How Insider Trading Is Detected: Signals and Limits

How is insider trading detected?

Insider trading is detected by looking for trades that line up too neatly with material nonpublic information, then testing whether the trader had access to that information. The trade pattern is only the starting clue. A real case usually needs a second layer: relationships, communications, firm records, option activity, account ownership, or testimony that connects the trade to inside information.

FINRA's FINRA Insider Trading Detection Program says it monitors trading in stocks, options, and bonds around material news events and makes hundreds of referrals to the SEC and law enforcement each year. FINRA's FINRA technology overview also describes surveillance algorithms and pattern checks across very large trade-data flows.

That is the first boundary for a reader: the public can screen disclosed insider transactions, but public filings do not prove an illegal insider-trading case by themselves.

What signals do investigators look for?

The basic detection model is an event-window test. Find a material event, then look backward for trades that were unusually timed, unusually sized, unusually profitable, or placed by accounts with a plausible information path.

A useful public screen should therefore separate "unusual" from "illegal." It can rank cases for review. It cannot replace subpoenas, broker records, phone records, messages, witness interviews, or enforcement judgment.

Who has data the public does not?

Regulators, exchanges, FINRA, broker-dealers, and law-enforcement agencies can see data that ordinary readers cannot. That includes customer account details, order-routing records, option and equity audit trails, firm communications, and cross-market patterns. SEC MIDAS describes a market-structure analytics system used for empirical market analysis, forensic work, and monitoring.

The public layer is narrower. It includes issuer news, EDGAR filings, Form 4 reports, price and volume data, court records, and company disclosures. Those sources are enough to build a serious research screen. They are not enough to claim that a named person traded on material nonpublic information unless the claim is already supported by an official complaint, order, indictment, or admission.

How do Form 4 filings help detection?

Form 4 filings help by showing what officers, directors, and certain 10 percent owners disclosed after transactions in their company's securities. SEC Section 16 guidance says those insiders report most company-stock transactions within two business days on Forms 3, 4, or 5. The SEC Insider Transactions Data Sets are extracted from the XML-based fillable portions of those forms.

For detection work, the useful Form 4 fields are concrete:

As of August 7, 2026, Arkolith production tracked 2,839,368 total Form 4 transaction rows, of which 2,794,467 were non-superseded current rows after amendment handling. The open-market signal subset contained 175,784 purchase rows and 608,301 sale rows. That split matters because awards and option exercises can swamp raw filing volume if they are treated as conviction trades.

Use Form 4 transaction codes, Form 4 derivative versus non-derivative tables, and 10b5-1 trading plans before reading any single transaction as a signal.

What can a public-record screen catch?

A public-record screen can catch disclosed patterns that deserve a second look. It can ask whether insiders bought shortly before good news, sold heavily before bad news, clustered in one company, repeated a behavior across several events, or filed amendments that changed the economic meaning of a prior disclosure.

The screen below is deliberately public-record only:

The strongest public output is a review queue, not an accusation. A good queue says: here is the trade, here is the source filing, here is the event, here is the timing gap, and here is what remains unknown. For the signal side of that queue, use insider buying versus selling as the interpretation boundary.

How can an analyst or agent reproduce the screen?

Start with one issuer and one event. Pull the event date, then scan public Form 4 rows before and after that date. Filter to open-market transaction codes first. Keep the source accession next to every row.

# Resolve the ticker first
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://arkolith.com/api/v1/search?q=NVDA"

# Pull insider transactions for the ticker
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://arkolith.com/api/v1/insider/transactions?ticker=NVDA"

# Compare the same public-record context with institutional movement
curl -H "Authorization: Bearer YOUR_API_KEY" \
  "https://arkolith.com/api/v1/stocks/NVDA/capital-change-brief"

For a human route, browse the Arkolith Form 4 data layer, insider activity by ticker, or how to track insider transactions. For an agent route, start at /connect and use MCP when the workflow needs tool calls with source evidence attached. If the job is API selection rather than detection logic, use the insider trading data API guide.

What should you not claim from Form 4 data?

Do not claim that a disclosed Form 4 transaction is illegal. Form 4s are public reports of trades and ownership changes by insiders. Many are routine compensation, tax withholding, option exercises, gifts, planned sales, or ordinary diversification.

Also do not treat sales and purchases symmetrically. A purchase with personal cash can be more interpretable than a sale, but neither proves motive. A sale can be planned, tax-driven, liquidity-driven, or part of compensation mechanics. The safer language is "this transaction is worth reviewing" or "this cluster strengthens the public-record signal," not "this proves insider trading."

The public screen becomes useful when it is specific and falsifiable: name the issuer, insider, transaction code, transaction date, event date, accession, and the boundary around what is still unknown.

Frequently asked questions about insider-trading detection

Can the public detect insider trading?

The public can detect suspicious public-record patterns, especially around Form 4 filings and event timing. The public usually cannot prove illegal insider trading without official records or investigative evidence.

Does every Form 4 mean insider trading?

No. Form 4 is the disclosure form for many insider transactions and ownership changes. It includes lawful open-market trades, awards, option exercises, gifts, tax withholding, and planned sales.

What is the fastest public insider signal?

Form 4 is usually the fastest public ownership signal because most covered insider transactions must be reported within two business days. That does not make the transaction illegal or predictive by itself.

Why do options matter in detection?

Options can create large event exposure with less upfront cash, so regulators and surveillance teams watch option activity around material events. Public Form 4 data can show insider derivative activity, but market-wide option surveillance needs nonpublic trading data.

What is a good first screen?

Pick one issuer, one event date, and a 30 to 90 day window. Filter Form 4 rows to open-market codes, keep source accessions, and separate purchases, sales, planned sales, awards, and derivative events before drawing any conclusion.

This article explains public filings, market-surveillance concepts, and data workflows. It is not investment advice, legal advice, tax advice, or an allegation about any person or company.