ESMA shrinks the list for delaying inside information

The European Securities and Markets Authority (ESMA) has rewritten when a European Union (EU) issuer may delay inside information, and the United Kingdom has not adopted the Listing Act text that forced the change. The final report of October 16, 2026, reference ESMA74-268544963-1718, revises the Market Abuse Regulation (MAR) guidelines after Regulation (EU) 2024/2809 changed Article 17. From June 5, 2026 only the final event in a protracted process must be disclosed, and a delay must not be in contrast with the issuer's latest announcement on the same matter. These MAR delay guidelines apply only once published in every official EU language. The text below is set against the UK rule and Hong Kong's statutory safe harbours.

Key facts

• Final report, October 16, 2026, ESMA74-268544963-1718. Earlier guidelines: October 20, 2016 (ESMA/2016/1478) and April 13, 2022 (ESMA70-159-4966).
• Listing Act disclosure changes apply from June 5, 2026, Article 4(3) of Regulation (EU) 2024/2809, published on November 14, 2024 and in force 20 days later.
• Delegated Regulation (EU) 2026/789 of April 8, 2026 was published on July 16, 2026. It lists protracted processes and when each final event occurs.
• Consultation paper ESMA74-268544963-1567 is dated February 19, 2026 in the SMSG advice. It closed on April 29, 2026. ESMA received 28 responses, most from issuers. On the distress interest, 24 of 26 respondents were in favour and two were opposed.
• The revised guidelines apply when published in all official EU languages. Competent authorities then have two months to tell ESMA whether they comply.
• Administrative fines under MAR in 2025 were EUR 33,392,952. Article 17(1) was among the provisions most often sanctioned (ESMA43-502934634-2902, October 15, 2026).

Methodology and sources

This account uses ESMA's final report of October 16, 2026, ESMA74-268544963-1718: the marked-up guidelines in Annex I, the cost note in Annex II, the Securities and Markets Stakeholder Group (SMSG) advice of May 26, 2026 (ESMA24-229244789-5649) in Annex III, and the response tables in Annex IV. The consultation date and paper number come from that advice. Dates for the Listing Act and for Delegated Regulation (EU) 2026/789 are those the report states. The UK text is Article 17 on legislation.gov.uk and the Financial Conduct Authority (FCA) Handbook Disclosure Guidance and Transparency Rules sourcebook (DTR) 2.5, last updated on July 29, 2024. Hong Kong is the Securities and Futures Commission (SFC) Guidelines on Disclosure of Inside Information, June 2012, on Part XIVA of the Securities and Futures Ordinance, in force from January 1, 2013. The enforcement example is the FCA Final Notice to Tejoori Limited of December 13, 2017. The window is November 14, 2024 to October 16, 2026. ESMA's news notice only points to the final report.

Related:ASIC tests a 10-year CFD product intervention order extension

What the October 16 guidelines actually permit

Article 17(1) still requires disclosure as soon as possible of inside information which directly concerns the issuer. Intermediate steps in a protracted process are no longer disclosed. Only the final event is disclosed, and Article 17(4a) takes those steps outside the delay regime. If confidentiality fails, Article 17(7) still applies. Article 17(4)(b) now tests contrast with the latest announcement on the same matter. Points (a) and (c) are unchanged. Because Article 17(11) covers only legitimate interests, Guideline 2 is deleted. No respondent opposed that deletion.

The revised guidelines on delaying inside information are ESMA's non-exhaustive list of legitimate interests under point (a) of Article 17(4) of the Market Abuse Regulation. The final report of October 16, 2026, reference ESMA74-268544963-1718, leaves three statutory conditions: a legitimate interest, no contrast with the issuer's latest announcement or other communication on the same matter, and confidentiality. Since June 5, 2026, intermediate steps in a protracted process are not disclosed, so delay is only for a one-off event or the final event. ESMA adds five interests: a public-authority confidentiality order, including a third-country authority; time to collect further information on an exceptional event; a concrete business opportunity disclosure would jeopardise; a governing-body or key-manager appointment not yet told to a current employer; and an intra-group delay where one announcement would undo another's. The other two Article 17(4) conditions must also be met. The report says the list is read restrictively. The consultation that closed on April 29, 2026 drew 28 responses.

Paragraph 21 deletes points (a), (c), (d), (e), (f), (g) and (h) of previous Guideline 1. Annex I also strikes an own-funds action not yet authorised under Article 77 of the Capital Requirements Regulation, and a draft supervisory review decision. The distress interest stays for early-stage distress outside insolvency proceedings, not covered by the delegated act, only where concrete measures restore liquidity and capital. A profit warning stays under Article 17(1).

"the issuer needs to comply with an order to maintain the confidentiality of the inside information issued by a public authority of a Member State, the EU or a third country on the base of law, a specific legal provision, or the powers otherwise attributed to that public authority (i.e. case law)."

