Market Abuse Regulation (MAR) — Regulation (EU)…

Which MAR controls do we need before our next earnings release — and what are auditors most likely to find missing?

MAR has been directly applicable across the EU since 3 July 2016, with insider lists, ad-hoc disclosure and PDMR notifications enforceable today and fines up to EUR 15 million or 15% of group turnover for insider dealing or market manipulation under [Art. 30 Abs. 2]; legal counsel owns immediate scope confirmation.

Short Answer

MAR catches every issuer admitted to or traded on an EU regulated market, MTF or OTF, plus their advisers, brokers and emission allowance market participants [Art. 2]. The hard duties auditors test first are: prohibitions on insider dealing and market manipulation [Art. 14, Art. 15], ad-hoc disclosure of inside information 'as soon as possible' with documented delay decisions [Art. 17], maintained insider lists kept for at least five years [Art. 18], PDMR transaction notifications within three business days plus a 30-day closed period before financial reports [Art. 19], and Suspicious Transaction and Order Reports (STORs) from any person professionally arranging or executing transactions [Art. 16]. Listing Act amendments via Regulation (EU) 2024/2809 reshaped Article 17 disclosure mechanics and Article 19 closed-period exceptions, and the European Single Access Point (ESAP) submission obligation under [Art. 21a] starts on 10 January 2028.

Who is affected

Every issuer with financial instruments admitted to trading or traded on an EU regulated market, MTF or OTF (irrespective of size or sector), their PDMRs and persons closely associated with them, emission allowance market participants above the de minimis CO2/thermal-input thresholds, auction platforms and monitors under Regulation (EU) No 1031/2010, and any investment firm, broker, asset manager, custodian or trading-venue operator that professionally arranges or executes transactions in MAR-scope instruments [Art. 2, Art. 16(2), Art. 17, Art. 19].

Deadline

Continuous compliance is enforceable today: ad-hoc disclosure 'as soon as possible' [Art. 17(1)], STOR reporting 'without delay' [Art. 16(2)], PDMR notification within three business days [Art. 19(1)], publication by issuer within two business days of receipt [Art. 19(3)], 30-day closed period before each interim or year-end report [Art. 19(11)], insider-list retention five years [Art. 18(5)]. Next dated milestone: 10 January 2028 — issuers must additionally submit Article 17 and Article 19(3) disclosures to the ESAP collection body [Art. 21a].

Risk

Ceiling for insider dealing or market manipulation [Art. 14, Art. 15] under [Art. 30(2)(j)(i)]: at least EUR 15,000,000 or 15% of total annual turnover for legal persons (Member States may set higher); at least EUR 5,000,000 for natural persons. Disclosure and PDMR breaches [Art. 16, Art. 17]: at least EUR 2,500,000 or 2% turnover for legal persons; insider-list and PDMR breaches [Art. 18, Art. 19]: at least EUR 1,000,000 for legal persons. Disgorgement of profits gained or losses avoided is mandatory and may be tripled [Art. 30(2)(b), (h)]. National regulators (BaFin, AMF, CONSOB, FCA-equivalents in EEA) routinely publish enforcement decisions and have repeatedly imposed six- and seven-figure fines for late ad-hoc disclosure and missing insider lists since 2017.

Proof

Legal status

• In force
• as of 2026-05-10
• Consolidated version of 4 December 2024 (incorporating amendments by Regulations (EU) 2016/1011, 2016/1033, 2019/2115, 2023/2869 and 2024/2809)

Primary sources

• EUR-Lex — Full text of the Market Abuse Regulation
• ESMA — Market Abuse — Q&A and guidelines for uniform application

What to do now

Legal / DPO

•Confirm in writing the universe of in-scope financial instruments and venues (regulated market, MTF, OTF) and document the legal basis for each issuer entity, including any SME growth market exemptions [Art. 2, Art. 18(6)].
•Review and refresh the Article 17(4) delay-of-disclosure protocol: written assessment template covering legitimate-interest test, no-misleading test and confidentiality safeguards, with mandatory ex-post notification to the competent authority and a documented retention trail [Art. 17(4)].
•Validate that closed-period rules and the narrow Article 19(12) and 19(12a) exceptions are reflected in the dealing code and that PDMR onboarding letters under [Art. 19(5)] are countersigned and archived.

