Before CAT, reconstructing a fast-moving event meant stitching together partial records from many venues over weeks. CAT records every route, modification, cancellation and execution with timestamps, in one place.
For surveillance this is transformative: patterns such as spoofing, layering and marking-the-close are far easier to prove when every message from a participant is visible across venues at once.
Example: a trader places and cancels bids on three venues while selling on a fourth. Each venue alone shows unremarkable activity. CAT links all four to one account and the pattern — 4,100 cancelled bids against 190 executed sells over six weeks — becomes a chart in an enforcement filing.