How to Manage Capital Markets Compliance in Turbulent Times: A Checklist

Seventy-seven per cent. That is the share of executives in PwC's Global Compliance Survey 2025 who said compliance issues had hurt their company, to some or a great extent, in areas that drive growth.

Read quickly, the figure sounds like a complaint about red tape. Read again, it says something less comfortable: compliance is already shaping growth, whether you manage it or not. The same survey adds a second number. 64% of respondents said technology was helping them see their risks and their risk management activities more clearly.

None of this makes the burden lighter. When markets turn turbulent, regulators reach for legislation, and every new obligation costs issuers time and money. So one question runs through each item in this checklist: is this control worth what it costs you? For some items the law answers it for you. For others, you decide.

Managing capital markets compliance comes down to four disciplines: assessing compliance risk regularly, building clear internal controls, tracking regulatory change, and meeting your obligations under MAR, the EU Whistleblowing Directive and, for investment firms, MiFID II. This checklist reflects the EU Listing Act amendments to MAR that now apply, including the new disclosure rules for protracted processes and the new insider list templates.

How compliance affects growth and financial performance

PwC describes the backdrop as "myriad macro forces and crises". Regulators respond by legislating to keep capital markets safe and fair, and issuers absorb the administrative and financial cost.

The PwC finding cuts both ways. If compliance issues can hold back growth in 77% of companies, a programme that works can protect it. The difference often comes down to timing: knowing what new legislation will require, and how current rules are likely to change, lets you build a strategy that uses your resources well instead of reacting at the last minute.

The case for a proactive approach in volatile markets

Economic uncertainty, market volatility and closer regulatory scrutiny tend to arrive together. A proactive approach means you see the obligation before it lands, budget for it and assign it to someone.

The sceptic's objection is fair: proactive work costs money up front, for risks that may never materialise. The answer in the rest of this checklist is not to do everything. It is to know which items the law makes mandatory, and to spend your discretionary effort where the damage would be greatest.

How should you manage compliance risk?

Running regular compliance risk assessments

The risks you are exposed to change over time, so a risk matrix written once goes stale. Run compliance risk assessments periodically and update the matrix each time, so it reflects the business you run now rather than the one you ran when you wrote it.

How do you update policies when market conditions change?

Update policies by tracking planned changes to legislation and adapting how you apply your compliance protocols and respond to incidents. A structured policy management process gives each policy an owner, a review date and a record of who approved which version.

PolicyLog, the Euronext Corporate Solutions policy management platform, supports this with version control, scheduled review reminders and notifications when regulations you subscribe to change. You can also map each policy to the regulations it addresses, so you know which ones to review when an obligation moves.

Prioritising high-risk areas in trading and reporting

This is where the cost question gets its first real answer. Identify the most pressing compliance concerns in trading and reporting, and deal first with the most imminent threats that would cause the greatest damage. Lower-level risks come after, with lighter controls.

Internal controls every compliance programme needs

Monitoring mechanisms for market abuse risks

Stronger monitoring lets you spot an internal issue before it becomes embedded in the organisation. Caught early, it is a correction. Caught late, it is a regulatory problem.

Clear escalation procedures for compliance violations

When a breach happens, nobody should have to work out who to tell. A clear escalation procedure sets out the workflow in advance, so a violation is handled quickly and decisively instead of sitting in someone's inbox.

Why does leadership support matter?

Leadership support makes it far easier to sell compliance to the rest of the company and to secure funding for internal initiatives and RegTech. It matters for another reason too: the sceptic who matters most usually sits on the board.

Make that case on both sides of the ledger: what the business gains from a strong compliance focus, and what it risks if the measures fall short. Leadership will weigh the cost either way, so give them the full picture.

How do you stay ahead of regulatory change?

Tracking regulatory updates at national and EU level

Monitor government press releases in your home Member State and at EU level, alongside the industry press. Structured regulatory horizon scanning turns that monitoring into a process, so an upcoming change reaches an owner rather than a reading list.

The EU Listing Act shows why. Its changes to MAR took effect in stages between December 2024 and June 2026, and the detailed rules followed in delegated and implementing acts over the summer of 2026. An issuer that tracked only the headline regulation would have missed the templates and lists that decide how the rules work in practice. People are a source too. Attend workshops and webinars relevant to your sector, and talk to peers who are watching the same files.

