Understanding

Behavior Detection
Technology:
Emerging Approaches To Dealing
With Three Major Consumer
Protection Threats

A White Paper Report by Mantas, Inc.

April 2003
 Understanding Behavior Detection Technology
.........................................................................................................................................

Understanding Behavior Detection Technology:

Emerging Approaches To Dealing With Three Major Consumer Protection
Threats
..................................................................................................................................................................................

Executive Summary

Good news for consumers and financial services companies: A new generation of "behavior
detection" technology means that more and more financial abuses will be detected in the
early stages as they are happening, rather than long after a consumer's money is gone
and the often unwitting company's reputation is harmed.

Identity theft (including a fast-rising practice known as "account takeover"), "rogue"

stockbroker abuses (such as churning, front running and shadowing of accounts) and financial
marketplace inequities (involving such systemic problems as failure to provide mutual fund
breakpoint discounts and unfair prices in the fixed-income securities marketplace) are major
problems today for consumers and financial services companies, both of which stand to benefit from
the application of the new technology.

Behavior detection technology untangles the webs of complex behavior that lie behind such
problems as money laundering, stockbroker fraud, and investment marketplace price manipulation.
It allows companies to uncover wrongdoing by finding suspicious patterns of behavior hidden within
voluminous data. The key to behavior detection technology is its ability to identify suspicious events
and related entities over time, separate them from normal everyday events, and then to zero in on
the perpetrators. Without this sophisticated tool, it is likely that many suspicious behaviors will go
undetected for long periods of time or not be uncovered at all.

There are five progressive levels in compliance technology now used by the financial services
industry, ranging from the low-tech “Level Zero” manual sampling of data to the full-blown “Level 4”
behavior detection technology. Level Four includes all of the techniques and "views" of the lower
levels, and adds to them more complex technologies such as “Link Analysis” and "Sequence
Matching.” Using these sophisticated technologies, a behavior detection system sifts through millions
of pieces of data in order to find hidden relationships between events and entities and evaluates
related activity in context to identify potentially suspicious patterns.

Level Four technology can identify securities front running, networks of related accounts that may
indicate fraud or money laundering, rapid movement of funds, and a sudden escalation in account
activity. It will be the key to the early detection and "cracking" of problems that now often escape
notice until after the damage is done. While many less sophisticated illegal activities can be detected
using Levels One to Three technologies, the most cunning financial abuses will be uncovered only
with Level Four techniques.

Mantas delivers behavior detection technology to the global financial services industry and is used by
some of the best-known names in the industry to deploy technology for broker surveillance, best
execution and trading compliance, anti-money laundering compliance, fraud detection, and other
purposes.

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 2
 Understanding Behavior Detection Technology
.........................................................................................................................................

What Is “Behavior Detection” Technology?

Behavior detection technology untangles the webs of complex behavior that lie behind such
problems as money laundering, stockbroker fraud, and investment marketplace price manipulation.
It allows companies to detect wrongdoing by finding suspicious patterns of behavior buried and
hidden within voluminous data.

Wrongdoers leave behind an electronic trail of data. That data

reveal the story of their fraud by recording critical events, such
as deposits, withdrawals, wire transfers, account openings,
changes in power of attorney, trades, orders, and quotes. The
wrongdoers also may use many separate entities to carry out
their schemes, establishing accounts under different names
using a variety of financial products such as insurance policies or
securities, and employing different traders. Data about these
events and entities is captured. And data is also captured about
when these events take place. The order in which events take
place is extremely important, often spelling the difference
between fraudulent or innocent behavior.

The key to behavior detection technology is its ability to identify suspicious events and
entities that build over time, separate them from normal everyday events, and then to
zero in on the wrongdoers. Without this sophisticated technology, it is likely that many
suspicious behaviors will go undetected for long periods of time or not be uncovered at
all.

Consider the scenario of a drug dealer seeking to launder large amounts of illicit cash. The criminal
knows that if he deposits cash, the bank will file a form tipping off the government to the
transaction. So, the drug dealer buys money orders with the cash on the theory that, since money
orders are regulated less rigorously, he is less likely to be detected. He also knows that if he buys
$3000 or more in money orders at one time, he has to supply an ID. To avoid this, the drug dealer
makes the rounds to several convenience stores, and at each he buys five $500 money orders. He
then deposits all his money orders at the bank. However, to avoid suspicion, he makes the deposits
at several branches over several days and into several accounts. He later consolidates the money
into one account and wires it to an account at an offshore bank.

