Detecting toxic trading requires more than ranking accounts by profit. A brokerage needs to understand how orders interact with its prices, execution and liquidity arrangements. The useful question is whether a repeatable pattern is creating adverse outcomes, and what evidence explains those outcomes.
“Toxic flow” is used in different ways by different desks. Some use it for economically adverse selection; others use it for suspected exploitation of an execution weakness. Establish your working definition before building a detection rule.
Separate an execution problem from an abuse allegation
A client can trade successfully without doing anything improper. Market moves, legitimate automation and effective strategy selection can all produce profitable outcomes. Equally, an unprofitable account can still generate operational problems. Profitability is context, not a verdict.
Research on toxic flow examines liquidity-provider adverse selection and dealing decisions. That economic framing does not, by itself, establish a contractual breach or a legal classification. See the primary research paper A Simple Strategy to Deal with Toxic Flow for one model of the problem.
Assemble the evidence before scoring the account
Start with trade requests, executions, server timestamps, symbol settings and available bridge or liquidity records. Where possible, compare the execution price with the relevant quote sequence. Align clocks and identify which timestamp refers to receipt, routing or completion.
Preserve the original observations alongside any calculated indicator. If a rule reports an unusual execution result, the reviewer should be able to see the trades, comparison window and calculation that produced it. Missing quote history should be shown as missing evidence, not quietly replaced by an assumption.
Review several signals together
Patterns worth investigating include repeated activity around apparent stale quotes, unusually clustered entries, rapid changes between related accounts and consistent differences between client and external execution outcomes. Holding time, trading frequency and win rate can help prioritise a review, but none is sufficient on its own.
- Timing: Does the same sequence recur, and are the timestamps reliable enough to support the comparison?
- Execution: Is the pattern linked to a particular feed, symbol, route or session?
- Relationships: Do shared infrastructure and trading patterns recur across accounts?
- Economic impact: What costs and retained trading results are attributable to the observed flow?
Compare like with like
Assess outcomes within comparable symbols, trading sessions and execution conditions. A news release can affect many unrelated traders at once. A common strategy or signal provider can produce similar orders without implying that the accounts are under common control.
Review both adverse and favourable outcomes over a sufficiently representative window. An indicator built only around the largest losing execution can exaggerate the pattern. Record the number of observations and keep the rules versioned so a later reviewer can reproduce the result.
Several accounts place matching orders within a short window. The desk first confirms clock alignment, checks whether a public event explains the timing and compares the execution records. Shared-device evidence and repeated matching patterns can justify a deeper review; the initial timing match remains a signal.
Make the investigation understandable
A good case view should explain what triggered the alert, list the contributing trades and present related-account evidence separately from the financial result. The reviewer should be able to record an explanation, request more evidence or close a false positive.
Prioritise cases with material impact and strong supporting evidence. Avoid a workflow that automatically treats every flag as confirmed abuse. Any action should follow the brokerage’s documented review process and applicable agreements, with an accountable decision-maker.
Use resolved cases to improve the controls
Track false positives, repeated infrastructure issues and the reasons investigations were closed. A pattern may point to quote handling, a routing configuration or a data-quality problem rather than client behaviour. Fixing that underlying issue can be more effective than increasing the sensitivity of an alert.
BrokerCNC’s Investigation Center presents behaviour evidence and response workflows, while Syndicate Intelligence adds linked-account context. Review them together when evaluating how a desk moves from a detection signal to a supported conclusion.
See the workflow in BrokerCNC.
Explore the product demo, then discuss your servers, routing and brokerage priorities with our team.
Book a Live Demo →