— Guideline 1, point (a), Annex I, ESMA74-268544963-1718, October 16, 2026 (ESMA final report)

"Powers otherwise attributed" means case law, and the delay ends when the order ends. The second interest is time to collect missing facts on an exceptional event, such as a cyber-attack, until a rough estimate exists. ESMA rejects a fixed 48-hour rule and extra time for analysis or remediation. The third is a concrete business opportunity, such as parallel tenders. Ordinary negotiations wait until completion. Point (e) is a formal appointment not yet told to the current employer, and not a resignation. Point (f) is a group company that has already delayed the same information. Paragraph 92 says this is not automatic, and paragraph 93 recalls Article 10. Contractual clauses are rejected. A small and medium-sized enterprise (SME) growth market issuer explains only if the authority asks.

How the EU, the United Kingdom and Hong Kong treat a delay

Sources: ESMA74-268544963-1718; ESMA43-502934634-2902; UK Article 17; FCA DTR 2.5; Tejoori Final Notice; SFC guidelines, June 2012. Last updated: October 17, 2026.

UK Article 17 on legislation.gov.uk still requires a legitimate interest, a delay not likely to mislead the public, and confidentiality, including for intermediate steps. After disclosure the issuer tells the FCA and explains if asked. DTR 2.5.4, dated February 24, 2017, says financial difficulty itself may not be hidden. The UK split between the Criminal Justice Act 1993 and UK MAR does not import the Listing Act wording. Hong Kong section 307D uses harbours instead: a legal prohibition, or confidentiality plus an incomplete negotiation, a trade secret, central-bank liquidity support, or a section 307E waiver. Paragraph 40 puts a short fact-check inside the timing rule.

An issuer comparing the EU, the UK and Hong Kong cannot use one delay list. In the EU, since June 5, 2026, intermediate steps in a protracted process are not announced under the amended Article 17(1) of MAR, and a delay of what must be announced has to meet Article 17(4): a legitimate interest, no contrast with the latest announcement on the same matter, and confidentiality. ESMA74-268544963-1718 adds five legitimate interests and deletes the guideline on misleading the public. In the UK, legislation.gov.uk still shows the pre-Listing Act Article 17(4), including the test that a delay is not likely to mislead the public, and DTR 2.5, last updated on July 29, 2024, still points to the older ESMA guidelines. In Hong Kong, section 307D, in the SFC guidelines of June 2012, uses statutory safe harbours, including incomplete negotiations. The FCA's penalty of £70,000 on Tejoori Limited, on December 13, 2017, shows what a late Article 17(1) announcement cost under the test the UK still has.

"The SMSG broadly supports ESMA’s proposed revisions to the MAR Guidelines on delayed disclosure of inside information, reflecting the changes introduced by the Listing Act (Regulation (EU) 2024/2809)."

— Giovanni Petrella, Chair, Securities and Markets Stakeholder Group (SMSG advice, May 26, 2026)

What the Tejoori notice shows about a disclosure that was simply late

On December 13, 2017 the FCA fined Tejoori Limited £70,000 under section 123(2) of the Financial Services and Markets Act 2000 for breaching Article 17(1) between July 12 and August 23, 2016. Settlement cut 30 per cent from an undiscounted £100,000. Tejoori, admitted to the Alternative Investment Market (AIM) on March 24, 2006, held 10.1 per cent of BEKON Holding AG. On July 12, 2016 it learned a drag-along would force a sale to Eggersmann Gruppe GmbH & Co. KG for no initial consideration, with only possible deferred consideration below its valuation. The shares transferred on August 10, 2016. Tejoori announced on August 24, 2016 after the London Stock Exchange contacted the nominated adviser. The price rose 38 per cent over August 22 and 23, 2016.

Paragraph 5.12 finds the information was already inside information on July 12, 2016, materially different from the announcement of February 5, 2016, "such that it would not have been permissible for Tejoori to have delayed disclosure to the public pursuant to Article 17(4) of MAR." Old Guideline 2, struck through in the October 16 report, treated that contrast as misleading. Article 17(4)(b) now carries a version of that test. The FCA found the board was not deliberate or reckless. Paragraph 6.10 records a false market for six weeks, at seriousness Level 2. The notice applies the 2016 statute, still the UK limb and no longer the EU limb. The FCA's later equity-transparency instrument does not reopen it.

What the rewrite means for issuers, venues and compliance teams

Annex II records compliance cost as "None" for issuers, regulators and investors. Paragraphs 110 and 111 ask first whether the matter is an intermediate step. If it is, there is no announcement and no delay. If it is the final event, all three limbs of Article 17(4) must be met. The SME filing concession does not relax those limbs. Banks get no wider distress interest, and Pillar 2 guidance is not a delay example. If confidentiality fails, Article 17(7) requires disclosure as soon as possible. In the Tejoori notice the exchange called the nominated adviser. DTR 2.5.2 has required, since July 1, 2005, that a developing situation be watched. A UK broker cannot treat the two Article 17 texts as one rule, which is why cross-border differences ESMA has already named matter. Fund managers and crypto-asset service providers (CASPs) come under Guideline 1 only if they are issuers. Otherwise Article 10 applies. Paragraph 43 says keep the public-authority order. Issuers do not report compliance.

