The FCA received 3,806 suspicious transaction and order reports (STORs) in 2025, down 16% from 4,528 in 2024, and on the same day it disclosed material surveillance weaknesses at seven UK retail brokers. The findings appeared in the regulator's Market Watch 86 newsletter, published Wednesday. None of the seven firms was named.

All seven were required to strengthen their surveillance after supervisory visits, and in some cases the FCA deployed skilled person reviews — independent checks carried out by outside experts — to verify the fixes. The FCA said report quality from the visited firms has improved since the visits.

What did the FCA find?

The findings focus mainly on insider dealing surveillance under the UK Market Abuse Regulation (UK MAR), which obliges brokers to flag suspicious orders and trades to the FCA. Those STORs feed directly into the regulator's insider dealing work, so a weak escalation culture upstream degrades the enforcement pipeline. The review also covered manipulation risks retail brokers face, such as pump and dump schemes — coordinated promotion followed by mass selling that can collapse a price. Webull's UK chief executive, Nick Saunders, warned last year that such schemes can send a stock down 90% in seconds.

The FCA grouped the weaknesses into three areas:

• Escalation thresholds. Some firms set the bar for reasonable suspicion too high; some procedures discouraged escalation unless an analyst could show a link between the client and the issuer, and others steered analysts toward closing alerts. The FCA reminded firms that a report does not require proof that market abuse took place.
• Calibration. Some brokers applied a single price-move threshold to large-cap and small-cap shares alike; some set a minimum trade value so high that much client activity went unmonitored.
• Oversight. Some staff could not explain how their surveillance system worked; some firms relied on vendor default settings with limited testing; senior managers showed limited grasp of surveillance, and responsibilities were split across functions with no end-to-end owner. Quality assurance ranged from full reviews to none.

Some risk assessments also ignored the firm's own client base, treating institutional and retail clients alike. "Ten years after its introduction, these arrangements should be well-established," the regulator wrote.

What has weak surveillance already cost?

The findings follow a series of enforcement actions tied to surveillance and reporting failures:

• March 2025: Dinosaur Merchant Bank was fined £338,000 (about $450,000) after CFD trades placed through a new order system between June and October 2024 never reached its automated surveillance. The underlying value of those trades was about $3.05 billion. The bank stopped selling CFDs in May 2025.
• January 2025: CFD broker Infinox was fined £99,200 over 46,053 transaction reports it never submitted. The FCA said the gap risked market abuse going undetected.
• 2022: Citigroup's international broker-dealer paid £12.6 million for failures in detecting market abuse. Later that year, BGC Brokers and two GFI Group units were fined a combined £4.8 million for surveillance that did not cover every asset class subject to MAR.

How does this compare with the 2023 review?

The contrast with April 2023 is stark. Market Watch 73, covering nine CFD and spread betting providers, reported that most could show their insider dealing alerts were largely effective. Even so, that review found lookback periods (the window a system scans for suspicious activity) as short as 24 hours, weak coverage of non-equity asset classes, and only one of nine firms checking the quality of alerts its analysts had reviewed.

This time the tone is harder. The FCA said market abuse risks at UK retail brokers remain a supervisory priority, and it framed the persistence of these gaps — a decade into the UK MAR regime — as evidence that firms, not rules, are the constraint. For compliance desks, the message is that vendor default settings, high minimum trade values and split ownership of surveillance will now read as supervisory findings rather than operational quirks.