Compliance

•Operate a permanent insider-list system with project-based and permanent sections, capturing identity, reason, date and time of access, with five-year retention and on-demand export to the regulator [Art. 18(1), (3), (5)].
•Run a documented ad-hoc disclosure workflow that triggers on inside-information identification under [Art. 7]: decision log, dual-control approval, dissemination via the officially appointed mechanism, and parallel website publication for at least five years [Art. 17(1)].
•Maintain a register of PDMRs and persons closely associated with them [Art. 19(5)], track transactions against the EUR 20,000 calendar-year threshold (or higher/lower national threshold under [Art. 19(8), (9)]), and publish the issuer notification within two business days of receipt [Art. 19(3)].

IT / Security

•Provision a tamper-evident, access-controlled insider-list platform with full audit trail of additions, removals and reason changes, supporting export in the ESMA template format demanded by the competent authority [Art. 18(1), (4), (9)].
•Implement secure channels and segregation of duties for STOR generation by trading-venue operations and professional intermediaries, with role-based access, retention and immutable timestamps to evidence 'without delay' notification [Art. 16(1), (2)].
•Prepare ESAP submission pipelines: machine-readable formats and metadata (LEI, issuer-size category, information type) routed to the relevant collection body in parallel with each Article 17 and Article 19(3) disclosure starting 10 January 2028 [Art. 21a].

Product / Engineering

•Embed an inside-information classification gate into product, M&A, pricing and clinical/contract-decision workflows so that material non-public events are flagged to the disclosure committee before any external touchpoint [Art. 7, Art. 17].
•Build a closed-period blocker into share-plan tooling and PDMR trading interfaces that prevents own-account dealing in the 30 days before each interim and year-end report [Art. 19(11)].
•Surface a market-sounding workflow for capital-markets activity: gatekeeper script, written sounding records and recipient acknowledgement, aligned with [Art. 11] safe-harbour conditions.

Key Terms

Inside information: Information of a precise nature, not made public, relating directly or indirectly to one or more issuers or financial instruments, which would, if made public, be likely to have a significant effect on prices [Art. 7(1)(a)]. Specific regimes apply to commodity derivatives and emission allowances [Art. 7(1)(b)–(c)].
Insider dealing: Where a person possesses inside information and uses it by acquiring or disposing of, for own account or on behalf of a third party, financial instruments to which that information relates; cancellation or amendment of pre-existing orders also qualifies [Art. 8].
Market manipulation: Conduct giving false or misleading signals as to supply, demand or price of a financial instrument, or securing the price at an abnormal or artificial level, including through transactions, orders to trade, dissemination of false information and benchmark manipulation [Art. 12].
Person discharging managerial responsibilities (PDMR): A member of an issuer's administrative, management or supervisory body, or a senior executive with regular access to inside information and decision-making power over the entity's future developments and business prospects [Art. 3(1)(25)].
Insider list: A maintained list of all persons with access to inside information of an issuer, including advisers, accountants and credit rating agencies, kept up to date and retained for at least five years [Art. 18(1), (3), (5)].
Suspicious Transaction and Order Report (STOR): Notification by trading venues, market operators and persons professionally arranging or executing transactions of orders or transactions reasonably suspected of constituting insider dealing, market manipulation or any attempt thereof [Art. 16(1), (2)].
Closed period: A 30-calendar-day period before the announcement of an interim or year-end financial report during which a PDMR may not deal in the issuer's shares, debt instruments or linked derivatives, subject to narrow exemptions [Art. 19(11), (12), (12a)].
Market sounding: Communication of information, prior to the announcement of a transaction, in order to gauge investor interest, conducted within the safe-harbour conditions including assessment, recordkeeping and recipient notifications [Art. 11].