Just a few years ago, this seemingly simple form of money laundering was difficult to detect. Today,
the technology exists to ferret out this type of hidden money laundering as well as other more
complex patterns of fraud.

Volumes of Data - The chief challenge to behavior detection is the sheer volume of data that must
be scrutinized. By definition, the suspicious behavior in question almost always is composed of many
events and entities – for example, many transactions spread over many accounts. Any single
transaction in isolation may look completely normal.

It is only when that transaction is linked to all the other relevant transactions that it becomes
suspicious. A trade by itself looks normal, but in the context of other trades it becomes apparent
that it is part of a market manipulation scheme. A bank account by itself looks normal, but when it is
linked to other accounts it becomes part of a money-laundering ring.

Since the suspicious events and entities are buried in millions of legitimate events and entities, how
do you separate the suspicious from the legitimate? The answer – by examining the relationships
between the events and entities. For example, relationships must be found among transactions or
among accounts. But the number of combinations to examine can quickly escalate into an
intractable problem. What is needed is a method of intelligently choosing which relationships to
examine and which to filter out. And that is what behavior detection technology does.

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 3
 Understanding Behavior Detection Technology
.........................................................................................................................................

There is another important complicating factor: “bad guys” who get smarter and smarter about how
to pull off their schemes. If a criminal is caught using one approach, he will use a different and more
sophisticated approach the next time. Thus, the problem behavior evolves to outwit older, outdated
detection techniques. Technology that fails to constantly evolve and take into account the
“advances” among lawbreakers may be rendered all but useless almost from the time it's put in
place.

Putting The Theory Into Practice

The financial services industry is a major consumer of technology that is used to detect such
problem behaviors as money laundering, illegal activities by employees and investment price
manipulation. A number of different technology approaches are being used to address compliance
problems for banks, insurance companies, brokerage firms and other entities. However, the
development of this technology is so new that coverage varies widely and some of America’s largest
financial institutions are shielded by extremely sophisticated detection methods, while others may
rely upon extremely limited technologies that are either too narrow to detect a full range of potential
problems or too elementary to catch the newest and most complex abuses.

The problems that the institutions must detect present

themselves in “scenarios” or "stories" that range from the fairly
simple to the mind-bogglingly complex. For example, some
criminals may use an easily detected kind of money laundering
scheme while other wrongdoers may devise far more complex
schemes with trails that escape all but the most advanced
analysis. The financial services industry, therefore, must use
systems that combine a range of techniques: rudimentary
“tests” to identify simple scenarios and more sophisticated
technology to isolate the most complex schemes.

The Industry’s Levels of Detection - There are five progressive levels of complexity for
compliance technology in use in the financial services industry.

» Level Zero: Sampling with Manual Investigation. At this level, a firm is basically
sampling data and manually examining the sampled accounts and transactions, perhaps
using some tools to semi-automate the process such as sorting the data in spreadsheets and
scanning the sorted data. Only some portion of the data can be examined, the work of
spotting important relationships is left to human effort, and the effort is probably spread out
over multiple people. This is an “old school” paradigm with obvious drawbacks: while
analysts may use some types of technology to pull together information, important data is
lost in sampling, and it involves a lot of painstakingly time-consuming work by hand that
may not keep up with the crush of information that should be scrutinized. In addition, since
the manual effort may be spread out over multiple people, suspicious behaviors may go
unnoticed because each analyst only has the chance to examine one aspect of the puzzle
and no one analyst ever sees the whole picture.

» Level One: Single Events and Entities. This level automatically checks all the data, but it
examines each piece in isolation and does not consider relationships. The drawback here is
that most major “problem behaviors” now involve a sophisticated web of events and entities
that unfold over a period of time. Level One will only catch the most blatantly suspicious
transactions or accounts – ones that are so suspicious that they stand out by themselves.
For example, Level One technology could flag single wire transfers to a person on a terrorist
watch list or funds being transferred from one account to a high-risk geography. But the

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 4
 Understanding Behavior Detection Technology
.........................................................................................................................................

reality is that most problem behavior transactions look quite innocent in isolation, only
taking on an air of suspicion when linked to other related transactions.

