How to Create and Manage MAR Insider Lists: The 2026 Checklist

1. What is an insider list under MAR?

An insider list is a register of every individual who has access to inside information and who works for the issuer, whether under a contract of employment or by performing tasks through which they obtain access, such as advisers, accountants or credit rating agencies. Article 18 of MAR makes the insider list mandatory for issuers and for any person acting on their behalf or on their account.

The insider list serves two distinct purposes. Internally, it controls the circulation of inside information and reminds each insider of their legal obligations. Externally, it provides competent authorities with an immediate evidential record when they investigate suspicious transactions or an unlawful disclosure.

For the complete regulatory background, consult our guide to Article 18 of MAR and our insider list definition.

2. What changed for insider lists in 2026?

Two regulatory changes took effect in summer 2026. On 5 June 2026, amendments introduced by the EU Listing Act (Regulation (EU) 2024/2809) to the disclosure provisions of MAR began to apply, including a revised condition for delaying public disclosure. On 5 July 2026, Implementing Regulation (EU) 2026/1291 introduced new insider list templates applicable to all issuers. The core obligations under Article 18 remain unchanged.

2.1 One simplified format for all issuers

Implementing Regulation (EU) 2026/1291 repeals Implementing Regulation (EU) 2022/1210, which had itself replaced the original templates in Implementing Regulation (EU) 2016/347. It extends the alleviated format, previously reserved for certain SME growth market issuers, to every insider list maintained under Article 18. Issuers should therefore migrate existing insider lists to the new templates and use them for every new list.

2.2 Fewer personal data fields to collect

The new templates require considerably less personal information. For each insider, issuers record the first name and surname, professional telephone numbers, function and reason for inclusion, the date and time at which access was obtained and ceased and the national identification number or, where no such number applies, the date of birth. Birth surnames, personal telephone numbers and home addresses are no longer required. For a third-party service provider, such as a law firm or an investment bank, the issuer lists a single natural person as the contact and includes the firm’s name and address in the function field.

2.3 What stays the same

The obligations in Article 18 are otherwise unchanged. Issuers must still open a separate list for each piece of inside information, update the insider list promptly, obtain written acknowledgements and provide the list to their competent authority as soon as possible upon request. The insider list must also be maintained in electronic form that restricts access to clearly identified individuals, keeps the information accurate and current, and preserves access to previous versions.

3. Who must keep an insider list?

4. When must you open an insider list?

Issuers must open an insider list as soon as inside information exists and any individual has access to it, irrespective of any decision to delay disclosure. ESMA has confirmed that insider list obligations apply throughout the period in which information qualifies as inside information, even if that information subsequently loses its price sensitivity and is never published.

4.1 What counts as inside information?

Under Article 7 of MAR, inside information is information of a precise nature that has not been made public, relates directly or indirectly to an issuer or its financial instruments and, if made public, would be likely to have a significant effect on the prices of those instruments. Typical examples include acquisition negotiations, financial results that differ materially from market expectations, an unexpected change in dividend policy, the planned departure of a chief executive and a regulatory decision concerning a key product.

4.2 Delayed disclosure: the conditions since 5 June 2026

Issuers must disclose inside information to the public as soon as possible. Article 17(4) permits a delay, on the issuer’s own responsibility, only where three cumulative conditions are met: immediate disclosure is likely to prejudice the issuer’s legitimate interests; the inside information is not in contrast with the issuer’s latest public announcement or other communication on the same matter; and the issuer is able to ensure its confidentiality. The second condition replaced the former requirement that the delay must not be likely to mislead the public.

A Commission Delegated Regulation (EU) 2026/789, in force since 19 July 2026, sets out a non-exhaustive list of situations in which inside information may be in contrast with earlier communications, including material changes to forecasts, financial results or business strategy. ESMA consulted on revised guidelines on delayed disclosure in early 2026 and expects to publish its final guidelines in the fourth quarter of 2026.

