9.1 Insider Trading Law and Enforcement Mechanics
Insider trading means trading on important information that the public doesn’t have, called material non-public information, in breach of a duty. An insider owes that duty to shareholders; an outsider can owe it to whoever gave them the information. A tippee, the person who receives the tip, is liable when the tipper shared it for a personal benefit, and a gift to a friend or relative counts. Civil penalties can reach three times the profit, on top of giving back the gains.
Why it matters: Passing a tip to a friend can be as risky as trading on it yourself.
Summary: Insider trading is trading on material non-public information (MNPI) in breach of a duty, either an insider’s duty to shareholders or an outsider’s duty to the source of the information. A tippee is liable when the tipper disclosed for a personal benefit, which a gift to a friend or relative satisfies, and the civil penalty can reach three times the profit on top of disgorgement.
- US law rests on Rule 10b-5 and two theories: classical (insiders) and misappropriation (outsiders, O’Hagan, 1997).
- A $40,000 options bet on a tip can make $635,000 and carry a civil exposure of $2.54 million (disgorgement plus three times the profit).
- Criminal penalties reach 20 years and $5 million for individuals (15 U.S.C. §78ff).
- Rule 10b5-1 plans now need a 90-to-120-day cooling-off for directors and officers, 30 days for others.
- Trading a comparable company on your employer’s secrets (“shadow trading”) was found liable in SEC v. Panuwat (2024).
Insider trading is trading a security based on material non-public information (MNPI) — information significant enough to affect a reasonable investor’s decision, and not yet available to the public market. The prohibition reaches well beyond company insiders.
In the US no statute defines the offense; courts built it from Section 10(b) of the Securities Exchange Act and SEC Rule 10b-5 on two theories. Under the classical theory, an insider who trades breaches a duty to the company’s shareholders. Under the misappropriation theory, an outsider breaches a duty to the source of the information: a law-firm partner who bought Pillsbury options while his firm advised the bidder, and made over $4.3 million, was convicted on that basis (United States v. O’Hagan, 1997). A tippee (the person who receives a tip) is liable when the tipper disclosed for a personal benefit and the tippee knew or should have known it; a gift of information to a trading relative or friend counts as that benefit (Dirks v. SEC, 1983; Salman v. United States, 2016).
Enforcement relies heavily on trading surveillance: regulators and exchanges run automated systems flagging unusual trading activity immediately ahead of major public announcements — an unexplained spike in options volume the day before an M&A deal is announced is a classic, frequently investigated pattern. Once flagged, investigators build a case using trading records, phone and message records, and known relationships between the trader and the company, since MNPI cases are rarely proven by a single piece of direct evidence alone.
Suppose a target trades at $40.00, a $60 cash offer is coming, and the stock opens at $58.50 on the announcement. A tippee who buys 10,000 shares makes 10,000 × (58.50 − 40.00) = $185,000, a 46% return. One who instead buys 500 call contracts struck at $45 for $0.80 pays 500 × 100 × 0.80 = $40,000; on announcement each call is worth at least 58.50 − 45 = $13.50, so the position is worth 500 × 100 × 13.50 = $675,000, a profit of $635,000, or 15.9 times the stake. Out-of-the-money calls bought days before a deal are the cheapest leverage on the secret, which is why unusual options volume is a classic surveillance flag.
The law prices that leverage back. Beyond giving up the profit (disgorgement), a court may impose a civil penalty of up to three times the profit gained or loss avoided (15 U.S.C. §78u-1), so the options trade carries a civil exposure of up to 635,000 × 4 = $2.54 million, 63.5 times the $40,000 put at risk. Willful violations are crimes punishable by up to 20 years in prison and a $5 million fine for individuals, $25 million for firms (15 U.S.C. §78ff). Raj Rajaratnam of Galleon received 11 years in prison and a $92.8 million SEC penalty, a record for an individual, in 2011.
Insiders who must sell stock use a Rule 10b5-1 plan: written trading instructions adopted while not aware of MNPI, which then serve as a defense. Amendments adopted December 14, 2022, require the plan to be entered and operated in good faith, impose a cooling-off period before the first trade (for directors and officers, the later of 90 days or two business days after the 10-Q or 10-K for the quarter of adoption, capped at 120 days; 30 days for other persons), and restrict overlapping and single-trade plans. The doctrine is still moving: in April 2024 a jury found a Medivation executive liable for buying options in Incyte, a comparable company, minutes after receiving an email about Medivation’s imminent acquisition, the first “shadow trading” verdict (SEC v. Panuwat).