Frequently Asked Questions

Does MAR apply to a company traded only on an MTF such as a growth market?

Yes. The full MAR regime applies once an issuer has requested or approved admission to trading on a regulated market, MTF or OTF in a Member State [Art. 2(1), Art. 17(1), Art. 18(7)]. Issuers on SME growth markets benefit from limited alleviations on insider-list scope and on the written explanation for delayed disclosure [Art. 17(4) third subparagraph, Art. 18(6)], but the substantive prohibitions on insider dealing and market manipulation apply in full [Art. 14, Art. 15].

How quickly must we publish inside information after a board decision?

'As soon as possible' [Art. 17(1)]. Delay is only permitted on the issuer's own responsibility if all three Article 17(4) conditions are met cumulatively: legitimate interests would be prejudiced, the delay is not likely to mislead the public, and confidentiality can be ensured. Where delay is used, the issuer must notify the competent authority immediately after publication and provide a written explanation, except where Member State law requires it only on request [Art. 17(4) third subparagraph].

Who exactly is a Person Discharging Managerial Responsibilities (PDMR)?

A PDMR is a member of an administrative, management or supervisory body of the issuer or emission allowance market participant, or a senior executive who has regular access to inside information and the power to take managerial decisions affecting future developments and business prospects of the entity [Art. 3(1)(25)]. Persons closely associated include spouses, registered partners, dependent children and certain controlled legal persons [Art. 3(1)(26)].

What is the EUR 20,000 PDMR threshold and how is it calculated?

Notification under [Art. 19(1)] is triggered once the aggregate gross value of a PDMR's (or closely associated person's) transactions in the issuer's instruments reaches EUR 20,000 within a calendar year [Art. 19(8)]. Transactions are added without netting. National competent authorities may raise the threshold to EUR 50,000 or lower it to EUR 10,000 with notice to ESMA [Art. 19(9)].

Which transactions can a PDMR still make during the 30-day closed period?

By default none in the issuer's shares, debt instruments or linked derivatives [Art. 19(11)]. The issuer may permit dealing only on a case-by-case basis for severe financial difficulty or for specific share-plan / pre-determined arrangements [Art. 19(12)]. Following the Listing Act (Regulation (EU) 2024/2809), [Art. 19(12a)] requires the issuer to allow trading that does not stem from active investment decisions or that results from external factors or pre-determined terms.

When must an investment firm or broker file a Suspicious Transaction and Order Report (STOR)?

Without delay, whenever there is a reasonable suspicion that an order or transaction (placed or executed, on or off venue) could constitute insider dealing, market manipulation or attempted insider dealing or market manipulation [Art. 16(2)]. The duty applies to any person professionally arranging or executing transactions and is enforced by the home Member State competent authority [Art. 16(3)]. Detection arrangements and reporting templates follow ESMA's regulatory technical standards under [Art. 16(5)].

How long do insider lists need to be retained and what data is mandatory?

At least five years after creation or last update [Art. 18(5)]. Mandatory fields: identity of every person with access, reason for inclusion, date and time access was granted, and the date the list was drawn up [Art. 18(3)]. The list must be promptly updated whenever access changes, the reason changes or a person is added [Art. 18(4)], and provided to the competent authority as soon as possible upon request [Art. 18(1)(c)].

Assessment Factors & Checklist

Premium

Start 7-day free trial

Questions for Your Lawyer

Premium

Start 7-day free trial

Conclusion & Summary

Premium

Start 7-day free trial

Detailed analysis with source links.

Schalten Sie die KI-Analyse frei — mit markierten Fundstellen und direkten Links zu EUR-Lex. 7 Tage kostenlos testen.

Start 7-day free trial →

Keine Kreditkarte heute. Kündigung jederzeit.