Market abuse surveillance has always been built around the individual. The rogue trader, the anomalous account, the single position that stands out from the book. According to cross-broker intelligence network Tapaas, that instinct is now the weakness abusers rely on. The activity doing the real damage is collaborative, and it is structured specifically to look unremarkable to any one broker watching its own book in isolation.In new source material shared with the industry, Tapaas maps five models of coordinated abuse across contracts-for-difference (CFD) and foreign exchange (FX) markets, and this month it has put measured figures behind them. For a surveillance desk, the value sits less in the headline numbers than in the structure. Each model carries a behavioural signature a risk team can actually look for. What follows is a practitioner's map of all five, and the common flaw that lets every one of them work.Model one: internal hedgingThe simplest form. Two or more accounts, held by related parties or controlled by a single operator, take opposing positions on the same instrument at the same broker. The directional risk cancels out while the operator harvests value that a lone account cannot reach, whether bonuses, rebates or execution advantages.To the broker, the positions appear to offset and pass as an ordinary, two-sided flow. The tell is in what the accounts share beneath the surface. The detection signal is a cluster of accounts consistently taking opposing positions on the same instrument, with high timing correlation and low net directional exposure across the group.Model two: external hedgingThe same logic evolved. The opposing positions are split across different brokers, which makes the relationship invisible to any single firm. One account wins and one loses, but across firms the net position stays flat or positive, with the winning side deliberately routed to whichever broker offers weaker pricing, worse execution or lighter surveillance.Tapaas estimates that between 1 and 2 per cent of habitual traders globally, those with established, recurring account histories, are running systematic external hedging at any given time. At network scale, it describes this as a persistent structural drain on broker profitability.The July surveillance build puts figures behind that estimate. Over a single trailing month, the network recorded 1,841 chronically losing accounts that were re-funded rather than abandoned, the pattern you would expect when the winning leg of a hedge sits at another firm entirely. In one case, an account had lost around $5 million across its lifetime and still received roughly $2.5 million in fresh deposits with no withdrawals, a losing leg kept alive on purpose because its matching winner earns elsewhere. That re-funding loop is the visible half of a relationship neither broker can see in full.The detection signal has sharpened accordingly. Rather than leaning first on identity data, the network can now match trades on timing alone: the same instrument, the same size, the opposite side, inside two seconds once each broker's clock is corrected. Device fingerprints, funding-source overlap and internal-transfer links then serve as corroborating evidence of common ownership.Model two-a: funded-account challenge hedgingA fast-growing variant, and the one Tapaas singles out as most underdetected. It exploits the asymmetry built into the proprietary trading firm challenge model. A trader opens a funded-account challenge at a prop firm, which carries the risk during the evaluation phase, while holding an opposing live CFD position at a retail broker. If the challenge account wins, the trader qualifies for funding, a capital gain with limited downside, while the live position hedges the directional risk so the trader cannot lose on both sides at once. In the more advanced form, challenge accounts are hedged against other challenge accounts across different prop firms.The reason it matters now is scale. Funded-account challenges have grown quickly as a retail acquisition model, and the larger that ecosystem grows, the wider the attack surface. It is difficult to catch because surfacing it requires data from two entity types, prop firms and retail brokers, that have not historically shared it. The detection signal is temporal correlation between challenge-account activity and opposing live positions, overlap in funding sources, and behavioural profiles that match across the two entity types. In practice, the losing live leg is now detectable on its own: a chronically losing live account that keeps being re-funded is visible from the broker's side alone, with no sight of the prop firm required."The funded-account challenge model has created an attack surface the industry has barely begun to measure," said Andria Orphanidou, chief operating officer at Tapaas. "It sits across two types of firms that have never shared data, which is exactly why it goes unseen. The funded-account challenge model has created an attack surface the industry has barely begun to measure. It sits across two types of firms that have never shared data, which is exactly why it goes unseen. And the scheme is detectable from the losing leg alone, through