» Level Two: Rudimentary Summaries. At this level, the overall behavior of an account is
summarized at a coarse-grained level and simple techniques are applied. While some
problems may be detected, more sophisticated abuses are likely to evade detection. Level
Two technology is appropriate for scenarios in which a simple, high-level measurement on a
single account clearly identifies the behavior. Level Two technology could apply a technique
such as rule matching to the overall account, directing the software to find all accounts with
more than 10 wire transfers and more than $1,000,000 deposited, for example. This level of
review could be used to identify excessive debit card activity or large checks, monetary
instruments, or funds transfers in large round dollar amounts, or large depreciation in value
within one account.

» Level Three: Sophisticated Summaries. Here, finer-grained summaries find account

nuances by breaking down account transactions into complex subsets. If a suspicious
behavior involves only a small subset of the account’s transactions, it can get lost in the
noise when looking at the overall behavior of the account (rudimentary summaries), but
finer-grained summaries catch these nuances. This type of analysis is more sophisticated
than what is described in Level Two, enabling analysts to detect potential abuse within an
account. For example, this level of review could identify a pattern of monetary instruments
within one account that are just under reporting thresholds or multiple checks or
instruments in the same amount. This level of review still is not able to identify hidden
account relationships, analyze behavior across accounts, or identify important and
potentially suspicious sequential patterns. Those types of behaviors require Level Four
analysis, which can be referred to as “behavior detection technology.”

» Level Four: Behavior Detection

Technology. Each of the preceding
levels of review encompasses the
techniques of the earlier level and
then builds on it. Level Four review,
behavior detection technology,
includes all of the techniques and
"views" of the lower levels, and
adds to them more complex
algorithms such as “Link Analysis”
and "Sequence Matching.” Using
these sophisticated technologies, a
behavior detection system sifts
through millions of pieces of data in
order to find relationships between
events and entities that on the
surface do not appear related and evaluates potentially related activity in sequence to
identify potentially suspicious patterns. Level Four technology can identify securities front
running, networks of related accounts that may indicate fraud or money laundering, rapid
movement of funds, and a sudden escalation in account activity. While many less
sophisticated illegal activities can be detected using Levels One to Three technologies, the
most insidious behavior scenarios will only be uncovered using Level Four techniques.

A Closer Look at “Level 4” Technology

How does “Level Four” or behavior detection technology work? Consider the case of Mantas, where
the behavior detection platform relies upon specially designed Link Analysis and Sequence Matching
algorithms designed to find hidden relationships and suspicious patterns such as those described
below.

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 5
 Understanding Behavior Detection Technology
.........................................................................................................................................

“Link Analysis” finds hidden links between accounts and then pieces this information into larger
webs of interrelated accounts. At the simplest level, consider the three accounts shown in the
following diagram:

The first two accounts are linked by a common

address. The second two accounts are linked by a
shared cell phone number. Thus, all three accounts
are linked together. While this example focuses on a
very small (and simple) group of accounts, the
principal at work is the same when vastly larger webs
of accounts are detected. Accounts may be linked in
much more subtle ways, such as sharing a common
beneficiary, or evidence that the parties involved do
business with each other such as writing checks or
wiring funds to each other. Once a group of linked
accounts is found, their behavior can be examined as
a group, which can unmask previously hidden
suspicious patterns of behavior. This technology is
particularly applicable for problems where “rings” of
perpetrators are involved.

“Sequence Matching” is employed when a particular order of events (such as those transpiring
over a period of time) contains some important clue that points to a hidden relationship or
relationships. For example, a stock trader who receives a large customer order may try to trade
ahead of that order because she believes it will move the market and giver her an instant profit.

The following sequence of events within a short

period of time can indicate that the trader is
exploiting inside information about an order and
taking advantage of a customer:

1. A customer places a large order.

4
2. A trader places an order in the same
security, which is executed in a personal 3
account. 2
1
3. The large customer trade is executed.

4. The price of that security changes.

These events in a different order would be entirely innocent. In this particular example, Sequence
Matching defines a problem series of events or behaviors in advance and then searches for any
occurrence of a tell-tale sequence among the thousands of trades and orders taking place in a
particular day.

