How to Structure Insider Lists Before an IPO

In the months before an Initial Public Offering (IPO), companies in the European Union face increased regulatory scrutiny of how they manage inside information. The Market Abuse Regulation (MAR) requires issuers to keep structured, compliant insider lists and mishandling them exposes a company to significant legal, financial and reputational risk. This guide sets out a practical framework for building and managing insider lists in line with MAR, tailored to the pre-IPO period.

A pre-IPO insider list is the record an issuer keeps under Article 18 of MAR of everyone who has access to inside information while it prepares to go public: who they are, why they have access and exactly when they got it. It is more than a compliance checkbox. It is an audit tool and a legal safeguard. A poor or outdated process is a major liability for a company approaching an IPO.

1.1 Why the months before an IPO multiply the flow of inside information

Going public is one of the most sensitive periods in any company's life. Strategic plans are formalised, documentation is prepared and external advisers become involved, so the flow of inside information multiplies.

As the IPO gets closer, the number of insiders grows significantly. It often includes external advisers, board members and internal staff with insight into product or financial performance. Without the right tools and processes, this growing circle of insiders becomes difficult to monitor and manage.

1.2 Who checks: ESMA and national regulators (BaFin, AMF, CNMV, FCA)

The European Securities and Markets Authority (ESMA) and national competent authorities such as BaFin, the AMF, the CNMV and the FCA require issuers to account for exactly who had access to what information, and when. The insider list is the document that answers that question.

1.3 89% of MAR enforcement actions involve insider list failures

89% of MAR enforcement actions involve failures in insider list management. When regulators act under MAR, the insider list is very often part of the problem, which is why it deserves attention well before the listing date.

1.4 67% of IPO due diligence delays come from incomplete insider access records

67% of IPO delays linked to due diligence bottlenecks are caused by incomplete insider access records. Investment banks, regulators and legal counsel often request insider access logs during IPO preparation. A clean, segmented and timestamped record speeds up that review and builds trust.

2. How should you structure insider lists before an IPO?

Every pre-IPO insider list starts from Article 18 of MAR. Issuers must keep a list with a separate section for each piece of inside information, record specific details for each individual and keep the data accurate and promptly updated. Each list must be kept for at least five years after it is drawn up or updated, but an insider’s personal data must not be kept for more than five years after they leave the list. For each insider, record their first name(s) and surname(s), professional telephone numbers, their function and reason for being an insider, the date and time they obtained and ceased access (in UTC, yyyy-mm-dd, hh:mm), and their national identification number (or, only where none applies, their date of birth). Each section also records when it was created, when it was last updated and when it was sent to the competent authority. Missing any of these can lead to non-compliance and sanctions. Lists must also be ready to export immediately, because MAR requires you to provide them to the competent authority as soon as possible on request.

Under the EU Listing Act, a lighter, standard insider list format now applies to every issuer, not just those on SME growth markets (Commission Implementing Regulation (EU) 2026/1291, in force since 5 July 2026). Personal home addresses, personal phone numbers and surnames at birth are no longer required, and the company name and address no longer have a field of their own. For a third-party adviser, such as a bank, law firm or auditor, you list a single contact person and record the firm’s name and address in the function and reason field. The adviser keeps its own insider list for its staff.

If you are listing on an SME growth market, such as one of the Euronext Growth markets, you can keep a simpler list: only the people who, because of their function or position, have regular access to inside information, with the date and time each one obtained and ceased that access. This list has no event-based sections. Your Member State can still require a fuller list, so check with your national competent authority.

2.1 Segment lists by project or event

Split insider lists into logically separate projects or events, such as:

• IPO preparation

• Drafting of the prospectus

• Roadshow planning

• Governance discussions

• External adviser involvement (legal, audit, IR, PR), recorded through one contact person per firm

2.2 Maintain a core "IPO preparation" master list

It should include the internal employees involved across multiple workstreams and, for each external adviser, its designated contact person.

2.3 Use the permanent insiders’ section with care

A common mistake is keeping a single, monolithic insider list for everyone. It lacks precision and does not meet the MAR templates, which require a separate section for each piece of inside information. The templates do allow a separate permanent insiders’ section, but only for people who, because of their function or position, have access to all inside information at all times. Anyone listed there should not also appear in the event-based sections. Everyone else belongs in the section for each piece of inside information they can access. Issuers on an SME growth market can instead keep the single regular-access list described above.

2.4 Timestamp both access and removal

Log the moment each person obtains access and the moment that access ends, in UTC (yyyy-mm-dd, hh:mm). When someone loses access, complete the “ceased” field rather than deleting their entry, including in the permanent insiders’ section. These timestamps form the basis of your audit trail, and regulators often ask for them.

3. How do you run insider list management day to day before an IPO?

Run it with a clear owner, automated insider acknowledgements, real-time updates and software built specifically for MAR insider lists. Together, these turn the insider list from a last-minute document into a live, auditable control.