Where an issuer delays disclosure, it should document the decision comprehensively: when the inside information arose, when the decision to delay was taken, when publication is expected, which individuals were responsible and how each condition was satisfied. Immediately after publication, the issuer must inform its competent authority that disclosure was delayed. Depending on the Member State, the issuer either submits a written explanation of how the conditions were met at that point or provides it upon the competent authority’s request.

The Listing Act also modified the disclosure treatment of protracted processes. Intermediate steps, such as the negotiation phase of an acquisition, no longer need to be disclosed, because the disclosure obligation now attaches to the final event or circumstance. Where an intermediate step nevertheless constitutes inside information, the issuer must still maintain an insider list for it.

5. How to create a MAR-compliant insider list in six steps

Creating a compliant insider list involves six consecutive steps: identifying the inside information, opening a dedicated list, adding the individuals with actual access, deciding whether to use a permanent insiders’ list, recording the required data in the 2026 format and obtaining written acknowledgements. Each step generates documentary evidence that your competent authority can inspect.

Step 1: Identify the inside information and record when it arose

Confirm that the information satisfies the definition in Article 7 and record the date and time at which it was identified. The 2026 templates require this timestamp for every list, expressed in the yyyy-mm-dd, hh:mm format and in Coordinated Universal Time (UTC). Describe the specific piece of inside information precisely, so that anyone reviewing the insider list subsequently understands exactly what it covered.

Step 2: Open a separate insider list for each piece of inside information

Each piece of inside information requires its own event-based insider list. Several pieces of inside information can exist simultaneously, for example a pending acquisition and an unexpected profit warning. Separate lists demonstrate precisely which individuals had access to which information, the evidence competent authorities require when they reconstruct an unlawful disclosure.

Step 3: Add only people with actual access

List every individual who actually has access to the information, including employees, directors and the designated contact persons of external service providers. Do not include individuals who could theoretically access the information but have not done so. Record the date and time at which each individual obtained access, specified to the minute in Coordinated Universal Time.

Step 4: Decide whether to use a permanent insiders’ list

Individuals who, due to the nature of their function or position, have access to all inside information at all times may be listed in a separate permanent insiders’ list. If you maintain one, do not duplicate those individuals in the event-based list. Keep this list deliberately small: classifying someone as a permanent insider asserts that they access every piece of inside information and ESMA has long advised that only a very limited group of senior individuals should qualify.

Step 5: Record the required data in the 2026 format

For each insider, the templates in Implementing Regulation (EU) 2026/1291 require the following information. Our insider list template guide explains how to implement the prescribed format operationally.

Each list additionally documents its creation timestamp, the timestamp of its most recent update and the date of its transmission to the competent authority.

Step 6: Inform insiders and collect written acknowledgement

Article 18(2) requires issuers to take all reasonable steps to ensure that every insider acknowledges in writing the legal and regulatory duties entailed and is aware of the sanctions applicable to insider dealing and unlawful disclosure of inside information. In practice, notify each individual when you add them, explain that they must not deal on the basis of the information, recommend or induce others to deal, or disclose it unlawfully and follow up until they confirm. Retain each acknowledgement alongside the insider list.

6. How to manage an insider list until it is closed

An insider list is a continuously evolving record. Issuers must update it promptly whenever circumstances change, restrict access to it, preserve every previous version, provide it to the competent authority upon request and retain it for the required period. Closing a list correctly is as important as opening it, particularly when a competent authority later examines the chronology.

6.1 When must you update the list?

Article 18(4) specifies three triggers for an update: a change in the reason for including an individual, a new individual obtaining access and an individual ceasing to have access. Each update must specify the date and time of the triggering change and the 2026 templates additionally record the time of each list’s most recent update in UTC. The requirement to update promptly leaves little room for periodic batching, so amend the insider list when the change occurs rather than at the end of the week.

6.2 How to control access, versions and the audit trail

Outside the SME growth market regime, insider lists must be maintained in electronic form that restricts access to clearly identified individuals who require it. A spreadsheet circulated by email makes these controls difficult to demonstrate. Your documentation should therefore establish which individual modified which entry, and at what time.

