Market Abuse (MAR) and STORs Explained: A Practical UK Guide

What UK MAR is and why it matters

UK MAR is retained EU law based on Regulation 596/2014. The original European regulation came into effect on 3 July 2016 and was onshored into UK law on 31 December 2020. Its purpose, in the FCA's words, is to strengthen market integrity and protect investors. It applies to financial instruments admitted to trading, or for which a request for admission has been made, on UK regulated markets, multilateral trading facilities and organised trading facilities, and it reaches related instruments whose price or value depends on those.

The regime does two things at once. It prohibits the behaviours that damage markets, and it imposes obligations to prevent and detect them. Those obligations fall on issuers, on UK trading venues, on firms professionally arranging or executing transactions, and on UK emission allowance market participants. In practice this means the same piece of legislation governs both the person tempted to misuse information and the firm expected to catch them.

The consequences are serious. The FCA can pursue civil enforcement under UK MAR, and a separate criminal regime sits alongside it. The FCA states that criminal sanctions for insider dealing and market manipulation can incur custodial sentences of up to 10 years and unlimited fines. Preventing and detecting market abuse also supports the FCA's own statutory objectives of protecting consumers, enhancing market integrity and promoting competition, which is why the regulator treats surveillance failings so seriously.

The three prohibited behaviours

UK MAR prohibits three main behaviours, and understanding the distinction between them matters because your surveillance and your STOR narrative need to name the right one. The first is insider dealing. Under Article 8, this arises where a person possesses inside information and uses it by acquiring or disposing of, for their own account or for the account of a third party, directly or indirectly, financial instruments to which that information relates. It also captures cancelling or amending an order that was placed before the person held the information, and recommending or inducing another person to deal.

The second is unlawful disclosure of inside information. Under Article 10, this occurs where a person who possesses inside information discloses it to any other person, except where the disclosure is made in the normal exercise of an employment, a profession or duties. This is the behaviour that catches a careless conversation, a leaked deal, or a tip passed to a friend, whether or not any trading follows and whether the disclosure was deliberate or negligent.

The third is market manipulation. Under Article 12, this covers transactions or orders that give, or are likely to give, false or misleading signals as to the supply of, demand for or price of a financial instrument, conduct that secures the price at an abnormal or artificial level, transactions employing a fictitious device or any other form of deception or contrivance, and the dissemination of false or misleading information. UK MAR also captures attempted manipulation and, in some situations, benchmarks and spot commodity contracts.

The table below summarises the three behaviours with a plain example of each. These examples are illustrative of the categories rather than descriptions of specific cases.

What counts as inside information

Inside information is the concept that ties the whole regime together, and it is defined narrowly in Article 7. It is information of a precise nature which has not been made public, relating directly or indirectly to one or more issuers or to one or more financial instruments, and which, if it were made public, would be likely to have a significant effect on the prices of those financial instruments or of related derivative financial instruments. Each limb has to be satisfied for information to qualify.

The FCA guidance breaks this down into practical tests. Information is not public if it has not already been disclosed through a regulatory information service, the press, a website or other public means. Information is precise if it indicates a set of circumstances which exist or which may reasonably be expected to come into existence. And the price test is met where a reasonable investor would be likely to use the information as part of the basis of their investment decisions. Precision does not require certainty; a set of circumstances that may reasonably be expected to arise can still be precise.

For compliance teams the practical work is identifying inside information early, controlling who has access to it through insider lists and information barriers, and disclosing it correctly when the time comes. Get the identification wrong and everything downstream fails, because you cannot police the use of information you have not recognised as sensitive in the first place. This is where a strong control framework earns its keep, and where a platform such as Nasara Connect's control module helps firms keep insider lists, access controls and disclosure decisions documented and auditable.

The STOR obligation: who must report and when

UK MAR does not just prohibit bad behaviour; it requires the market to help detect it. UK trading venues and firms who are persons professionally arranging or executing transactions must detect and report suspicious transactions and orders to the FCA without delay via STORs. The duty attaches where the venue or firm is registered or has its head office in the UK, or, in the case of a branch, where the branch is situated in the UK.