"Where an issuer has initiated an internal investigation—triggered by a whistleblower report under Directive (EU) 2019/1937, a compliance review, or an audit finding—premature disclosure could compromise the investigation’s integrity, alert wrongdoers, or lead to destruction of evidence."

— Morten Kinander, Rapporteur, Securities and Markets Stakeholder Group (SMSG advice, May 26, 2026)

The SMSG offered that interest, and also interests for an informal inquiry, for litigation strategy, and for a third-country ban on disclosure. The final report does not add them. Investigations remain protracted processes, or the public-authority interest where a court has ordered silence.

What is still open after the final report

The guidelines are not yet the text authorities must try to follow under Article 16(3) of the ESMA Regulation. They apply from publication in all official EU languages. Annex I still shows "from 13/06/2022", with a bracket for that later date. Authorities then have two months to notify compliance or non-compliance, with reasons. Issuers file nothing. On May 26, 2026 the SMSG asked for interim guidance covering the period since June 5, 2026. This October report is the fourth-quarter text it expected. It creates no retrospective harbour.

The report lists Commission Implementing Regulation (EU) 2016/1055 and does not amend it. It sets no look-back for the latest announcement, and it does not treat "as soon as possible" as running from when the issuer knew, or ought to have known. Case C-53/26, the Bundesgerichtshof reference on a holding company and a subsidiary, is pending, with no judgment. The footnote is the InfoCuria entry for C-53/26. The question of when a draft is inside information is being tested on other facts. For these issuers, Article 7 and this text govern until the regulation desk can read the translations.

TL;DR

ESMA's final report of October 16, 2026, ESMA74-268544963-1718, rewrites the guidelines on delaying inside information under Article 17 of the Market Abuse Regulation. Listing Act changes apply from June 5, 2026: intermediate steps in a protracted process are not disclosed, and delayed information must not contrast with the issuer's latest announcement on the same matter. ESMA deletes the old protracted-process examples and the guideline on misleading the public, and adds five legitimate interests. The distress interest stays, but not for profit warnings. The guidelines apply only when published in every official EU language. The UK text of Article 17 still uses the test that a delay is not likely to mislead the public. In 2025, authorities imposed EUR 33,392,952 of administrative fines under MAR, with Article 17(1) among the provisions most often sanctioned (ESMA43-502934634-2902).

Frequently asked questions

What do the MAR delay guidelines cover?

They are ESMA's non-exhaustive list of legitimate interests for delaying disclosure under point (a) of Article 17(4) of the Market Abuse Regulation. The revision is the final report of October 16, 2026, ESMA74-268544963-1718. Two further conditions still apply: no contrast with the latest announcement on the same matter, and confidentiality. An interest off the list can still be used, and ESMA says the list is read restrictively. The text is addressed to issuers and competent authorities.

When do the revised guidelines apply?

Not on October 16, 2026. They apply when ESMA publishes them in every official EU language. Annex I still prints June 13, 2022, with a bracket for the later date. Competent authorities then have two months to say if they comply. Issuers do not file that notice. The statute is already in force: the Article 17 changes have applied since June 5, 2026. Until the languages appear, issuers have the regulation, Delegated Regulation (EU) 2026/789, and a final report that is not yet the applicable guideline.

Which legitimate interests did ESMA add, and which did it refuse?

ESMA added five: a public-authority confidentiality order, including from a third country; time to collect information on an exceptional event; a concrete business opportunity that disclosure would jeopardise; a governing-body or key-manager appointment not yet told to a current employer; and a group delay that is not automatic. The distress interest stays, narrowed, and it does not cover a profit warning. ESMA refused a resignation, a contractual confidentiality clause, extra analysis after a cyber-attack, and an internal investigation as its own ground.

Can an issuer still delay a merger negotiation?

In the EU, usually no. Since June 5, 2026 an intermediate step in a protracted process is not disclosed, and it does not go through the delay test. Delegated Regulation (EU) 2026/789, published on July 16, 2026, identifies the final event. Only that event is announced as soon as possible. ESMA deleted the old example that treated the talks as a reason to delay. UK Article 17 still allows a delay of intermediate steps if its three conditions are met. Hong Kong section 307D still harbours an incomplete negotiation while confidentiality holds.

Does a cyber-attack come with a fixed number of hours?

No. A severe incident can already be inside information under Article 7(2) before the damage figure is known. The new interest allows a delay only while missing information is collected, until a rough estimate exists. ESMA rejected a 48-hour cap. Further analysis and remediation are not reasons to wait. Other notification duties continue beside MAR and do not replace the Article 17 announcement. The report says those notifications stay confidential.

What records must an SME growth market issuer keep?

An issuer admitted to trading only on an SME growth market gives the written explanation only if the national authority asks, and it need not keep that record if it can justify the decision when asked. The three Article 17(4) conditions are not relaxed. The relief does not extend to other issuers. In the UK the issuer tells the FCA straight after disclosure, and explains only if the FCA asks. That UK step is not limited to SME growth markets.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.