A Suspicious Transaction and Order Report (STOR) is the formal report made to the relevant market authority when a firm or trading venue has a reasonable suspicion that an order, transaction, or related behavior could amount to market abuse, including attempted market abuse. ESMA’s materials describe a STOR as the report submitted to national competent authorities under Article 16 of the Market Abuse Regulation (MAR), and the FCA says firms and trading venues must detect and report suspicious transactions and orders to it without delay via STORs.
Key Takeaways
- STORs Are Formal Reports of Suspected Market Abuse
- STORs Cover Suspicious Transactions and Orders
- Attempted Market Abuse Can Also Trigger STOR Consideration
- Insider Dealing Is a Core STOR Typology
- Market Manipulation Is a Core STOR Typology
- Unlawful Disclosure of Inside Information Can Be Relevant to STOR Reporting
- Spoofing and Layering Can Generate STOR Escalations
- Front Running Can Create STOR Reporting Risk
- Marking the Close Can Trigger Market Abuse Suspicion
- Suspicion Rather Than Proof Is the Relevant Reporting Threshold
- Firms Must Maintain Effective Arrangements to Detect Suspicious Orders and Transactions
- Trading Venues Can Also Have STOR Reporting Obligations
- STORs Connect Internal Surveillance With Regulatory Enforcement
- Trade Surveillance Is a Primary Source of STOR Cases
- Communications Surveillance Can Provide Evidence of Intent and Coordination
- Order Data Can Be as Important as Executed Trade Data
- STOR Reporting Is Distinct From AML SAR or STR Reporting
- Confidentiality Is Critical After a STOR Has Been Submitted
- Timely Escalation Is Fundamental to Effective STOR Governance
- Effective STOR Frameworks Require Detection, Investigation, Judgement and Reporting Working Together
In the financial crime environment, STORs matter because they are the market-abuse equivalent of a formal suspicious-activity escalation. They connect private-sector detection — by brokers, investment firms, and trading venues — to public-sector supervision and enforcement. The FCA’s current reporting page explains that STORs are used to report suspected market abuse, and its April 2025 speech says STORs are an especially effective way firms can help the FCA combat market abuse.
From a professional perspective, a STOR is not a general AML filing. It is specific to market abuse under MAR and UK MAR. That means it is concerned with behavior such as insider dealing, unlawful disclosure of inside information, and market manipulation, rather than suspicious customer activity in the broader AML sense. The FCA’s Market Abuse Regulation page places STORs squarely within the MAR framework, and ESMA’s reporting materials do the same.
Watch on YouTube: Suspicious Transaction and Order Report (STOR)
A key point is that the reporting obligation is tied to suspicion, not proof. Firms are not expected to complete a full enforcement case before reporting. Under Article 16 MAR, persons professionally arranging or executing transactions must have effective arrangements, systems, and procedures to detect and report suspicious orders and transactions. ESMA’s 2022 report on emission allowances restates that these firms must actively monitor, detect, and report suspicious orders and transactions where they have a reasonable suspicion.
This is why STORs sit at the center of market surveillance and market-conduct governance. A firm needs more than just a reporting form. It needs effective surveillance, escalation routes, skilled review, and a decision process for determining when suspicion has reached the point that a STOR should be filed. The FCA’s Market Watch 79 says firms must have effective arrangements, systems, and procedures to detect and report suspicious activity, proportionate to the scale, size, and nature of their business.
In practical terms, a STOR may arise from suspicious trading ahead of an announcement, possible spoofing or layering, unusual order behavior, front running, possible insider dealing, or other patterns suggesting manipulation or misuse of inside information. The exact typology varies, but the control principle is the same: if the order or transaction behavior appears suspicious in the context of MAR, the firm must assess whether a STOR is required. This is an inference supported by the MAR framework and the FCA’s market-abuse reporting guidance.
A mature STOR framework also requires proper confidentiality and governance. FCA guidance has noted that firms need procedures to ensure that the subject of a STOR is not informed of the report, which reflects the seriousness of the reporting process and the need to preserve the integrity of any regulatory follow-up.
STOR reporting remains a live operational obligation. The FCA updated its “How to report suspected market abuse as a firm or trading venue” page on 26 February 2026, and it published a new Connect submission guide for STORs in March 2026, showing that the process continues to be actively maintained rather than treated as a legacy requirement.
What Financial Institutions Should Consider
- Maintain a Comprehensive Market Abuse Risk Assessment
- Establish Clear STOR Escalation Procedures
- Define Consistent Suspicion Thresholds
- Monitor Both Orders and Executed Transactions
- Maintain Effective Insider Dealing Surveillance
- Detect Spoofing and Layering Patterns
- Monitor Front-Running Indicators
- Monitor Trading Around Material Corporate Events
- Strengthen End-of-Day Manipulation Surveillance
- Integrate Trade and Communications Surveillance
- Analyse Order Modifications and Cancellations
- Correlate Trading With Restricted and Insider Lists
- Provide Investigators With Sufficient Market Context
- Document Decisions to File or Not File a STOR
- Submit Required STORs Without Undue Delay
- Protect STOR Confidentiality
- Maintain Complete Investigation and Decision Audit Trails
- Feed STOR Outcomes Back Into Surveillance Calibration
- Conduct Regular STOR Process Effectiveness Testing
- Treat STOR Reporting as a Core Market Integrity Control
Ultimately, a Suspicious Transaction and Order Report is a core reporting tool in the financial crime environment because it enables firms and trading venues to escalate possible market abuse to the regulator quickly and formally. It is the bridge between internal market surveillance and public enforcement, and it plays a central role in protecting market integrity under the MAR framework.