This is precisely why investment banks and law firms maintain strict information barriers (“Chinese walls”) between deal teams holding MNPI and other parts of the firm, and why employees at these firms are placed on formal restricted lists and watch lists preventing them from trading in specific securities — the control exists specifically to prevent MNPI from crossing internally, not just externally.
Before any trade, ask: is the information public, and would a reasonable investor think it important? If it is not public and the answer is yes, or you cannot tell, do not trade or pass it on; take it to compliance, which can restrict the name. After Panuwat, treat comparable companies the same way. Directors and officers who must sell should do so only through a Rule 10b5-1 plan adopted while holding no MNPI, expecting no trades for 90 to 120 days. The rule does not cover conclusions built from public information, however sharp.
Believing a tip is safe because it came secondhand or as a favor. A gift to a friend satisfies the personal-benefit test (Salman), and the penalty scales with the trade: in the worked example a $40,000 options bet carries a potential civil bill of $2.54 million before any criminal case. Avoid it by refusing the conversation, not by sizing the trade small.
Is it illegal to trade on a tip from a friend?
It is if the friend breached a duty by passing on MNPI for a personal benefit and you knew or should have known it. Under Salman (2016), a gift of the information to a trading relative or friend is itself the benefit; no payment is needed.
What is a Rule 10b5-1 plan?
It is a written plan to trade a company’s stock on preset terms, adopted in good faith while holding no MNPI, which defends later trades even if the person then learns inside information. Directors and officers must wait 90 to 120 days before the first trade; others wait 30 days.
What is shadow trading?
It is trading in an economically linked company using confidential information about your employer, such as buying a rival’s options before your company’s takeover is announced. A jury found this to be misappropriation in SEC v. Panuwat (April 2024).
Insider trading law in the US rests on Rule 10b-5’s classical and misappropriation theories, and reaches tippees whose tippers disclosed for a personal benefit, gifts included. Options give a tip its greatest leverage, which is why surveillance flags them and why the civil penalty of up to three times the profit, plus disgorgement, can turn a $40,000 bet into a $2.54 million liability; Rule 10b5-1 plans with cooling-off periods are the lawful route for insiders.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. A tippee buys 300 call contracts (100 shares each) struck at $30 for $0.50 a share; on the takeover announcement the stock reaches $36. Using the chapter’s rule (disgorgement plus a penalty of up to three times the profit), what is the maximum civil exposure?
- $720,000
- $180,000
- $495,000
- $660,000
Reveal Answer
Answer: D. Cost = 300 × 100 × 0.50 = $15,000; value = 300 × 100 × (36 − 30) = $180,000; profit = $165,000. Disgorgement plus 3 × profit = 4 × 165,000 = $660,000.
2. A law-firm partner with no role on a client’s tender offer buys options in the target and profits. Which theory supported his conviction in O’Hagan (1997)?
- The classical theory
- The fraud-on-the-market theory
- The misappropriation theory
- The market-manipulation theory
Reveal Answer
Answer: C. He owed no duty to the target’s shareholders; he breached a duty to the source of the information (his firm and its client), which is the misappropriation theory the Supreme Court upheld.
3. A company officer adopts a Rule 10b5-1 plan on March 2, 2026, and the 10-Q for that quarter is filed on May 8, 2026. When is the earliest permitted first trade?
- June 1, 2026
- April 1, 2026
- May 12, 2026
- June 30, 2026
Reveal Answer
Answer: A. For directors and officers the cooling-off is the later of 90 days (May 31) or two business days after the 10-Q (May 12), capped at 120 days, so it runs to May 31, a Sunday, and the first trade can be made Monday, June 1.
4. A banker tells his brother about a pending acquisition as a favor, expecting nothing back, and the brother buys the target’s stock. Under Salman v. United States (2016), what follows?
- Only the brother is liable; he traded
- Both can be liable; the gift is the benefit
- Only the banker is liable; he held the duty
- Neither is liable; no money changed hands
Reveal Answer
Answer: B. Salman held that giving inside information as a gift to a trading relative or friend satisfies the personal-benefit test, so the tipper and the knowing tippee are both exposed.
5. Worked problem: A $30,000 options bet on a tip makes $400,000. What is the civil exposure (disgorgement plus three times the profit)?
Reveal Answer
Answer: Exposure = $400,000 + 3 × $400,000 = $1,600,000.
6. Worked problem: What multiple of the original bet is that exposure?
Reveal Answer
Answer: $1,600,000 ÷ $30,000 = 53.3 times the amount risked.
