Insider trading cases are built on circumstantial evidence assembled into a pattern that is difficult to explain away. Direct evidence — a recording of someone saying "I have inside information and I am going to trade on it" — is rare. What the SEC actually works with is a combination of trading data, communications records, relationship analysis, and timing that, taken together, tells a story that is hard to explain as coincidence.
After nine years in the SEC's Division of Enforcement, I know exactly how that pattern is assembled. I know what evidence the agency collects, how it is analyzed, and what makes the difference between a case that results in prosecution and one that is closed. That knowledge shapes how I advise clients who are the subject of insider trading inquiries, and it shapes how I think about the disclosure obligations of public companies and their insiders.
The Legal Framework: What the SEC Must Prove
Insider trading is not defined in a single statute. The prohibition against insider trading has been developed through SEC enforcement actions and court decisions interpreting Section 10(b) of the Securities Exchange Act of 1934 and Rule 10b-5 promulgated thereunder. The basic prohibition is against trading in securities while in possession of material nonpublic information in breach of a duty of trust or confidence.
The elements that the SEC must prove in an insider trading case are: that the defendant traded in securities; that at the time of trading, the defendant possessed material nonpublic information; that the information was material — meaning that a reasonable investor would consider it important in making an investment decision; that the information was nonpublic — meaning that it had not been disclosed to the general public; and that the defendant traded in breach of a duty of trust or confidence owed to the source of the information.
The duty element is where insider trading law is most complex. The classical theory of insider trading applies to corporate insiders — officers, directors, and employees — who trade in their company's securities while in possession of material nonpublic information. The misappropriation theory applies to outsiders who trade on information that they have obtained in breach of a duty owed to the source of the information — for example, a lawyer who trades on information obtained from a client, or a financial analyst who trades on information obtained from a company in the course of a legitimate business relationship.
The tipping liability theory extends insider trading liability to people who receive material nonpublic information from an insider (tippees) when the insider breached a duty by disclosing the information and the tippee knew or should have known that the information was disclosed in breach of a duty.
How the Investigation Actually Begins
Most insider trading investigations begin with a trading anomaly identified by the SEC's surveillance systems. The systems monitor trading activity across all exchanges and OTC markets and flag statistical deviations — trades that cluster in the days before a material announcement, options activity that is inconsistent with normal volume patterns, accounts that have no prior history of trading a particular security suddenly taking large positions.
The algorithm generates an alert. An enforcement attorney reviews the alert and asks the initial question: is there a plausible innocent explanation for this trading pattern, or does it suggest access to material nonpublic information? If the trading occurred in the days before a significant announcement — an earnings release, a merger announcement, a regulatory approval — and the timing and size of the trades are inconsistent with the trader's normal pattern, the enforcement attorney opens an inquiry.
The inquiry begins with a review of publicly available information about the trader and the company. The enforcement attorney looks at the trader's prior trading history in the security, the trader's relationship to the company and its insiders, and the nature of the announcement that followed the trading. If the publicly available information does not provide an innocent explanation for the trading pattern, the inquiry escalates to a formal investigation.
The Evidence Collection Process
A formal insider trading investigation involves the collection of evidence from multiple sources. The enforcement team issues subpoenas to brokerage firms for trading records, to telecommunications companies for phone records, and to the company and its advisors for documents relating to the material nonpublic information.
The trading records are the foundation of the case. They show exactly when the trades were made, how much was traded, and the prices at which the trades were executed. They also show the account history — whether the trader has previously traded in this security, whether the size of the trades is consistent with the trader's normal pattern, and whether the trades were made in a single account or spread across multiple accounts.
The phone records are often the most important evidence. They show communications between the trader and potential sources of material nonpublic information in the period before the trading. A phone call from a corporate insider to a trader on the day before a merger announcement is not proof of insider trading, but it is evidence that requires explanation. A series of phone calls between the insider and the trader in the weeks before the announcement, combined with trading activity that begins immediately after one of those calls, is much more difficult to explain.
The documents relating to the material nonpublic information establish what the information was, when it became material, and who had access to it. In a merger case, these documents include the merger agreement, the board presentations, the due diligence materials, and the communications among the deal team. The enforcement team traces the flow of information from its source through the organization to identify everyone who had access to it before it was publicly disclosed.
The Relationship Analysis
One of the most important analytical tools in an insider trading investigation is relationship analysis — mapping the connections between the trader and potential sources of material nonpublic information. The enforcement team builds a network diagram showing the trader's relationships with corporate insiders, investment bankers, lawyers, accountants, and other people who might have had access to the material nonpublic information.
