Disclosure controls and market abuse for newly listed companies

What actually changes on the first day of trading

Before listing, information management is a deal control. After listing it becomes a continuous regulatory obligation, and it applies to a much larger population of people than the IPO working group.

Three things change at once. First, the company becomes responsible for deciding, in real time, what the market needs to know and when. Second, a defined group of managers and employees becomes personally restricted in how they deal in the company's securities and personally responsible for reporting their dealings. Third, everything the company says to the market is now tested against rules designed to prevent information asymmetry — and those rules are enforced with hindsight, using the company's own emails, lists and meeting minutes as evidence.

The practical consequence for a CFO is that disclosure is not a communications activity bolted onto finance. It is an operating process with owners, inputs, decision points and records. The first 100 days are covered in First 100 days after listing, and the broader transition in Life after the IPO.

Two rulebooks, one operating model

The same underlying risk — some people know more than the market — is addressed differently in the EU and in the US. Label matters here, because a control copied from one regime may be unnecessary, or insufficient, in the other.

The EU: MAR's three pillars

For issuers with securities admitted to trading on an EU or EEA regulated market, the Market Abuse Regulation (EU) 596/2014 sets out the core issuer duties:

• Disclosure of inside information (Article 17). The issuer must inform the public as soon as possible of inside information directly concerning it. Delay is possible only within the narrow conditions in the regulation — for example where disclosure would prejudice legitimate interests, confidentiality is maintained, and the market is not misled — and the national competent authority must be informed after the fact and given an explanation on request. Internal procedures must therefore be able to document why a delay was justified at the moment it was decided, not reconstruct it later.
• Insider lists (Article 18). Issuers must draw up and promptly update lists of everyone with access to inside information, in the format set by Commission Implementing Regulation (EU) 2016/347, and retain them for at least five years. Separate lists are kept for recurring access (a permanent list) and for individual projects or transactions (project lists).
• Managers' transactions (Article 19). Persons discharging managerial responsibilities (PDMRs) and persons closely associated with them must notify the issuer and the national competent authority of transactions in the issuer's securities, and the issuer must then publish them. Procedures and deadlines are prescribed in Article 19, including a de minimis threshold per calendar year below which individual transactions need not be notified — the level of that threshold has been amended at EU level, so confirm the current figure with your national competent authority rather than relying on memory.

The prohibitions themselves — insider dealing, unlawful disclosure of inside information and market manipulation — sit alongside these duties, and market abuse rules also apply to the company when it trades in its own shares: buybacks and stabilisation need to fit the applicable safe harbour, such as Commission Delegated Regulation (EU) 2016/1052 in the EU. Aftermarket mechanics are developed in Greenshoe, stabilisation and lock-ups.

The UK operates its own domestic market abuse regime post-Brexit. It is closely related in structure but is a separate rulebook with its own guidance and thresholds.

The US: FD, Section 16 and trading arrangements

On US exchanges the starting point is different. There is no general duty to announce every piece of material information immediately; instead the framework constrains how information flows and how insiders behave:

• Regulation FD prohibits selective disclosure of material nonpublic information to securities market professionals and holders of the company's securities, and requires public disclosure instead. The control implication is concrete: investor meetings, analyst calls and conference appearances need a defined process, a named person present, and a rule that price-sensitive topics are handled through public disclosure.
• Section 16 reporting. Directors and Section 16 officers file a Form 3 when they become subject to the rules, a Form 4 for changes in beneficial ownership within the period set out in Exchange Act Rule 16a-3, and a Form 5 annually. The filing obligation is personal, and short-swing profit rules under Section 16(b) can bite on transactions within six months of each other.
• Rule 10b5-1 plans. These provide an affirmative defence for trades made under a qualifying plan. The rule requires cooling-off periods before trading starts, longer for directors and officers than for other persons, and treats material modifications as a new plan.
• Item 408 of Regulation S-K. Issuers must disclose adoption and termination of Rule 10b5-1 and non-Rule 10b5-1 trading arrangements by directors and officers each quarter, and describe the company's insider trading policies and procedures annually, filing them as an exhibit. This means a company's trading policy is not just an internal document — a version of it becomes public.

Disclosure in the US also runs on its own calendar of periodic and current reports, driven by the applicable form type and exchange listing standards rather than by a "disclose as soon as possible" rule. Sanctions and filing obligations differ for domestic issuers and foreign private issuers, so the form set must be confirmed for the specific issuer.

The disclosure committee

The disclosure committee is the mechanism that turns all of the above into something that works at 07:00 on a results day. It should exist before listing day, not after the first quarterly close.

Who sits on it

A workable composition for a newly listed company is a small core with standing and ad hoc members:

• chair: the CFO (or the general counsel, depending on where the company locates the risk);
• company secretary or general counsel — agenda, records, escalation;
• head of investor relations — external calendar and market feedback;
• group financial controller — close calendar, preliminary numbers, segment information;
• head of internal audit or risk — control evidence;
• business unit or regional finance leads, on call when their segment holds the trigger.

What it decides

The committee's job is not to write the release. It is to answer four questions in a documented way:

1. Is there information that is inside information (EU) or material and nonpublic (US)?
2. Does it require disclosure now, later, or within a documented delay decision?
3. Who is on the insider list for this matter, and from what date?
4. Who is subject to a dealing restriction, and from when until when?

