Who Investigates Insider Trading? SEC, DOJ, and FINRA Explained

Insider trading investigations don't usually start with a detective reading a newspaper and getting a hunch. They start with software. A handful of institutions, each with a distinct role, are responsible for flagging, investigating, and — where warranted — prosecuting suspicious trading. Here's how the pieces fit together.

The SEC: The Primary Civil Regulator

The Securities and Exchange Commission's Division of Enforcement is the main civil regulator for insider trading in U.S. markets. It has the authority to investigate, subpoena records and testimony, and bring civil actions seeking disgorgement of profits, civil monetary penalties, and bars from serving as an officer, director, or securities professional.

The SEC also runs its own market surveillance capabilities and maintains a whistleblower program that pays awards to individuals who provide original information leading to a successful enforcement action above certain thresholds — a meaningful source of tips in cases that are hard to detect from trading data alone, such as tips passed privately with no unusual public trading pattern.

Critically, the SEC's authority is civil, not criminal. It cannot send anyone to prison. When a case looks serious enough to warrant criminal charges, the SEC typically refers it to the DOJ, and the two agencies often coordinate — which is why a single scheme can end up producing both an SEC civil complaint and a DOJ criminal indictment.

FINRA: The Self-Regulatory Organization Doing the Day-to-Day Watching

The Financial Industry Regulatory Authority (FINRA) is a self-regulatory organization — not a government agency — that oversees broker-dealers and the exchanges' member firms. FINRA runs sophisticated, largely automated trade surveillance across the markets it oversees, looking for patterns that correlate unusual trading with subsequent price-moving news.

In practice, FINRA (along with the exchanges' own surveillance units) is often the first line of detection. Its systems flag things like an account that suddenly buys a large, out-of-character options position in a stock right before an acquisition announcement, or a cluster of accounts with some apparent connection to each other trading the same illiquid name just ahead of news. FINRA doesn't bring insider trading charges itself — its role is surveillance, investigation of the initial pattern, and referral. When its analysts find something that looks like a genuine violation rather than coincidence, they refer the matter to the SEC for further investigation and potential enforcement action.

The DOJ: Criminal Prosecution

The Department of Justice, generally through U.S. Attorney's Offices and sometimes the Fraud Section of the Criminal Division, handles the criminal side. DOJ involvement means the government is pursuing the case as securities fraud under criminal statutes, with the possibility of felony charges and prison time on the table — a materially different level of exposure than an SEC civil case. We go into more detail on what separates a civil matter from a criminal one in our piece on insider trading penalties.

DOJ cases often run parallel to, or shortly after, an SEC civil case built on the same facts, since the SEC's civil investigative tools (subpoenas, depositions) can surface evidence useful to a criminal referral, and vice versa.

How a Case Actually Gets Flagged

Put together, here's the general path a suspicious trade tends to follow, though not every case hits every step and the order can vary:

Automated surveillance catches an anomaly. Exchanges, broker-dealers, and FINRA run algorithms that flag statistically unusual trading — a spike in volume, an options position far outside a stock's normal range, or trading concentrated in a narrow window — that correlates suspiciously well with a later news event, like an earnings surprise or an M&A announcement. This kind of price-timing correlation is the single most common trigger for a look.

A referral moves up the chain. If the pattern looks like more than coincidence — for example, if the accounts involved have some traceable connection to the company, its advisors, or each other — FINRA or an exchange refers the matter to the SEC.

The SEC investigates. This can involve subpoenaing brokerage records, trading data, phone records, and testimony to trace who traded, when, and whether there's a plausible connection to a source of non-public information. Building a case often means establishing a chain: an insider with access to the information, a channel by which it reached the trader, and trading that closely tracks the timing of that access.

Whistleblower tips supplement the data-driven cases. Not every violation shows up in a clean statistical pattern — a single, well-timed trade by someone who received a private tip may not stand out in volume data at all. This is where the SEC's whistleblower program fills a gap that pure surveillance can miss, since it relies on someone with direct knowledge coming forward. Tips can come from a colleague of the person who traded, a compliance officer who noticed something off internally, or, increasingly, from data analysts at brokerage firms who spot a pattern their automated systems didn't quite flag on their own.

Media reporting and short-seller research occasionally play a role too. It's less common than the mechanisms above, but journalists and independent research firms investigating a company sometimes surface facts — unusual trading by a specific individual, a suspicious timing coincidence — that end up feeding into a regulatory referral, even though neither has any enforcement authority of its own.

Civil and/or criminal action follows. Depending on severity, intent, and scale, the matter proceeds as an SEC civil action, a DOJ criminal prosecution, or both.

The Exchanges Themselves Also Play a Role

Beyond FINRA, the major exchanges — the New York Stock Exchange and Nasdaq among them — run their own real-time surveillance of trading on their platforms as part of their regulatory obligations, and these systems can independently flag the same kind of anomaly FINRA looks for: a security that trades an unusual multiple of its normal volume, or that sees a sudden concentration of options activity, shortly before a scheduled or unscheduled corporate announcement. In practice, exchange surveillance, FINRA, and the SEC's own market-watch functions overlap and cross-reference each other rather than operating in silos, which is part of why a genuinely anomalous trade is difficult to keep hidden even without a single centralized watchdog.

State Regulators and International Cooperation

Two more participants show up less often in headlines but matter in specific cases. State securities regulators can investigate and bring their own actions under state securities laws (often called "blue sky laws"), sometimes alongside federal action. And because modern markets are global, cases involving foreign traders, offshore accounts, or information that crossed borders can involve cooperation between the SEC and foreign regulators, or between the DOJ and foreign law enforcement, to trace trading activity and serve subpoenas across jurisdictions. Neither of these is the primary mechanism in most cases, but both can extend the reach of an investigation well past U.S. borders when the facts call for it.

Why the Vast Majority of "Insider Trading" You See Never Reaches Any of This

It's worth being direct about something: almost none of the "insider trading" activity that shows up in financial news or on a tracking site ever touches SEC enforcement, FINRA referrals, or DOJ prosecutors, because it isn't a violation of anything. It's a Form 4 filing — the routine, legally required disclosure that corporate officers, directors, and large shareholders file with the SEC, generally within two business days of a trade. For the fuller breakdown of that distinction, see our definitional piece on insider trading.

That disclosed data is actually part of the broader system that makes suspicious trading easier to spot in the first place. When a company's officers and directors are trading in the open, on a public schedule, it becomes much easier — in aggregate, over time — to tell the difference between that normal, disclosed activity and a genuinely anomalous trade that doesn't fit any disclosed pattern. MySmarTrend's insider trading tracker follows that legal, disclosed side of the ledger, pulling directly from SEC filings so you can see where company insiders are putting their own money to work — the version of "insider trading" that's actually useful to watch as an investor, not the version that ends up in an enforcement action.

We track disclosed insider and congressional trading every day — the legal, public data that's actually a useful signal. Free. Drop your email below.