Suspicious Transaction and Order Reports: A Guide to STORs

Requirement	Practical answer
Who must report?	UK trading venues and persons professionally arranging or executing transactions where Article 16 of UK MAR applies
What activity is covered?	Suspicious transactions, orders, amendments, cancellations, and attempted market abuse
What is the threshold?	Reasonable grounds to suspect that the activity might constitute market abuse
Is proof required?	A STOR is a report of suspicion, not a finding of misconduct
When must it be submitted?	Without delay once reasonable suspicion has been formed
Where is it submitted?	Through FCA Connect
Can an unexecuted order be reported?	Orders and attempted market abuse are within scope

What is a Suspicious Transaction and Order Report?

A Suspicious Transaction and Order Report (STOR) is a notification submitted to the FCA where an organization subject to Article 16 of the UK Market Abuse Regulation has reasonable grounds to suspect potential market abuse.

A STOR can concern insider dealing, attempted insider dealing, market manipulation, or attempted market manipulation. It may relate to a completed transaction, but it can also concern an order that was amended, cancelled, rejected, or never executed. This distinction matters because some forms of attempted manipulation operate through displayed orders rather than completed trades.

A STOR does not establish that a person committed market abuse. It provides the FCA with information that the reporting organization considers sufficiently suspicious to justify regulatory assessment. The FCA has described STORs as an important source of market intelligence — in a 2025 speech, the regulator said that more than 70% of its then-current market-abuse investigations originated from a STOR.

The current submission requirements are set out in the FCA’s guidance on reporting suspected market abuse as a firm or trading venue.

For the wider legal framework covering inside information, insider dealing, unlawful disclosure, market manipulation, prevention, and detection, see a complete guide on market abuse regulation.

Who is required to submit a STOR?

Article 16 of UK MAR applies to two broad categories.

The first comprises market operators and investment firms operating UK trading venues. They must establish and maintain arrangements, systems, and procedures for detecting and reporting suspicious orders and transactions.

The second comprises persons professionally arranging or executing transactions. This can include investment firms, banks, brokers, asset managers, firms handling client orders, and other professional market intermediaries where their activities fall within scope.

For this second category, the FCA states that a STOR must be made where the person is registered or has its head office in the UK or, in the case of a branch, where the branch is situated in the UK.

Applicability depends on the activity being performed rather than the organization’s name or general business category.

The organization should determine whether it professionally arranges or executes transactions, which entities and branches are in scope, and how responsibility operates across group companies, outsourced services, and international desks.

The FCA Handbook’s SUP 15.10 connects the notification requirement directly to Article 16 and explains that the reporter must be able to describe the basis for its suspicion.

What transactions and orders are covered?

STOR obligations extend beyond completed trades.

An order may become reportable where it was entered, amended, canceled, or left unexecuted as part of potentially abusive activity. Suspicion may also emerge only after the firm connects the order with later events, another account, a related instrument, or relevant communications.

A completed transaction may warrant investigation because of its timing, price, size, profitability, connection to an announcement, relationship with another instrument, or inconsistency with the subject’s previous behavior.

An unusual transaction is not automatically suspicious. Firms should consider the activity in its complete market and behavioral context.

The inclusion of orders is particularly important for detecting attempted manipulation. For example, a trader may display orders intended to create a false impression of buying or selling pressure and cancel them before execution.

For a focused explanation of that pattern, see spoofing and layering explained.

What does “reasonable grounds for suspicion” mean?

The reporting threshold is reasonable suspicion, not proof.

A firm does not need an admission, a completed disciplinary investigation, certainty about the precise offense, or evidence capable of establishing civil or criminal liability.

However, the decision should be based on more than speculation, rumor, or an automated alert examined without context.

SUP 15.10 says a notification requires sufficient indications that an order or transaction might constitute market abuse. Those indications may not become apparent until after the transaction and may arise only when the activity is viewed alongside other transactions, behavior, or information.

A defensible assessment should explain what happened, why it was unusual, what evidence was considered, and why the activity might constitute actual or attempted insider dealing or market manipulation.

The firm is deciding whether the reporting threshold has been reached. It is not determining guilt.

Where the evidence is incomplete, investigators should identify whether further proportionate review could clarify the issue without allowing the process to delay a report that is already required.

What activity may indicate potential market abuse?

No individual indicator proves that market abuse occurred. Firms should consider combinations of behavior, market context, account relationships, information access, and communications.