Why should you engage directly with regulators?

A working relationship with the bodies that develop the rules gives you two things a press release cannot: earlier warning of what is coming, and a direct line when you are unsure what an obligation requires. Here the external factor is real. The regulator's timetable, not yours, often decides how much time you have to adapt.

Using internal audits to reveal compliance gaps

Test your current processes against every obligation that applies to you. An internal compliance audit shows where you are covered and where you need extra controls. It also tells you where you may be over-investing, which is the other half of the cost question.

MAR compliance: handling inside information

How do you recognise and disclose inside information

Under Article 7 of the Market Abuse Regulation (MAR), inside information is information of a precise nature that has not been made public, relates directly or indirectly to an issuer or its financial instruments, and would be likely to have a significant effect on their prices if it were made public. Everything under MAR starts with one judgement: has this information crossed that threshold? Train employees to make that call accurately, because every later step depends on it.

When information qualifies as inside information, the company must, as a rule, disclose it as soon as possible: in a press release to the financial and industry media, on its website and to the financial markets. Disclosure is easier to get right when it sits inside a wider corporate communications strategy that keeps your message consistent for investors and the media.

Protracted processes: disclose the final event, not each step

The EU Listing Act added a second judgement. Since 5 June 2026, when inside information arises from a protracted process, such as negotiating an acquisition, you no longer disclose each intermediate step. You disclose the final event or circumstance, as soon as possible after it occurs, provided the intermediate steps stay confidential.

Commission Delegated Regulation (EU) 2026/789 sets out a non-exhaustive list of final events in common protracted processes, and the moment at which each one is deemed to occur. It is the first place to look when you are unsure whether a step is the final one.

The change affects disclosure only. An intermediate step can still be inside information, so the ban on insider dealing still applies to it, and the people who know about it still belong on an insider list.

Delaying disclosure: conditions and follow-up steps

An issuer can delay disclosure only when three conditions hold:

1. Immediate disclosure would harm the issuer's interests.

2. The issuer can keep the information confidential.

3. The inside information does not contradict the issuer's latest public announcement or other communication on the same matter.

The third condition replaced the old test that a delay must not be likely to mislead the public. Delegated Regulation (EU) 2026/789 lists situations in which delayed information would conflict with an earlier announcement, and in those situations a delay is not available.

Because intermediate steps in a protracted process no longer have to be disclosed, they no longer need to be delayed either. Expect to use the delay mechanism less often. ESMA is revising its guidelines on the legitimate interests that can justify a delay, so check the current version before you rely on the.

A delay is not a pause in the work. Employees need to know the follow-up steps, starting with creating and maintaining an insider list.

Keeping insider lists compliant and up to date

This is where the stakes rise. If your national competent authority (NCA) opens an investigation or audits your processes, it can ask for your insider lists, including earlier versions. Keep each list for at least five years after it is drawn up or updated.

Since 5 July 2026, insider lists must follow the templates in Commission Implementing Regulation (EU) 2026/1291, which replaced the previous templates as part of the Listing Act reforms. The lighter format once reserved for issuers on SME growth markets now applies to every issuer. You no longer record insiders' birth surnames, personal telephone numbers or home addresses. You record a national identification number, or a date of birth where there is none, and for a third-party adviser a single named contact person is enough.

For each insider, record when they obtained and when they ceased to have access, in UTC, in the format yyyy-mm-dd, hh:mm. Update the list promptly whenever someone gains or loses access, and keep earlier versions accessible. Permanent insiders now have their own "obtained" and "ceased" fields too, so when someone stops being a permanent insider, record the date rather than deleting the entry.

The five-year rule now has a ceiling as well as a floor: do not keep an insider's personal data for more than five years after they leave the list.

Each insider must also acknowledge their place on the list and their obligations, and chasing those acknowledgements in person is slow, so automate the reminder emails until each insider responds.

InsiderLog stores insider lists in the ESMA-mandated format, timestamps every change, archives versions automatically and keeps a complete audit trail. Automated notifications and reminders capture each insider's confirmation, and access controls limit who can see the lists.

How do you control employee personal trading?

What to include in a personal trading policy

Set out what you expect of employees in their personal trading, and alert them to the risks of market abuse and market manipulation. A clear policy helps you meet your obligations under MAR. If your company is itself an investment firm, or a bank providing investment services, it also supports the personal transaction rules under the Markets in Financial Instruments Directive (MiFID II). Like any policy, it only works if you keep the policy current and acknowledged by employees.

