ESMA revises MAR guidelines on delayed disclosure: five new legitimate interests

Under MAR Article 17(4) an issuer may delay disclosing inside information if immediate disclosure is likely to prejudice its legitimate interests, the information is not in contrast with its latest public announcement on the same matter, and confidentiality is ensured. ESMA's guidelines illustrate the first condition with a non-exhaustive list. The revised Guideline 1 adds five cases.

1. An order from a public authority. The issuer must comply with an order to keep the information confidential issued by a public authority of a Member State, the EU or a third country, on the basis of law, a specific legal provision or powers recognised in case law. ESMA's examples are an order not to disclose a tender award and confidentiality on grounds of public policy, public security or public health. The delay lasts only as long as the order, and ESMA suggests keeping records of it to support the written explanation given to the national competent authority.

2. Collecting missing facts after an exceptional event. The issuer needs information that is not immediately available, for example on the effects of a major incident or cyber-attack, so that the market can assess the event correctly. The delay covers only the time needed to obtain it. ESMA says disclosure should follow as soon as a rough estimate of the damage is possible, and further analysis of the data or remedial action does not justify a longer delay. ESMA sets no fixed time limit, such as 48 hours for cyber incidents, and MAR disclosure is without prejudice to incident notifications under NIS 2, DORA and the GDPR.

3. Losing a business opportunity. Disclosure of sensitive commercial information may directly cost the issuer an identifiable and concrete business opportunity. ESMA's examples are competitors in other similar tenders using the terms of a contract award, and competitors adjusting their strategy after the issuer announces it will enter a new market or launch a new product. Following the consultation, this case covers private competitive processes as well as public procurement.

4. Appointing a key person. The issuer has appointed a member of its governing body, a manager or another key person who has not yet told their current employer that they will leave, and disclosure could jeopardise the decision. This applies only to the appointment decision formally taken by the governing body, and only for the period strictly necessary.

5. A delay by another group company. Information concerning the issuer has been delayed by another company in the same group, including a holding or subsidiary company, and the close links between them mean immediate disclosure would directly prejudice the issuer and undermine that delay. ESMA stresses that there is no automatic group-wide right to delay.

The Listing Act, Regulation (EU) 2024/2809, amended MAR Article 17 so that inside information on intermediate steps in a protracted process no longer has to be disclosed. Only the final event or circumstance must be disclosed, as soon as possible after it occurs. Under Article 4(3) of the Listing Act these changes have applied since 5 June 2026. Commission Delegated Regulation (EU) 2026/789, published in the Official Journal on 16 July 2026, lists protracted processes and the moment each final event is deemed to occur.

Many of the old examples in Guideline 1, such as negotiations on mergers and acquisitions, decisions awaiting approval by another body of the issuer and planned purchases or sales of major holdings, concerned such intermediate steps. ESMA has therefore deleted them. It kept, with new wording, the case of an issuer in serious and imminent financial distress outside insolvency law, but says it should be applied restrictively and does not cover a mere deterioration in performance such as a profit warning. Because the Listing Act replaced the condition that a delay must not mislead the public, ESMA also deleted Guideline 2.

The guidelines apply to national competent authorities and to issuers, so they concern issuers whose financial instruments are listed or traded in Cyprus and their compliance teams and boards. ESMA did not accept some requests from the consultation. A key manager's resignation, contractual confidentiality clauses and the need to coordinate with third parties are not legitimate interests in their own right.

The report adds no new procedural requirement for issuers, and issuers do not have to report to ESMA whether they comply. Within two months of publication in all languages, competent authorities must tell ESMA whether they comply. For background, see our study note on disclosing inside information and our study note on what counts as inside information.

Review the delay procedure and the decision template the board or disclosure committee uses. The first question is now whether the information is an intermediate step in a protracted process, using the Delegated Regulation's list. If it is, no delay is needed. A one-off event or the final event of a process can be delayed only if all three Article 17(4) conditions are met. ESMA reminds issuers that the legitimate interests are to be read narrowly and that ESMA expects disclosure as soon as the circumstances justifying the delay come to an end.

Update the records kept for each delay so they show which legitimate interest applies, including any authority order, why the information is not in contrast with the latest announcement, and how confidentiality is kept. The written explanation to the competent authority depends on these records, although issuers listed only on an SME growth market need to provide it only on request. For background on insider lists, see our study note on insider lists.