Because criminals, money launderers, and con artists constantly adapt their behavior to get around
the existing detection systems, their problem behavior grows ever more complex, spread out over
time, and difficult to detect. As criminals vary their behaviors to defeat simpler and older detection
methods, compliance officials at financial services firms must employ more and more sophisticated
technology – such as behavior detection technology and techniques such as Link Analysis and
Sequence Matching – in order to expose hidden relationships and uncover what otherwise most
likely would have remained covered tracks.

Three Major Consumer Protection Threats

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 6
 Understanding Behavior Detection Technology
.........................................................................................................................................

The power of “behavior detection” technology is best appreciated when it is seen in action. The
technology is used by financial services firms to protect their own bottom lines and reputations, as
well as the financial well-being of the consumers who are their customers. As a leader in the field of
behavior detection technology, Mantas has identified three consumer protection challenges that
illustrate the increasing complexity of problem behavior and the practical, day-to-day benefits that
will arise from the wider application of the new generation of behavior detection technology.

Problem 1: “Rogue Broker” Abuses - For years, brokerage firms had to rely upon “low” or “no”
tech solutions to detect problem broker behavior that ranges from front running trades ahead of
clients and shadowing customer accounts and cases in which a broker engages in excessive trading
(churning) in a client’s account in order to generate illicit commission income.

In recent years, concern has grown about so-called “rogue

brokers” who may employ often difficult-to-detect schemes to
enrich themselves at the expense of investors, or who appear to
have placed their clients in unsuitable investments leading to
media horror stories about retirees losing their life savings when
high-tech stocks tumbled. These abuses and others can take a
major toll on the life savings of investors, particularly those who
are not savvy about how to manage their relationships with
financial professionals.

While it is true that investors who discover they have been cheated can resort to arbitration venues
to recover some or all of their losses, the reality is that some investors don’t recover their money for
a variety of reasons and even when the investors are made whole, such proceedings are enormously
embarrassing for the brokerage firms involved. Even if the conduct is entirely the fault of just one
“rogue broker” or a handful of like individuals, it is the broker-dealer that suffers the black eye in
terms of negative media coverage.

Behavior detection technology is now being used to identify as early as possible the risks that a
brokerage firm may face due to unsuitable investment recommendations, illicit broker activity and
other employee malfeasance. Some examples of the type of behavior that can be uncovered by
advanced behavior detection technology are the following:

» Churning and active trading. Churning is defined as excessive trading in a brokerage

account, undertaken by a broker in order to increase that broker's commissions. Similar
practices which can also have a negative impact on investors are twisting, encouraging an
investor trade shares of similar mutual funds to drive up commissions, and encouraging
active trading in general. Commissions can add up quickly and eat into investors' profits - or
contribute to their losses. In addition, churning and active trading can increase investors' tax
bills through repeated sales. Behavior detection technology can identify many different
patterns of behavior that may indicate this type of problem behavior. For example, behavior
detection technology identifies accounts in which brokers have encouraged investors to buy
and sell mutual fund shares within relatively short periods. Behavior detection technology
also isolates patterns of activity that may identify a broker encouraging a customer to
engage in short-term trading. In the case of advisor-managed accounts, behavior detection
technology detects individual accounts for which the advisory fees are disproportionately
large relative to the size of the account as well as groups of accounts managed by the same
advisor that all appear to be engaged in active trading that may not be beneficial for the
investors. Any of these scenarios may indicate that an investment professional is
encouraging potentially harmful short-term or excessive trading.

» Shadowing of customer accounts. Investors who are considered to be “in the know”
may be unaware that one or more financial professionals are copying their investment
behavior or their accounts. This “shadowing” may take place in the name of the financial
professional or in a proxy account. By analyzing all trades carried out by all customers and
all employees, it is possible for behavior detection technology to hone in on links showing
similar or identical trades in a short period of time. Behavior detection technology uses

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 7
 Understanding Behavior Detection Technology
.........................................................................................................................................

Sequence Matching to identify patterns of activity that may indicate account shadowing is
taking place. Using Link Analysis, behavior detection technology can also track down a
hidden account that a broker or employee may be using for these rogue trades. The high
volume of daily trading activity at almost any brokerage firm makes it a requirement to use
this kind of sophisticated technology to find problems like this. Neither manual surveillance
nor lower level technology can provide the comprehensive detection necessary to truly
protect investors and firms from this type of abuse.