A standing materiality framework helps the committee be consistent: what types of events have historically moved the company's numbers or guidance, what thresholds the business uses internally, and who can be reached out of hours.

Rhythm and records

A fixed cadence — a meeting ahead of each reporting cycle plus event-driven sessions — is easier to sustain than permanent readiness. What matters more than the schedule is the record: dated minutes, a decision log with a named decision-maker, and a list of who was informed. If a regulator or a court examines a delay decision later, contemporaneous records do the heavy lifting.

Insider lists and access control

In the EU, insider lists are a legal obligation, and they are also a genuinely useful control. Build them early and treat them as live documents:

• Appoint one owner. Company secretary or legal, with a named deputy, not a shared inbox.
• Separate recurring from project access. A permanent list for people who routinely see inside information, and a project list opened and closed with each transaction, with a start date for every entry.
• Onboard with acknowledgement. Each person added should acknowledge in writing the duties and the sanctions that attach to insider dealing and unlawful disclosure, as the regulation expects.
• Close lists deliberately. People come off a project list when they leave the project, and the closure should be recorded.
• Draw the boundary around the deal team. Advisers, auditors, IT staff with access to the finance systems, and external translators can all belong on a list.

In the US, there is no statutory insider list, but the same practice is how companies evidence control over material nonpublic information. Under either regime, a stale list is the kind of finding that undermines everything else in a file.

Closed periods, trading windows and pre-clearance

In the EU, PDMRs may not deal during the closed period before the announcement of a year-end report or an interim financial report the issuer is obliged to publish — the period is set in Article 19(11) of MAR. Because the obligation attaches to reports the issuer must publish, the practical question is which reports your regime and venue actually require; mandatory quarterly reports do not exist in every EU market.

In the US, there is no statutory closed period. Blackout windows and trading windows are a matter of company policy, typically built around the reporting calendar, with separate event-specific blackouts when something material is in flight. Policy design points that recur in newly listed companies:

• publish the windows in advance as a calendar, so the answer to "can I sell?" is not a judgement call;
• require pre-clearance for directors, Section 16 officers and a defined wider group, with a written request, a check against the window and any event list, and a log;
• handle Rule 10b5-1 plans (and equivalent EU arrangements) through a single approval route, with the certification and the cooling-off period recorded at adoption;
• keep the event-specific restriction list short, with a named owner, and tell the people on it that they are restricted without circulating the reason.

Managers' transactions and Section 16 reporting

The reporting mechanics decide whether a company looks well governed or not, because failures are public.

On the EU side, the sequence for a PDMR transaction is: the individual notifies the issuer and the national competent authority, then the issuer publishes the transaction. Both steps have prescribed forms, short deadlines set in Article 19 of MAR, and an electronic reporting channel at the national authority. Persons closely associated with a PDMR are inside the net, and PDMRs must tell those persons about their own obligation.

On the US side, administration means EDGAR codes and powers of attorney in place for every insider before the first grant, a named administrator, and a process that treats Form 4 filing as an operational task with a deadline, not as something the insider will handle themselves.

Both regimes require the company to keep the transaction log complete enough to reconcile against filings. A quarterly reconciliation between the internal dealing log, the insider list, the public filings and the register of shares is a cheap control with a high hit rate.

EU and US compared

Common pitfalls in the first year

• The insider list is populated once and never maintained. It should be updated when access changes, and the changes dated.
• The window is administered in people's heads. Without a published calendar and a pre-clearance log, the first departure from policy is invisible until it is a filing issue.
• Regulation FD is treated as an IR topic. Analyst calls, investor conferences and dinners need a process owner on the legal or finance side, not only in IR.
• Deal team controls are dismantled after listing. The systems that protected the prospectus — restricted folders, adviser confidentiality agreements, project lists — are exactly the ones that matter for the first post-listing transaction.
• Late Section 16 filings and missed manager notifications. These are usually process failures: no codes, no power of attorney, no calendar reminder, no reconciliations.
• Announcing through the wrong channel. In the EU, disclosure must be made in a way that reaches the public broadly and simultaneously; relying on a website post alone does not satisfy every national regime or exchange rule.
• The disclosure committee stops meeting when the IPO is over. The quarter after listing is precisely when the committee earns its place.

Owners and sequence for the first 100 days

A defensible sequence, with the owner named in the RACI plan (see IPO RACI and workstream plan):

1. Before admission — adopt the insider trading policy; appoint the disclosure committee and its secretary; set the reporting calendar and the trading window calendar; build permanent and project insider lists with acknowledgements; arrange insider reporting credentials and powers of attorney; brief every director and officer in writing on their personal obligations.
2. Weeks one to four after listing — first disclosure committee cycle; publish the window calendar internally; open the dealing log; test the transaction notification route end to end with a real, small transaction.
3. First reporting cycle — run the committee on its normal cadence, exercise the materiality framework, reconcile the dealing log against public filings, and record the results of the exercise so the board's audit committee can review the effectiveness of the disclosure process. Board-level readiness for this scrutiny is set out in Board and committee readiness for a listed company.

The rules described here differ by jurisdiction, by venue and over time. Confirm the current position with the exchange rulebook, the regulator's guidance and your own advisers before relying on any specific deadline.

This page is educational content and is not investment, legal, tax or accounting advice.