the chronic re-funding signature, with no visibility into the prop firm required. "Model three: syndicate tradingThe most structurally complex model and, at scale, the most damaging. A network of traders coordinates entry across multiple accounts and potentially multiple brokers, building a cumulative position large enough to move the CFD price itself, particularly in lower-liquidity instruments. Once the price shifts, the group exits, often having pre-positioned in futures or options to capture the move they engineered. Because CFD volumes can influence the hedging behaviour of brokers running B-book models, that pressure feeds back into real price movement, and syndicate operators exploit the mechanism deliberately.Tapaas identifies two recurring shapes. In the ring structure, a closed network of accounts each trade with several others in a fully connected mesh, with no single coordinator, which keeps the group resilient even if one node is caught. In the cascade structure, one or two coordinating accounts sit at the apex and feed timing signals down to an execution layer, which distributes across a wide base of terminal accounts. The coordinator takes the cleanest position, the execution layer absorbs the noise and the detection risk, and the terminal accounts are treated as expendable.The July build shows these structures are no longer only theoretical. Graph analysis surfaced a single connected cluster of just over 11,000 accounts spanning four brokers, roughly 40 per cent of them registered with near-sequential account numbers. The confirmed economics so far are incentive harvest rather than price impact: the cluster's main body carries a median on-book profit and loss of zero and a lifetime spread cost of around $16 million, yet it collected $0.7 million in negative-balance compensation in a single month, enough to offset most or all of what it pays the brokers in spread over that period. Around it sit 598 hub accounts, the busiest synchronised with 957 counterparties in one day, and a 523-account layer that moved $25 million in a month while 98 per cent of it never placed a suspicious trade. Detection of same-direction price impact, the mechanism that would confirm deliberate price movement, remains in development.The detection signal combines graph analysis of account relationships, timing correlation across account clusters, position concentration in thin instruments ahead of price moves, and cross-broker network mapping.The flaw they all exploitRead together, the five models share one design principle. Each is invisible to a broker operating alone. Internal hedging looks like an ordinary two-sided flow; external hedging leaves no trace at the firm holding the losing account; funded-account challenge hedging is split across entity types that have never compared notes; and syndicate trading passes for correlated retail sentiment unless the account relationships can be drawn out. The exploitation lives at the edges, where accounts meet and identity fragments across venues that never see each other's data. Closing that boundary is what cross-broker intelligence is built to do.Why recurrence is the number that mattersThe data Tapaas reports supports the operational case rather than replacing it. Across its network, the firm says it has identified 347,653 abusive traders and that during a recent volatility spike, 73 per cent of flagged accounts were operators it had seen before. That figure is not a sign the abusers have grown careless. It is a measure of how much changes when behavioural fingerprints sit in a shared record rather than a single firm's files. An operator who would look like a new client to any one broker is already recognisable to the network. Volatility, on this reading, does not create abusive traders. It reveals the ones already in the system, with toxic flow able to double as a share of trades inside a volatile window before falling away by 46 per cent week on week once conditions settle."Volatility does not create these traders; it exposes them," said Orphanidou. "When the next spike comes, we are not starting from zero. We already know which accounts are most likely to activate, which instruments are most exposed, and which brokers carry the most concentration risk. That turns the week after an event from a post-mortem into something you can prepare for in advance."The remaining 27 per cent, the genuinely new accounts, are where the live detection challenge sits. Even there, Tapaas notes that behavioural signatures often align with established typologies, from timing distributions and order-sizing profiles to instrument preferences and geographic clustering that mirrors known network patterns. That is the practical payoff of the map. Once a surveillance team has the five models and their signals in hand, even an unfamiliar account can be measured against known shapes instead of being treated as a blank slate. The next volatility event will test every broker's book. The firms that have already mapped the network will spend that week watching the accounts they expected, rather than explaining the ones they missed. This article was written by FM Contributors at www.financemagnates.com.

Read full article on FINANCEMAGNETS