» Front running. This problem occurs when a broker or other employee aware of a single
order large enough to move the price of a security may attempt to profit by trading ahead of
that order in his or her own account or that of a family member. In a more sophisticated and
complex version of front running, some unscrupulous traders may use their inside
knowledge of a coming trade by taking a position in a related investment. For example, if a
broker or employee knows of a large order that will potentially raise the price of a certain
security, that trader could take a position in an option on that security, knowing that he or
she can benefit from the expected price increase. Behavior detection technology has the
complex algorithms and scalable capabilities needed to monitor all activity and detect this
cross market or cross product abuse. Behavior detection technology uses Sequence
Matching and other techniques to analyze what data is available, which tends to be more
limited for such instruments as options and derivatives, then uses proprietary risk metrics
analysis to determine which accounts to analyze for trading that may, in the context of the
execution data, indicate this type of abuse.

» Cherry picking. This refers to investment advisors who place a large block trade for a
certain security, then allocate those shares unfairly among their clients. In these cases, the
advisor waits to allocate the shares until after there has been a move in the price. The
advisor may then assign shares that have already gone up in price to a few favored
accounts, while shares of securities that go down in price are allocated to others. The
advisor may even engage in short-term trading and then decide how to allocate profits and
losses to client accounts. Behavior detection technology analyzes all of an advisor’s trades
and identifies any patterns that may indicate cherry picking is taking place.

Problem 2: Identity Theft “Account Takeover” - Identity theft a major emerging problem for
American consumers. The FBI calls identity theft one of the fastest growing crimes in the United
States and estimates that 500,000 to 700,000 Americans become identity theft victims each year.
The number one complaint category for the Federal Trade Commission in 2002 was “identity
theft/fraud.” Behavior detection technology is an important new weapon in the war against identity
theft.

There are several identity theft problem categories that include

different kinds of fraudulent activities, each representing its own
set of problems for financial services institutions, their
customers, and law enforcement. “Account takeover” is a major
headache for banks and their customers. Experts agree that the
early detection of illicit activity that signals possible identity theft
(e.g., intercepted checks or compromised PINs) can provide the
key to minimizing the losses that a consumer or financial
institution would otherwise suffer. Swift, front-end detection is an opportunity for the bank to alert
the customer to the possibility of compromised accounts or identity theft or signal law enforcement
to possible misdeeds, thereby enabling the customer to protect or minimize losses associated with
other potentially compromised accounts or giving law enforcement information that may help catch
crooks or fraudsters.

“Account takeover” typically involves a con artist gaining information about a consumer’s financial
account and then making changes in the administrative information associated with the account. In
some cases, this type of activity involves collusion with bank employees. For example, the swindler
may engineer a change to the mailing address or arrange to have him or herself given signature
authority on the account. The “takeover artist” then drains the account through a series of electronic

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 8
 Understanding Behavior Detection Technology
.........................................................................................................................................

withdrawals, checks or wire disbursements. Behavior detection technology isolates instances in

which administrative changes to an account are followed by a disbursement from the account,
particularly withdrawals in amounts or sequences that appear unusual for the consumer involved. In
some cases, a crook may take over an account in order to use it for other illegal purposes, such as
money laundering.

In looking for instances of “account takeover,” behavior detection technology focuses on such factors
as:

» Change in behavior. A sudden increase in the frequency or volume of transaction activity

may be suspicious and warrant additional investigation. Behavior detection technology
analyzes the transaction activity and detects significant changes from the typical behavior of
an account. Behavior changes often are scrutinized in combination with instances of account
balance declines.

» Rapid depreciation of funds. The sudden depreciation of funds within an account can
signal account takeover or another form of fraud. Behavior detection technology can detect
this type of activity and alert compliance analysts to fraud that might otherwise go
undetected until the customer receives his or her bank statement. As described above,
behavior detection technology also looks for instances where changes in behavior are
accompanied by declines in account balances or where an administrative change to an
account is followed by a disbursement from the account, especially if the withdrawals are in
amounts or sequences that appear unusual for the account.

