The surveillance analyst's last defensible task just got automated

The surveillance analyst who reads the news to explain a price spike. A model does that step now, in Seoul.

South Korea's Financial Supervisory Service extended AI across its whole crypto surveillance pipeline. Local reporting put the rollout in late August 2026.

This is not a first attempt. The agency built manipulation-detection algorithms in January.

Those flagged suspects and the timing of their orders. What changed is coverage, not capability.

AI now runs from the first alert to the drafted investigation report. The pipeline is end to end.

Korea is not alone. India's SEBI said on August 24 it will extend AI surveillance to corporate filings.

Wholetime member Kamlesh Chandra Varshney gave that signal at a FICCI conference. The goal is flagging misstatements without waiting for a complaint.

Nasdaq embedded AI across market abuse investigations in October 2025. The CFTC has said it will use AI surveillance on prediction markets.

IOSCO published a supervisory toolkit for AI oversight in 2026. The pattern is global and it is not slowing.

Market surveillance has six steps. Most people picture one.

Step one is ingestion. Order books, trade prints, deposit and withdrawal logs, and reference data all stream in.

Step two is pattern matching. The system compares live activity against a stored library of known abuse tactics.

Korea names two of them. Racehorse schemes inflate a token price fast over a short window.

Cage schemes are subtler. An asset under temporary deposit and withdrawal limits swings hard because nobody can arbitrage it.

Step three is volume forensics. The FSS pairs Benford's law with machine learning to catch fake volume.

Benford's law describes how leading digits appear in natural data. Manufactured trade sizes break that distribution, and the model reads the break.

Step four is the context check. This is the step that used to be a person.

When volume or price spikes, a generative model scans news coverage and exchange notices. It asks one question: does a legitimate reason exist?

An analyst used to answer that. Now the model drafts the answer and the analyst reviews it.

Step five leaves the market entirely. The system monitors YouTube, message boards, and private chat rooms.

Video audio and subtitles get converted to text in real time. The model looks for front-running, false claims, and coordinated buying advice.

Step six is escalation. If no legitimate reason appears, the FSS demands granular trade data from the exchange.

Human investigators then review the AI-drafted report. They decide whether to open a formal case.

The legacy stack is rules plus attention. A threshold trips, an alert fires, and an analyst reads it.

That model has one fatal number. An industry survey covered 20 global banks and broker-dealers.

More than 70% reported false positive rates above 25%. One alert in four is noise, and a human reads every one.

Alert fatigue follows, and real signals get missed. The bottleneck was never detection, it was triage.

The machine stack attacks triage first. Context checking is the expensive part, and it is the part a model does well.

Scale explains why. LSEG says its surveillance handles billions of trade and order messages a day.

Where machines fail is specific and worth naming.

Novel schemes are the first gap. A library of known tactics cannot match a tactic nobody has seen.

Adversarial adaptation is the second. Manipulators read enforcement notices too, and they learn which patterns trip alerts.

Evidence is the third. A court needs a reasoned account of intent, and a confidence score is not one.

Data quality is the fourth and least glamorous. Bad timestamps and missing fills break detection no matter how good the model is.

Chat monitoring adds a legal problem. Real-time surveillance of private messaging raises questions that differ by jurisdiction.

Three pools move.

The first is the surveillance analyst. Level-one alert review is the same job agent triage is eating inside banks.

The difference here is who is buying. When the supervisor automates, the supervised have to match the pace.

That is the second pool, and it grows. Surveillance vendors sell to both sides of the same fight.

Nasdaq, LSEG, and specialist providers all ship AI surveillance now. Every agency upgrade is a sales cycle.

The third is enforcement economics. Complaint-driven investigation is slow and cheap for an agency.

Model-driven investigation is fast and expensive to defend against. Legal budgets at exchanges and brokers rise on the other side.

Note the asymmetry that matters most. Supervisors historically lagged the market on technology.

An agency reading chat rooms in real time is not lagging. That is a change in who holds the information edge.

Step four fell. Step six held.

The judgment about whether a price move has an honest explanation is now machine work. The decision to open a case is not.

That limit is legal, not technical. Enforcement needs a named human who can be cross-examined.

Watch for one disclosure. The first published false-positive rate from an AI surveillance system tells you whether this works.

Watch the first contested case harder. A defense lawyer will demand the model's reasoning, and the answer will set the standard.

Territory: +machines on detection, +incumbents on enforcement.

Compliance triage labor compresses on both sides, while surveillance vendors and supervisors gain the information edge.