The difference between compliance and proof

There is a version of regulatory scrutiny where your organisation followed every rule and still does not come out well. Not because the decisions were wrong — but because the evidence is scattered, the timeline has to be reconstructed and the story takes too long to tell.

In market abuse compliance, the strength of your legal position depends at least as much on documentation quality as it does on the underlying decisions. Knowing the law is not the same as being able to defend what you did under it.

Evidence gaps that surface under pressure

Insider list management is where this tends to become visible first. In active periods — earnings, M&A, debt financing — the insider population changes quickly. If updates happen across multiple versions, owned by different people, with no clear version control, what you end up with is a patchwork. 'This spreadsheet was current, except when it was not' is exactly the kind of inconsistency that undermines credibility with a regulator.

The same applies to closed periods. ESMA has clarified what 'announcement' means for the purposes of determining when the 30-day window ends — but the legal risk in practice is not usually about knowing the rule. It is about being able to show that the right population was notified, that those notifications can be evidenced and that any exceptions or approvals were handled consistently and documented in real time, not reconstructed afterward.

PDMR transaction records are where the forensic pressure gets most acute. When approvals live in email threads, producing a complete, chronological sequence under time pressure is genuinely hard. The questions that tend to follow — was the person inside at the time? was a closed period in effect? was the threshold accurately tracked year-to-date? — each require a clean record that most email-based processes simply do not produce.

On thresholds specifically: Article 19(8) of the Market Abuse Regulation (MAR), as amended, sets the general annual notification threshold at €20,000, with competent authorities able to move it to €50,000 or lower it to €10,000. If thresholds are tracked manually and applied inconsistently across a year, that inconsistency is very hard to explain after the fact in a way that does not raise further questions.

Legal inherits the consequences of everyone else's processes

In fragmented compliance environments, legal tends to become the clean-up function. Not by design, but by gravity. Compliance has the lists; company secretary tracks PDMR scope changes; finance owns the results calendar; IR manages disclosure timing. Each function does its part. But when a regulator asks for the file, it is legal that has to assemble it — from tools that were never designed to work together.

That is not just an operational problem. It is a legal exposure. The defensibility of a compliance programme is measured, in part, by whether it can be evidenced as a coherent, connected control chain. A collection of email approvals, multiple spreadsheet versions and a shared drive document with an ambiguous date does not constitute one.

One timeline. One file. One version of events.

The legal case for an integrated MAR platform is not primarily about reducing manual effort, though that matters. It is about producing a record that is coherent, complete and quickly retrievable — one that holds up when someone reads it carefully and asks hard questions about what happened and when.

InsiderLog connects insider list management, closed period monitoring, PDMR transaction tracking and delayed disclosure documentation into a single workflow with a single audit trail. Insider lists are maintained in the ESMA-mandated format. Notifications and confirmations are captured automatically. Delayed disclosure decisions are documented in the required structure and remain accessible. Threshold tracking is continuous. Changes are timestamped and archived.

The result is that the 'regulator conversation' stays factual — because the record is coherent, the timeline is intact, and legal does not need to reconstruct anything.

Schedule a consultation with a compliance specialist to see how an integrated workflow changes your organisation's legal exposure.