Article 18 MAR: Insider List Content, Format, and Retention

Article 18 of the Market Abuse Regulation (MAR) requires issuers, and anyone acting on their behalf, to keep a detailed electronic list of every person with access to inside information, update it promptly when access changes, retain it for at least five years, obtain written acknowledgments from those listed, and produce it to the competent authority on request. The insider list requirements under Article 18 MAR are prescriptive on both content and format, and breaches carry fines of up to €1,000,000 for companies and €500,000 for individuals.¹

Who Has to Keep a List

The obligation sits with two groups: the issuer whose financial instruments trade (or are seeking admission to trade) on a regulated market, and any person acting on the issuer’s behalf or account.² The second group is broad. Law firms advising on a deal, auditors, consultants working on a restructuring, credit rating agencies, and investment banks running an offering all fall inside it. Each outside firm keeps its own list covering its own people. You cannot rely on the issuer’s list to cover your team.

Issuers on an SME growth market are treated differently. Under Article 18(6), they are exempt from maintaining a full insider list if they take all reasonable steps to make sure anyone with access acknowledges the legal duties in writing and understands the sanctions for insider dealing, and if they can still produce a list on request from the competent authority.² Member states can opt out of that relief and require fuller lists from SME issuers, though the data fields remain reduced compared to the standard format.

What Each Entry Must Contain

Commission Implementing Regulation (EU) 2022/1210 sets the format for insider lists and replaced the earlier 2016/347 implementing regulation.³ For each person on the list, the following must be recorded:

Full name and birth surname (current surname, surname at birth if different, and first name).
Professional telephone number where the person can be reached at work.
Personal telephone number, such as a personal mobile or home number.
National identification number, where applicable.
Home address.
Reason for inclusion, meaning the specific project, deal, or event giving the person access.
Date and time the person first obtained access to that specific inside information.

The level of personal detail is deliberately high because regulators need to identify individuals quickly and cross-reference them against trading records across jurisdictions.⁴ The MAR obligation itself provides the lawful basis for processing the data under GDPR; the practical safeguard is tight access controls and secure storage of the list.

How the List Is Structured

Insider lists are divided into separate sections for each piece of inside information. Each section covers one event, deal, or corporate development and records every person who had access to that specific information.⁵ When a regulator investigates trading around an earnings announcement, they want to see exactly who had the earnings figures and when. The event-based structure delivers that.

Alongside the event sections sits a permanent insiders section for individuals who, by virtue of their role, have access to all inside information at all times.⁵ This typically includes the CEO, CFO, general counsel, and board members. Listing them once here avoids repeating the same names in every event section.

Lists must be kept in electronic form so they can be retrieved quickly and sent to regulators without delay.³ The format must keep the information complete, readable, and reconstructable from past versions. ESMA publishes standardized templates. SME growth market issuers have some flexibility on the electronic form requirement provided they still guarantee completeness, confidentiality, and data integrity.

Updating the List

Article 18 requires prompt updates in three situations:

When the reason for including someone on the list changes.
When a new person gains access to the inside information.
When someone ceases to have access.

Each update must record the date and time the change occurred.² This is where firms most often slip. A person leaves a project or moves roles, and compliance hears about it weeks later. Building the update trigger into HR and project workflows, rather than relying on ad hoc notifications, is what separates lists that survive regulatory scrutiny from those that don’t.

How Long to Keep It

Every insider list must be retained for at least five years after it is drawn up or last updated.⁶ The medium has to be durable, and past versions must remain reconstructable. Market abuse cases often surface long after the trade closes, and five years gives regulators room to look back.

Written Acknowledgment from Each Insider

Issuers and those acting for them must take all reasonable steps to make sure every person on the list acknowledges in writing the legal and regulatory duties involved, and understands the sanctions for insider dealing and unlawful disclosure of inside information.⁶ If a regulator investigates and the insider later claims not to have known the rules, the missing acknowledgment becomes the issuer’s problem. Most firms handle this with a standard form signed when access is first granted, stored alongside the list itself.

Producing the List to Regulators

The competent authority can demand the list at any time. On request, the issuer or the person acting on their behalf must provide it as soon as possible.² Regulators treat delay as a compliance failure in its own right. Most authorities operate secure electronic portals for submission, and the list must arrive in the prescribed electronic format. Once received, the regulator cross-references access timing against trading records; a purchase two days before an acquisition announcement by someone listed on the deal section is exactly the pattern the list is designed to expose.

Penalties for Non-Compliance

Under Article 30, competent authorities can impose administrative sanctions for insider list breaches. The maximum fine is €500,000 for a natural person and €1,000,000 for a legal person, or 0.8% of total annual turnover for a legal person, whichever is higher.¹ The Listing Act introduces a lower ceiling of €400,000 for SMEs on Article 18 breaches.

Regulators can also impose non-monetary sanctions: public censure, temporary bans on individuals holding management functions, and orders to cease the conduct. For professional service firms whose business depends on regulatory trust, a published finding of insider list failures often bites harder than the fine.

What Changes in July 2026

Regulation (EU) 2024/2809, the Listing Act, extends the alleviated insider list format currently available to SME growth market issuers to all issuers. The bulk of these provisions apply from July 2026.⁷ The practical effect is a reduction in the personal data collected for each entry. ESMA submitted its draft implementing technical standards to the European Commission in October 2025, and the Commission has three months to adopt them. The obligation to keep an insider list is unchanged; only the depth of personal detail per entry is being trimmed.

1
European Securities and Markets Authority. Annual Report on MAR Administrative and Criminal Sanctions
2
Legislation.gov.uk. Regulation (EU) No 596/2014 – Article 18 Insider Lists
3
EUR-Lex. Commission Implementing Regulation (EU) 2022/1210
4
EUR-Lex. Commission Implementing Regulation (EU) 2016/347
5
EUR-Lex. Commission Implementing Regulation (EU) 2022/1210
6
Legislation.gov.uk. Regulation (EU) No 596/2014 – Article 18 Insider Lists
7
European Securities and Markets Authority. Final Report on the Draft Implementing Technical Standards on the Extension of the Use of the Alleviated Format of Insider Lists