FINRA and SEC Surveillance Obligations and Insider Risk Program Alignment
Regulators expect insider risk controls to work as compliance controls, not just policies on paper.
The regulatory framework governing insider risk at broker-dealers and investment advisers names specific rules and assigns specific duties. The 2026 FINRA Annual Regulatory Oversight Report makes clear that examiners will look for evidence that controls actually run, not just that a policy document describes them. FINRA Rule 3110 requires firms to maintain a process to review transactions "reasonably designed" to identify trades that may violate Exchange Act or FINRA rules prohibiting insider trading or manipulation, and to promptly conduct an internal investigation once a trade raises that possibility. The word "promptly" sets a timing standard, not a suggestion, and it shapes much of what follows in this piece.
On the data side, the Regulation S-P amendments add a matching duty. Covered institutions, meaning brokers, dealers, investment companies, and registered investment advisers, must develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. If you ran a larger entity, you had to comply by December 3, 2025; smaller entities get until June 3, 2026. The 2026 Report names a cluster of rules that insider threats can put a firm out of compliance with: Exchange Act Rules 17a-3 and 17a-4 governing books and records, FINRA Rules 3110 and 4370 covering supervision and business continuity, and Regulation S-ID addressing identity theft red flags.
The Report's definition of insider threat matters as much as the rule list. FINRA defines insider threats as incidents involving firm employees who purposely or inadvertently use their access to firms' systems to cause harm to firms and their customers. Regulators treat negligent conduct the same as malicious conduct, so a careless email forward and a calculated data theft can trigger the same compliance exposure. The SEC's own examination priorities for 2026 track closely with FINRA's, and because the timing and content overlap between the two agencies' documents, this looks like a coordinated set of exam themes, not separate, unrelated notices.
FINRA Frames Insider Threat as an Operational Compliance Risk
FINRA's 2026 Report treats insider threats as a direct route to violating the rules a firm is already examined on. An insider risk program sits inside the compliance program itself, built from the same obligations that govern supervision, books and records, and privacy. The Report states outright that insider threats may compromise a firm's ability to comply with Reg S-P Rule 30, FINRA Rules 3110, 3120, and 4370, and Exchange Act Rules 17a-3 and 17a-4. That list functions as a table of contents for what an insider risk program has to cover.
FINRA places insider threats inside the broader cybersecurity and cyber-enabled fraud section of the Report, next to ransomware, system breaches, social engineering, new account fraud, and account takeovers. The placement carries a specific expectation: FINRA wants firms to apply the same supervisory rigor to a trusted employee's conduct that they apply to an external attacker's. The Cyber & Operational Resilience program, known as CORE and launched as part of FINRA Forward, identifies, assesses, and shares cyber and technology risk intelligence directly with firms that could be affected. FINRA has built its own detection infrastructure for threats across the industry, and it expects firms to build something like it internally.
One way to read the 2026 Report's intent is that market abuse risk runs through three linked functions: supervision, workflow, and escalation. A surveillance system that only produces alerts has done a fraction of the job. A program that satisfies the standard shows why a given alert fired, what an analyst reviewed in response, what decision got made, and how that decision was recorded and retained. Insider risk controls, under this framing, work as compliance controls, and examiners will treat them that way.
Enforcement Actions and the Actual Exposure Points
Recent SEC enforcement actions lay out patterns that keep recurring, and any insider risk program needs to catch them, because each pattern hides a gap that policy language alone cannot close.
In the first pattern, a departing employee moves customer data out the door. In a September 2025 SEC action, a former investment adviser allegedly directed the unauthorized transfer of his employer's clients' nonpublic personal information to his personal email and to his future business partner, and the SEC held this up as aiding and abetting his firm's Regulation S-P violation. A separate September 2025 complaint described a defendant who misappropriated clients' NPI, including names, contact details, account balances, and fees, emailing the data to himself and to a future business partner starting as early as spring 2023. In both cases, the data moved through channels the employee was authorized to use, email and a personal account, before anyone recognized the risk. If a system only catches blocked exfiltration attempts, it would have missed both.
In a second pattern, an employee trades on information the role legitimately gave access to. On September 5, 2025, the SEC filed and settled insider trading charges against Ryan Squillante, former Head of Equity Trading at an investment firm, who allegedly used material nonpublic information to short the stock of at least ten public companies after learning of upcoming secondary offerings through his job. The trades generated substantial profits. The exposure here was not a system break-in. It was authorized access to information the role touched every day, combined with outside trading activity, and catching it requires connecting what someone saw internally to what they did in the market.
