Market Abuse Regulation Article 16: what it asks of asset managers

Article 16 of the Market Abuse Regulation (MAR) is the rule that makes market abuse surveillance a legal duty. Its first paragraph covers trading venues; its second covers "any person professionally arranging or executing transactions", and requires that person to run "effective arrangements, systems and procedures to detect and report suspicious orders and transactions" and to notify the regulator "without delay" once it has a reasonable suspicion. European regulators read that second paragraph to include asset managers, so a fund manager's own orders must be watched for insider dealing and market manipulation, and every alert it decides not to report needs a written reason it can produce for five years. The work is hard because the alert says only what pattern fired, while the evidence sits in the order system, the news, the chats and the lists. Botminds' Trade Surveillance is built for that gap: agents assemble a cited case for every alert so that an analyst decides, and a second person checks, with the reasons on file.

The rule text below is quoted from the UK version of MAR on the official UK legislation site, which is up to date to 26 October 2026, and from the EU text as adopted in 2014. The product examples come from a fictional asset manager, Quillfield Capital, run through the solution on sample data.

What does Article 16 of the Market Abuse Regulation require?

Article 16 requires two groups of firms to detect and report suspected market abuse. Article 16(1) applies to market operators and investment firms that run a trading venue: they must prevent and detect insider dealing and market manipulation on their venue and report suspicious orders and transactions. Article 16(2) applies to everyone else who handles orders professionally, and it is the paragraph that matters to a fund manager.

The full text of Article 16(2), in the UK version, reads: "Any person professionally arranging or executing transactions shall establish and maintain effective arrangements, systems and procedures to detect and report suspicious orders and transactions. Where such a person has a reasonable suspicion that an order or transaction in any financial instrument, whether placed or executed on or outside a UK trading venue, could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation, the person shall notify the FCA without delay" (UK MAR, Article 16). The EU text is the same except that the notice goes to the competent authority of the Member State where the firm is registered or has its head office (MAR as adopted, Article 16(2) and (3)).

Two duties sit in that sentence. The first is a standing system: arrangements, systems and procedures that exist before anything suspicious happens. The second is an event-driven report, the suspicious transaction and order report, or STOR, filed once suspicion is formed. Firms tend to measure themselves on the second, because a STOR is visible. Regulators examine the first, because a system that never alerts files no reports.

Does MAR apply to asset managers?

Yes. Article 16(2) applies to any "person professionally arranging or executing transactions", and both ESMA and the FCA read that phrase to include investment managers. The definition in Article 3(1)(28) turns on what a firm does, not on its licence: "a person professionally engaged in the reception and transmission of orders for, or in the execution of transactions in, financial instruments" (UK MAR, Article 3). A fund manager that places orders with brokers is engaged in exactly that.

ESMA settled the point for the EU in a published answer to the question whether UCITS management companies and AIFMs fall within the obligation:

"Persons professionally arranging or executing transactions" thus includes buy side firms, such as investment management firms (AIFs and UCITS managers), firms professionally engaged in trading on own account (proprietary traders) and investment firms providing direct electronic access (DEA providers) with respect to their DEA clients' trading activity.

ESMA, Questions and Answers on MAR, Q&A 6.1 (ESMA_QA_1149), answer dated 15 November 2022

The FCA says the same in plain terms on its reporting page: firms "who are persons professionally arranging or executing transactions must also detect and report suspicious transactions and orders to us without delay via STORs" (FCA, How to report suspected market abuse as a firm or trading venue). The UK duty applies to a firm registered or with its head office in the UK, or to a UK branch.

The practical consequence is that a fund manager cannot rely on its brokers. The Delegated Regulation says that all persons "involved in the processing of the same order or transaction shall be responsible for assessing whether to submit a STOR" (Delegated Regulation 2016/957, Article 5(2)). The broker sees the order; only the manager sees the portfolio manager's reason for it, the research that preceded it and the chat that came before the instruction.

