Criminal Defense Lawyers

What Triggers an SEC Investigation

The SEC isn’t hunting for you. An algorithm is. Before any human at the Securities and Exchange Commission reviews your trading activity, a system called ARTEMIS has already flagged it. ARTEMIS contains roughly 10 billion equity and options trade records – every trade made on every U.S. exchange, going back years, sitting in a searchable database. By the time you receive a letter or subpoena, the machine has already identified the pattern. The human investigators aren’t searching for evidence. They’re confirming what the data already showed them.

This changes everything about how you should think about SEC investigations. The old image of investigators poring through documents looking for suspicious activity is outdated. Today’s enforcement starts with automated detection. Thousands of trades get flagged every year without any human involvement. The question isn’t whether the SEC will notice suspicious activity – they notice everything. The question is whether your activity fits the patterns their algorithms are trained to identify.

Understanding what triggers an SEC investigation means understanding the machine. It means knowing how 20,000 tips per year get evaluated, why “informal” investigations are actually the dangerous ones, and what happens in the sixty days after you first appear on someone’s radar. Most importantly, it means recognizing that by the time you know about an investigation, you’re already months behind.

The Machine That Never Stops Watching

The SEC’s surveillance infrastructure is more sophisticated then most people realize. ARTEMIS – thats the Advanced Relational Trading Enforcement Metrics Investigation System – isn’t just a database. Its an analytical engine that ranks trades based on different metrics and identifies suspicious patterns across billions of records. Named after the Greek goddess of the hunt, it does exactly what the name suggests.

But ARTEMIS handles historical data. For real-time surveillance, theres MIDAS – the Market Information Data Analytics System. Every day, MIDAS collects approximately one billion records from the proprietary feeds of all thirteen national equity exchanges. Thats not a typo. One billion new records daily. The SEC knows about your trade before your broker confirms it.

Heres what makes this terrifying. The automated systems dont just flag obvious patterns like unusual volume before announcements. Their looking for relationships between traders. Coordinated trading across accounts that appear unrelated. First-time trading in a stock by someone who suddenly appears with a well-timed position. ARTEMIS specificaly looks for traders with no history in a company who suddenly show up right before material news. Your first trade in a particular stock could be the one that triggers an investigation.

In 2017, the SEC caught seven individuals who generated millions in profits by trading on confidential information about thirty impending corporate deals. They used shell companies. They used code words. They used an encrypted, self-destructing messaging application to evade detection. The SEC caught them anyway. Data analysis uncovered the illicit trading despite every precaution the traders took. The algorithms dont care about your encryption. They care about trading patterns.

Six Ways Your Investigation Starts

OK so the surveillance is constant, but what actualy triggers an investigation rather then just a flag? There are six primary pathways, and understanding them reveals how the SEC prioritizes its limited resources.

First is whistleblowers and tips. The SEC recieves over 20,000 tips, complaints, and referrals every single year. Each one gets reviewed by the Enforcement Division. The Office of Market Intelligence – comprised of more then 40 attorneys, former traders, accountants, and other experts – evaluates incoming tips. At least two SEC attorneys look at every submission. If your tip identifies specific individuals, provides examples of particular fraudulent transactions, or points to non-public materials evidencing fraud, its more likely to get assigned to Enforcement staff.

Second is market surveillance. The automated systems we discussed – ARTEMIS, MIDAS, and FINRA’s own surveillance tools – flag unusual activity. Unusual options trading before announcements is especialy suspicious becuase of the leverage involved. Buying out-of-the-money call options right before positive news raises immediate questions. The improbability of success without inside information makes these trades impossible to explain.

Third is corporate disclosures and restatements. When a company restates its financials, the SEC notices. Academic research has found that SEC case selection is associated with “conspicuous public trigger events” like restatements, self-disclosures of malfeasance, auditor departures, and unusual trading. These are what researchers call “low-hanging fruit” – cases that are already partialy proven by public evidence. The SEC pursues these becuase they require less investigative effort to build.

