AML in Capital Markets: Insider Trading

capital markets

Securities typologies are often overlooked by anti-money laundering (AML) programs. The issue is compounded by the absence of effective industry solutions, which tend to focus on payment-oriented transaction monitoring. As AML regulators intensify the monitoring requirements for securities, organizations will need to add the requisite subject-matter expertise to their AML arsenals. There are numerous different securities typologies that can be manifested at global organizations, particularly those that provide custody, brokerage, clearing or depository services. This article will focus on insider trading and provide lessons learned from case studies.

Insider Trading Typology

According to the U.S. Securities and Exchange Commission (SEC), “Illegal insider trading refers generally to buying or selling a security, in breach of a fiduciary duty or other relationship of trust and confidence, on the basis of material, nonpublic information about the security.”1 The possession and misuse of material, nonpublic information (MNPI) is the defining behavior.2 Shartsis Friese LLP, a law firm based in San Francisco, California, reviewed the SEC Division of Enforcement’s 2018 annual report and concluded that the insider trading cases cited involve the following MNPI categories:3

  • Mergers and acquisitions (59.3% cases)
  • Earnings (11.8% cases)
  • Drug trials/U.S. Food and Drug Administration (FDA) approval (10.2% cases)
  • Business combinations: investments, strategic partnerships, licensing (10.2% cases)
  • Miscellaneous: oil discovery, secondary offering, product milestones (5.1% cases)
  • Data breaches (3.4% cases)

Primary red flags or indicators that MNPI is being misused include, but are not limited to, the following:

  1. Stock purchases in advance of mergers4
  2. Buying securities before a major positive announcement (FDA approvals, earnings beat)5
  3. Selling securities before a major negative announcement (FDA rejections, earnings miss)
  4. The size of the purchase relative to the total holdings or daily trading volume
  5. No previous activity (buys or sells) in the company's stock
  6. Purchase of the security demonstrates the market participant differing in investment strategy

The subsequent case studies illustrate customer behavior that parallels these red flags in proximity to material market events. Each case study also demonstrates how combinations of red flags can appear in insider trading cases. The red flag numbers in each case study correspond to the numbering above. Dates and numbers are for illustration purposes only.

 capital markets case study 1

capital markets case study 2

Detection Methods

The application of securities expertise to AML monitoring is still in the nascent stage. As a result, there are not many well-known, time-tested vendor solutions available for organizations. The following are suggestions on how an organization can begin exploring this topic. This list is by no means exhaustive and options are expected to increase as this space continues to evolve.

Blue Sheet Reviews

Blue Sheet reviews are an effective and potentially budget-friendly way for an organization to monitor securities typologies. The two case studies presented in this article are based on activities identified in multiple Blue Sheet reviews. Although this discussion is focused on insider trading, Blue Sheet reviews can also lead to many other securities typologies including portfolio pumping, cross trades, prearranged trading, etc. Blue Sheets are requests from regulators, such as the Financial Industry Regulatory Authority (FINRA)6 and the SEC, for transactional information related to specific securities, especially ones that recently experienced a spike in volatility.7 Blue Sheet requests originate from regulators’ use of proprietary monitoring solutions such as the Securities Observation News Analysis and Regulation (SONAR) system. FINRA’s Office of Fraud Detection and Market Intelligence uses SONAR to trace unusual price or volume movements in stocks across the U.S. markets and to combine that information with news feeds that SONAR receives daily. FINRA’s process also generates alerts that identify situations indicative of potential insider trading.8 By leveraging the Blue Sheets, organizations can develop investigation protocols and subject-matter expertise even in environments with limited budget for costly technology implementations.

In-House Build

Developing specialized in-house monitoring is another option that organizations can pursue. Due to the complexity of trading patterns and the typically large volumes, market data (e.g., daily trading volume, average volume and news) as well as securities reference data (e.g., market capitalization, asset class and exchange) are essential for model optimization. For example, market dominant activity (described in the typology section) is difficult to identify without being able to compare transaction sizes against the daily market volume. Different asset classes (e.g., common stock, fixed income, derivatives) also need to be treated differently and some may even be out of scope depending on the typology. Because of the inherent nuances and complexities, it is important to ensure that there is securities subject-matter expertise guiding the implementation. Without the essential market data and the proper subject-matter inputs, model outputs are likely to be misaligned with the typology and unmanageable in terms of volume.

Vendor Selection

Because there is no dominant vendor solution for AML securities monitoring, this is an area brimming with opportunity. Vendors that can supply the essential market data described above, systematically categorize market news events and provide subject-matter expertise on how to manage different types of trade data (e.g., custody vs. executing broker vs. clearing firm) and different asset classes for AML monitoring purposes have the potential to be highly successful. Organizations interested in partnering with a vendor should understand whether the proposed solution provides these functionalities and support.


FINRA’s regulatory notice 19-189 and the Financial Conduct Authority’s thematic review10 on money laundering in the capital markets were both issued in 2019, signaling increased regulatory interest in securities monitoring for AML. Insider trading is just one of many securities typologies that financial institutions need to be able to detect and mitigate. The next several years should lead to exciting developments from both a technology and investigative perspective as AML professionals become better risk managers in the securities space.

Lily Zhen, vice president AML risk analytics, State Street Corporation,

Eric Barefield, vice president AML compliance, State Street Corporation,

  1. “Insider Trading,” U.S. Securities and Exchange Commission,
  3. Jahan P. Raissi, “Are there Any Lessons from the SEC’s Insider Trading Cases Brought Over the Last 17 Months?” Martindale, February 26, 2019,
  4. David Chase, “SEC radically changes its approach to investigating insider trading,” The Hill, November 29, 2016,
  5. “Insider Trading,” The Blanch Law Firm,
  6. "Electronic Blue Sheets,” Financial Industry Regulatory Authority,
  7. Will Kenton, “Blue Sheets,” Investopidia, December 2, 2019,
  8. “5 Surprising Facts About Insider Trading,” Financial Industry Regulatory Authority, May 3, 2017
  9. “Regulatory Notice 19-18 FINRA Provides Guidance to Firms Regarding Suspicious Activity Monitoring and Reporting Obligations,” FINRA,
  10. “TR19/4: Understanding the money laundering risks in the capital markets,”Financial Conduct Authority,

Leave a Reply