MAR insider lists for advisors: your client starts the clock, your firm keeps the list

A non-executive director at a European drinks company knew the board was about to appoint a new chief executive. Before the news was public, he bought 200,000 of the company's shares for his retirement fund. The national regulator banned him from working in a regulated financial firm for five years and fined him €75,000.

The company was fined too: €90,000, not for the trade but for discrepancies in its insider list. The regulator found that it had not updated the list promptly, had not dated each update, and had not recorded which external parties acting on its behalf had access to the information.

That last finding is the one for advisory firms. The external parties acting on an issuer's behalf are firms like yours.

1. Does an advisory firm need its own insider list under MAR?

Yes. Article 18 of the Market Abuse Regulation (MAR) requires issuers and anyone acting on their behalf, such as advisors, accountants or credit rating agencies, to each draw up a list of the people with access to inside information. If your team can access a client's inside information, your firm keeps its own list for each piece of it.

An insider list records every person, inside or outside the company, who has access to a specific piece of non-public information that would move the price of a financial instrument if it were made public. Each piece of inside information gets its own list, and each person stays on it for as long as they have access.

1.1 What your client's list records about your firm

Your client's list does not name your whole team. It usually holds one contact person from your firm, with the same identifying details your client records for its own staff, including when they became aware of the information. The template in force since 5 July 2026 under Implementing Regulation (EU) 2026/1291 builds this in: its name columns ask for a third-party service provider's contact person, and its function column carries your firm's name and address. This is the entry the drinks company failed to keep. Everyone else at your firm with access belongs on your own list.

1.2 If your client outsources its list, who answers to the regulator?

Your client does. An issuer stays responsible for drawing up and maintaining its insider list, and for sending it to its national competent authority (NCA) on request, even when it outsources the work to an advisor or another third party.

Your firm answers for its own list. As BaFin's guidance on Article 18 sets out, that means drawing it up, keeping it updated and providing it to the NCA when asked. It also means telling your employees that they are on it and what that requires of them.

2. When does your firm have to open an insider list?

As soon as your client decides to delay disclosing inside information that your team can access. The list must be drawn up promptly and kept in electronic form, so your process has to exist before the call comes. Since 5 June 2026, the conditions for a delay have changed, and intermediate steps no longer have to be disclosed.

The information belongs to your client, and so does the decision. Your client judges whether information is inside information and whether to delay publishing it, and you rely on your client to tell you when your team has access and when it intends to delay. That judgement can go wrong. In the energy company case in section 6.1, the company decided a deal was not significant enough to count as inside information, and the regulator disagreed: it should have published the information promptly or, if it delayed, drawn up an insider list.

Three Listing Act dates change how advisors keep insider lists:

2.1 What changed for delayed disclosure on 5 June 2026

The Listing Act changed Article 17 of MAR in three ways, as part of the wider 2026 changes to the Market Abuse Regulation:

• A new condition for delay. Delay still requires that immediate disclosure would harm the issuer's legitimate interests and that confidentiality can be kept. The information must now also not contradict the issuer's latest public announcement on the same matter, replacing the test that a delay was not likely to mislead the public.
• No disclosure of intermediate steps. In a protracted process, only the final event must be published, as soon as possible after it occurs. Commission Delegated Regulation (EU) 2026/789 lists examples of final events.
• A confidentiality duty. The issuer must keep inside information confidential until it is disclosed.

Undisclosed intermediate steps can still be inside information, and Article 18(1) has not changed, so the people with access to them still belong on an insider list. Implementing Regulation (EU) 2026/1291 also sets how that list is kept: in an electronic form that limits access to the people who need it, keeps the information accurate and current, and keeps previous versions accessible. Decide in advance who opens a list, where it lives and who can see it.

3. Who on your team counts as an insider?

Only the people who actually have access to your client's inside information. Being staffed on the client is not enough on its own. Each insider must be told they are on the list, with the reason recorded, and must confirm in writing that they will not trade on the information or pass it on.

Not everyone staffed on a client will see the precise information, so deciding who is an insider takes judgement, person by person, and the answer changes as the work does. Each time someone gains or loses access, update the list and keep every version in case the NCA asks for it. Regulators check the detail: in the bank case in section 6.2, one list gave no reasons for including anyone, and some insiders were missing key personal details.

Each insider must also acknowledge their legal and regulatory duties in writing, and confirm they know the sanctions for insider dealing and for disclosing inside information unlawfully. You need to show that you made every effort to get that confirmation, which means following up until each person replies. Failing to do it can lead to sanctions.

3.1 What changes when your firm is on several clients' lists?

The workload multiplies. Each client that delays disclosure of information your firm can access means a separate insider list of your own. Some of your people may be insiders for two or more issuers at once, so you need to know, at any moment, who is an insider for which client.

As more people join a client's work, changes to the list multiply, and so does the risk of error, especially when someone keeps the list on top of their regular work. In spreadsheets, weak version control can leave the wrong list live.

The list itself is confidential, because it shows who knows what, and about which client. Keeping it that way takes access controls, so that people see only the lists they are party to, and insiders who understand why confidentiality matters. It also holds personal data, which you must handle in line with GDPR.