Fourth is media coverage. Newspaper stories, media reports, and even social media posts can trigger SEC interest. When Enron’s problems started making headlines in 2001, the SEC quickly opened an inquiry. Within two months of admitting they overstated profits by nearly $600 million, Enron was bankrupt and the DOJ had launched criminal investigations. Media scrutiny accelerates everything.

Fifth is referrals from other agencies. The Department of Justice, FBI, other federal agencies like the Department of Defense or EPA, and even state regulators can refer matters to the SEC. FINRA surveils both equities and options markets and refers suspicious trading to the SEC when it finds something concerning. The SEC dosent operate in isolation – its part of a larger regulatory ecosystem.

Sixth is routine examinations and reviews. Sometimes an SEC investigation starts from a routine review of filings that reveals something concerning. What begins as a comment letter can escalate into an investigation. The SEC reviews thousands of filings every year, and anomalies get noticed. This is the pathway that catches people who thought they were being careful.

The Algorithm Finds You First

Heres something most people dont understand about SEC investigations. Phase one is completely automated. A human hasnt looked at your case yet – its just data in a queue of potential investigations. The algorithm flagged your trading activity based on patterns, timing, or relationships. You dont know about it. Your broker dosent know about it. But your already in the system.

Phase two is initial review. FINRA investigators or the SEC’s Market Abuse Unit conducts preliminary analysis. They examine the trading pattern, the timing relative to public announcements, and any obvious connections between the trader and people with access to inside information. This is still happening without your knowledge.

Only in phase three does someone reach out to you – and by then, theyve already formed preliminary conclusions about your activity. The data told them a story before you had a chance to tell yours. By the time you know your under investigation, your already behind.

Why “Informal” Is the Dangerous Word

Many SEC investigations start as “Matters Under Inquiry” or MUIs. This sounds informal. It sounds preliminary. It sounds like maybe its not serious. Thats exactly why its dangerous.

An MUI is how the SEC gathers information before deciding wheather to open a formal investigation. The threshold for opening an MUI is intentionaly low – the purpose is to collect facts. During an MUI, the SEC cant issue subpoenas. They rely on voluntary cooperation. And heres the trap: most people voluntarily cooperate becuase they think its just informal. They answer questions. They produce documents. They think there helping themselves.

The SEC has sixty days to decide wheather to close the MUI or convert it to a formal investigation. If it converts, everything you voluntarily provided during the informal phase is now part of a formal investigation record. The “informal” cooperation built the foundation for the formal case against you.

And once its formal? The SEC gets subpoena power. They can compel witnesses to testify and produce documents. Theres no limit to how many subpoenas they can issue. Third and fourth subpoenas are not uncommon. The documents collected can run into millions of pages. The informal phase was the evaluation. The formal phase is the execution.

The Whistleblower Pipeline

Twenty thousand tips per year. Let that number sink in. The SEC’s Office of Market Intelligence has built an entire infrastructure around processing this volume of information. Every tip gets a unique TCR number – Tips, Complaints, and Referrals. Every tip gets forwarded to evaluation. The question isnt wheather your being watched, but by how many people.

Heres the kicker. Whistleblowers have financial incentives to report. SEC whistleblower awards range from 10-30% of sanctions collected if the information leads to a succesful enforcement action exceeding $1 million. In some cases, whistleblowers have recieved tens of millions of dollars. Your co-worker, your competitor, your disgruntled former employee – they all have financial motivation to report you to the SEC.

The OMI conducts initial evaluation of each tip to determine wheather it relates to an existing investigation, wheather similar information has already been submitted, and wheather it relates to misconduct within the SEC’s statute of limitations. When OMI determines a complaint warrants further investigation, it gets assigned to one of the SEC’s eleven regional offices or an Enforcement specialized unit. When it dosent warrent further investigation, it gets designated “No Further Action” – but even then, it gets a second review before closing.

