Platforms · Software · Providers · Markets
The Financial Conduct Authority (FCA) has told seven UK retail brokers to improve how they detect suspected insider dealing by clients. It disclosed the findings on Wednesday, but did not identify the firms. After inspecting them, the regulator required all seven to address weaknesses; it brought in outside specialists for skilled person reviews at some firms to assess their remediation.
The findings matter to firms responsible for spotting and escalating suspicious activity under the UK Market Abuse Regulation (UK MAR). Brokers must send the FCA reports on suspect orders and trades, which inform its insider dealing investigations.
The authority received 3,806 suspicious transaction and order reports (STORs) in 2025, 16% below the 4,528 submitted in 2024. The insider dealing component fell 21% to 3,124.
Where surveillance controls failed
Several problems arose before an alert became a report. At some brokers, analysts faced a bar for escalation that the FCA considered too demanding. Procedures at some firms also led staff to look for evidence connecting a client with an issuer, or prompted them to close alerts. The regulator said evidence of completed abuse is not a prerequisite for filing a report.
Surveillance design and testing also came under scrutiny. Some firms used the same price-change trigger for large-cap and small-cap equities, while minimum trade-value filters excluded substantial client activity from monitoring. Staff at some brokers struggled to describe how their system operated, and the FCA found firms relying on vendors' preconfigured options without adequate testing.
Governance varied. In some cases, senior managers had little understanding of the controls, responsibilities were spread among teams without one person overseeing the full process, and quality checks ranged from comprehensive to absent.
Some risk reviews failed to account for the firm's own clients, including by treating institutional and retail activity as equivalent. The FCA noted that the regime is now a decade old.
Who is covered and when duties apply
The reporting obligation applies to brokers under UK MAR; the FCA's visits covered seven UK retail firms. The newsletter sets no shared deadline for their changes. It does not identify the brokers or specify a common timetable for completing remedial work.
Earlier enforcement shows the operational consequences of gaps. In March, the FCA fined Dinosaur Merchant Bank £338,000 (about $450,000) after trades in CFDs routed through a new order system bypassed automated monitoring.
The trades were executed between June and October 2024 and had an underlying value of about $3.05 billion, according to the regulator. The bank ceased offering CFDs in May 2025. In January 2025, Infinox received a £99,200 fine over 46,053 transaction reports it had not filed.
Wholesale cases have also involved surveillance coverage. Citigroup's international broker-dealer paid £12.6 million in 2022. Later that year, BGC Brokers and two GFI Group units were fined £4.8 million in total for controls that did not cover every asset class subject to MAR.
The current findings, first reported by Finance Magnates, differ from the FCA's April 2023 Market Watch 73 review of nine CFD and spread betting providers, where most firms could demonstrate largely effective insider dealing alerts. That review nevertheless found lookback windows of just 24 hours and weak monitoring outside equities; only one of the nine firms checked the quality of analyst-reviewed alerts.
The FCA says abuse risks at UK retail brokers remain a supervisory priority, while report quality from the inspected firms has improved since their visits.
What this means on the desk
Operations and risk teams should check which order and trade flows reach surveillance, including activity excluded by minimum-value filters. Are thresholds differentiated for the instruments and client groups the firm actually serves? Can analysts explain how vendor settings generate alerts, and is there evidence that those settings have been tested?
Firms should also establish who owns the process from alert review through escalation and STOR submission, and how quality assurance is recorded. The FCA did not name the firms or set a common remediation date, so operators should confirm whether their own review has produced deadlines or specific control changes.
