Physical trading, derivatives trading and who is on the other side

Asset-backed trading arm versus standalone merchant

What the evidence says

License-to-operate lens

• 27 of 50 interactions are rated highly prone to error, omission or breach. 26 of the 50 are backed by an enforcement action or court record, not only by surveys or vendor claims.
• The costliest failures sit at boundaries, not inside systems. Macquarie's fictitious trades passed a reconciliation whose scope excluded future-dated clearing and a P&L check with a fixed threshold. Trafigura's nickel and Hin Leong's diesel passed document checks while the goods were absent or financed three times. Trafigura Mongolia's receivables were hidden from head office for about five years.
• The largest regulatory penalties came from front-office conduct. Bribes paid through third-party agents (over $1.7bn in DOJ bribery resolutions with Vitol, Glencore, Freepoint, Gunvor and Trafigura) and benchmark manipulation (Glencore's $1.186bn CFTC order) dwarf recordkeeping fines for merchants. Sanctions risk now sits in cargo origin and vessels: OFAC's $275m Adani settlement penalised a buyer for accepting a seller's origin claim.
• AI is deployed by name in only 4 interactions: chat-to-ticket booking (Koch), broker recap matching (Koch), invoice and tank reconciliation (Freepoint) and communications surveillance (Vitol). Another 16 rest on vendor or consultancy claims, and 30 are proposals with no public deployment.
• The biggest gaps are where AI could add most. 17 of the 27 high-risk interactions have no public AI deployment, including the cross-checks that would have mattered in the fraud cases: bills of lading against vessel tracks, broker quotes against market data, receivables against sales, and physical bids against derivatives books.

Commercial and competitive lens

• 20 of 50 interactions are high on the commercial lens, and 13 are high on both. The overlap is where a control failure is also a direct hit to profit: missing inventory, hidden receivables, false title documents, mismarks and disguised positions, demurrage and invoice leakage, slow onboarding and trader departures.
• Profit leaks quietly in the physical back office. Demurrage, invoices, fees, settlement disputes, letter-of-credit discrepancies and unexercised contract options lose margin on every cycle without ever reaching a regulator. Marcura estimates dry bulk demurrage at $8–10bn a year with 5–10% of write-downs from charter-party ambiguity, and McKinsey estimates about $20bn of optimisation value untapped in oil and gas products. Both are interested estimates; treat them as order of magnitude. R19 R80
• A compliance-only register misses 7 high commercial exposures. I7, D4, X1, X2, X3, X4, X8 are high commercially but not on license to operate. Most are about advantage: order flow seen by brokers (X1), data sent to AI tools (X2), traders moving with models (X3) and edge eroded by shared vendor data (X4). The rest are profit left behind in contract and storage options (D4, X8) and in margin funding (I7). The best-documented advantage channel is brokers trading against client orders (Classic Energy, 63 occasions). Team moves are the most visible: senior Glencore metals traders went to Vitol and Mercuria, and Trafigura lengthened senior non-competes to 12 months. R94 R89 R90
• AI cuts both ways. In 12 of 50 interactions AI can expose as well as protect: staff pasting data or code into AI tools (26.4% of uploads held sensitive data, 12% through personal accounts), agent connectors that can be tricked into leaking private data, and models built on the same vendor data as rivals. BCG and the equities evidence agree that lasting edge comes from applying AI to proprietary operational data, not from generic tools. R98 R101 R106 R104
• 14 high license risks are only medium or low commercially (I1, I2, E1, D5, C2, K6, G1, G2, G3, G4, G8, Y2, T2, T3). Regulatory conduct and screening obligations (G1–G4, G8, K6, D5, Y2) dominate: the case for investing there rests on the license lens, so the aim is to meet the obligation reliably at the lowest cost. Booking, reconciliation and talent items (I1, I2, E1, C2, T2, T3) carry a real but smaller commercial cost per event.

The two lenses compared

Each interaction placed by its license-to-operate rating (columns) and its commercial rating (rows). The top-right is where a register built only for compliance would miss exposure.

Frame 1: how the firm is regulated and owned

The same interaction weighs differently depending on who checks the firm from outside. Each cell describes the kind of firm that sits there, the outside checks it faces, the interactions that weigh most, public cases from the register, and the commercial and AI angles.

“Community owned” covers public agencies, government-owned utilities, cooperatives and member-governed nonprofits; ISOs and RTOs run markets rather than trade in them. “Unregulated” means no prudential or licensing supervisor for the trading activity; every firm remains subject to market-conduct, sanctions and anti-bribery law. The cases are public records that illustrate each cell. Interactions named in each cell are this page’s judgement.

Frame 2: deal stage and what is traded

All 50 interactions placed by when they occur relative to the deal and whether they turn on physical delivery or on time- and market-sensitive execution and valuation. Chips with a dashed outline span both markets; select any chip to open its card.

