SFMA — Systemic Financial Manipulation & Attack — is the Silbad-coined name for a class of coordinated financial activity that targets the stability, liquidity or market functioning of a country, a financial institution or a major company. This page is the canonical definition, the boundaries of the category, and an honest account of why the term exists.
Quoted exactly as it appears in Silbad's internal messaging framework — the same wording that appears, where appropriate, in our contractual and pilot documentation.
Systemic Financial Manipulation & Attack (SFMA) — a set of financial activities, detectable from transactional and market patterns, aimed at manipulating or destabilising the stability, liquidity or market functioning of a country, financial institution or company.
SFMA sits between several established disciplines and overlaps with all of them. It is not a replacement for any of them — and being precise about that boundary is part of what makes the category useful.
Fraud has a victim — a person, an account, an institution from whom value is taken. SFMA can have a victim too, but its target is the market itself, the institution as a system, or the macroeconomic surface a country sits on. The damage is measured in stability and confidence, not in stolen balances.
AML follows the proceeds of past predicate crime through the financial system. It is retrospective by construction — the crime happened, the money is moving, the AML programme tries to interdict it. SFMA is forward-looking: it watches for coordinated activity that is preparing or executing a market-level effect, not laundering its proceeds.
Market-abuse regimes — MAR-style insider-dealing and instrument-level manipulation rules — are about specific instruments and specific counterparties. SFMA is broader and systemic: coordinated activity across instruments, venues, currencies and actors, intended to move a market or a national balance sheet rather than to harvest mispricing on a single instrument.
Pump-and-dump, spoofing, layering and similar are tactical patterns; they can serve SFMA, but a single instance of any of them is not SFMA. SFMA requires the coordination, the systemic target, and the intent to disrupt stability or function — not just a price move.
Sanctions evasion seeks to move value past a regulatory wall. It overlaps with SFMA when the evasion is itself part of a destabilisation effort, but the two are not equivalent. Most sanctions-evasion screening fits inside AML / sanctions disciplines, not inside SFMA.
SFMA detection works on the transactional and market patterns that regulated financial institutions already collect under their existing mandates. It does not extend the data the institution holds, and it does not import data from outside the regulated frame. It is a different reading of existing data — not a new data acquisition.
When SFMA succeeds, the costs land on populations who never participated in the financial event at all — and who therefore also have no obvious recourse.
A coordinated attack on a national currency or on credit conditions inside a banking system shows up at the supermarket — through the cost of imports, through mortgage rates, through whether banks lend to small businesses next quarter. The pricing happens in trading rooms; the bill arrives elsewhere.
A financial-stability event — a sudden liquidity squeeze, a cascading counterparty failure, a confidence collapse — is the macroeconomic side of SFMA. Once it starts, it rarely stays inside the institution it began at; contagion is part of the design.
Sovereign-debt manipulation, coordinated short-selling against state-linked banks, or attacks on a country's reserves all translate into public-finance losses. The losses are absorbed through tax, through cuts to public services, or through monetary tightening — not through the original counterparties.
The deepest consequence is in confidence — in the institution, the market, the regulator, the currency, the system itself. Confidence is slow to rebuild and easy to lose. SFMA succeeds, in many of its forms, simply by making confidence harder to sustain.
Each financial-defence discipline that SFMA borders was built for a different problem. Each is good at its own problem and structurally weak at SFMA's.
AML and fraud systems are built around a single regulated institution's view of its own customers and transactions. SFMA signals are diffuse across multiple institutions, instruments and venues. No one institution sees the whole pattern; the pattern only exists when those views are correlated.
Each individual transaction inside an SFMA pattern is typically inside the normal distribution. The thing that is anomalous is the coordination — many actors moving in the same direction at the same time. Per-event scoring will rarely flag any of them.
The most useful early signal — the preparatory phase of an attack — is by definition not yet the attack. Event-based detection misses preparation because nothing has happened in the strict event sense; the signal is in the shape of the activity, not in any single event being abnormal.
SFMA findings touch geopolitics, attribution, and sometimes the integrity of named state actors. Tools that confidently "name the attacker" or attribute findings to specific governments are a liability — both because they overstate what financial data can prove, and because they put the using institution in the wrong public position.
AML, fraud, market abuse and DORA all have decades of statutes, supervisory expectations and case law behind them. SFMA does not yet have a comparable scaffolding. Defending against it therefore requires both the technical tooling and an explicit position on what the institution will and will not do with what it sees.
In most jurisdictions, no single body has SFMA as an explicit mandate. Pieces of the picture sit with the central bank's financial-stability function, the financial supervisor, the treasury, sometimes a national security service. The detection problem is therefore also a coordination problem.
The phenomenon is not new. The term is. The reason is practical, not proprietary.
Marengo is Silbad's real-time, advisory-grade defence platform against SFMA. It is offered exclusively to public-sector and EU institutional users — central banks, treasury and finance ministries' economic-security functions, and EU-level supervisors such as the ECB SSM, ESRB and EBA — on a pilot-led, ethically reviewed basis. Marengo recognises both the manipulation event and the preparatory activity that precedes it; the operational interpretation and any public communication remain, by design, with the institution.
Open the Marengo product page →