Provable and unprovable: why insider dealing slips the net

Across the European Union, insider dealing is the most reported and the least resolved of the two market-abuse offenses. In 2024, National Competent Authorities (NCAs) received 6,763 suspicious transaction and order reports (STORs) and related notifications; 57 percent alleged insider dealing and 41 percent market manipulation.¹ At the enforcement end, the ranking inverts. Of 377 actions taken under the Market Abuse Regulation (MAR) that year, the largest share fell under Article 15, market manipulation, ahead of the insider-dealing provisions.² More suspicion, fewer findings. The offense that firms flag most often is the one supervisors sanction least.

The gap is not a failure of effort or of will. It is a property of the evidence.

Why the order book cannot convict

Market manipulation is written into the trade record. Spoofing leaves canceled orders; layering leaves a staircase of resting bids that vanishes once the real order fills; wash trading leaves an account matching itself. Each pattern is deterministic. The intent is legible in the sequence of orders and their timestamps, and the same record that raises the suspicion also proves it. Reconstruct the order book and the case largely assembles itself.

Insider dealing leaves no such trace. A purchase placed on material non-public information (MNPI) and a purchase placed on ordinary conviction are identical in the book: same instrument, same size, same venue, same millisecond. What separates them sits outside the record entirely, in what the trader knew, when they knew it, and whether the knowledge moved the hand. The order book will not testify to a state of mind.

That is the whole of the asymmetry. Manipulation is proven by reconstructing the trade. Insider dealing can only be proven by reconstructing the information around the trader, and that information is scattered across systems, perishable, and often never captured at all. The slip is not one failure. It is five, one at each place the information should have been held.

The anatomy of the slip

Access: the register of who could have known. MAR Article 18 requires issuers and their advisers to keep insider lists, and wall-crossing records document who is brought over the barrier and when. Together they are the register of access, the population who could have traded on knowledge. In practice these lists are frequently out of date and unevenly kept, a weakness noted across supervisory and industry reviews of the MAR estate.³ A stale register cannot be cross checked against a suspicious trade. Therefore, the first question any insider-dealing case must answer is could this person have known, and it often has no reliable answer on file.

Timing: anomaly is not intent. Trading ahead of a price-sensitive announcement is the classic signal, and the analytics that surface it have grown sharper: a trader's own history becomes the baseline, and departures from it around a material event are flagged. The limit is fixed and worth stating plainly. These methods surface statistical anomalies, not legal violations. They produce a starting point for investigation, never a finding. Better event timestamps sharpen the anomaly; they do not close the distance to intent.

Communications: where intent actually lives. The reason manipulation is provable and insider dealing is not is that intent leaves its trace in language, not in the order book. The decisive record is the message, the call, the wall-crossing email, the exchange that shows knowledge passing and a trade following. Without that trace, it is difficult to prove that a trade rested on inside information rather than coincidence. ESMA's supervisory action singled out communications surveillance as under-resourced, and the migration of business conversation onto personal messaging channels is carrying the most important evidence to exactly the place it is least likely to be captured.

Relationships: the surface keeps widening. Intent also lives in connections: tippee chains, family, associates, and now the frontier the enforcement community calls shadow trading, where information about one company is used to trade an economically related one. The 2024 case SEC v. Panuwat put the theory on the record in the United States, and researchers have since begun modeling the market as a graph to surface the non-obvious relationships that single-instrument review misses.⁴ The relationship view widens what can be reached. It widens the false-positive surface by the same measure, and under MAR the legal presumption that possession plus trading implies use is doing work that no network diagram can do on its own.

The market view: reconstruction across venues. A trader can split activity across venues and jurisdictions, and until recently the Union had no consolidated picture of it. That is changing. In December 2025 ESMA selected EuroCTP to operate the consolidated tape for shares and exchange-traded funds, with a provider for over-the-counter derivatives named in July 2026.⁵ The distinction that matters is that a consolidated tape is post-trade transparency, not surveillance. The tape narrows the fragmentation gap. It does not touch the intent problem.