• Post-deal physical is the heaviest cell: 10 of its 18 interactions are high on license to operate and 8 are high commercially. The large fraud losses in the register (Trafigura’s nickel, Hin Leong, Trafigura Mongolia) all sit here.
• Pre-deal derivatives has the fewest high license risks (4 of 8, all shared with physical trading), but it holds the clearest leaks of proprietary advantage: order flow seen by brokers, predictable algorithms and data everyone buys.
• Pre-deal physical is where conduct risk sits (8 of 11 high on license to operate): agents, counterparty information, sanctions and origin. Post-deal derivatives (7 of 14 high) is where concealment works through marks, dates and thresholds.

Stage and market tags are this page’s judgement. Chip colour is the license-to-operate rating; the second row of chips in each cell lists the high commercial exposures.

Where errors and leakage concentrate

The register

Context and gaps

• US enforcement eased in 2025, obligations did not. The CFTC settled six technical cases against ten firms for $8.325m in total and now refers only material issues, and US FCPA enforcement was paused, then narrowed by new DOJ guidelines. The rules, limitation periods and non-US regimes (FCA, REMIT, EU sanctions law) are unchanged. R35 R32 R49
• Regulators judge AI by existing rules. The CFTC's 2024 advisory creates no new obligations but makes AI an examination topic. The recent surveillance fines were about missing data feeds, not model failures, so feed completeness matters as much as model quality. R54 R31 R33
• Protecting edge is moving from courts to contracts. Proving a trade-secret theft means revealing the secret, and the one public commodity case found (BP, 2010) saw search orders reversed. Firms lean on non-competes, garden leave and deferred pay instead, while the FTC has dropped its ban and the UK is consulting on caps. Enterprise AI terms that bar training on customer content are now part of the same toolkit. R85 R87 R92 R93 R99
• Audit-firm literature is thin. No 2020–2026 commodity-specific reconciliation or control study from the Big 4, the IIA or the Journal of Accountancy was found; the most recent retrieved (PwC, about 2018) describes services rather than findings. Regulator notices, court records and fraud studies are the best public evidence. R79 R58
• Integration, not models, is the first barrier. Commodity software users rank system integration (65%) and data cleaning (57%) as their top problems, the upstream causes of most reconciliation breaks. R12
• Paper still dominates title documents. About 89% of bills of lading were still paper in mid-2025, and the UN negotiable cargo documents convention needs ten signatures to take effect. Digitising title stops duplicate bills; it does not prove the goods exist. R23 R24
• Not found (license lens): commodity-specific break rates, days to close, unconfirmed-trade backlogs, onboarding times, attrition rates, or any independent measurement of AI accuracy on these tasks.
• Not found (commercial lens): commodity-specific duplicate-payment or letter-of-credit discrepancy costs, imbalance charges, deals lost to slow KYC, any measurement of broker information leakage, any 2019–2026 trade-secret judgment against traders at a named trading house, or a confirmed theft of proprietary data from a major trading house. The absence of public cases more likely reflects settlement and arbitration than absence of disputes.

The organisation on three flows

AI impact by flow

• Information is where most of the work sits: 58 of 68 roles touch the information flow, and its split mirrors the whole organisation (42% Machine, 35% Amplify Output).
• Physical-flow roles keep the most Human Edge. The 13 roles that touch the physical flow average 27% Human Edge against 15% for information, because ports, cargoes and supplier relationships are physical and messy. The file's two low-confidence roles, Scheduler and Vessel Operator, are both here.
• Cash-flow roles split between production and sign-off. Accounting, margin and P&L production are Machine-heavy, but 10 of the 12 sign-off-retained roles sit on the cash flow, so the accountable attestation stays human.
• The three control functions differ. Credit risk averages 47% Machine: spreading, memos and margin calls are routine, which is why credit-memo agents are one of the few named agent cases in the industry. Treasury and capital averages 19% Human Edge, the highest of any cash function, because bank relationships and funding decisions stay human. Compliance averages 44% Machine, with production of reports and screening exposed and the compliance officer's accountability retained.

Role map

Where AI technologies overlap

How many roles in each function use each technology. Darker cells mean a larger share of the function. The last row counts how many of the seven technologies meet in each function.

• Language models are the common layer. They apply to 41 roles in 10 of the 10 functions, from research synthesis to contracts, credit memos and P&L commentary.
• The other technologies cluster. Forecasting sits with research, the front office and risk. Optimisation and execution engines sit with the front office. Agents sit where documents move cash and cargo: commercial operations, finance, treasury, credit and compliance. Geospatial and sensor AI appears only in research and commercial operations.
• Overlap is densest in commercial operations and market risk and control, where 6 of the seven technologies meet. That is where integration and governance of several AI systems on one workflow will matter first.
• Technology predicts the mode. Roles touched by agents average 51% Machine; roles touched by forecasting average 34%, with more Amplify Output.

