Insider trading detection - expert insights on surveillance

When an insider trading alert triggers, the assessment starts with a few questions: Does the trading behaviour deviate from the client’s normal pattern? Does the information meet the definition of insider information? And was that information public at the time of trading? 

In this article, Per Friberg, Senior Financial Crime Surveillance Officer at Trapets, explains how suspected insider trading is identified and assessed in practice - all from the reality of handling alerts, reviewing news, analysing behaviour and deciding whether a case reaches the threshold for a STOR (Suspicious Transaction and Order Report). 

This article is part of our expert series, in which Per answers questions we receive about insider trading and market and trade surveillance. If you missed the previous article, you can read it here. 

From alerts to insight: how insider trading detection works in practice 

A common question from surveillance officers is how detection algorithms work. At a high level, the answer is that insider trading detection is built on multiple alert types that work together, rather than a single signal. 

As Per explains: 

“We use several alerts to help us detect suspected insider trading. These are continuously developed and become more accurate over time.” 

One of the core alerts is the Insider Trading Pattern (ITP), developed by Trapets, which scores several parameters that, when combined, indicate increased risk.  

These include price movements shortly after a news release, increased turnover ahead of disclosure, and the ability to identify accounts that traded in the “right” direction before information became public. 

Importantly, the scoring also considers how trading occurred: 

“The scoring also takes into account whether the trading has been aggressive and whether profits were realised after the information was disclosed.” 

This approach reflects the reality of market surveillance, that suspicious behaviour is rarely defined by a single metric. Context, timing, and behaviour matter. 

News‑driven alerts and the limits of automation 

Alongside pattern‑based alerts, surveillance teams also rely on news‑driven alerts that trigger when significant price movements occur after a disclosure. These alerts focus on the market impact of the information itself, rather than pre‑event trading. 

Here, automation deliberately stops short: 

“Any trading ahead of the news must be identified manually and then investigated to assess whether there is a suspicion.” 

This distinction highlights an important principle: that alerts are indicators, not conclusions. As Per mentions: 

“As with all alerts in a surveillance environment, they are only flags indicating that something needs to be examined more closely.” 

Manual assessment remains decisive 

Despite continuous technological developments, insider trading investigations still require human analysis.  

Each alert requires a structured assessment of:  

• whether the information qualifies as insider information;
• whether it was public or not at the time of the trade
• whether it is information that, if it were made public, it would have a significant effect on the price of the instrument,
• and whether it is precise enough to influence an investment decision. 

Only when these criteria are met does the investigation move forward. 

The trading analysis itself is often extensive: 

“This investigation is often time-consuming and involves analysing the accounts or client’s behaviour compared with their normal trading pattern.” 

Order behaviour, instrument choice, position size, account history and funding patterns are all reviewed. High cumulative abnormal returns are assessed manually as part of this deeper investigation. 

“Even though the alert framework is constantly developing, a degree of manual analysis and judgement will always be required.” 

When no alert triggers, but the risk remains 

Experienced surveillance teams know that not all risk is captured by alerts alone. Certain events demand scrutiny regardless of whether thresholds are met. 

Public takeover bids are a clear example: 

“From experience, we know that information too often leaks ahead of takeovers, and that insider trading before takeover offers occurs on a large scale.” 

In such cases, manual review of trading activity ahead of disclosure is often the only way to identify suspicious behaviour. Alerts support the process, but they do not replace investigative judgment. 

Filtering signals: why most alerts are closed 

High alert volumes are a reality of surveillance operations. Based on Per's experience, more than 90% of alerts can be closed without further action, depending on the alert type. 

Closing price alerts, for example, frequently relate to earnings reports or well‑known market events: 

“Once is nothing, twice is a clear warning sign.” 

Patterns across time matter far more than isolated incidents. 

Learning over time: experience meets technology 

Surveillance accuracy improves not only because detection logic develops, but because investigators gain experience. While insider trading is often a one‑off event, the ability to assess whether a case meets the threshold for a STOR improves with time. 

As Per notes, long‑term cooperation with regulators also strengthens this judgement: 

“Over time, we have built experience that makes us highly accurate in our ability to detect suspicious trading.” 

Looking ahead: insider trading and market abuse trends 

Insider trading is unlikely to decrease. It is often committed by individuals who unexpectedly gain access to sensitive information and act on it. 

“Insider trading ahead of takeover bids will likely remain the most common and most serious form.” 

At the same time, market manipulation trends shift. Pump‑and‑dump schemes, misuse of social media and misleading information remain areas of focus, while more traditional tactics are easier to detect and sanction. 

To summarise this: strong detection logic, supported by experienced investigators, remains essential in market and trade surveillance.  

Looking to improve your market and trade surveillance? Trapets Market and Trade Surveillance gives you powerful tools to detect unusual trading behaviours. Read more about our solutions.

About Per Friberg: 

Per brings a unique experience shaped by years in investment banking, where he worked as a sales trader in European and US equities and derivatives, followed by extensive experience as a criminal investigator of market abuse at the Swedish Economic Crime Authority and the National Anti-Corruption Unit (NOA) within the Swedish Police Authority.