What can seal it

The instinct is to reach for analytics but evidence of intent cannot be inferred from the trade record no matter how finely it is read. The layers that yield leads (timing, relationships) can be improved indefinitely and still deliver only leads. The layers that yield proof are the ones that reconstruct the information state around the trader, and there are two.

The first is access, made auditable. An insider list that is current, timestamped, and machine-readable turns the opening question of every case from an investigation into a lookup. This is unglamorous governance, and it is the cheapest large gain available.

The second is the communications record, and it is the one that changes the evidentiary picture rather than merely lengthening the queue of suspects. The message trace is the only layer that carries intent rather than anomaly. It is also where the evidence is now most likely to escape, because the conversation has migrated to off-channel media: personal handsets, encrypted apps, messages that were never recorded and may never be recovered. The tensions here are real: proportionality, privacy, and a false-positive burden that grows with reach. Off-channel evasion is not answered by reading messages, but by three moves the courts already test.

The first move is to compel capture. In the Union the obligation already exists: MiFID II requires firms to record communications that relate to transactions, and MAR requires them to arrange to report suspicion. The enforcement of that duty is where the United States has gone furthest, and its example is instructive even though the Union has not followed it at scale. Since 2021 the SEC and CFTC have levied more than 3.5 billion dollars across more than 100 firms for failing to preserve business communications conducted on personal messaging apps, and in some cases found that firms had deleted the messages to evade oversight.⁶ Note the limit precisely: these are record-keeping cases, not insider-dealing cases. They punish the failure to keep the trace, not the abuse the trace would have shown. But they treat the capture gap itself as the harm, which is the right instinct.

The second move is to recover what survives. Off-channel does not mean unrecoverable. In practice the unrecorded conversation is routinely pulled back into evidence: from cloud backups of encrypted apps the parties believed were untraceable, from a counterparty's handset produced under warrant, from a cooperating witness, and at the far end from lawful interception. The illustrative cases are American. The Sharp prosecutions turned on backups of supposedly untraceable messaging; United States v. Chen used recovered encrypted-app texts to show the parties knew before they traded; and the Rajaratnam wiretaps let a jury hear the tips passed directly, with no inference required at all.⁷ The lesson transfers cleanly to the Union: the decisive variable is not the channel but whether a residue survives it.

The third move is to infer the conversation from the footprint it disturbed, and this is the move the surveillance literature actually contemplates for off-channel abuse, because a message that was never captured cannot be modeled as text. What can be modeled is the trade record it left behind. Synchronized, directional trading by ostensibly unconnected accounts, clustered in a narrow window before a price-sensitive event, is systematized circumstantial inference of a conversation no one recorded (see figure). The courts accept the reasoning but hold it to a threshold. In the Canadian Walton decision, the Court of Appeal held that inferences may be drawn from circumstantial evidence, but speculation is not a proper inference and the standard is clear and cogent. And SEC v. Clark shows the tension is live: a trial judge dismissed an insider-dealing case mid-trial, finding the circumstantial record too thin, before the Fourth Circuit reversed and held that suspicious trading and a close relationship can be enough to reach a jury.⁸ This is why the serious work in this line pairs the inference with interpretable methods: a finding that cannot be explained to a tribunal is worthless, however sharp the model behind it.

Here the Union's regime is not a jurisdictional footnote; it changes the inference itself. Under MAR, once possession of inside information and a trade are established, use is presumed, a rebuttable presumption the defense may displace.⁹ The circumstantial chain therefore stops one rung short of where it must run in the United States, where the personal-benefit test of Newman and Salman requires proof that a benefit passed from tipper to tippee before liability attaches. Put plainly: an insider ring that would demand reconstruction of the tipper's motive in New York can, in the Union, be carried the last step by the presumption. The footprint has less work to do, which is the single most consequential difference in how the two regimes prove an unrecorded conversation.

For manipulation, the record convicts. For insider dealing, the record has to exist before the order is ever placed: a contemporaneous, auditable account of who held the information and who was told. That is not a detection problem to be solved after the fact. It is a governance problem, solved before the suspicious order arrives or not at all.