The pattern was the point.

A surveillance program blind to its own business

FINRA found that Revere Securities did not maintain an AML program or a supervisory system reasonably designed to detect the suspicious and potentially manipulative trading its own business invited, and imposed an $800,000 fine, a censure, and a third-party consultant.

Since 2022, Revere had acted as underwriter or selling-group member in roughly sixty small-cap IPOs, more than forty of them for issuers based in Hong Kong or China.¹ It is a business with a well-known shadow: foreign-based, small-cap IPOs are a classic vehicle for ramp-and-dump schemes, where a stock is pushed up on thin, concentrated trading right after listing and then dumped, leaving later buyers with the losses. Several of Revere’s offerings showed exactly those hallmarks: sharp post-IPO price spikes and collapses, allocations concentrated in a handful of accounts, and trading that moved in unison.

FINRA did not find that Revere ran a scheme, or that its customers were proven manipulators. It found something narrower and, for a gatekeeper, damning: the firm was not equipped to see. It did not detect, investigate, or consider reporting the activity, because its one method of looking could not register the shape the activity took. The violations ran across FINRA Rules 3310, 3110 and 2010.¹

A human, a blotter, one day

Here is the technical heart of the case, and it is worth stating plainly. Revere’s sole means of detecting suspicious and potentially manipulative trading was a manual review of the daily trade blotter: a person reading through a list of the day’s trades.¹

A daily blotter is a flat list of what happened today. Read it with all the diligence in the world and you can still only ever ask one question: does any single trade, on its own, today, look wrong? That is a useful question. It is also the wrong question for this risk, because it cannot be asked across the two dimensions where coordination actually shows up: across accounts, and across days.

No single order in a coordinated scheme has to look remarkable. A customer selling their IPO allocation is ordinary. Two customers doing it is a coincidence. It is only when you line up seventeen of them, firing within five minutes, at the same price, from accounts that opened on the same day and share an address, that the picture resolves. The blotter never lines them up. It was built to scroll, not to connect.

Many accounts, one hand

What makes this case so clean is that the red flags FINRA listed are, almost without exception, patterns rather than events. Each is invisible in a single row and obvious in aggregate.¹

• Issuer C, April 2024. About 40 percent of the IPO went to eighteen customers, including four newly incorporated US entities sharing one business address and owned by individuals in Hong Kong and China. All eighteen emailed requests to liquidate every share within thirteen minutes of each other on the IPO day.
• Issuer B, August 2025. Seventeen sell orders across seventeen accounts, entered within five minutes on the morning of the IPO, each priced one cent above the IPO price, before a national best bid and offer was even available.
• Issuer A, September 2023. Nearly a fifth of the offering concentrated in eight Australia-based accounts, all referred by the same foreign broker-dealer, all sending limit orders to liquidate on the IPO date.
• Issuer E, April 2023. Seemingly unrelated customers who opened accounts the same day and listed the same address received identical allocations, and another set sold the shares on thirteen identical dates.

Read as single trades on single days, none of these needed to trip an alarm. Read as what they were, groups of accounts behaving as one, across time, they are almost ostentatious. The whole signal is in the correlation. Here is the same reality, seen two ways.

The tool was wrong, not the people

It would be easy, and wrong, to read this as a story about a lazy reviewer. The reviewer may have been diligent. The problem is that diligence cannot rescue a tool pointed at the wrong dimension. The blotter’s unit of analysis is one account, one day. The scheme’s unit of analysis is the network, across time. Those are different objects, and no amount of care spent examining the first will reveal the second.

This is the trap of a control that looks reasonable in isolation. A person reviewing every trade sounds thorough. On a coverage checklist it reads as a tick in the box: yes, trades are reviewed, daily, by a principal. But coverage is not resolution. The question is not whether every trade was looked at. It is whether the thing you are hunting is even visible at the magnification you are using. Revere was examining individual grains of sand for a shape that only appears from the air.

Nine years of the same warning

The detail that turns this from an oversight into a finding is history. This was not the first time FINRA told Revere its manual blotter was not up to the job. The firm’s 2017 settlement specifically identified the manual blotter review as problematic from a risk perspective. Revere did not begin implementing automated surveillance until late 2025.¹

The years in between are the aggravation. The business that most needed cross-account, cross-day surveillance grew through the whole period, and the known-inadequate tool stayed in place. FINRA also found the firm skipped its required independent AML testing in 2022 and 2023, running both years at once in 2024, and noted a separate 2025 settlement over how order tickets were marked.² A single blind spot is a weakness. A blind spot you were shown, and left in place while the exposure grew, is a finding.

Watch at the level the threat lives

This series keeps returning to automated systems and the humans who govern them, and Revere is the surveillance-side mirror of the whole set. A trading engine too fast to stop. A monitoring program aimed at the wrong product. A report filed too late. And here, a detection tool whose resolution was wrong for the threat: it could see individual actors in the moment, and the threat was a network over time.

For anyone building or buying surveillance and AI monitoring, the transferable rule is this: the unit of analysis has to match the risk. If the abuse you fear is coordinated or networked, point-in-time, per-entity review is structurally blind, no matter how good the people or how clean the single-trade checks. You need analytics that reason across entities and across time: linked-account graphs, synchronized-order detection, cross-day pattern analysis, concentration and market-share views.

The last point is the one boards underrate. Revere was not penalised only for lacking automated surveillance. It was penalised for being told, understanding, and taking years to act while the risky business expanded. In AI governance terms: a known model limitation you have chosen not to fix does not read as prudence under scrutiny. It reads as notice.

Surveillance built for coordination

A monitoring program fit for a foreign small-cap IPO business has a recognisable shape, and it is mostly about seeing across accounts and across time. None of it is exotic; the control recommendations attached to this case name it directly.³

• Cross-day, cross-account surveillance. Automated analytics that span multiple accounts and multiple days, the exact dimensions a daily blotter cannot reach, calibrated to the firm’s own IPO activity.
• Linked-account graphs. Detection that connects accounts by shared addresses, contact details, referral sources, funding and timing, so “seemingly unrelated” customers acting in concert surface as one cluster.
• Pattern scenarios for the real risk. Synchronized orders and sales, concentrated allocations and resale, IPO price spike and reversal, significant market-volume participation, and economically unusual trading, each a named scenario, not a hope that a reviewer notices.
• CIP and CDD that actually bite. Identity verification that escalates discrepancies rather than approving through them, documented customer risk profiles, and risk-based refresh, so the inputs to surveillance are trustworthy.
• Independent testing and validation, on time. Annual independent AML testing in the year it is due, and independent validation that the surveillance scenarios actually catch the red flags they claim to.
• Supervision mapped to manipulation. Written supervisory procedures that name market-manipulation red flags explicitly, with principal review and escalation of alerts rather than reliance on a manual scroll.

See at the level of the scheme

The simple reading of this case is “they should have bought surveillance software,” and that is true but shallow. The deeper point is about what detection is actually for. A control is not defined by how much activity it touches. It is defined by what it can resolve. Revere’s review touched every trade and resolved almost nothing that mattered, because the thing worth catching only existed at a scale the tool could not render.

For every firm standing up automated monitoring and AI surveillance, the discipline is to start from the shape of the threat and work back to the instrument, rather than the reverse. Ask what the abuse looks like when it succeeds, at what scale, across how many actors, over how long, and then ask whether your tool can even see an object of that shape. If it cannot, no amount of diligence, coverage, or good intent will close the gap. You will be looking straight at the pattern, one account at a time, and never see it.