Introduction
You have been handed insider compliance and there is nothing there yet. This guide sets out the order to build it in, what depends on what, and why every control has to leave a record from day one.
Perhaps the company has just listed, or a board member asked a question nobody could answer cleanly. Either way, the task is to get the highest-risk controls standing first, without spending six months on a programme that looks complete on an org chart but cannot produce a record when an inquiry lands.
1. Map the population
You cannot run a control until you know who it applies to, so start with an honest map of your people in two overlapping groups. Your covered population is everyone your insider trading policy binds: directors, officers, designated employees, contractors with access, and their related persons and entities. Section 16 reporting persons are a narrower set with personal filing obligations: directors, Section 16 officers and holders of more than 10% of a registered class of equity. Conflating the two is the most common early mistake, and deciding who counts as a Section 16 officer turns on policy-making function, not job titles.
Since 18 March 2026, directors and officers of foreign private issuers (FPIs) have also had to file Section 16(a) reports, although FPI 10% holders remain outside the regime. Keep both lists as dated, living records, because every later control routes off them.
More in our guide: Section 16 onboarding for new officers and directors.
2. Set the policy
Every other control enforces the policy, so it comes next. Item 408(b) of Regulation S-K requires a domestic issuer to disclose whether it has an insider trading policy and to file it as an exhibit; FPIs make the equivalent disclosure in Form 20-F under Item 16J. Once public, the filed version has to be the one in force, and the one your people acknowledged. Build distribution and version-specific acknowledgement in from the start, because retrofitting those records later is exactly the reconstruction this function exists to avoid.
More in our guide: Building an insider trading policy that holds up.
3. Stand up pre-clearance
Pre-clearance is the only control that can stop a problem trade before it executes. Until it exists, covered persons trade with no checkpoint and you have no record of the judgement made at the time. Keep the first version simple: an easy request form, a certification that the requester holds no material non-public information (MNPI), routing to the right approver, approvals that expire, and a retained decision. A simple process people use beats an elaborate one they route around.
More in our guide: Designing pre-clearance workflows.
4. Build the blackout calendar
Where pre-clearance handles individual requests, the trading-window calendar handles the restriction everyone shares. Build the quarterly blackout once from your earnings dates and let it repeat, adding special windows when an MNPI matter calls for one. Then wire it into pre-clearance, so a closed window blocks the clearance decision rather than sitting in an email nobody reads.
More in our guide: Blackout and trading-window calendars.
5. Put MNPI on a matter footing
Insider trading enforcement turns on who knew what, and when. Treat each pool of MNPI as a matter with its own access record: who was brought inside, when, and their acknowledgements. US law has no equivalent of the insider-list mandate in the EU and UK Market Abuse Regulation (MAR), but when a regulator or your own counsel reconstructs a matter, that record is the difference between an answer and a guess. Starting while matters are few is far easier than imposing it on deals already in flight.
More in our guides: MNPI handling: who's inside, when, and proving it and Insider lists for US issuers without a MAR mandate.
6. Run the Section 16 filing machinery
Reporting persons file on a tight clock: Form 3 within 10 days of becoming a reporting person, Form 4 before the end of the second business day after a transaction, and Form 5 within 45 days of fiscal year end. The obligation sits with each individual, but the function does the legwork of keeping the roster, capturing transactions and handing clean data to a filing provider.
Two dependencies catch teams out. Every filer needs EDGAR access under EDGAR Next, in force since 15 September 2025, which takes time to arrange and cannot wait until a deadline is two days away. And under Rule 16a-3(k), an issuer with a website must post its insiders' Section 16 filings by the end of the business day after filing and keep them up for 12 months.
More in our guide: Section 16 mechanics for Forms 3, 4 and 5.
7. Add a 10b5-1 programme if you need one
If your executives use Rule 10b5-1 trading plans, run them from a register rather than a folder of PDFs, tracking adoption dates, cooling-off periods, overlapping plans and broker notices. If nobody uses plans yet, note it and move on, but be ready to receive the first request.
More in our guide: 10b5-1 plan administration for legal teams.
Evidence: built into every step
Each control is only a defence if it leaves a record: who was covered, who acknowledged which policy version, who was cleared and on what certification, who was restricted, who knew about which matter, and what was filed when. On the day a question arises, a control you cannot prove is not far from one you never ran. Evidence is not a later project but a property every control needs as you build it.
Why this order
Nothing can be targeted without the population, and nothing enforced without a policy. Pre-clearance and blackouts touch the most people most often, so they come before the specialist machinery, while Section 16 sits on a small, defined group and can run in parallel once the roster is clean. Build in this order and, when someone asks what your programme looks like, you can show them rather than describe it.
InsiderList runs these controls as one connected system, from an effective-dated roster through pre-clearance and blackouts to filing-ready Section 16 data, with every action leaving a timestamped, exportable record. Book a demo to see it.
InsiderList is insider trading compliance software used by companies in the UK, Europe, the USA and the UAE. This article is for general information and does not constitute legal advice. For advice on your situation, consult qualified US securities counsel.
