Unusual funding and unusual trading are the same investigation

Funding and trading are usually watched by different people. Payments and back office watch money moving. The dealing desk watches positions moving. Both teams do their job well and the interesting cases sit in the gap.

A deposit arriving twenty minutes before an unusual position is not remarkable on either screen alone. Put the two side by side and it is the first line of a case file.

What Risk Manager puts on one screen

Volume monitoring and deposit and withdrawal monitoring sit beside exposure. So unusual funding and unusual trading appear in the same place rather than in two systems owned by two teams.

Among the pre-built alert types, two are about money rather than positions: a deposit alert and a negative balance alert. Credit and bonus abuse is a third type, and it is where funding and trading meet by definition.

Each alert type has its own thresholds, check frequency, active-hours window, a re-trigger threshold so a worsening situation raises its hand again, and its own report table.

Patterns that only make sense across accounts

Several of the alert types are aimed at organized behavior rather than ordinary risk. Hedged positions opened across different accounts inside a synchronicity window you set, where one account is swap-free and another is not. Opposite-side positions in the same symbol held by different clients on bonus accounts, in the same country or in different ones. Multiple clients trading from a single IP address. Near-identical trade comments across accounts. Price improvement captured by trading both directions inside a second.

None of these are conclusions. They are patterns worth a person's attention, and funding is often what confirms a pattern or clears it.

The alert types above describe specific measured behaviors, and the broker decides what any of them means.

What Risk Manager does not do

It reads. Risk Manager connects to MetaTrader 4, MetaTrader 5, cTrader and The Edge, each through its own dedicated connector, and it reads from those servers for monitoring and analysis. It does not sit in the execution path and it does not interfere with execution.

That is deliberate rather than a gap. A monitoring system that can also act is a system that can also break something, and the desk that has to explain an incident cares about that distinction.

Where to start if you only have an hour

Take one case from the last quarter that took too long to resolve. Which screen would have shown the funding side, which screen would have shown the trading side, and how long did it take somebody to put the two together?

That is the number worth improving.

Exposure, alerting and the funding view are part of Risk Manager. If you want to see it against your own book rather than staged data, tell us which case you would want to re-run.