When Dinosaur Merchant Bank launched a new CFD order management system in June 2024, it unknowingly disconnected the surveillance infrastructure that was supposed to watch for market abuse. For the next four months — through October 2024 — billions of pounds worth of CFD trades moved through the platform with no monitoring system watching them. The Financial Conduct Authority fined the firm £338,000 in March 2026, citing a failure to maintain adequate market abuse surveillance systems and controls during that period.
The case is, at its core, a system migration story gone quietly wrong. Dinosaur Merchant Bank — a specialist UK broker-dealer operating primarily in equity derivatives — introduced an upgraded order routing platform mid-year. The integration did not preserve the connection between new order flow and the existing surveillance system. Orders entered, processed and settled. Alerts did not generate. Nobody noticed the gap for months.
A Technology Upgrade That Created an Oversight Gap
The FCA's investigation found that the surveillance disconnection affected the firm's ability to detect potential market manipulation, insider trading and other conduct prohibited under the Market Abuse Regulation. CFDs — contracts for difference — are instruments that allow clients to speculate on price movements without taking ownership of the underlying asset. They are also instruments that regulators treat as higher-risk from a market abuse perspective, precisely because they can be used to establish positions ahead of price-sensitive events while leaving a smaller footprint than direct equity trades.
During the June to October 2024 window, the volume of CFD activity processed by the new system ran into the billions in notional value. Market participants trading through the platform during that period were effectively operating without the deterrent effect of surveillance — not because the firm intended to reduce oversight, but because a technical implementation failure had removed it without anyone recognising what had happened.
The firm identified the failure in October 2024 after an internal review. It did not immediately restore surveillance to a compliant standard. That remediation took until May 2025, a further seven months after the problem was discovered. The FCA took note of both the initial gap and the pace of the fix.
An Exit from CFDs and a Question About What Was Missed
In May 2025 — the same month full surveillance was finally restored — Dinosaur Merchant Bank stopped selling CFD products to clients entirely. The firm did not publicly state the reasons, but the timing is difficult to separate from the compliance picture. A broker that has just spent nearly a year remediating a surveillance gap in its CFD business, and is simultaneously drawing regulatory scrutiny, faces an uncomfortable calculus: the cost and complexity of maintaining compliant infrastructure for a product line may outweigh the commercial return.
The more pressing question left unresolved in the FCA's public findings is whether any market abuse actually occurred during the surveillance gap. The regulator's action addresses the control failure, not the underlying conduct. It is standard practice for the FCA to fine firms for systems failures without requiring proof of harm — the requirement is that adequate controls exist, not that they were tested by actual misconduct. Whether the period of unsupervised trading attracted any activity that would have triggered alerts under a functioning system is not addressed in the published notice.
The Compliance Architecture Problem
The Dinosaur Merchant Bank case illustrates a recurring theme in FCA enforcement: technology change events — system migrations, platform upgrades, connectivity changes — are disproportionately likely to create compliance gaps. The reason is structural. Surveillance systems are often built on top of existing infrastructure rather than embedded within it. When the underlying infrastructure changes, the surveillance connection can break silently. There is no error message. Trades continue to process normally. Only the monitoring feed stops.
Regulators across jurisdictions have repeatedly flagged this pattern. ESMA guidance on market abuse surveillance emphasises the need for firms to validate surveillance functionality after any system change that affects order capture or routing. FCA supervisory expectations align with this: firms are expected to test that surveillance tools receive and process order data correctly following upgrades. Whether Dinosaur Merchant Bank conducted such testing before going live with the new system in June 2024 is not stated in the published findings, but the four-month gap before discovery suggests the validation process, if it existed, did not catch the disconnection.
The £338,000 fine sits in the middle range of FCA financial penalties for systems and controls failures of this type. It reflects the absence of aggravating factors like deliberate concealment or evidence of underlying abuse, while penalising the length of the gap, the scale of unmonitored activity and the time taken to remediate once the failure was identified.
Editor's note: Dinosaur Merchant Bank Limited is a UK-authorised broker-dealer regulated by the Financial Conduct Authority. The firm settled the FCA action in March 2026. The FCA's Final Notice is available through the FCA Register. BestForex.io has reached out to Dinosaur Merchant Bank for comment.