How do pre-clearance and trade monitoring work?

With pre-clearance, employees submit a prospective trade to management before they carry it out. The company can then reject any trade that could create regulatory problems for the individual or for the company.

Monitoring covers what happens after. Use tools that alert you to breaches of your personal trading policy and of market abuse and manipulation rules.

Persons discharging managerial responsibilities (PDMRs), and persons closely associated with them, must also notify their own transactions to the issuer and the NCA once their total for the calendar year reaches the notification threshold. Since the Listing Act, the default threshold is €20,000, and NCAs can set it anywhere between €10,000 and €50,000, so check the figure that applies in your country. Each notification is due within three business days of the transaction, and the issuer then has two business days from receiving it to make it public.

For PDMRs, InsiderLog's Employee Trade Center manages transactions from pre-approval to reporting. Thresholds, trading windows and insider status stay aligned in one system. Compliance sees pending, approved and rejected transactions on one dashboard, and each PDMR receives a PDF of their report for submission to the NCA.

Managing conflicts of interest

Collecting and analysing declared interests

Ask employees to declare their financial and family interests when they join, and again as their role in the company develops. Then analyse what they declare against the interests of the business. A declaration nobody reviews protects nobody.

What mitigation strategies and sanctions should you put in place?

Mitigation strategies include moving a stakeholder to another project or department, or asking a director to recuse themselves from certain discussions. Plan these responses before a conflict appears.

Pair those plans with sanctions for failing to declare. Your internal stakeholders should know that hiding a conflict of interest is unacceptable and could bring regulatory consequences.

The role of an independent oversight committee

An impartial panel can rule on whether a potential conflict actually meets the threshold. That ruling also answers the cost question in this area: it shows where to focus your compliance effort and where a lighter touch is enough.

How do you build a speak-up culture under the EU Whistleblowing Directive?

Reporting channel and investigation requirements

The EU Whistleblowing Directive, and the national laws that transpose it in each Member State, require reporting channels that accept written and/or verbal reports and keep the reporter's identity private.

Two deadlines shape the investigation. You must acknowledge a report within seven days and give the whistleblower feedback within three months. The person or team running the investigation can be internal or external, but must have no conflict of interest with the reporting person or anyone named in the report.

How do you protect whistleblowers and their rights?

Protect whistleblowers with robust non-retaliation policies, dissuasive sanctions for anyone who breaches them, and clear communication so every stakeholder understands them. Retaliation can come from the company, from management or from the whistleblower's own peers.

Train employees and leadership on what the law gives whistleblowers: confidentiality, protection from retaliation and free, comprehensive information about their rights. They should also receive legal protection, legal aid to fight retaliation, financial assistance and access to psychological support.

Encouraging people to speak up and learning from reports

The cheapest investigation is the one you never need. An environment where people are encouraged to be open and to act in the interests of colleagues, the company and its clients avoids many lengthy, costly cases.

Explain how to make a report and what happens after it. People who know the workflow worry less about speaking up. Then keep records of every investigation and analyse them, so you can see where breaches happen most and whether your mitigation measures are working.

IntegrityLog is a reporting platform compliant with the EU Whistleblowing Directive. It supports confidential reporting, anonymous if required, and lets you communicate with the reporting person without ever meeting them. Only authorised people can access case details, and a dashboard keeps you on track with deadlines.

Frequently Asked Questions

InsiderLog for insider lists and PDMR transactions

InsiderLog manages insider lists in the ESMA-mandated format, closed periods and the documentation of delayed disclosure in one auditable system. Its Employee Trade Center takes PDMR transactions from pre-approval to reporting.

IntegrityLog for whistleblowing

IntegrityLog is an internal reporting channel compliant with the EU Whistleblowing Directive. Authorised people can stay in contact with reporters while keeping their identity confidential, and reports can be anonymous.

PolicyLog for policy management

PolicyLog keeps your policies in one place, with version control, review reminders and alerts on changes to the regulations you subscribe to.

Which of these controls is worth its cost for your business is a question you will keep answering as the rules change. To follow those changes with peers, subscribe to the Compliance Alliance for compliance webinars and regulatory updates. To see the tools at work, request a demo.