioritize findings, comply with changing regulations, and increase revenue by identifying opportunities to improve customer service. This enables firms to deploy a platform that can serve both their compliance and business growth needs. For example, as banks and other firms evaluate their requirements under the proposed New Basel Capital Accord (Basel II), they are faced with a strong incentive to improve their operational risk measurements. Behavior detection technology provides firms with an enterprise-wide “early detection” system that can alert them to problems that, left undetected and unaddressed, could seriously undermine a firm’s position. In the past, firms have analyzed historical data to predict future potential losses. Unfortunately, that approach doesn’t account for new problems and, more importantly, provides no ability to act to prevent the loss, it simply allows firms to account for it. Behavior detection technology offers firms the chance to truly manage their operational risk, to understand their customer, employee, and business partner activity, and to move proactively to limit losses for the firms and its customers. In addition to helping firms deploy a best practices approach to risk management, behavior detection technology also gives firms an opportunity to improve their customer relationships. For example, when behavior detection technology identifies a brokerage account that becomes poorly diversified, it provides the opportunity to offer that customer professional investment advice. Some of the best-known names in the global financial services industry are using the Mantas platform today to meet these critical needs. Over time, more and more firms will recognize the value of behavior detection technology and its ability to help them understand and act on customer, employee, and business partner behavior. Mantas is a Safeguard Scientifics partner company. More information about Mantas is available at www.mantas.com.

......................................................................................................................................................................................................................... © 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 11