9.2 AML/KYC in Practice
AML and KYC programs have two jobs: know who your customers are, and watch what they do. Money laundering moves illicit money through three stages: placement, layering and integration. In the US, cash over $10,000 in a day triggers a Currency Transaction Report. Splitting cash to dodge that limit, called structuring, is itself a crime. Suspicious activity of $5,000 or more must be reported within 30 days of detection.
Why it matters: Dodging a reporting limit is a crime in its own right.
Summary: AML/KYC programs verify who customers are and watch what they do, because laundering moves illicit money through placement, layering and integration. In the US, cash over $10,000 a day triggers a Currency Transaction Report, splitting cash to avoid it (structuring) is itself a crime, and suspicious activity of $5,000 or more must be reported within 30 days of detection.
- CTRs aggregate a customer’s cash within one business day (31 CFR 1010.313).
- Four deposits of $9,400 to $9,800 total $38,300 without triggering a CTR; a structuring scenario catches them.
- Alert thresholds set staffing: 10,000 monthly alerts at 30 minutes each is about 31 analysts.
- TD Bank left 92% of its volume (about $18.3 trillion) unmonitored and paid $1.89 billion to the Justice Department plus a $1.3 billion FinCEN penalty in 2024.
- A SAR is confidential; the customer is never told.
Know Your Customer (KYC) requires financial institutions to verify a client’s true identity, understand the source and purpose of their funds, and assess their risk profile before opening an account — the practical first line of defense against Anti-Money Laundering (AML) risk. AML itself targets the broader process of disguising illegally obtained money as legitimate, classically described in three stages: placement (introducing illicit cash into the financial system), layering (moving it through multiple transactions and accounts to obscure its origin), and integration (the now-“clean” money re-emerging as apparently legitimate funds).
| Control | What It Does |
|---|---|
| Customer Due Diligence (CDD) | Standard identity verification and risk assessment applied to every customer |
| Enhanced Due Diligence (EDD) | Deeper scrutiny applied to higher-risk customers — politically exposed persons (PEPs), customers from high-risk jurisdictions, unusually large or complex transactions |
| Suspicious Activity Report (SAR) | A mandatory confidential filing to the relevant financial intelligence unit when a transaction pattern looks suspicious — filed regardless of whether the institution can prove wrongdoing |
| Transaction Monitoring | Automated, rules-based systems continuously scanning transaction flows for patterns consistent with layering or structuring |
US banks file a Currency Transaction Report (CTR) for cash in or out of more than $10,000 in one business day, adding together multiple transactions they know are by or for the same person (31 CFR 1010.313). Launderers respond by structuring: splitting cash into amounts below the threshold. Structuring is a crime in itself, even when the money is clean, punishable by up to 5 years, or 10 years as part of a pattern above $100,000 in 12 months (31 U.S.C. §5324). A bank must file a SAR on suspicious activity involving at least $5,000 within 30 calendar days of detection, extendable to 60 days only to identify a suspect (31 CFR 1020.320).
Worked example. A customer deposits $9,500, $9,400, $9,800 and $9,600 in cash on four consecutive business days at different branches. No day exceeds $10,000, so no CTR is due, yet the total is 9,500 + 9,400 + 9,800 + 9,600 = $38,300. A scenario such as “three or more cash deposits between $8,000 and $10,000 within 10 business days” fires on the third deposit, and the 30-day SAR clock runs from the initial detection of facts that may justify a filing.
Thresholds also set the workload. Illustrative assumptions: 2,000,000 accounts, a rule that alerts on 0.5% of them a month, 30 minutes per alert and a 2% conversion to SARs. That is 2,000,000 × 0.005 = 10,000 alerts, 10,000 × 0.5 = 5,000 analyst hours (about 31 full-time staff at 160 hours a month) and 10,000 × 0.02 = 200 SARs, or 50 alerts per SAR. Raising the band’s floor might cut alerts by 60% to 4,000 (12.5 staff), but if a quarter of the real cases sit below the new floor, SARs fall to 150: the 50 unfiled reports are the regulatory exposure that the saving bought.
If cash activity clusters just below $10,000, money moves in and out within days, or volumes do not fit the customer’s stated business, open an investigation; if it remains unexplained, file a SAR within 30 days of initial detection, whether or not you can prove a crime. Never tell the customer a SAR is being considered or filed, and never suggest keeping deposits under $10,000. Review every monitoring scenario at least yearly against the products and payment channels the bank actually offers; a rule set that has not changed while the business has is a finding waiting to happen. Thresholds are calibration, not a safe harbor: a pattern below every threshold is still reportable.
