Kestrel Trade Surveillance — Q4 2025 Alert Summary

**Reporting period:** October 1, 2025 – December 31, 2025 **Prepared by:** Compliance Surveillance Team (Equities Desk Compliance Officer + two analysts) **Reviewed by:** Chief Compliance Officer **Distribution:** CCO, General Counsel, Head of Equities Trading, Head of Operations, Audit Committee (quarterly summary)

1. Purpose

This summary consolidates the trade-surveillance alert activity for Q4 2025, the disposition of alerts, the escalation flow for internal investigations, and the FINRA Rule 3110(d) quarterly submission. It is produced pursuant to `Kestrel-WSP-Equities` §6.3 and `Kestrel-Information-Barriers` §5.

2. Governing framework

Kestrel's trade-surveillance program implements:

- FINRA Rule 3110(d) — Transaction review and investigation (`FINRA-Rule-3110-3130`); - Advisers Act § 204A insider-trading policies and procedures (`15 USC 80b-6 / 17 CFR 275.204A-1`); - The firm's SAR-SF filing obligations under 31 CFR 1023.320 (`31 CFR Part 1023`); - Recordkeeping under 17 CFR 240.17a-4 (`17 CFR 240.17a-3, 240.17a-4, 240.15c3-5`).

3. Alert volume

3.1 Total alerts by category

| Category | Q4 2025 alerts | vs. Q3 2025 | |---|---|---| | Potential insider trading (pre-announcement activity in announced M&A / earnings target) | 182 | +14 | | Spoofing / layering candidates | 41 | +3 | | Wash trades | 19 | 0 | | Marking the close | 26 | +5 | | Front-running (rep-owned account activity ahead of client activity) | 8 | 0 | | Unusual customer activity (outside stated investment objective) | 307 | +22 | | Pre-clearance bypass (proprietary or supervised-person account) | 6 | +2 | | Restricted-list breach attempt (blocked at OMS) | 14 | +4 | | Locate-policy exception (short without locate — blocked) | 22 | +1 | | Other | 38 | -6 | | **Total** | **663** | **+45** |

3.2 Alerts by venue

The increase in unusual-customer-activity alerts (+22) is principally attributable to a single retail account that added options trading in November 2025; alerts from that account were dispositioned as "explained" following a direct customer outreach documenting the customer's updated investment objectives.

3.3 Alert disposition

| Disposition | Count | % | |---|---|---| | Close — false positive | 398 | 60.0% | | Close — explained (customer or firm documentation) | 211 | 31.8% | | Escalate — Insider Trading Review Committee (ITRC) | 38 | 5.7% | | Escalate — SAR-SF review | 12 | 1.8% | | Open at period end | 4 | 0.6% |

4. Escalations and outcomes

4.1 ITRC escalations

Of the 38 ITRC escalations in Q4 2025:

- 29 closed as non-substantive after review by the ITRC; - 7 closed with an internal-investigation file opened and retained; - 2 resulted in a trader being placed on a 30-day heightened surveillance watch (no disciplinary action).

No ITRC escalation in Q4 2025 resulted in a referral to FINRA or the SEC. Quarterly 3110(d) submissions were filed via FINRA Gateway on February 15, 2026, within the 15-day deadline for the month following the quarter-end.

4.2 SAR-SF reviews

Of the 12 SAR-SF review escalations in Q4 2025:

- 4 resulted in a SAR-SF filing with FinCEN within the 30-day deadline under 31 CFR 1023.320(c); - 8 closed without a filing, with documentation retained under 31 CFR 1023.320(e); - 0 were open at period-end for SAR-SF disposition.

SAR-SF confidentiality was maintained in accordance with 31 CFR 1023.320(d). Disclosure to external parties was limited to FinCEN, the SEC, FINRA, and OFAC inquiries where applicable.

4.3 Restricted-list breach attempts

All 14 restricted-list breach attempts were blocked at the order-management system level; no trade cleared. Each breach attempt was reviewed by the EDCO and the General Counsel. Three attempts resulted in remedial training for the originating representative. No evidence of attempted MNPI misuse was found.

4.4 Locate exceptions

All 22 short-without-locate attempts were blocked by the market access controls under `Kestrel-Market-Access-Controls` §4.2; no short sale cleared. Reg SHO (`17 CFR 242.200-204`) compliance reaffirmed.

5. Sampling and quality controls

5.1 Random sampling of unflagged trades

The surveillance team performs a random sample review of unflagged trades under the 3% sampling rate specified in the firm's WSPs and reaffirmed in the remediation of FINRA 2025 Finding 2 (`Kestrel-FINRA-Exam-Letter-2025`). Q4 2025 random-sample volume: approximately 14,400 trades reviewed.

No matters surfacing through random sampling were escalated in Q4 2025 beyond those already flagged by the alert rules.

5.2 Model governance

Surveillance rule thresholds are reviewed quarterly by the EDCO with input from the Surveillance Data Scientist. Q4 2025 changes:

- Tuned the wash-trades rule to reduce a source of recurring false positives associated with automated-rebalancing Kestrel Advisors trades; - Added a new rule for AI-generated communications in the email surveillance layer (separate from trade surveillance but operated by the same team; documented here for completeness).

5.3 Keyword lexicon refresh

The quarterly keyword-lexicon refresh was performed on December 15, 2025, on schedule per remediation of FINRA 2025 Finding 2. Ten new terms were added; two were retired. Refresh log is retained.

6. Training and staffing

- Surveillance team headcount: 1 EDCO + 2 analysts + 1 data scientist; unchanged from Q3 2025. - Quarterly refresher training completed by all team members on December 8, 2025. - FINRA Rule 3110(d) procedures reaffirmed in the annual compliance training module.

7. Recordkeeping

Alert records, disposition records, and internal-investigation case files are preserved under 17 CFR 240.17a-4(e) (three-year retention for supervisory review records; six-year retention for records of the investigations themselves, where longer retention is required by the nature of the matter). SAR-SF filings and supporting records are retained for five years under 31 CFR 1023.320(e).

8. References

- FINRA Rule 3110(d) (`FINRA-Rule-3110-3130`) - 31 CFR 1023.320 (`31 CFR Part 1023`) - 17 CFR 240.17a-4 (`17 CFR 240.17a-3, 240.17a-4, 240.15c3-5`) - 17 CFR 242.200-204 (Reg SHO) (`17 CFR 242.200-204`) - 15 U.S.C. § 80b-6 (antifraud / fiduciary) (`15 USC 80b-6 / 17 CFR 275.204A-1`) - Kestrel-WSP-Equities - Kestrel-Information-Barriers - Kestrel-AML-Program - Kestrel-Market-Access-Controls - Kestrel-FINRA-Exam-Letter-2025