EU MAR: ESMA extends simplified insider list format to all issuers

Introduction

On 21 October 2025, the European Securities and Markets Authority (ESMA) finalised its draft Implementing Technical Standards (ITS) which extend the alleviated insider list format (previously reserved for issuers on SME Growth Markets) to all EU issuers under the amended Market Abuse Regulation (MAR).

These changes will have direct operational implications for issuers across the EU, and present an opportunity for streamlining insider list governance and reducing administrative burdens.

What is changing

• ESMA has consolidated the current five insider-list templates into three:
  • A template for the event-based section (applicable to all issuers).
  • A template for the permanent insiders section (applicable where appropriate).
  • A lighter template for persons who have regular access to inside information (for SME Growth Market issuers under a simplified regime).
• The data fields required under the alleviated formats have been reduced. For example:
  • personal phone numbers and full home addresses are removed;
  • identification can be via a National Identification Number (NIN) or, where NIN is unavailable, date of birth.
• The ITS confirm that external advisers or third-party service providers with access to inside information must be included with one nominated contact person per provider. The provider is expected to maintain its internal list of persons who accessed inside information.
• Issuers must keep the insider lists electronically (with versioning, restricted access, accuracy controls) under Article 18(1) MAR. SME Growth Market issuers under the simplified regime may under certain conditions use non-electronic formats provided confidentiality and integrity are ensured.
• The new ITS will be submitted to the European Commission for adoption, after which the existing Implementing Regulation (CIR 2022/1210) will be repealed and replaced. The bulk of the changes will apply from mid-2026 in line with the entry into force of the Listing Act.

What this means for issuers

For issuers these changes translate into four main implications:

1. Process review: Issuers should assess which template applies to them now and prepare to migrate existing formats.
2. Data field update: The reduction in required personal data means the insider list data collection and privacy documentation may need adjustment (for example revised privacy notices or retention schedules).
3. External advisers: Engagement letters and internal procedures may need to reflect the requirement for a single contact per external provider and ensure the provider maintains its own list.
4. System readiness: Issuers still relying on manual tools for insider list management should evaluate their systems for compatibility with the new template structure, version control requirements and electronic format mandates.

Key take-aways

• The extension of the alleviated insider list format to all issuers is a material simplification under MAR.
• Issuers should use this opportunity to refresh their insider list governance, policies, templates and data collection processes.
• Data protection compliance remains vital: even though personal data requirements are reduced, issuers must ensure confidentiality, integrity and proper retention of insider-list records.
• Compliance teams should begin planning now, transition may be required ahead of the effective date in mid-2026 once the ITS is adopted by the Commission.