4. Do market soundings require an insider list?

Not while the sounding is under way. A market sounding can involve sharing inside information, and Article 11 of MAR sets out what must be recorded, but it does not require an insider list. Once the sounding ends, if the issuer delays disclosure, everyone with access to the information goes on an insider list.

When your firm gauges how the market might react to a possible transaction, it may pass on inside information. Record the information provided and who received it, and know the moment a sounding ends and an insider list begins.

4.1 What the Listing Act changed for market soundings

Since 4 December 2024, following the procedure in Article 11(4) has been optional. A firm that follows it, including recording all information given and when, is deemed to have disclosed it in the normal course of its work, and not following it creates no presumption that the disclosure was unlawful. The definition also widened: a market sounding now covers communications before the announcement of a transaction, if any.

Two records stay mandatory for every firm that conducts soundings, whichever route it takes. Before the sounding, a written record of whether it will involve inside information, and why (Article 11(3)). Once the information stops being inside information, a record that you told the recipients as soon as possible (Article 11(6)).

5. What the regulator found in the drinks company case

Each of the three findings against the drinks company matches a requirement that your firm's own list must meet.

The first was that the company had not updated its list promptly to show who did or did not have access. The template records this in two columns, Obtained and Ceased: the date and time each person gained and lost access to the information. Every change creates a new version of the list.

The finding that concerns advisors most was that the company had not recorded which external stakeholders acting on its behalf had access. That is the line in your client's list that points to your firm, and your own list covers everyone behind it.

5.1 The 2026 template: fewer fields, the same yyyy-mm-dd, hh:mm UTC timestamps

The company had also failed to date each update. Dates are written yyyy-mm-dd, the ISO 8601 format, and times hh:mm in UTC, and getting the format wrong is enough to expose your firm to sanctions. Implementing Regulation (EU) 2026/1291 keeps those formats and extends to all insider lists the lighter format once reserved for issuers on SME growth markets. It drops fields such as home address and personal phone numbers, but keeps each person's function and reason for being an insider, and each section's creation, update and transmission dates. Whoever keeps your lists needs to track changes like these, which is what regulatory horizon scanning is for.

5.2 Five years: the minimum for the list, the maximum for personal data

MAR requires each list to be kept for at least five years after it is drawn up or updated, with every previous version, the date and time of each change and the reasons for adding people. Since 5 July 2026, personal data on a list must be kept no longer than five years after a person leaves it. That dated history is what an investigation will rely on.

6. What can a missing or incomplete insider list cost?

Fines and reprimands. Since the Listing Act, national law must allow a maximum fine for a company's Article 18 breach of at least 0.8% of total annual turnover, or at least €1 million where that would be disproportionately low. For SMEs, Member States may set at least €400,000 instead.

Before the Listing Act amended Article 30, the reference figure was €1 million, with no turnover-based level, and Member States had until 5 June 2026 to apply the new levels. ESMA reported €212,167,889 in MAR-related administrative fines for 2023 in its annual sanctions report, including sanctions for Article 18 breaches.

6.1 Nearly €2.5 million for an unlawful delay in disclosure

A European energy company knew of a deal that would affect electricity supply to its home country's national grid, and did not make it public. Market participants traded on a false picture of how much power was being generated, and may have paid more than they needed to. The regulator found that the deal was inside information: precise, not public, related to wholesale energy products and likely to move their prices significantly. It fined the company nearly €2.5 million.

6.2 A bank reprimanded for one incomplete list and one missing list

A large European bank failed to create and populate insider lists for two statements on departures from its senior management, both of which it had identified as inside information. For one, it drew up no list at all. For the other, its list lacked key personal details and reasons for inclusion, had no record of when it was created or updated, and gave dates without times. The NCA reprimanded the bank on both counts; the outcome has not been made public.

7. What advisors can do before the client calls

Most of the insider list workload starts with your client, so the first protections lie in how you work with them. Build a trusted, collaborative relationship with each client, so you hear early and can act at once; some advisors also help clients identify and manage inside information under MAR. Stay alert to what each client is working on: if a client expects regulatory approval for a new product, for example, that news could create inside information and the need for insider lists.

Inside your firm, your team has privileged access to your clients' operations, and with it a great deal of trust. Make sure your people know their obligations and follow clear policies and procedures. That protects the client relationship and your firm's reputation.

8. How InsiderLog supports advisors' insider lists

InsiderLog lets advisory firms keep correctly formatted insider lists for inside information from many clients, with a clear view of each list's status. Each client and each piece of inside information gets its own list, with client records kept apart. Only authorised team members can access the data on the lists they manage, and the data is stored securely, in line with GDPR.

Every update is timestamped, so each client has a complete audit trail, and you can edit forms and emails to suit your needs without version-control issues while staying MAR compliant. Automated email reminders go to insiders until they confirm their obligations and the sanctions for non-compliance. An add-on market soundings module keeps accurate records of inside information disclosed during soundings, in line with MAR.

9. What still depends on your client

No process removes the starting point: the information is your client's, and so is the decision to delay. Your list can be correctly formatted, timestamped and complete, and still start late if no one tells you.

Request a demo to see how InsiderLog handles insider lists across your clients.