A third pattern involves unauthorized reach inside an authorized environment. On May 6, 2026, the SEC charged 21 individuals in a scheme that ran a decade. Nicolo Nourafchan, an M&A attorney, allegedly accessed confidential deal files at his firms, including draft merger agreements, signing checklists, and board presentations, even on matters he was not staffed to work on. He misappropriated material nonpublic information from more than twelve pending corporate transactions between 2018 and 2024. Nourafchan was otherwise permitted to use that system, so the file access itself is exactly the kind of lateral reach a well-scoped data access monitoring program would flag as unusual.
A fourth pattern extends the definition of "insider" past a firm's own payroll, to a third-party data processor trading on client filings it was entrusted to handle. Across all four patterns, the risk appeared in authorized access paired with behavior that didn't fit the access, not through a breach that a perimeter control would have stopped.
Where FINRA keeps finding the same operational gaps in surveillance programs
FINRA's own examination findings point to systems that exist but are tuned poorly, staffed thinly, or cut off from the investigation workflow the rules demand. The gap is rarely that a firm has no surveillance system at all.
On market manipulation surveillance, the 2026 Report documents firms that fail to build systems able to catch a range of manipulative trading schemes, that set surveillance thresholds poorly or without tailoring them to the securities or account types they actually use, and that never go back to revisit those thresholds as business or market conditions shift. The Report also finds that thin staffing or inadequate training delays alert review, and that firms fail to document what their review actually found. On the anti-money-laundering side, the Report cites under-resourced programs directly: staffing and resources that don't keep pace with business expansion or with new threats as they emerge.
Third-party risk compounds these gaps. The 2026 Report notes that a single incident at a critical service provider can touch large segments of the industry, and it holds firms to a supervisory standard covering all outsourced activities, not just internal operations. The third-party data processor pattern described above is the enforcement expression of that same finding.
FINRA's standard runs on three steps: detect, investigate, document. An alert fires, an analyst reviews it, a decision gets made and recorded. Most of the deficiencies FINRA actually cites live in the second and third steps. Firms generally have something that detects. Far fewer can show a clean, documented trail proving that detection led to a timely, recorded decision.
The Alert Volume Problem as a Regulatory Compliance Problem
When a surveillance system produces more alerts than a team can realistically review, the duty to "promptly" investigate suspicious activity stops being achievable through manual effort alone. Alert volume is a compliance risk in its own right, not just a workload complaint.
The industry's average Mean Time to Conclusion, the span from initial detection through final resolution of an alert, stretches to many months at many firms. Rule 3110's "promptly conduct an internal investigation" standard makes a long MTTC a rule violation. The mechanism behind that delay runs through false positives: when most alerts turn out to be nothing, analysts learn to treat the alert queue as noise, and the documented result is teams that later admit they dismissed an alert that turned out to matter. That pattern traces straight back to the poorly calibrated thresholds FINRA's own findings describe.
Thin staffing, which FINRA cites directly in its AML findings, explains part of the slowdown. It doesn't explain all of it. Static-rules systems generate alert volumes that no realistic staffing level can absorb when the underlying rules aren't tuned to the specific securities and account types a firm actually handles. You can add enough analysts, but the backlog still grows, because the rules keep firing on the same false signals regardless of headcount. A mature security operations center targets a short Mean Time to Triage for its highest-priority alerts, and that benchmark gives compliance programs a concrete, internal definition of what "promptly" has to mean in practice: high alert volume, combined with a low rate of real investigation and a slow time to resolution, adds up to direct exposure under Rule 3110.
Why static-rules DLP cannot satisfy a regulatory standard that requires behavioral understanding
FINRA's standard calls for surveillance calibrated to the specific securities and account types a firm actually has, reassessed as conditions change, so that it produces alerts a team can promptly investigate and document. That is a behavioral standard, built around what counts as normal for a given person, with a given piece of data, in a given context. Static-rules DLP cannot meet it, because of how that kind of system is built.
Traditional DLP works through predefined rules, regular expressions, and keyword matching to spot sensitive data. Those methods catch structured data well, things like credit card numbers or Social Security numbers that follow a fixed format. They miss data that is sensitive because of its context. Static rules are also straightforward to route around: change a data format slightly, swap in a synonym, and the rule simply doesn't fire, leaving a gap a determined insider can walk through without tripping anything. A rule built to block any email containing a credit card number will flood a compliance team with alerts over entirely legitimate business activity, while missing the Nourafchan pattern entirely: a draft merger agreement carries no credit card number, no Social Security number, no string that any predefined rule was built to catch.
Behavioral and AI-driven detection starts from a different question. Instead of asking whether a piece of data matches a predefined pattern, it asks whether a given action is normal for that user, with that data, in that context, at that time. That shift, from matching patterns to inferring behavior, makes it possible to calibrate detection to a firm's actual population of securities and account types, which is what FINRA's examiners have been asking for. A program built on that kind of inference can show an examiner why an alert fired, what was reviewed, and what decision got made and documented, which is the closed loop the 2026 Report describes and the standard that static rules were never built to satisfy.