The most damaging whistleblower in SEC history might be Harry Markopolos. He complained to the SEC’s Boston office in 2000, telling them it was impossible to legally make the profits Bernie Madoff claimed using his stated investment strategies. The SEC ignored him. For eight years. The $65 billion Ponzi scheme continued while the whistleblower was dismissed. Madoff wasnt caught by the SEC – he turned himself in when the fraud collapsed. The lesson? The SEC receives thousands of tips. They dont act on all of them. But when they do, the information often comes from someone who knew exactly what was happening.

Public Triggers: Why Bad News Gets Worse

Heres something nobody warns you about. Academic research by finance professor Jonathan Karpoff at the University of Washington found that the stock price of a company subject to investigation tends to fall an average of 40 percent from the first revelation of misconduct until the investigation is resolved. Forty percent. Before any charges are filed. Before any guilt is determined.

This creates a brutal cascade. Investigation revealed → stock drops 40% → shareholders file class action lawsuit → executives get terminated or resign → careers destroyed. And this sequence often starts from public trigger events that the SEC is specifically watching for. Restatements. Auditor departures. Management resignations. Material weakness disclosures.

WorldCom became the largest corporate accounting fraud case in history after the SEC discovered they overstated assets by over $11 billion. The company settled for $2.25 billion. Enron admitted overstating profits by nearly $600 million and was bankrupt within two months. The investigation itself wasnt what destroyed these companies – it was what the investigation revealed, and the cascade that followed.

The Venue They Choose Determines Your Odds

Heres a statistic that should terrify anyone facing SEC scrutiny. According to analysis by the Wall Street Journal, the SEC had a 90% win rate in contested cases brought before its own Administrative Law Judges from October 2010 through March 2015. In federal court trials over the same period? Only 69%.

Think about that. Same agency. Same evidence. Same legal theories. But a 21 percentage point difference in outcomes depending on venue. The SEC often gets to choose which forum to use. If your facing an SEC enforcement action, the forum selection may matter more then the facts of your case.

This is why understanding what triggers an investigation matters so much. Once your in the SEC’s crosshairs, you enter a system thats designed to produce outcomes favorable to the government. The 90% win rate before ALJs isnt becuase SEC lawyers are exceptional – its becuase they only bring cases where the data already supports their conclusions, and they often get to choose judges who work for the same agency.

What Happens the Moment You’re Identified

So what actually happens once the SEC decides your worth investigating? The informal phase – the MUI – begins without your knowledge. Staff attorneys request information, review public filings, analyze trading data, and form preliminary conclusions. You might not know any of this is happening.

If they decide to convert to formal investigation, they write a memorandum that goes up to the five-member Commission. The Commissioners vote on wheather to issue a Formal Order of Investigation. This document – usually two to three pages – gives SEC staff the power to issue subpoenas. Once that happens, the SEC can compel testimony and document production. Voluntary cooperation becomes mandatory compliance.

The average time from opening an investigation to filing an enforcement action is about two years. But that dosent count investigations that close without charges. Some of those drag on for years too. The financial and emotional toll of being under investigation – even one that goes nowhere – can be devastating.

What You Should Know Right Now

If your reading this article becuase your worried about SEC scrutiny, understand this: the surveillance is constant, the data collection is comprehensive, and the triggers are numerous. Whistleblowers, algorithms, media reports, routine reviews, other agencies, your own company’s disclosures – any of these can start an investigation.

The most important thing you can do is get experienced counsel before you respond to any SEC inquiry, even an “informal” one. The information you provide during the informal phase can and will be used against you if the investigation becomes formal. The voluntary cooperation you offer can build the case that destroys you.

The SEC credited cooperation in 75% of public company investigations in FY2024. Cooperation matters – but only when its strategic, protected by counsel, and designed to minimize exposure rather then maximize disclosure. The difference between those who survive SEC investigations and those who dont often comes down to one thing: understanding what triggered the investigation in the first place, and responding accordingly. The machine is watching. The question is weather you’ll be ready when it finds you.