» Escalation in inactive account activity. An account that has been dormant, then
suddenly becomes active, may be the target of account takeover or identity theft fraudsters.
Behavior detection technology will alert compliance officials to an emerging pattern of
increased activity so it can be investigated to determine whether the behavior is legitimate
customer activity – or fraud.

Many law enforcement officials and regulators are quick to point out that what is often described as
“identity theft” is simple fraud, though it often is conducted through sophisticated electronic means.
For example, a con artist may steal your debit card and then use your “secret” PIN number to
conduct what is known as “suspect return activity.” A pattern of excessive purchase and/or return
activity associated with a debit card may indicate attempts to launder funds, perpetrate fraud, or
may indicate account takeover. In addition, use of debit cards in certain geographies may be of
interest, particularly if this is a change in behavior for the debit cardholder. Behavior detection
technology monitors debit card use to detect this type of activity, especially if it represents a change
in behavior as compared with the average or typical movement of the account during a set period of
time.

Behavior detection technology also identifies other, similar types of patterns and behavior that may
indicate fraud, such as multiple or recurring addresses. In opening multiple accounts, members of
fraud rings may utilize the same addresses, phone numbers, PIN numbers or other information on
some accounts. For example, two accounts may share a phone number, one of those accounts may
share a PIN number with a third account, that third account may have a lot of journals with a fourth
account, and so on. Behavior detection technology finds all of those different hidden connections and
connects the dots to identify the network of fraudulent accounts. The technology can also identify
accounts that share any information with previously identified fraudulent accounts so returning
fraudsters can be stopped early and proactively.

Problem 3: Investment Marketplace Inequities - The problem of “rogue brokers” outlined

above focuses on instances where individual financial professionals try to evade detection as they
“game” the system at the expense of customers’ bottom lines and the reputations of their
employers. But investors also face more systemic problems at financial institutions that are now
being addressed through the application of behavior detection technology. In these cases,
development of advanced behavior detection technology now enables firms to constantly and

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 9
 Understanding Behavior Detection Technology
.........................................................................................................................................

comprehensively monitor the treatment of investors (as well as

such issues as their own proprietary trade execution) and move
quickly and proactively to prevent problems that could harm
investors and the firm’s own reputation as well as to improve
customer service and the firm’s performance. Examples of
emerging investing marketplace inequities that can be
addressed through behavior detection technology include the
following:

» Mutual fund breakpoints. The issue of price fairness for mutual funds is a major concern
for the roughly half of American households that hold such funds. The recent controversy
over mutual fund “breakpoints” focuses, in part, on the issue of whether or not investors are
being sold the class of mutual fund shares that are appropriate – or suitable – for them.
Breakpoints are commission discounts typically offered on larger investments in what are
known as the Class A shares of mutual funds. In some cases, a broker may recommend
Class B shares – which result in a higher commission – when an investor would pay lower
commissions for Class A shares due to the level of an individual or household investment.
Or, a broker may sell the investor Class A shares but fail to provide the appropriate
discounts that should have resulted from the combination of personal fund shares and
retirement plan shares for an individual, spouse and family accounts. This may be done
intentionally or it may result from a broker not knowing what investments have been made
by an individual or household. Behavior detection technology analyzes all transactions and
can also link together household accounts to ensure that investors get the correct price for
shares. In addition, by analyzing all of a household's investments, behavior detection
technology can also identify cases where an investor may have been sold unsuitable shares
for his or her own situation or any patterns that may suggest an intentional avoidance of a
price breakpoint. In all cases, the technology is identifying patterns of activity that suggest a
broker is not meeting his or her responsibility to customers and to the firm.

» Fixed-income investment pricing. Fixed-income investors include both individual and

institutional investors and as a result of the market downturn of the last few years, more
individual investors have turned to bonds. Stock or equities investors operate in a liquid and
transparent market where they can easily see the price being charged for a share, as well as
all of the relevant information that leads to that price. But in the fixed income marketplace,
there is simply far less information available and even the savviest investors can have
difficulty understanding pricing and trading of bonds. Behavior detection technology can help
firms analyze what information is available for the benefit of the firm and its customers. For
example, bond firms adopt and maintain policies to comply with securities regulations that
limit the amount by which the price of a bond can be “marked up.” The lack of marketplace
transparency can, however, make it difficult to determine whether such policies are being
maintained. The complex algorithms deployed by behavior detection technology are able to
analyze what information is available in order to help firms identify inappropriate price mark
ups and even help improve price performance, which can be a competitive benefit. Behavior
detection technology can also help firms to identify potential customer favoritism by
accessing and analyzing data on all of a firm's proprietary trades including those done for
customers, then comparing trades done for individual customers to look for any potential
signs of favoritism, as well as comparing the prices to trades taking place outside the firm.