Potential concern	Illustrative indicators	Context to investigate
Insider dealing	Unusual trading before a price-sensitive announcement; sudden position changes; unexpectedly profitable activity	Access to information, connected persons, timing, communications, and prior behavior
Spoofing or layering	Large or multiple orders canceled after affecting apparent price, supply, demand, or liquidity	Order lifetime, execution intent, opposite-side trades, repetition, and algorithmic strategy
Marking the close	Concentrated activity near the close that influences the closing price	Position exposure, benchmark use, liquidity, and legitimate execution requirements
Wash or matched trading	Transactions with no apparent change in beneficial ownership or coordinated counterparties	Account ownership, common control, communications, and economic purpose
Misleading information	Statements inconsistent with known facts and linked to related trading activity	Source, audience, timing, market impact, knowledge, and associated positions
Coordinated activity	Similar orders or transactions across connected accounts or people	Relationships, shared devices, beneficial ownership, instructions, and communications

Attempted market abuse can be reportable even where the strategy fails, the order does not execute, or the intended market effect does not occur.

When must a STOR be submitted?

A STOR must be submitted without delay once reasonable suspicion of actual or attempted insider dealing or market manipulation has been formed.

“Without delay” does not mean that every automated alert must be reported immediately. The firm can perform enough review to confirm that the data is accurate, understand the activity, and assess whether the threshold is met.

That review should not become an open-ended investigation used to postpone reporting.

The applicable technical standard also recognizes that suspicion can arise later, in light of subsequent information or events. In that situation, the organization can report historical activity but should explain the timing of the suspicion and the resulting delay.

Once reasonable suspicion exists, the firm should not wait for an employee admission, a complete internal disciplinary process, a final legal opinion on liability, or the outcome of a separate client investigation.

A decision not to report should also be documented. The case record should explain why the evidence did not establish reasonable grounds for suspicion at that time.

How should a potential STOR case be investigated?

The investigation should be proportionate to the activity, product, market, and evidence available.

A practical process normally involves five connected stages:

1. Validate the alert and underlying data. Confirm that prices, quantities, timestamps, instruments, venues, orders, and transactions are complete and accurate.
2. Reconstruct the activity. Establish what occurred, in what sequence, and how the activity relates to market conditions, announcements, other accounts, instruments, or venues.
3. Test suspicious and legitimate explanations. Review previous behavior, customer or employee strategy, economic purpose, access to information, algorithmic logic, and relevant communications.
4. Assess the Article 16 threshold. An authorized decision-maker should determine whether the evidence creates reasonable grounds to suspect actual or attempted market abuse.
5. Submit or close with a documented rationale. Where the threshold is met, submit the STOR without delay. Where it is not, record the evidence considered and reasons for closure.

The file should identify what triggered the review, who investigated it, who made the reporting decision, and when each material step occurred.

Evidence supporting an innocent explanation should be preserved alongside evidence supporting suspicion. The purpose is a fair threshold assessment, not confirmation of an initial alert.

What information should a STOR contain?

STORs are submitted through FCA Connect using the prescribed form.

The report should clearly identify the reporting organization, relevant instruments, orders or transactions, dates, times, prices, quantities, venues, and people or accounts involved.

The narrative should explain what happened and why it is suspicious. It should connect the facts rather than merely attach raw order or transaction data and expect the FCA to infer the concern.

Where relevant, the report may include charts, order-book analysis, communications, account relationships, beneficial-ownership information, or supporting documents.

A strong narrative normally allows the FCA to understand:

• The chronology of events
• The suspected type of market abuse
• The evidence supporting the suspicion
• The relationship between the people, accounts, instruments, and activity
• Any legitimate explanation considered
• What additional information the firm holds

The firm should provide relevant additional information discovered after submission and respond to any subsequent FCA request for documents or clarification.

Global Relay’s broader article on reporting requirements provides additional context on data quality, governance, and regulatory reporting processes.

Should the subject of a STOR be told?

STOR cases should be handled on a restricted, need-to-know basis.

Informing a client, employee, trader, or another subject that a STOR has been or may be submitted could compromise a regulatory investigation, affect future behavior, or create a risk that evidence is altered or destroyed.

This does not mean the front office can never be involved in gathering an explanation. Firms may sometimes need business or product expertise to investigate an alert properly.

The risk is uncontrolled disclosure.

FCA Market Watch 73 observed that some firms routinely involved front-office staff in STOR submissions without considering whether those individuals needed to know. It also found firms reluctant to ask appropriate questions because of generalized concerns about tipping off.

The organization should define who can access cases, who can approve submissions, how the subject may be approached, and when Legal or senior Compliance involvement is required.

Separate customer, employment, disciplinary, and regulatory decisions should be coordinated without disclosing the STOR unnecessarily.

What is the difference between a STOR, a SAR, and a market observation?

These notifications serve different purposes and are not interchangeable.

Report	Recipient	Main purpose	Typical use
STOR	Financial Conduct Authority	Report suspected actual or attempted market abuse	Where an Article 16 reporter has reasonable grounds to suspect insider dealing or market manipulation
Suspicious Activity Report	National Crime Agency	Report knowledge or suspicion relating to money laundering or terrorist financing	Where the applicable financial-crime reporting threshold is met
Market observation	Financial Conduct Authority	Provide relevant market-abuse intelligence outside a formal STOR obligation	Where the organization observes concerning activity but is not involved or lacks sufficient information to submit a STOR

The same conduct may require consideration of both a STOR and a SAR. Potential market abuse may also create suspicion that profits or assets represent criminal property.