By flow

The seven technology families

• FC Forecasting and predictive ML price, load, weather, demand, credit scoring
• OP Optimisation, pricing and execution engines dispatch, routing, storage, hedging, algorithmic execution, option pricing
• LM Language models on documents and text research synthesis, contracts, confirmations, commentary drafts
• AG Agents and workflow automation multi-step work across systems: trade capture, nominations, reconciliation, credit packs
• CD AI-assisted coding and analytics code generation, model building, natural-language dashboards
• AN Anomaly detection and surveillance booking errors, P&L breaks, price verification, trade surveillance
• GS Geospatial and sensor AI vessel tracking, satellite, weather grids, tank and site sensors

Open questions for the next iteration

• Should the map follow the attached org chart's seven bands, or regroup roles by flow (for example, moving trade support and confirmations into a single post-trade band)?
• The 10 added roles in credit, treasury and compliance need a review of their splits. IT and information security are still absent; add them as a function?
• Should each role's technology tags be weighted (primary versus secondary) rather than on or off?
• The file's eight-seat trading deep-dive (task intensity by seat) could drill down from the front-office band.

The file reports a task-weighted aggregate of about 41% Machine, 34% Amplify Output, 8% Accelerate Learning and 17% Human Edge (the file calls these modes Replace, Multiply, Compress and Resists). Averaging its 58 roles directly gives 42%, 35%, 7% and 16%; the difference is rounding. Figures on this page include the 10 added roles: 42%, 35%, 7% and 16% overall. The file's text cites 12 sign-off-retained and 8 pipeline roles, but its role tables flag 10 and 7; this page uses the tables.

The five levels

Levels describe how much of the work the system does and who commits the result. They are cumulative: a level 4 capability still needs the data and models of level 3.

1. L1ManualSpreadsheets, email, portals and re-keying. Knowledge sits with people.
2. L2Digitised and assistedStructured data, rules and dashboards. General chat assistants used informally.
3. L3Predictive and embeddedMachine learning and language models built into the workflow. People review every output.
4. L4Agentic, human in the loopAgents run multi-step work across systems and prepare the action. A person approves it or supervises live.
5. L5Autonomous within limitsSystems decide and act inside delegated limits. People set limits, handle exceptions and review afterwards.

Where the frontier sits

Click a cell to mark where your own firm sits on that row. Marks are kept in this browser only.

2a. How the five levels map to published maturity models

The matrix uses its own five-level scale, built around how much of the work the system does and who commits the result. It is not CMMI. The table shows the nearest published equivalents. The BCG ladder is the domain anchor, and the Feng, McDonald and Zhang autonomy levels are the closest match for agents.

* BCG's Level 1 was not captured in the research notes; the placement is by elimination. CMMI and SAE rows are analogies: CMMI measures process discipline and SAE measures driving automation, so neither is a measure of AI capability in trading.

• S72 Beyond AI: how tech is transforming commodity trading BCG, 18 Jun 2026 Read
  Anchor for the domain: BCG's commodity-trading maturity ladder. Our L3–L5 correspond to its Levels 2–4, and its statement that Level 4 is theoretical sets our empty L5 frontier.
• S97 Levels of Autonomy for AI Agents (Feng, McDonald, Zhang) arXiv 2506.12469 / Knight First Amendment Institute, Jun 2025 Search result only
  Closest match for the autonomy axis: five levels defined by the human's role. Its Approver and Observer levels map to our L4 and L5.
• S98 Capability Maturity Model Integration (CMMI) Wikipedia summary of CMMI Institute model, n/a Search result only
  CMMI measures process maturity, not autonomy. Used as an analogy for the enabler rows (governance, data, operating model), where repeatable process matters more than autonomy.
• S99 SAE J3016 Taxonomy of driving automation SAE International, Apr 2021 revision Search result only
  Analogy only: SAE's split between conditional automation (human takes over on request) and high automation mirrors our L4/L5 line.
• S100 AI maturity models (incl. Gartner's five levels) BMC blog, Undated Search result only
  Gartner's five AI maturity stages (awareness to transformational) are organisation-wide, so they suit the enabler rows more than single capabilities.
• S78 AI in energy and commodities: from hype to practical application (ComTech report) CTRM Center, 18 Aug 2026 Read
  Domain classification: information services most mature, operational automation emerging, autonomous front-office decisions strictly limited.
• S75 At the threshold of a new era in commodity trading McKinsey, Page undated; press 9 Mar 2026 Read
  Adoption stages (implementing, piloting, not started) and post-trade agent cases used for the credit and KYC row.
• S87 AI in commodity trading Accenture, 29 Jun 2026 Read
  Value levers (alpha, execution, risk, operations) used to separate the financial-trading rows.
• S90 Gartner: over 40% of agentic AI projects will be cancelled by 2027 RCR Wireless, 27 Jun 2025 Read
  Gartner's warning on “agent washing”, the reason vendor-only agent claims are rated lower confidence.

2b. Evidence for each capability's frontier rating

The primary source sets the frontier level; supporting sources corroborate it. Confidence combines the evidence type and how fully the source was read.

Of the 21 frontier ratings, 6 are high confidence, 10 medium and 5 low. The low ones (surveillance, confirmations, contract terms, scheduling, physical settlement) rest on unread, illustrative or sponsored sources and are the first to test.

Scope

9 of the 31 audit findings concern the maturity matrix and are listed here with the action taken. The others concerned individual company and people profiles and are not part of this edition. Page references such as “PDF p.29” refer to the original 29-page edition of the dossier.

Findings