Q3 2026 enforcement update: The growing complexity of market abuse

The quarter also shows how much more complex the underlying misconduct is becoming, with abuse increasingly spread across networks of people, accounts and information flows rather than contained within a single trader or transaction.

In Q3 2026, we saw 45 enforcement actions:

Across five jurisdictions:

Totalling $75 million:

Q1 was fundamentally about institutional control failures. We saw 25 actions and $65m in civil penalties, with $48.56m coming from trade surveillance systems and control deficiencies. Canaccord ($40m) and Credit Suisse ($7m) were the most noteworthy cases, and the message was that persistent gaps in data capture, system configuration and governance were still producing major institutional penalties.  

Q2 then shifted decisively toward proven misconduct, particularly insider trading. We saw 26 actions, only $5.7m in monetary penalties, and insider trading plus market manipulation represented more than 83% of tracked actions. We explicitly predicted at the end of that blog that there would be “more actions against individuals in proven cases of misconduct”.

Fast forward to Q3 and market abuse enforcement has accelerated. Enforcement volume has increased 73% quarter-over-quarter and 80% of all Q3 actions concern actual misconduct rather than surveillance or control deficiencies. That continues the Q2 trajectory and validates our prediction. 

‍

Civil penalties vs disgorgement in Q3

Disgorgement is unusually prominent this quarter. We do not normally present separated figures because it tends to account for only a small share of overall financial remedies. Q3 is different: around $67.7m of disgorgement and prejudgment interest sits alongside just $7.1m in civil penalties.

The biggest reason is one exceptional SEC matter. Lawrence Billimek and Alan Williams alone account for almost 88% of Q3’s disgorgement and prejudgment interest. Rather than an unusually large punitive fine, the remedy largely reflects the scale of profits generated by a six-year front-running scheme.

Between 2016 and 2022, the pair executed more than a thousand trades ahead of an asset manager’s market-moving orders, generating around $47m in illicit profits. The SEC’s disgorgement orders effectively seek to strip out those gains and are deemed satisfied by forfeiture imposed in the parallel criminal proceedings. Both men also received custodial sentences.

The duration of the scheme is interesting from a surveillance perspective. The misconduct was not defined by one extraordinary trade, but by a persistent relationship between one person’s trading and another institution’s orders across securities and over time. The SEC says the case originated from its Market Abuse Unit’s analytics, which were used to identify that repeated pattern.

It shows why surveillance needs to connect trading behaviour across accounts, securities and time, rather than assessing each event in isolation, a theme we return to later in this blog.

‍

The individualisation of market abuse

The focus on individuals marks a notable shift in the Western markets we track. Holding individual bad actors to account has been a longstanding feature of enforcement in Singapore and Hong Kong, but we are now seeing the same emphasis emerge more clearly in the US.

That looks, at least in part, like a reflection of current regulatory priorities. The SEC is placing greater emphasis on individual accountability under its new leadership. The regulator said in its FY2025 enforcement results, published in 2026, that it had shifted away from an approach focused on the volume of cases and “record-setting penalties”, while placing renewed emphasis on holding individual wrongdoers accountable and prioritising fraud, manipulation and abuses of trust. That maps to what we’re seeing in Q3.

‍

An update on UK enforcement 

75% of the FCA’s current enforcement work is financial crime-related, so the relative quiet on market abuse may simply reflect where cases currently sit in the enforcement pipeline.

That does not suggest the regulator is easing off. Quite the opposite. In June the FCA proposed raising the minimum penalty for the most serious market abuse cases involving individuals from £100,000 to £150,000, explicitly citing deterrence. Where enforcement does land on individuals, the FCA wants the consequences to carry real weight.

A focus on individuals won’t be the default state in perpetuity. We still expect institutional fines to return. For now, though, these cases offer a useful window into the growing complexity of market abuse.

‍

Complex networks at the heart of market abuse

Modern market abuse isn’t one trader making one suspicious trade. We’re seeing information and activity distributed across tipping chains, associates, brokers and multiple accounts.

• Cummins/Meritor tipping chain: A Cummins corporate-development accountant allegedly tipped her husband, who passed the information to a friend. It then moved through that friend’s wife in China, another contact in Virginia, and two further traders in Washington and California. Four downstream traders collectively made more than $500,000. The suspicious activity was spread across a multi-step social network rather than a single insider-trader relationship.

• Beacon Minerals: Former project manager Alexander McCulloch procured two associates to acquire a combined 11 million shares while he held confidential drilling results. The insider held the information, but the trading appeared in other people’s accounts.

• Singapore marking-the-close case: MAS sanctioned two brokers for facilitating a client’s manipulation despite recognising the trading pattern. One placed orders through both the client’s account and an employee’s account and also advised on execution. The conduct therefore spanned a client, multiple brokers and multiple accounts over several years.

Market abuse does not sit neatly inside one account, one trader or one data source. Information moves through relationships and the trading appears somewhere else. That makes the surveillance problem relational. The more distributed the misconduct becomes, the less effective surveillance is when trades, accounts and communications are assessed in isolation. Where the signals exist, firms need technology capable of joining them together.

• Trade data needs context. Orders and executions become more meaningful when firms can connect them with eComms, employee relationships, account ownership and known personal or professional links.

• Cross-account surveillance matters. Firms need to identify common control, linked beneficiaries, shared devices or IPs where available, coordinated timing and similar trading patterns across multiple accounts.

• Investigation matters as much as detection. Technology may surface a cluster of related trades, but investigators still need the context to understand how the people, accounts and communications are connected.

‍

Surveillance risk hasn’t evaporated

The scarcity of institutional penalties should not be mistaken for lower surveillance risk. The underlying misconduct remains widespread, and the cases above show how difficult it can be to detect when activity is distributed across people, accounts and communications.

Institutional control cases also remain disproportionately expensive when they do land, accounting for just 20% of Q3 actions but 56% of civil penalty value.

The sophistication of the conduct should be a reminder to test surveillance efficacy, not just coverage. Firms should be stress-testing scenarios in sandboxes, replaying known cases against existing controls, recalibrating thresholds where signals are missed, and deploying AI to strengthen the investigation layer once alerts are generated.

As the abuse becomes more sophisticated, surveillance has to prove it can keep up. To see how eflow’s technology can support your firm’s trade surveillance obligations, explore our interactive demo.

‍