3.1 Assign a list owner

Designate a responsible person or team, often legal or compliance, to:

• Control list creation and updates

• Manage acknowledgement requests

• Coordinate with external advisers

3.2 Automate insider acknowledgements: 60% of audited insiders hadn't acknowledged their obligations

Under MAR, everyone on an insider list must be informed of their obligations and confirm they are aware of them. In practice, this is where many companies fall short: 60% of insiders listed in MAR audits had not acknowledged their obligations (source: ESMA coordinated action on insider list compliance, 2023).

Automate the process with digital tools that notify insiders, deliver regulatory disclosures and collect timestamped confirmations of receipt. To reduce liability:

• Automate acknowledgement collection, with electronic signatures and audit timestamps

• Distribute a MAR Insider Guide with clear, accessible dos and don'ts

• Run a compliance briefing or short video training for all insiders

These practices improve audit readiness and show regulators and investors a proactive compliance culture.

3.3 Enable real-time updates

Manual spreadsheets are no longer enough. Regulators now expect real-time, traceable updates and secure access management.

3.4 Use MAR-compliant software: 6 must-have features

MAR sets highly specific standards for how insider lists are created, maintained and overseen. Manual spreadsheets and generic compliance tools often fail to provide the traceability, precision and legal defensibility required. Insider list software must do more than store names: it must enable real-time, auditable compliance with Article 18. Look for:

1. Project-based segmentation: separate insider lists by event, such as IPO preparation or governance discussions, as MAR requires.

2. Regulator-compliant fields: capture and validate every field in the Implementing Regulation (EU) 2026/1291 templates, including names, national ID number or date of birth, reason for access, professional phone numbers and UTC timestamps for when access was obtained and ceased.

3. Automated acknowledgement workflows: make sure every insider is informed of their obligations and has acknowledged them, with timestamped records.

4. UTC timestamping and change logs: keep a secure, exportable audit trail of when each entry was created, updated or ceased.

5. Secure access controls: use role-based permissions and two-factor authentication to restrict access to sensitive data and support decentralised compliance where needed.

6. Instant reporting: generate regulator-ready reports in one click, including historic versions of any list.

4. What are the most common pre-IPO insider list mistakes?

The average fine for insider list-related MAR breaches issued by EU regulators is €1.5 million. Despite best intentions, many pre-IPO companies make missteps that expose them to that risk. These are usually due to a lack of structure, inadequate tools or a misunderstanding of MAR requirements.

The most common mistakes are:

1.  Generic reasons for inclusion: Listing "project involvement" or "IPO work" as the reason for access fails MAR's requirement for specificity. Regulators expect clear, documented justifications linked to the nature of the inside information.

2. Creating the list too late: Waiting until inside information has already circulated is non-compliant. Insider lists must be set up the moment inside information is identified, not retroactively. Since 5 June 2026, the Listing Act no longer requires issuers to disclose intermediate steps in a protracted process, but any step that qualifies as inside information must still be recorded on an insider list.

3. Missing required data fields: Incomplete data, such as missing national ID numbers (or dates of birth where no national ID applies) or professional phone numbers, is a frequent compliance breach. The templates in Implementing Regulation (EU) 2026/1291 leave no room for gaps: every field must be completed, and the list must be kept accurate and up to date.

4. Relying on static tools like Excel: Spreadsheets are poorly suited to dynamic compliance workflows. They lack version control, audit trails and secure access protocols, which increases both the administrative burden and the risk.

5. Not keeping lists up to date: Insider lists must be updated promptly whenever access changes. When someone no longer has access, record the date and time it ceased rather than deleting their entry, so the list shows who had access and when.

6. No insider acknowledgement process: MAR requires every listed individual to be informed of their obligations and to confirm they understand them. Companies that overlook or delay this step are at high risk of sanctions.

7. Treating the insider list as an afterthought: When insider list management is left to junior staff or handled at the last minute before an IPO filing, quality and compliance suffer. Regulators expect proactive, high-integrity controls from day one.

5. Is your pre-IPO insider list MAR-compliant? An 8-point checklist

If you answered "no" to any of these, your process may fall short of MAR expectations.

6. FAQ: pre-IPO insider lists and MAR

7. Conclusion: build insider list management into your IPO plan from day one

For EU companies approaching an IPO, insider list management is not just a regulatory requirement but a strategic safeguard. Regulators expect precise records that are updated in real time, stored securely and easy to audit.

Yet 4 out of 5 pre-IPO companies still rely on Excel for insider list tracking. With spreadsheets and email, updates are often delayed, data is exposed to email leaks, version control is manual and error-prone, acknowledgements mean chasing people by email, and teams scramble when a regulator asks for the list. Purpose-built insider list software gives you instant, auditable updates, encrypted role-based access, centralised version history, automated acknowledgement workflows and lists that are always ready to export.

By building insider list management into your IPO planning early, with the right tools, ownership and processes, you demonstrate control, professionalism and readiness. To regulators, underwriters and investors, that sends a clear message: your organisation takes compliance seriously and is equipped for public life.

Have questions about your current insider list process, or want to see what full MAR compliance looks like in practice? Talk to an InsiderLog expert.