What MAR Article 16(2) adds through Delegated Regulation 2016/957

Article 16(2) states the duty; Commission Delegated Regulation (EU) 2016/957 says what an effective system is. It was written as the regulatory technical standard the article called for, it carries the STOR template in its Annex, and it remains in UK law in a retained version. Its demands on a buy-side firm are more specific than most surveillance policies acknowledge.

Three of those duties catch out fund managers most often. Monitoring "all orders" means the orders a portfolio manager cancelled before they reached the market, not only the fills a broker confirms. The FCA has said so directly, reporting firms that left cancelled and amended orders out of their monitoring altogether (FCA, Market Watch 69, May 2022). Covering "the full range" means the bond desk that trades by voice and the overlay team that trades futures. And "an appropriate level of human analysis" means an alert is the start of a decision, not the decision.

Why the reasons for not reporting are the real record

For every alert examined, the firm must keep the analysis and the reason it did or did not report. Article 3(8) of the Delegated Regulation requires a firm to "maintain for a period of five years the information documenting the analysis carried out with regard to orders and transactions ... which have been examined and the reasons for submitting or not submitting a STOR", and to give it to the regulator on request (Delegated Regulation 2016/957, Article 3(8)).

That clause changes what a close-out note is. A buy-side surveillance team closes far more alerts than it reports, so most of its regulatory record consists of decisions not to file. A note that says "reviewed, no concerns" records that an analyst looked; it does not document "the analysis carried out". A note that says what fired, what the analyst checked, what each source showed and why the facts fall short of reasonable suspicion is a record an examiner can test. What a close note that holds up contains is set out in full in a companion guide.

The record also has to be honest about timing. A STOR filed late must explain itself: the Delegated Regulation allows reports on past orders "where suspicion has arisen in the light of subsequent events or information", but the firm must then explain "the delay between the suspected breach and the submission of the STOR" (Article 6(2)). A file that shows when each piece of evidence arrived makes that explanation straightforward.

Can trade surveillance be outsourced under MAR?

Partly. A firm may delegate the work, but never the responsibility. Article 3(6) lets a firm delegate monitoring, detection and identification to another company in its group by written agreement; Article 3(7) lets it hand the data analysis and the alert generation to a third-party provider. In both cases the delegating firm "shall remain fully responsible" for its Article 16 obligations, and with a third party it must keep enough in-house expertise to judge the provider's work and direct access to everything about how the data was analysed and the alerts raised (Article 3(6) and (7)). The conditions, and what they cost, are set out in the trade surveillance system comparison.

The FCA has seen what happens when that oversight thins out. In Market Watch 69 it described UK compliance teams with "negligible understanding of the surveillance undertaken at group level" that, on looking into it after the FCA's questions, "discovered the surveillance was ineffective for the UK business" (Market Watch 69). The rule permits a vendor engine, a group surveillance hub or an outsourced review desk; it does not permit a firm that cannot explain its own alert logic. The cost side of that choice is in the trade surveillance system comparison.

UK MAR Article 16 and EU MAR: what differs

The obligation is the same in substance; the routing and the future differ. Both texts require detection and reporting by any person professionally arranging or executing transactions, and both rely on the same Delegated Regulation. The differences sit in who receives the report and in how each text is changing.

For a group with UK and EU entities, the practical question is routing: which entity's surveillance owns an order placed by a London portfolio manager for a Luxembourg fund and executed in Frankfurt. Article 5(2) answers part of it, since every entity involved in processing the order must assess it. Most groups write the answer into their procedures entity by entity, so that one analyst's close does not silently stand for three firms.

Market abuse regulation Article 18: a different duty, and where funds meet it

Article 18 is about insider lists, not surveillance. It requires "issuers, and any person acting on their behalf or on their account" to keep "a list of all persons who have access to inside information" and to give it to the regulator on request (UK MAR, Article 18). An asset manager usually meets Article 18 from the other side: its people appear on an issuer's or an adviser's list when they are brought inside, typically through a market sounding or a creditor discussion.

