The Judgment Gap in Market Abuse Compliance

Banks know the black-letter rules of the EU’s Market Abuse Regulation reasonably well. Article 17 on public disclosure, Article 14 on the prohibition of insider dealing, Article 11 on market soundings: these are documented, trained on, and built into policy manuals across the industry. The exposure that keeps surfacing in supervisory reviews and enforcement notices sits in the judgment calls layered on top of those rules.

Three areas account for a disproportionate share of that exposure: delayed disclosure decisions, information barriers, and market soundings. Each one depends less on knowing the rule and more on a person or a process reassessing a live situation correctly, under time pressure, without the benefit of hindsight.

Delayed Disclosure: the judgment call banks can’t fully delegate

Article 17(4) of the Market Abuse Regulation lets an issuer delay public disclosure of inside information where three conditions hold:

1. immediate disclosure would likely prejudice the issuer’s legitimate interests,
2. the delay is not likely to mislead the public, and
3. the issuer can keep the information confidential for the duration.

The test appears simple but applying it consistently, over the life of a delay that might run for weeks, is where banks struggle.

The AMF’s own guidance on inside information disclosure makes a point worth noting: the ability to rely on the delayed disclosure exception ceases the moment any one of the three conditions is no longer fulfilled, not at some later point when someone gets around to checking. Regulators expect firms to keep testing it as circumstances change, and ESMA’s guidelines on delayed disclosure reinforce that the assessment of legitimate interest and confidentiality has to hold for as long as the delay continues, not only at the point the decision was first made.

In practical terms, this means three things commonly go wrong:

1. The legitimate interest is assessed once and then treated as settled, with no defined trigger for revisiting it as new information emerges, whether that is a share price movement, a market rumor, or a shift in the underlying deal.
2. Confidentiality is assumed rather than actively tested, so a bank delays disclosure without checking whether the information has, in fact, stayed contained.
3. Documentation is built around the initial decision rather than the full life of the delay, leaving a thin record if a regulator later asks how the bank knew, at week three, that the original conditions still applied.

This last point is critical. Article 17(4) requires a bank to notify its national competent authority of the delay once the information is disclosed, and that authority can request a written explanation of how the conditions were satisfied throughout. The strength of a bank’s position rests almost entirely on what it can show, not on what it can now argue. A delay that was reasonable on day one but never revisited on paper is difficult to defend on day thirty, regardless of how sound the original reasoning was.

The governance fix involves naming an owner for the delayed decision, setting a cadence for reassessment tied to specific triggers rather than a calendar default, and keeping records current throughout the delay rather than reconstructing it after the fact. While this may appear straightforward, it tends to be harder to embed.

Information Barriers: designed to hold, tested when things move fast

Every bank of any size has an information barriers policy — physical separation between public and private side, systems access controls, formal wall-crossing procedures, and a restricted list that gets updated as new material non-public information enters the building. On paper, the architecture is sound, but the gap shows up in how people behave once a deal is moving fast.

ESMA’s own review of the MAR framework makes the underlying point directly: insider lists remain a key tool in market abuse investigations, precisely because they let an investigator check who had access to what, when, and whether a wall-crossing or disclosure was properly controlled. A wall-crossing procedure is only as strong as the insider list and the access log sitting behind it.

National regulators have not hesitated to enforce on this point directly. In one recent decision, France’s AMF Enforcement Committee fined three legal entities and eight individuals for insider dealing breaches that included a failure to maintain and update insider lists properly, with penalties ranging up to €1,000,000 against individuals.

The gatekeeper model works well as a design principle. It breaks down at the point where deal teams route around it because a policy did not anticipate exactly how the leak happened. Four patterns recur across how these failures happen inside a bank:

1. Wall-crossings that happen informally in the pressure of a live situation, with the formal log created after the fact rather than at the moment of disclosure
2. Restricted lists that lag the point at which material non-public information genuinely enters a business, rather than the point at which someone remembers to update the record
3. Informal channels, chat platforms, shared calendars, and casual desk visits, that carry sensitive information through routes the written policy never accounted for
4. Control functions themselves sitting across so many walls that they become a single point of failure rather than the safeguard they are meant to be

The point examiners repeatedly come back to is that barriers are tested by tracing how information truly moved, not by reading the policy document that describes how it is supposed to move. That distinction is the whole point, a wall can be correctly designed and still fail, because the test that matters is whether it holds up when people are busy, moving quickly, and communicating through channels the policy writer never pictured.

Market Soundings: the process is sound, the follow-through isn’t

Article 11 of the Market Abuse Regulation offers a safe harbor for disclosing market participants who follow a defined process when gauging investor interest ahead of a transaction— standardized scripts, confirmation of the recipient’s insider status, cleansing communications once the information is no longer needed, and records retained for five years. Get the mechanics right, and a disclosure that would otherwise look like unlawful tipping is protected. Get them wrong, and the safe harbor simply isn’t available when needed most.

The gatekeeper model sits at the center of ESMA’s guidelines for exactly this reason; a single, designated point of contact is meant to control who gets wall-crossed for a sounding, confirm their insider status, and log the disclosure properly. The mechanism is worth describing in full because it is where the safe harbor most often fails. Gatekeepers act as the first point of contact for a disclosing market participant requesting consent to conduct a sounding, and this arrangement is designed to keep the process consistent and limit the chance of a leak. The risk sits just after that point because once the gatekeeper has given consent, information can end up shared with additional individuals at the recipient firm over email or chat, with the circle of recipients expanding without any real control over who is being added or whether each of them has actually been wall-crossed by the gatekeeper.

This pattern captures why market soundings are a genuine grey area rather than a simple compliance checklist. The formal safe harbor framework can be followed to the letter at the point of initial contact, and the protection can still be lost three exchanges later, when a well-meaning banker copies a colleague into a thread without checking whether that colleague has been through the same process. Three related issues compound this:

1. Soundings that begin informally, as a banker “tests the water” before the formal Article 11 process is triggered, sitting outside the recorded framework entirely
2. Recipients who are wall-crossed for a sounding that is later abandoned but never formally cleansed, leaving them carrying inside information with no clear end point
3. Scripts and procedures that vary across desks or regions, which weakens the evidentiary record a bank would need to rely on the safe harbor if a regulator later scrutinizes the transaction

The stakes are direct. Lose the safe harbor and a disclosure that was defensible under Article 11 becomes a live instance of unlawful disclosure or, depending on what followed, insider dealing. The mechanics are not a formality around the substance. They are the substance.

Connecting the Dots: reassessment, not just rules

Delayed disclosure, information barriers, and market soundings look like three separate compliance domains with three separate rules. What they share is more instructive than what separates them. Each one depends on someone actively reassessing a live, moving situation.

Banks tend to invest more in the initial policy design but underinvest in the ongoing judgment layered on top of it. Training that covers only the rule and does not include grey areas creates teams that can recite Article 17(4) without being able to recognize, six weeks into a live delay, whether it still holds. Documentation practices that record the decision but not the reasoning behind it leave a bank exposed the moment a regulator asks not what was decided, but why, and whether that reasoning was ever revisited. And controls built around an assumption of good faith, rather than a genuine test for whether the assumption still holds, will look robust right up until the point they are tested.

There is a talent side to this too. The people making these calls, MLRO-adjacent compliance staff, deal-team gatekeepers, disclosure committee members, need working fluency in the grey zones themselves, not just familiarity with the underlying articles. That fluency is built through training and exposure to real supervisory findings and real judgment calls.