Submitting one report does not automatically satisfy the other obligation.

The National Crime Agency explains that Suspicious Activity Reports provide intelligence concerning possible money laundering and terrorist financing.

A market observation should not be used as a substitute where the organization is subject to Article 16 and has reached the STOR threshold. The FCA provides separate market-observation functionality through Connect for information falling outside a formal STOR obligation.

What role do trade and communications surveillance play?

Transaction and order surveillance can identify unusual behavior. Communications can help explain access to information, intent, coordination, relationships, and economic purpose.

A transaction alert may identify trading before an announcement. Email, voice, chat, mobile, or financial-messaging data may then show whether the person had access to inside information, acted on a client instruction, coordinated with someone else, or followed a legitimate documented strategy.

For order-based manipulation, communications may clarify why an order was entered or canceled and whether apparently separate accounts were connected.

Communications should complement rather than replace order and transaction surveillance. A suspicious message without corresponding market activity may not establish an Article 16 concern, while an abusive trading pattern may exist without an explicit written admission.

For the wider detection framework, see trade surveillance.

See also Eyes on surveillance: from trading to communications and Voice channels—the risk you’re missing.

What systems and controls should firms maintain?

Article 16 requires effective arrangements, systems, and procedures for detecting and reporting suspicious activity.

The framework should begin with a market-abuse risk assessment covering the firm’s products, customers, employees, venues, order flow, trading strategies, and geographic footprint.

Surveillance should capture relevant orders as well as transactions. FCA Market Watch 68 and 69 emphasized that canceled and amended orders can be critical to detecting spoofing, layering, and attempted manipulation.

The control environment also needs complete and accurate data, appropriately calibrated scenarios, skilled reviewers, clear escalation, authorized decision-makers, and quality assurance.

FCA Market Watch 79 described surveillance failures caused by missing data, faulty implementation, ineffective alert logic, and inadequate model testing. Some firms mistakenly assumed their monitoring was complete because the system continued producing plausible alerts despite material coverage gaps.

Senior management should receive information that enables meaningful oversight of alert age, unresolved cases, data-quality failures, coverage gaps, reviewer capacity, and quality-assurance findings.

The purpose is not to target a predetermined number of STORs. Submission volumes should reflect actual activity and risk.

What are common STOR compliance weaknesses?

A common weakness is monitoring completed transactions while failing to capture orders, amendments, cancellations, or attempted abuse.

Other firms use generic surveillance scenarios that do not reflect their products, clients, venues, or trading strategies. Related accounts and correlated instruments may be reviewed separately even where the activity should be assessed together.

Investigations can also be delayed by poor data, excessive alert volumes, unclear ownership, weak product expertise, or reluctance to escalate without proof.

Communications gaps create another weakness. Relevant mobile, voice, chat, or financial-messaging data may be unavailable when investigators need to understand information flow or intent.

Finally, some organizations treat STOR submission as the end of the matter. The firm may still need to preserve evidence, manage the client or employee relationship, correct surveillance gaps, consider a SAR, and provide additional information to the FCA.

Frequently asked questions

What does STOR stand for?

STOR stands for Suspicious Transaction and Order Report.

Who receives STORs in the UK?

STORs are submitted to the Financial Conduct Authority.

Who must submit a STOR?

UK trading venues and persons professionally arranging or executing transactions must submit STORs where Article 16 of UK MAR applies and the reporting threshold is met.

Does a firm need proof of market abuse?

The threshold is reasonable grounds for suspicion rather than proof, but the firm must be able to explain its evidence and reasoning.

Can an unexecuted or canceled order require a STOR?

Orders and attempted market abuse are included within the reporting framework.

When must a STOR be submitted?

It must be submitted without delay once reasonable suspicion has been formed.

Is a STOR the same as a SAR?

A STOR concerns suspected market abuse and is submitted to the FCA. A SAR concerns suspected money laundering or terrorist financing and is submitted to the National Crime Agency.

Can the same conduct require both reports?

The same facts can create separate market-abuse and financial-crime reporting considerations.

How Global Relay helps

Effective STOR assessment requires firms to connect suspicious transactions and orders with the communications and relationships surrounding them.

Global Relay captures and preserves communications across email, mobile, voice, financial messaging, collaboration platforms, and other business channels.

Global Relay Communications Surveillance enables firms to analyze captured communications for potential insider dealing, market manipulation, coordination, concealment, and other conduct risks.

Used alongside a firm’s order and transaction surveillance, this communications context can support alert investigation, escalation, STOR decisions, evidence preservation, and regulatory response.

Learn more about Global Relay Communications Surveillance, Global Relay Voice Surveillance, and Global Relay Archive.

Related reading:

• Reporting requirements
• Eyes on surveillance: from trading to communications
• Voice channels—the risk you’re missing