That is where Articles 16 and 18 connect. A manager that receives inside information must stop trading the affected securities, and its surveillance must check that it did. The FCA has reported investors trading in the gap between being approached for a sounding and consenting to receive it, with rationales such as "Rebalancing a portfolio" that did not reconcile with selling a stock and buying the same quantity back in the placing (FCA, Market Watch 75, October 2023). A wall-crossing log that the surveillance can read is the buy-side counterpart of an issuer's insider list.

Roles and segregation of duties in Trade Surveillance

What a US adviser has instead of Article 16

A US investment adviser files no STOR. Its duty to watch for the misuse of inside information comes from Section 204A of the Advisers Act, which requires every adviser to have written policies and procedures, and to enforce them, that are reasonably designed to stop the adviser or its people misusing material nonpublic information (15 U.S.C. 80b-4a). The statute asks for prevention and enforcement, not for reports to the regulator, but enforcing a policy against misuse of inside information means looking at trades, and examiners ask for the evidence.

The SEC has shown that the policy failure alone is enough for a penalty. In August 2024 it settled with an adviser over its procedures for nonpublic information in collateralized loan obligation trading, without any insider-trading charge; a guide on MNPI examples walks through that case. A global manager therefore runs one surveillance programme to two standards: European and UK regulators expect STORs from it, and the SEC expects enforced Section 204A policies with records behind them.

How regulators test Article 16 compliance

Supervisors look at the system, not the count of reports. The FCA runs a standing STOR supervision programme, which its 2026 priorities for wholesale markets commit it to continue, and it names what it keeps finding: data feeds that are incomplete or wrong, alerts calibrated badly, and surveillance models that are weakly tested and governed (FCA, Regulatory Priorities: Wholesale Markets, March 2026).

Each of those findings maps to a clause. Incomplete data breaks "all orders" and "the full range". Ineffective calibration breaks "effective". Weak testing breaks the annual review in Article 2(5). And the examiner's proof is the five-year file that Article 3(8) requires, which shows whether the alerts that did fire were looked at properly. Getting the data right at implementation is the first defence against the most common of those findings.

In Botminds' Trade Surveillance the record is built as the work happens. Each alert becomes a case with every statement linked to its source; the analyst closes or escalates with a reason code; a second person checks every close; and a STOR, when one is needed, is drafted from the same cited case file and approved only by the Head of Surveillance or the chief compliance officer. The record stays for seven years, two more than the Delegated Regulation's five. For how the report itself is written, see FCA STOR reporting; for the solution, start at Trade Surveillance.

Questions people ask

What is MAR Article 16(2)?

It is the paragraph of the Market Abuse Regulation that requires any person professionally arranging or executing transactions to run effective systems to detect suspicious orders and transactions and to report them to the regulator without delay. Article 16(1) is the equivalent duty for trading venues. In the UK the report goes to the FCA; in the EU, to the national competent authority.

Does UK MAR Article 16 still apply after Brexit?

Yes. MAR was brought into UK law on 31 December 2020, and Article 16 applies in its UK version, which names the FCA. The UK legislation site lists a revocation of the retained regulation under the Financial Services and Markets Act 2023 as a change not yet in force in late October 2026, so the text still applies; check its status on the day you rely on it.

Do UCITS management companies and AIFMs have to file STORs?

Yes, when they have a reasonable suspicion. ESMA's Q&A 6.1 says persons professionally arranging or executing transactions include "investment management firms (AIFs and UCITS managers)", because the definition in Article 3(1)(28) depends on the activity, not on a MiFID licence. The duty covers their own orders and transactions.

How long must surveillance records be kept under MAR?

Five years. Delegated Regulation 2016/957 requires firms to keep for five years the analysis of every order and transaction examined and the reasons for submitting or not submitting a STOR, and separately to keep the documentation of their surveillance arrangements, including changes, for five years.

Is a firm in breach if it never files a STOR?

Not in itself: the duty is to report when there is reasonable suspicion, and some firms rarely have one. But a firm with no STORs must show that its system would have found suspicious activity had there been any, through complete data, calibrated alerts, tested models and a file of reasoned closes. In Market Watch 56 (2018) the FCA said it thought firms were still sending too few STORs on fixed income products.