What must an insider list contain, and who must keep it?

An insider list records who has had access to inside information, so that a regulator investigating suspicious trading can see quickly who knew what, and when. Issuers must keep one, and so must each person acting on their behalf or for their account, such as a law firm or corporate finance adviser on a deal, each drawing up its own list. Where another person keeps the list for the issuer, the issuer remains fully responsible and keeps a right of access to it. Emission allowance market participants, auction platforms, auctioneers and auction monitors keep lists too. The duty applies only to issuers that have requested or approved admission of their instruments to a regulated market, approved trading on an MTF or OTF, or requested admission to an MTF.

The list covers everyone with access to inside information who works for the issuer under an employment contract or otherwise performs tasks giving access, for example advisers, accountants and credit rating agencies. Each entry shows at least the person's identity, why they are listed, the date and time they gained access, and the date the list was drawn up. The issuer takes all reasonable steps to make every listed person acknowledge in writing the legal and regulatory duties involved and confirm that they know the sanctions for insider dealing and unlawful disclosure.

Updates follow changes in who has access and why; there is no fixed timetable. The list is updated promptly, with the date of the update, whenever the reason for listing someone changes, someone new gains access, or someone stops having access; each update states the date and time of the change that triggered it. The list is not filed routinely: it goes to the competent authority, in Cyprus CySEC, as soon as possible when asked. It is kept for at least five years after it is drawn up or updated.

Implementing Regulation (EU) 2026/1291, in force since 5 July 2026, sets the templates for all insider lists. SME growth market issuers that list only persons with regular access use a simpler single-list template. The list has a section for each piece of inside information, and people who have access to all inside information at all times may be put in a separate permanent insiders' section instead. Entries record names, professional telephone numbers, function and reason, when access began and ended, and a national identification number or, failing that, date of birth. The main list is kept electronically, with access restricted and earlier versions retrievable; an SME growth market issuer's list may be kept in any form that protects its completeness, integrity and confidentiality. Personal data may be kept for no more than five years after a person leaves the list, a data-protection ceiling that sits alongside MAR's five-year minimum.

The exam material describes the original rule, under which issuers on an SME growth market were exempt from drawing up a list if insiders acknowledged their duties and the issuer could produce a list on request. Since 1 January 2021 they must keep a list, but may include only those persons who, because of their function or position, have regular access to inside information. A Member State may require a full list where specific national market integrity concerns justify it; Cyprus law contains no such requirement. The list goes to the regulator on request. Insider lists are also separate from the list of managers and their closely associated persons that issuers keep for managers' transactions.