Trade reconstruction is the process of rebuilding exactly what happened around a trade: the orders, amendments, cancellations, fills and prevailing market data that surrounded it, placed in the correct sequence with accurate times. Regulators ask for it after the fact, often long after, and the answer has to be defensible rather than approximate.
Why it is harder than it sounds
The difficulty is rarely finding the trade. It is establishing order between events that happened microseconds apart on different systems, each keeping its own time, each logging what it believed occurred.
Two systems can both be working correctly and still produce records that cannot be reconciled, simply because their clocks differ by more than the interval being reconstructed. At that point sequence becomes a matter of opinion, which is precisely what a reconstruction is supposed to eliminate.
Logs versus the wire
Application logs record intent: what the system decided to do. The network records what actually left and arrived. These usually agree, and the cases that require reconstruction are disproportionately the ones where they do not.
A message that was generated but queued, retransmitted or rejected downstream appears in the log as sent. Only an independent observer positioned between the systems can establish what reached the counterparty and when.
Where the requirement comes from
In the United States the driver is the Consolidated Audit Trail under SEC Rule 613. In Europe, MiFID II imposes comparable record-keeping and clock synchronisation obligations. The specifics differ; the underlying demand does not, which is an accurate, time-ordered account of events assembled from sources a regulator will accept.
Reconstructing from captured traffic
Capturing traffic continuously turns reconstruction from an investigation into a query, because the evidence was recorded before anyone knew which trade would be questioned. Corvil Trading Analytics decodes order lifecycle events from the network with nanosecond timestamps, so the same record serves both performance analysis and the compliance question of what was sent and when.
