Insider lists 2026: new mandatory format for listed companies

Key data

If your company is listed on the stock exchange or advises listed companies, you have a new obligation on the table: the format in which you register people with access to privileged information has just changed. The Commission Implementing Regulation (EU) 2026/1291, published on 15 June 2026, replaces Commission Implementing Regulation (EU) 2022/1210 and establishes a new technical standard for insider lists throughout the European Union.

This is not a minor procedural change: it directly affects the compliance, general secretariat and legal adviser departments of any listed company. And the supervisor that will oversee its application in Spain is the CNMV.

What does this regulation establish?

Insider lists are mandatory registers that must be maintained by issuers of securities and those acting on their behalf. They identify all persons who have access to privileged information about the company: executives, external advisers, lawyers, investment bankers or any other professional involved in a sensitive operation (a merger, a capital increase, an unpublished result, etc.).

Until now, the format of these lists was regulated by the Commission Implementing Regulation (EU) 2022/1210. The new regulation repeals it entirely and replaces it with an updated format, with the aim of improving the ability of European supervisors to detect and prosecute market abuse.

The regulation does not modify the obligation to maintain insider lists (that has been required by MAR since 2016), but the specific technical format that these lists must follow. Any template, system or procedure based on the 2022 format will become outdated.

Economic and operational impact

The impact is not direct cost in the form of a fee or tax, but operational and compliance cost. Affected companies will have to assume:

• Review and update of internal templates for insider lists to adapt them to the new format.
• Update of registration systems (compliance software, document management tools) if they are parameterized with the 2022 format.
• Internal training for compliance, general secretariat and legal teams on the new formal requirements.
• Review of contracts with external advisers (investment banks, law firms) to ensure they also adapt their records to the new format when acting on behalf of the issuer.

The risk of inaction is clear: the CNMV can impose sanctions on issuers that do not maintain their insider lists in the format required by regulation. The market abuse regulation (MAR) already provides for a severe sanctioning regime for breaches regarding privileged information.

Who does it affect?

• Companies listed on Spanish and European regulated markets (Stock Exchange, BME Growth, EU markets).
• Issuers of securities that have requested admission to trading on an EU regulated market.
• Financial advisers (investment banks, M&A boutiques) acting on behalf of issuers and managing insider lists on their behalf.
• Legal advisers and law firms participating in operations with privileged information and included in or managing insider lists.
• Compliance departments (compliance officers) of listed companies.
• General secretariats and legal departments of companies with securities admitted to trading.

Practical example

A company listed on the Spanish Continuous Market is preparing a merger operation. From the start of negotiations, its compliance department opens an insider list for the project, including internal executives, the advisory bank, the external law firm and the auditors involved.

Until now, that list was prepared according to the format of the Commission Implementing Regulation (EU) 2022/1210. With the entry into force of the new Regulation (EU) 2026/1291, the company must use the new standardized format for any list it opens from that moment on. If the CNMV requests the list as part of an investigation and the format is not as required, the company is exposed to a sanctioning proceeding, regardless of whether the content of the list is correct.

The compliance officer of this company must therefore update the internal template before opening any new insider list and verify whether the advisory bank and external law firm have also adapted their own systems.

What should companies do now?

1. Identify all current templates and systems for insider lists based on the format of Regulation (EU) 2022/1210 and mark them for update.
2. Obtain and analyze the new technical format established by Regulation (EU) 2026/1291 through the official source on EUR-Lex.
3. Update internal templates for insider lists before opening any new list under the new regulation.
4. Review compliance management systems (software, digital tools) to ensure the new format is correctly parameterized.
5. Communicate the change to external advisers (banks, law firms, auditors) acting on behalf of the issuer and managing insider lists, requiring confirmation of adaptation.
6. Train the compliance team and general secretariat on the new formal requirements to avoid errors in future operations.
7. Document the adaptation process to be able to demonstrate to the CNMV, if necessary, that the company has taken diligent compliance measures.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601291