» “Leakage” of analyst reports. There has been much attention paid recently to the very
real potential for abuse when the dividing line is breached between the research and the
investment divisions within a firm. One issue that has arisen is the question of whether
some traders have had access to research reports before they are publicly disseminated and
chosen to misuse that information for trading in their own or a related account. Behavior
detection technology helps firms build another safeguard into the wall that should separate
these two areas. The technology analyzes trades against the firm's restricted lists and its
gray lists (which limits trading based on pending research reports on individual companies
as well as reports on investment and trading strategies). The firm can rely on behavior
detection technology to monitor behavior against the policies it has in place that bar such

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 10
 Understanding Behavior Detection Technology
.........................................................................................................................................

activity. This type of protection helps firms meet their compliance requirements and also
sends an internal and external message that violations of these laws will not be tolerated –
or overlooked.

About Mantas
Compliance, Operational Risk, and Relationship Management

In the mid-1990s, the Mantas team, then a business unit of SRA International, began work for the
National Association of Securities Dealers (NASD). That first Mantas product is still used today by the
NASD to monitor all trading on Nasdaq and selected global markets, looking proactively for any
sequences of quotes and trades that may signal a potential violation, and reconstructing market
transactions using data gathered in real-time throughout the trading day.

Since that time, Mantas has continued to focus on developing and enhancing behavior detection
technology for the global financial services industry and been hired by some of the best-known
names in the industry to deploy technology for broker surveillance, best execution and trading
compliance, money laundering and fraud detection, and other purposes.

Behavior Detection Platform - The Mantas Behavior Detection Platform is a Web-enabled, end-to-
end solution that brings together the data from firms’ existing legacy systems – with market data as
necessary – providing for enterprise-wide data monitoring and analysis. The platform can scale up or
down to meet the needs of global financial services corporations as well as national and regional
firms or single lines of business or geographic locations.

Behavior detection technology gives financial institutions the ability to automatically monitor and
analyze customer, account, and transaction information across the entire organization for a complete
and accurate picture of behaviors of interest. As a result, it's now possible to detect suspect behavior
early enough to mitigate risk, report and prioritize findings, comply with changing regulations, and
increase revenue by identifying opportunities to improve customer service.

This enables firms to deploy a platform that can serve both their compliance and business growth
needs. For example, as banks and other firms evaluate their requirements under the proposed New
Basel Capital Accord (Basel II), they are faced with a strong incentive to improve their operational
risk measurements. Behavior detection technology provides firms with an enterprise-wide “early
detection” system that can alert them to problems that, left undetected and unaddressed, could
seriously undermine a firm’s position.

In the past, firms have analyzed historical data to predict future potential losses. Unfortunately, that
approach doesn’t account for new problems and, more importantly, provides no ability to act to
prevent the loss, it simply allows firms to account for it. Behavior detection technology offers firms
the chance to truly manage their operational risk, to understand their customer, employee, and
business partner activity, and to move proactively to limit losses for the firms and its customers.

In addition to helping firms deploy a best practices approach to risk management, behavior
detection technology also gives firms an opportunity to improve their customer relationships. For
example, when behavior detection technology identifies a brokerage account that becomes poorly
diversified, it provides the opportunity to offer that customer professional investment advice.

Some of the best-known names in the global financial services industry are using the Mantas
platform today to meet these critical needs. Over time, more and more firms will recognize the value
of behavior detection technology and its ability to help them understand and act on customer,
employee, and business partner behavior.

Mantas is a Safeguard Scientifics partner company. More information about Mantas is available at
www.mantas.com.

.........................................................................................................................................................................................................................
© 2003 Mantas Inc. | All rights reserved A White Paper by Mantas, Inc. | April 2003 | 11