The relationship analysis is not limited to direct relationships. The enforcement team also looks at second-degree relationships — connections between the trader and people who are connected to the source of the information. A trader who has no direct relationship with a corporate insider may have a relationship with the insider's lawyer, or with a financial advisor who is advising the company on the transaction.
The relationship analysis is combined with the timing analysis to identify the most likely source of the information. If the trader made his trades immediately after a phone call with a person who had access to the material nonpublic information, and the trader has no other plausible explanation for the timing of the trades, the enforcement team has identified the likely source and can focus its investigation on that relationship.
The Tipping Chain: How Liability Extends
One of the most important developments in insider trading law in recent years is the expansion of tipping liability. The Supreme Court's decision in Salman v. United States confirmed that a tippee can be liable for insider trading even if the tipper received no financial benefit from the tip, as long as the tipper made a gift of the information to a trading relative or friend.
The practical implication of this expansion is that insider trading liability can extend far from the original source of the information. A corporate insider who tells his brother about an upcoming merger announcement, without receiving any financial benefit, has breached his duty. The brother who trades on that information is liable as a tippee. If the brother tells a friend, and the friend trades, the friend may also be liable — if the friend knew or should have known that the information was disclosed in breach of a duty.
The enforcement team traces these tipping chains carefully. In complex cases, the chain may extend through three or four levels of tippees before reaching the trader who actually made the profitable trades. Each link in the chain must be established through evidence — communications records, relationship analysis, and trading data — but the enforcement team has the tools to trace these chains with considerable precision.
What Makes a Case Prosecutable
Not every insider trading investigation results in an enforcement action. Many investigations are closed when the enforcement team concludes that the trading pattern has an innocent explanation, or that the evidence is insufficient to establish the required elements of the violation. Understanding what makes a case prosecutable — what evidence the enforcement team needs before it will bring an action — is important for anyone who is the subject of an insider trading inquiry.
The most important factor is the timing of the trades relative to the announcement. Trades that are made in the days immediately before a significant announcement, by someone who had access to information about that announcement, are the clearest cases. The closer the timing, the stronger the inference that the trading was based on the information.
The second factor is the size and nature of the trades. A trader who makes a single, unusually large trade in a security he has never traded before, immediately before a significant announcement, presents a much stronger case than a trader who makes a series of small trades in a security he trades regularly. Options trades — particularly out-of-the-money options that would only be profitable if a significant announcement occurred — are particularly strong evidence because they suggest that the trader knew not just that something was going to happen, but approximately what it was.
The third factor is the quality of the relationship evidence. A phone call between the trader and a corporate insider on the day of the trade is strong evidence. A documented pattern of communications between the trader and the insider in the period leading up to the announcement is even stronger. The absence of any plausible innocent explanation for the relationship between the trader and the source of the information — no prior business relationship, no family connection, no social context — makes the trading pattern more difficult to explain.
The fourth factor is the trader's explanation. When the enforcement team interviews the trader — either voluntarily or through a formal investigative order — the trader's explanation for the trading is critical. An explanation that is consistent with the evidence and that provides a plausible innocent reason for the timing and size of the trades can be the difference between a case that is closed and one that is brought. An explanation that is inconsistent with the evidence, that changes over time, or that the trader cannot support with documentation is itself evidence of guilt.
The Practical Implications for Corporate Insiders and Their Advisors
The practical implications of everything I have described are straightforward. Corporate insiders — officers, directors, and employees with access to material nonpublic information — must understand that their trading activity is monitored continuously and that any trading pattern that is inconsistent with their normal activity will attract attention.
The most effective protection against insider trading liability is a robust insider trading compliance program that includes pre-clearance requirements for trades by insiders, blackout periods around earnings releases and other significant announcements, and Rule 10b5-1 trading plans that establish a predetermined trading schedule before the insider comes into possession of material nonpublic information.
But compliance programs are only effective if they are followed. An insider who circumvents the pre-clearance requirement, who trades during a blackout period, or who establishes a Rule 10b5-1 plan while in possession of material nonpublic information has not protected himself — he has created additional evidence of intent that the enforcement team will use against him.
The most important advice I give to corporate insiders is this: if you are uncertain whether information is material and nonpublic, assume that it is. The cost of not trading when you could have is trivial compared to the cost of trading when you should not have.
Frederick M. Lehrer served as an enforcement attorney in the SEC's Division of Enforcement at the Southeast Regional Office from 1991 through 2000, and concurrently as a Special Assistant United States Attorney in the Southern District of Florida from 1997 through 1999, prosecuting securities-related financial crimes. He has practiced securities and corporate law in private practice for more than twenty-five years, advising issuers worldwide on SEC registration, disclosure obligations, Regulation D private placements, Regulation A offerings, and going public transactions. The firm is based in Florida and serves clients internationally.