Building a US insider trading policy that holds up
Since Item 408(b) put insider trading policies on the public record, a US-listed company's policy has to work for two readers: the people who live under it, and the regulator who may read it years later. This guide covers who the policy should bind, what it should say, and how to keep the evidence that it was followed.
Every insider trading policy is judged twice. It is judged first by the people who have to live under it, every working day, and again, much later and only if something goes wrong, by a regulator or a court reading it after the fact. A policy that holds up is written for both audiences: clear enough that a covered person knows what to do on an ordinary Tuesday, and complete enough that the company can show it existed, was distributed and was followed.
Item 408(b) of the SEC's Regulation S-K raised the stakes on that second reading. A US domestic issuer must now disclose each year, in its Form 10-K and proxy statement, whether it has adopted insider trading policies and procedures governing dealings in its securities by directors, officers and employees, explain why not if it has none, and file the policy as an exhibit to the 10-K. Foreign private issuers face a parallel requirement under Item 16J of Form 20-F. Calendar-year companies filed their first policies with their 2024 annual reports, so most are now on their second public version, and a document that once lived on the intranet now sits on EDGAR for anyone to read.
Start with who is covered
A policy is only as good as its population, so the first structural decision is who it binds. That means directors, officers, designated employees and consultants, together with the family members and controlled entities whose trades trace back to them.
Many teams treat that group as interchangeable with their Section 16 reporting persons, and the confusion is a common error. Section 16 of the Securities Exchange Act of 1934 imposes public reporting, and for domestic issuers the short-swing profit rules, on directors, officers and holders of more than 10% of a class of registered equity. Your policy population usually reaches further down the organisation, taking in finance, legal and deal teams, while Section 16 reaches sideways to large shareholders whom the policy rarely binds at all. Because the two lists overlap without either containing the other, keep both, and keep the distinction visible.
Non-US issuers now need that discipline too. Since 18 March 2026, the Holding Foreign Insiders Accountable Act has required directors and officers of foreign private issuers to file Section 16(a) reports on Forms 3, 4 and 5, although the short-swing profit and short-sale rules still do not apply to them. An SEC order of 5 March 2026 exempts directors and officers of issuers in certain qualifying jurisdictions, on condition that they report under their home regime instead. A UK or European company with a US listing may therefore be keeping three lists at once: its insider lists and records of persons discharging managerial responsibilities (PDMRs) under the Market Abuse Regulation (MAR), its Section 16 roster or exemption analysis, and the population its insider trading policy covers.
Cover the substance
US insider trading policies share a well-established core, and anyone reading your filed exhibit will expect to find each of these elements in it:
- A prohibition on trading while in possession of material non-public information (MNPI), with MNPI defined in terms people can apply to the situations they actually meet.
- A ban on tipping, so that passing MNPI to someone who trades is treated as seriously as trading on it yourself.
- Blackout periods and trading windows tied to the reporting calendar, with pre-clearance for those whose access warrants it.
- Rules for Rule 10b5-1 trading plans, which since the SEC's 2022 amendments carry mandatory cooling-off periods and good-faith conditions, and whose adoption or termination by directors and officers must be disclosed each quarter under Item 408(a).
Those elements are settled. One more is still moving, and it is where your policy's wording may matter most.
Increasingly, policies also take a position on trading in other companies' securities on the strength of knowledge gained at work, a practice known as shadow trading. In SEC v. Panuwat, a jury found in April 2024 that a Medivation executive had committed insider trading by buying options in Incyte, a comparable biopharmaceutical company, shortly before Pfizer's acquisition of Medivation was announced. Medivation's own policy, which barred employees from using confidential information to trade in the securities of other public companies, did much of the work in establishing that he owed a duty not to trade. The Ninth Circuit heard his appeal on 11 June 2026 and, at the time of writing, has not ruled. Whether to include shadow-trading language, and how widely to draw it, is a question for your counsel. Your policy is where the answer lives, and Panuwat shows that its wording will be read closely.
Keep versions in step
Version drift undoes otherwise good policies. Three things need to line up: the version in force, the version your covered persons acknowledged, and the version on file with the SEC. Because the exhibit is filed with the annual report, it will always trail a mid-year amendment by some months, and that lag is expected. What weakens the company's position is an annual report that attaches a superseded version, or an amendment that went live without ever reaching the people it covers. Either way, the company loses the ability to say plainly that this was its policy on that date, and that its people accepted it.
Treat distribution and acknowledgement as part of the policy, not an afterthought. Each version goes to the people it covers, and each acknowledgement is tied to the exact version distributed, so the question "which policy did they accept, and when?" always has an answer.
Make training part of the record
A policy nobody understands is a liability dressed as a control. Assigning training by covered group, whenever someone joins the roster or a new version lands, and keeping the completion evidence turns the policy from a document into a practice. Certificates on each person's record, with outstanding names visible until the list is complete, are exactly what your next round of directors' and officers' questionnaires will ask for.
Leave a record
Everything above produces a defensible position only if it leaves a record: who was covered by which rule and when, who acknowledged which version, and who completed training. That evidence is what a company reaches for when an inquiry begins, and it is precisely the material that is painful to reconstruct after the fact, once the person who circulated the policy has moved on and the email chain has been archived.
InsiderList keeps one roster of covered and related persons, distributes each policy version paired with the acknowledgement that proves acceptance, and assigns training with completion evidence, so the policy, its people and the proof they accepted it stay in step. If you would like to see that record for your own policy, book a demo with our team.
InsiderList is insider trading compliance software used by companies in the UK, Europe, the USA and the UAE. This article is for general information and does not constitute legal advice. For advice on your situation, consult qualified US securities counsel.