6.3 How to close the list and inform insiders

A insider list closes when the information is published or ceases to be inside information, for example when negotiations collapse and the information loses its price sensitivity. Record the precise date and time at which each insider ceased to have access, because that final timestamp completes the documentary record. It is good practice to notify insiders that the information no longer constitutes inside information, so that they understand the associated restrictions have ended.

6.4 How to send the list to your regulator on request

Article 18(1)(c) requires issuers to provide the insider list to their competent authority as soon as possible upon its request. Each competent authority specifies on its website the electronic means it accepts, which must preserve the completeness, integrity and confidentiality of the insider list during transmission. Record the transmission date in the list itself and verify whether your competent authority applies additional national practices.

6.5 How long must you keep an insider list?

Article 18(5) requires issuers, and any person acting on their behalf or on their account, to retain each insider list for at least five years after it is drawn up or updated. The 2026 templates introduce a ceiling for personal data: issuers must not retain an insider’s personal data for more than five years after that individual ceased to be on the list. Incorporate both dates into your data retention schedule.

7. Your insider list compliance checklist

8. What are the penalties for insider list breaches?

Since the EU Listing Act, fines for legal persons that infringe Article 18 are calculated, as a general rule, on turnover: every Member State must empower its competent authority to impose maximum fines of at least 0.8% of total annual turnover. Where that amount would be disproportionately low, the authority must be able to impose at least €1 million instead, and Member States may set an alternative of at least €400,000 for SMEs. For natural persons, the maximum fine remains at least €500,000. National legislation may establish higher ceilings and competent authorities may also apply other administrative measures, such as public warnings. An incomplete insider list also weakens an issuer’s position in any broader market abuse investigation.

8.1 Maximum fines for Article 18 breaches

Article 30(2) of MAR establishes minimum levels for the maximum administrative fines that competent authorities must be able to impose. Since the Listing Act, the amounts for legal persons are based on turnover. For infringements of Articles 18 and 19, the maximum fine must reach at least 0.8% of total annual turnover, or at least €1 million where that would be disproportionately low. For Article 17, which governs the disclosure of inside information, it is at least 2% of turnover, or at least €2.5 million. Insider dealing and market manipulation attract considerably higher ceilings, of at least €15 million or 15% of total annual turnover. For natural persons, the maximum fine for Article 18 infringements remains at least €500,000. Enforcement is active: across the sectors within ESMA’s remit, national authorities imposed more than 970 administrative sanctions and measures in 2024, and the highest fines were imposed under MAR and MiFID.

Competent authorities also sanction insider list infringements independently. In one case documented on our blog, a national authority reprimanded a bank for failings that included insufficient information on an insider list relating to the resignation of its chief executive.

8.2 Case study: a delayed announcement, a leak and three fines

In the late 2010s, a European biotechnology company learned that a negative opinion on a key marketing authorisation application was highly likely, yet waited more than five weeks before publishing the information. The national regulator concluded that the company had not demonstrated a legitimate interest in delaying disclosure and fined it €1 million, a penalty subsequently reduced to €800,000 on appeal. A co-founder had disclosed the information to a shareholder, who traded on it both personally and on behalf of investment funds. The co-founder was fined €50,000 and the shareholder €500,000, partly in relation to a second piece of inside information a year later.

The regulator’s published summary, which our full case study analyses in detail, concentrates on disclosure and the unlawful communication rather than on the insider list. Nevertheless, the case demonstrates why the list matters: a complete, timestamped record of who had access is the evidence a regulator can use to reconstruct how information reached the market and the written acknowledgement is the moment at which each insider is formally warned.

9. Excel or specialist software: which is safer for insider lists?

MAR does not prohibit spreadsheets, but spreadsheets make compliance difficult to demonstrate. The 2026 rules require restricted access, accurate and current information, accessible previous versions and precise UTC timestamps. A spreadsheet circulated by email struggles to satisfy those requirements, whereas specialist insider list software embeds them in the workflow and generates an audit trail your competent authority can follow.

10. Frequently Asked Questions

12. References and further reading

• Article 18 of MAR explained
• MAR checklist for advisers
• 2026 Changes to the Market Abuse Regulation: What Issuers need to Know