The trigger is a reasonable grounds standard, not proof. A suspicious transaction or order is one where there are reasonable grounds to suspect it might constitute market abuse, such as insider dealing or market manipulation. A firm does not need to be certain, and it is not expected to run its own investigation to establish guilt before it reports. The obligation is to report the suspicion without delay, and importantly the requirement covers both executed transactions and orders, including orders that are placed and then cancelled or amended.

To meet this obligation firms are expected to have effective arrangements, systems and procedures to detect suspicious activity and to make sure that staff, particularly those managing financial crime risks, are trained to recognise it. Automated surveillance is common, but the human judgement that turns an alert into a decision to report remains central. Where a firm concludes there are reasonable grounds for suspicion, it moves to the reporting step described below.

The steps for submitting a STOR to the FCA are set out here in outline. They should be read alongside the FCA's own guidance and your firm's surveillance procedures.

What the STOR numbers show

The FCA publishes the number of STORs it receives each year, and the figures show both the scale of reporting and where suspicion concentrates. In 2022 the FCA received 4,008 STORs. In 2023 the total rose to 4,375. In 2024 it reached 4,528, of which 3,945 related to insider dealing, 581 to market manipulation and 2 to other categories. In 2025 the total was 3,806, split as 3,124 insider dealing, 679 market manipulation and 3 other.

Two patterns stand out. First, insider dealing dominates the reporting mix every year, consistently accounting for the large majority of STORs, with market manipulation a smaller but persistent share. Second, the FCA leans heavily on this pipeline: in a speech on 28 April 2025 the regulator said that over 70% of its current market abuse investigations originate from a STOR. That single statistic explains why the FCA treats surveillance and reporting failings as a supervisory priority rather than a box ticking exercise.

The chart below shows the total number of STORs received by the FCA over four calendar years. Firms should read the trend with care, because reporting volumes reflect market conditions and detection capability as well as the underlying level of suspicious activity.

Building a proportionate control framework

Compliance with UK MAR is not achieved by policy alone. It rests on a chain of controls that starts with identifying inside information and ends with a well evidenced STOR or a documented decision not to report. The intensity of that framework should be proportionate to the firm's role in the market. A trading venue and an interdealer broker will need far more surveillance capability than a firm whose exposure to relevant instruments is limited, but the underlying logic is the same for all: recognise sensitive information, control access to it, monitor for misuse, and report suspicion promptly.

The practical building blocks are familiar. Maintain accurate insider lists and information barriers so you know who holds what. Run surveillance that covers both transactions and orders, including cancelled and amended orders, because manipulation often lives in the order book rather than in executed trades. Train front office and control staff to recognise the warning signs, since detection depends on people as much as on systems. And keep records that let you demonstrate to the FCA how a suspicion was assessed and why a report was or was not made.

Firms preparing for authorisation or expanding into new markets should build these controls in from the start rather than bolting them on later. A structured approach to policies, surveillance and reporting, supported by tooling that keeps the audit trail intact, turns UK MAR from a source of anxiety into a demonstrable strength. If you are scoping the controls needed for a new permission, our authorisation support helps map the market abuse obligations that will apply to your business model.

Conclusion

The market abuse regulation frames market integrity as a shared responsibility. UK MAR prohibits insider dealing, unlawful disclosure of inside information and market manipulation, and it hangs those prohibitions on a precise definition of inside information. But the regime only works because the firms closest to trading are required to look for suspicious activity and to report it. The STOR is the mechanism that carries that intelligence to the FCA, and the numbers make its importance plain: the regulator says over 70% of its current market abuse investigations begin with one.

For compliance teams the takeaways are concrete. Know how to identify inside information, understand which of the three behaviours a given scenario engages, and be clear on the reasonable grounds standard that triggers a STOR submitted without delay through Connect. Build proportionate surveillance, train your people, and keep the audit trail that proves your judgement. Do that, and you protect your firm, your permissions and the wider market that depends on everyone playing by the same rules.

Frequently asked questions