Letting transaction monitoring go stale to control cost. From January 2018 to April 2024, TD Bank left 92% of its transaction volume, about $18.3 trillion, unmonitored, and from 2014 to late 2022 it added no new monitoring scenarios; three laundering networks moved more than $670 million through its accounts. On October 10, 2024, it pleaded guilty to Bank Secrecy Act violations, paying $1.89 billion to the Justice Department and a $1.3 billion FinCEN penalty, with further OCC and Federal Reserve penalties. Budget monitoring as a fixed cost of holding deposits, and test coverage (share of volume monitored), not only alert counts.
Do banks report cash deposits over $10,000?
Yes. A US bank files a Currency Transaction Report for cash deposits or withdrawals totaling more than $10,000 in one business day, adding together transactions it knows belong to the same person. A CTR is routine and implies no suspicion; it becomes a problem only if someone tries to avoid it.
Is structuring illegal if the money is legal?
Yes. Breaking cash into smaller amounts to avoid a CTR is a federal crime under 31 U.S.C. §5324 whatever the money’s source, punishable by up to five years in prison. The offense is evading the report, not laundering.
How long does a bank have to file a SAR?
Thirty calendar days from initial detection of facts that may justify a filing. If no suspect has been identified, the bank may take up to 30 more days to identify one, but never more than 60 days in total. The filing is confidential and the customer is not told.
AML/KYC programs know the customer and monitor activity against the placement-layering-integration cycle. US cash over $10,000 a day triggers a CTR, structuring to avoid it is a crime in itself, and suspicious activity of $5,000 or more must be reported within 30 days of detection; thresholds drive both laundering patterns and monitoring workloads, and stale monitoring, as at TD Bank, is the costliest failure.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. On one business day a customer deposits $7,000 in cash at one branch and $4,500 at another, and the bank knows both are hers. What must the bank file?
- A SAR only, because the deposits were split
- A CTR, because the day’s total is $11,500
- Nothing, because each deposit is under $10,000
- A CTR only for the larger $7,000 deposit
Reveal Answer
Answer: B. Multiple cash transactions the bank knows are by the same person are aggregated per business day: 7,000 + 4,500 = $11,500, above $10,000. A SAR is a separate judgment about suspicion.
2. A monitoring rule produces 6,000 alerts a month, each taking 40 minutes to review. At 160 hours per analyst per month, how many full-time analysts does it need?
- 37.5
- 16.7
- 25
- 40
Reveal Answer
Answer: C. Hours = 6,000 × 40 ÷ 60 = 4,000; analysts = 4,000 ÷ 160 = 25.
3. A bank detects suspicious activity but cannot yet identify a suspect. What is the latest it may file the SAR?
- 60 days after initial detection
- After the suspect is identified
- 90 days after initial detection
- 30 days after initial detection
Reveal Answer
Answer: A. The rule is 30 days from initial detection, with up to 30 more days to identify a suspect, but never more than 60 days in total.
4. Which failure sat at the center of TD Bank’s 2024 guilty plea?
- It screened payments against the wrong list
- It reported SARs to the wrong federal agency
- It filed too many CTRs on routine cash deposits
- 92% of its transaction volume was unmonitored
Reveal Answer
Answer: D. From 2018 to 2024 about $18.3 trillion, 92% of its volume, was unmonitored and no new scenarios were added for years.
5. Worked problem: A customer deposits $9,500, $9,600 and $9,700 in cash on the same business day. Is a Currency Transaction Report triggered?
Reveal Answer
Answer: Cash is aggregated within one business day: $28,800 exceeds $10,000, so yes, a CTR is required.
6. Worked problem: Four deposits of $9,300, $9,600, $9,700 and $9,900 on four different days total how much, and what should a monitoring scenario flag?
Reveal Answer
Answer: Total = $38,500. Each is under $10,000, so no CTR, but repeated just-below-threshold deposits are a structuring pattern to flag.
- 15 U.S.C. §78u-1, civil penalties for insider trading — Treble civil penalty
- SEC Release 33-11138, Rule 10b5-1 amendments (December 2022) — Cooling-off periods and good-faith condition
- 15 U.S.C. §78ff
- UNITED STATES, Petitioner, v. James Herman O’HAGAN. (Cornell LII)
- Raymond L. DIRKS, Petitioner v. SECURITIES AND EXCHANGE COMMISSION. (Cornell LII)
- SEC, November 8, 2011
- 31 CFR 1020.320, bank SAR rule — $5,000 threshold, 30/60-day deadline
- US Department of Justice, TD Bank plea (October 10, 2024) — Unmonitored volume and penalty