Prove who knew, and from when
Insider list management for listed groups. Hold the register by event rather than in one flat file, run closed periods that end when the announcement is published, and rebuild the position for any moment in the past.
- Capital Market Authority market conduct rules
- UK and EU Market Abuse Regulation, Articles 18 and 19
- ESMA Implementing Regulation (EU) 2016/347 field set
- Personal data minimised per entity
A register kept in a spreadsheet is administration. It is not evidence.
The control is usually sound in intent and undocumented in practice. Three failures show up in the same order every time an investigation starts, and all three are invisible until then.
The spreadsheet is overwritten
A file can say who is an insider today. It cannot say who was one at 10:30 on a Thursday in March, which is the first question an inquiry asks.
The restriction ends on a typed date
When results slip by a week, a hand-typed closed period lifts anyway, and people are free to deal before the market has the information.
Nobody can prove the notice landed
Notices go out by email. There is no record that anyone received them, under which version of the dealing code, or at what moment.
Five steps, and the evidence falls out of the work
Nobody keeps a register for its own sake. Each step below is something the governance team already does; the difference is what the system records while they do it.
- 01Bring in the register you already keep
The existing spreadsheet is adopted as a batch through the platform import channel. Every row keeps its origin, its source file hash, and its precision where the source recorded a date but no time.
- 02List people by event, not in one flat list
A permanent section holds standing insiders. Each transaction or reporting event gets its own section, restricted to the people who need to see it. Access obtained and listing are recorded as separate moments.
- 03Closed periods open themselves
Periods are generated from the reporting calendar under the version of the dealing code in force, which is stamped on the period. Notices go out, and receipt is acknowledged and timestamped.
- 04The period ends on the announcement, not a date
Somebody records the publication reference and timestamp; the system then ends the period. If the announcement moves, the restriction extends by itself and everyone in scope is told.
- 05Answer the supervisor from the system
Set a moment and the register rebuilds as it stood then, with access windows, acknowledgements and the rule versions then in force. Issue it as a hashed snapshot in the standard or ESMA field set.
Built for the moment somebody asks you to prove it
Sectioned register
A permanent section plus one per piece of inside information. Restricted sections stay out of reports and extracts without named access.
Point-in-time reconstruction
Entries are never overwritten. Any past moment is reproducible, including people since removed.
Event-driven closed periods
Two ways out and no third: a recorded announcement, or an override approved by someone more senior, with a review date attached.
Notices and receipt
Issued from the dealing code version in force, acknowledged to the minute, escalated on silence. Receipt is recorded as receipt, never as understanding.
Hashed exports
An issued export is an immutable snapshot with a hash, naming the entity, in the standard or ESMA 2016/347 field set — chosen per entity, not per tenant.
Self-service and advisers
Listed people maintain their own details and declare associated persons. External advisers are listed as a firm, with a reference to the list they hold.
Built as one, not assembled
Insider list tools exist. They are standalone, they store a current list, and they know nothing about your reporting calendar, your dealing code or your advisers. Five differences follow from that.
A current list cannot answer the question
Specialist tools store who is an insider now. The inquiry asks who was one at a moment in the past. Access windows and record history are held separately here, so the answer is reproducible rather than reconstructed by hand.
The restriction is tied to the obligation
The closed period reads the announcement obligation directly. Nothing else on the market connects the restriction to the filing calendar, because nothing else owns both.
Migrated history is marked as migrated
Rows adopted from a spreadsheet carry their batch and file hash for life, and every extract shows the boundary between adopted history and platform record. The claim survives the question that follows it.
Governed AI, not automation
The agent surfaces people who appear to hold inside information but are not listed, and shows what it read. A person sets the access time and decides. Nothing is listed, removed or dated by a model.
Part of the governance estate
The rule comes from the dealing code in Policy Management. The announcement date comes from Regulator Relationship Management. Advisers come from Supply Chain Mapping. Built as one, not assembled.
The register you already keep, adopted rather than retyped
Most groups arrive with years of history in a file. Adopting it in one act is not the same as recording each entry, and the extract says so: before the boundary, rows come from the named source file and its hash; after it, they are the platform's own record. That distinction is what keeps the claim standing when a supervisor asks about an event from three years ago.
- Source file
- insider-register-2019-2025.xlsx
- Hash
- sha256 3f9c…a71e
- Rows adopted
- 30 accepted · 8 with declared precision
- Quarantined
- 4 rows — no access date, never inferred
- Boundary
- 31 January 2026
Insider lists, closed periods and what a supervisor expects
What is an insider list?
An insider list is the record of people who hold inside information about a listed company, when they obtained it, and on what basis. Under the UK and EU Market Abuse Regulation, issuers and anyone acting on their behalf must draw up a list and provide it to the supervisor on request, in a prescribed format. In markets without a prescribed form, the list is still the evidence that an organisation controlled access to unpublished price-sensitive information.
What is a closed period?
A closed period is the window before a results announcement during which board members and designated staff may not deal in the company's securities. Its length is set by the dealing code and the applicable rules. The window opens on a derived date; it should end when the results are actually published, not on the date somebody expected them to be published.
What is the difference between a permanent insider list and an event list?
A permanent list holds people with standing access to inside information, such as board members, executives and the finance team. An event list is opened for one piece of inside information, such as a transaction or a results cycle, and holds only the people who hold that information. Keeping them apart is what allows an organisation to answer questions about one deal without disclosing the whole register.
Does this software file anything with a regulator?
No. It produces the list in the format a supervisor expects, including the ESMA Implementing Regulation (EU) 2016/347 field set where that applies, and records when and by whom it was issued. Filings and announcements are handled in Regulator Relationship Management.
Is an insider list required in Saudi Arabia?
Insider dealing is prohibited under the Capital Market Law and the Capital Market Authority's market conduct rules, and disputes are heard by the Committee for the Resolution of Securities Disputes. Saudi Arabia does not prescribe the MAR-style list form. In that market the register is a governance control and the organisation's own evidence in an investigation, which is how SustainGRC positions it.
Can we move our existing spreadsheet into it?
Yes, as a batch. Rows are validated, quarantined where an access date is missing, and accepted with declared precision where the source recorded a date but no time. Each adopted row keeps its batch reference and the source file hash, and extracts show the boundary between adopted history and records made in the platform.
How does AI appear in the module?
One agent proposes people who appear to hold inside information but are not listed, drawn from document distribution, document access and meeting attendance, and it shows what it read. The compliance officer accepts, rejects with a reason, or edits before accepting, and sets the access time. The module is fully usable with agents switched off.
Does it handle dealing pre-clearance?
Not in the current release. Pre-clearance of dealings and trade surveillance are out of scope, and the page says so rather than implying otherwise. The register, closed periods, notices and evidence are what this release covers.
See the question answered in forty seconds
Bring a date and a name. We will set the moment, rebuild the register as it stood, and issue the extract with its hash while you watch.
Insider dealing is prohibited in Saudi Arabia under the Capital Market Law. The Capital Market Authority does not prescribe the MAR-style list form, so in that market the register is a governance control and the organisation's own evidence, rather than a named filing. Where the Market Abuse Regulation applies, the obligation is explicit.