Where monitoring happens
Integrity monitoring is layered, and each layer sees something the others cannot.
Inside the operator. Trading and risk teams watching their own markets, and a dedicated integrity function where one exists. Sees every account and every bet on its own book. Sees nothing outside it.
Across operators. Integrity associations receiving alerts from members and identifying patterns that span books. Sees the market as a whole, at the level of what members report. Does not see accounts.
Independent monitoring. Data and monitoring companies analysing price movements across a large set of operators, typically under contract to sports federations. Sees price behaviour globally and in near real time. Does not see accounts or stake sizes.
The sport. Sees the contest, the participants, the dressing room, and the disciplinary record. Sees no betting at all.
Any one of these alone produces weak cases. The strong cases are the ones where the operator's account-level detail meets the monitoring company's cross-market view and the sport's knowledge of the participants. The whole architecture of integrity reporting exists to make that meeting happen.
The alert pipeline
A workable pipeline inside an operator has five stages, and the discipline is in not skipping any.
Detection. Rules and models on the signals from the previous lesson, applied per market and per account. Thresholds set against the baselines, not against round numbers.
Triage. A rapid check against the innocent-explanation list. Is there public news? Is a promotion running? Did another operator move first? Is this one large customer? Most alerts close here, and they should close with the explanation recorded.
Analysis. For alerts that survive triage: account-level examination. Who bet, when, from where, with what history, linked to whom. This is the operator's unique contribution and it is the stage most under-resourced.
Decision. Market action, reporting, both, or neither. Covered in the next lesson for market action and below for reporting.
Record. What was seen, what was checked, what was concluded and why. Every stage.
The failure mode is a pipeline that collapses detection and decision: an alert fires and the market is suspended, or an alert fires and a report is sent, with no triage or analysis between. Both produce a function that is noisy, that names people it should not, and that loses credibility with the bodies it reports to.
Triage in practice
The questions, in the order that closes alerts fastest.
Is there a public explanation? Team news, weather, a line-up change, a suspension, a player withdrawal. Check the sources a bettor would check.
Is this internal? A price boost, a featured market, a promotion, a streaming placement, a pricing error on our side.
Did the market move elsewhere first? Cross-operator price data shows whether we followed or led. Followers are rarely the source.
Is this one account? A single large customer distorts a thin market and is not a pattern.
Is the liquidity plausible for the fixture? A derby in a minor league can take real money legitimately.
Is the timing consistent with a reaction? Money after a visible event is a reaction; money before it is the concern.
An alert that has a satisfactory answer to any of these is usually explained. One that has none is worth the analyst's time.
Analysis in practice
The account-level work, and what it establishes.
Account age and history. New accounts, dormant accounts and accounts whose betting history is confined to this competition or this type of occurrence are the population of interest. Established accounts with broad histories betting large on a favourite are usually just customers.
Linkage. Shared devices, instruments, addresses, contact details, connection origins. A cluster of accounts betting identically at the same time is the strongest account-level signal available.
Geography. Where the money came from relative to where the fixture is. Repeated cross-border concentration on one competition is a pattern worth recording even where a single instance is explainable.
Prior alerts. Have these accounts appeared before, on which events, and what happened? Repetition converts anomaly into case.
Bet construction. Specific, unusual selections that require foreknowledge to be rational. A large bet on a particular player receiving a card in a particular half is not an opinion about football.
Outcome. Recorded after the event, weighed carefully, and never treated as conclusive alone.
What this establishes is a betting picture: who, how much, when, from where, with what pattern. It does not establish that anyone in the sport did anything, and the analysis should not be written as though it does.
Reporting: to whom, when and what
Most licensed operators are required to report suspicious betting, and the routes differ.
To the regulator, where a licence condition requires it. Usually a defined form, a defined timeframe and a defined threshold of suspicion.
To an integrity association, where the operator is a member. The value is aggregation: the association can tell the operator whether others saw the same thing.
To the sport governing body or its integrity unit, directly or through the association. The sport holds the disciplinary jurisdiction and knows the participants.
To law enforcement, where criminality is suspected, usually through the regulator or on legal advice rather than directly.
To a monitoring company, where the operator has a contractual relationship.
Three principles govern what to send.
Report the betting, not a conclusion about the sport. The report describes what was observed in the market and the accounts. It does not say the match was fixed, because the operator does not know that.
Report early enough to be useful. A report after the sport has already noticed adds little. A report that reaches the sport before the event, or during it, can inform an intervention.
Include the account-level detail, within legal limits. The operator's unique contribution is who bet. Data protection and the reporting framework govern what can be shared with whom, and the answer is usually more than operators assume and less than investigators would like.
Handling the customer
Integrity cases involve accounts, and the accounts belong to people who may have done nothing wrong or may be central to a criminal enterprise.
Do not accuse. The operator is not in a position to know what happened in the sport.
Do not tip off. Where a report has been made, or the case may reach law enforcement, telling the customer risks prejudicing an investigation and may be an offence in its own right.
Act on the account, not the allegation. Restricting stakes, holding settlement pending review, or closing the relationship are commercial decisions the operator can take on its own risk assessment. They do not require a finding about the sport and should not be communicated as though they rest on one.
Prepare the wording. A settlement hold on a suspicious winning bet needs a form of words that is accurate, minimal and does not disclose the reason. Improvising produces either a disclosure or an obvious evasion.
The record
Assume every integrity file will be read by a regulator, a sport's disciplinary panel, or a court.
It should contain: the trigger and the time; the baseline it was measured against; the triage questions asked and their answers, including the alerts that were explained and closed; the account-level analysis with linkage evidence; the decision and the reasoning; what was reported, to whom and when; the outcome of the event; and any subsequent information received.
Two failures recur. The alert closed with no explanation recorded, which means the function cannot show it looked. And the report sent with a conclusion about the sport rather than a description of the betting, which means the operator has asserted something it cannot support and will be asked to justify.
What good looks like from the outside
A sport receiving alerts from twenty operators learns quickly which ones are worth reading.
The valued ones are specific, timely, describe the betting precisely, include account-level detail within the rules, distinguish observation from inference, and follow up with outcome information. They also report the events that turned out to be explainable, with the explanation, because that calibrates the recipient's confidence in the ones that were not.
The unvalued ones report everything that moved, report late, report conclusions rather than data, and go quiet after sending. An operator in the second group is discharging a licence condition and contributing nothing, and the bodies it reports to know the difference.