← All posts
AI & Email Compliance

MNPI and market abuse: the everyday phrases that cross the line

August 25, 2026 · 7 min read

A chief executive of a gaming and betting company posted material operating figures from a personal social-media account, the kind of number a market moves on, framed as a casual update to followers. The company had not released those figures through its normal disclosure channels first. The US Securities and Exchange Commission treated the post as selective disclosure under Regulation FD and settled the matter for USD 200,000. The post read like an offhand brag. The regulator read it as a controlled event that had gone uncontrolled.

That gap, between how a line feels to the person typing it and how it reads to a regulator, is where most market-abuse exposure actually lives. The dramatic insider-dealing cases make the headlines. The routine risk sits in ordinary chat: a heads-up to a friend, a group message about pricing, a reassurance sent to calm a nervous counterparty. The tone is informal. The content is regulated.

Two mechanisms hide inside casual language

Under the EU Market Abuse Regulation (Regulation 596/2014, “MAR”), two Articles catch most of what goes wrong in day-to-day writing.

Article 14 covers insider dealing and unlawful disclosure of inside information. Inside information is precise, non-public, and price-sensitive: unpublished results, an unannounced deal, a regulatory decision, a large order. You do not need to trade to breach the rule. Telling someone else, outside the normal course of your job, is enough. This is where “material non-public information” (MNPI) leaks. A single sentence passing an unpublished figure to a person who should not have it is the whole offence.

Article 12 covers market manipulation, including behaviour that gives false or misleading signals about price or supply. Coordinating positions, agreeing to hold a level, or spreading information likely to move a price can all fall inside it. The line that creates exposure often looks like teamwork or friendly advice.

The informal tone is the risk, for a concrete reason. Casual phrasing strips out the guardrails a compliant message would carry: no reference to public disclosure, no note that information is embargoed, no clearance. The words that make a message feel private (“between us”, “off the record”, “you did not hear it from me”) are exactly the words a regulator reads as consciousness that the information was not meant to travel. Concealment language is not a defence. It is evidence of intent.

Scale matters here too. The SEC and CFTC have levied over USD 2 billion in penalties across firms whose staff conducted business on unmonitored channels. Those cases were about recordkeeping, but they share a root: business-critical, often price-sensitive, discussion moving through informal messaging where no one was checking the words before they left.

A taxonomy of high-risk phrasings

Below is the pattern library. Each row is a phrasing your teams actually use, the mechanism it triggers, and the safer move. Where a line cannot be rescued by rewording, the honest call is “do not send”.

What gets typed Why it is a problem Safer move
“Keep this between us until the announcement.” Signals the information is non-public and price-sensitive, and that it is being passed anyway (MAR Art. 14). Do not send. Wait for public disclosure, then share the released version.
“You did not hear it from me.” Concealment language reads as awareness that the tip was improper. Do not send. If the information is public, cite the public source instead.
“We should all hold around this level.” Reads as coordinating positions or signalling to move a price (MAR Art. 12). Do not send. Positions are individual decisions; remove the collective steer.
“Off the record, the numbers look strong this quarter.” Passes unpublished figures ahead of disclosure (MNPI leakage). Do not send. No wording makes pre-release figures shareable.
“Heads up before it goes public tomorrow.” Explicitly flags timing of unpublished, price-sensitive news. Do not send. Share only after the announcement is live.
“Deal is basically signed, not announced yet.” Unannounced transaction is textbook inside information. Do not send externally. Restrict to cleared deal-team channels.
“Everyone in the group is buying in ahead of the news.” Suggests concerted trading on non-public information. Do not send. Escalate to compliance if you are seeing this.
“Between us, results beat guidance.” “Between us” plus unpublished performance data is disclosure of MNPI. Rewrite to public facts only: “Results are out on [date]; nothing to add before then.”
“Sharing our Q3 revenue figure early with a few followers.” Selective disclosure of material data outside official channels (Reg FD parallel). Do not send. Route material figures through the disclosure process first.
“Trust me, the assets are fine.” A reassurance about financial condition can become fraud evidence if it is false or misleading. Do not improvise. Use only statements already cleared for public use.

The taxonomy sorts into four families, which is the useful bit to remember when a new phrase appears: MNPI leakage (passing unpublished, price-sensitive facts), concealment framing (“between us”, “off the record”), coordination signals (“we should all hold”), and selective disclosure (material figures out through an informal channel first). If a draft hits any of the four, it needs a second look before it leaves.

What real product output looks like

When VerbaPulse scans “Keep this between us until the announcement”, it does not rewrite the sentence into something clever. It flags the phrase and makes the call plainly: concealment language around unannounced information, recommendation to remove and wait for public disclosure. For “we should all hold around this level”, it flags the collective steer as a coordination signal and recommends removing it. Short, phrase-level, and honest about the cases where the safe answer is simply not to press send.

Where a pre-send check fits

Be clear about the boundary. A pre-send check is a front-end shield against accidental human risk: the careless line a well-intentioned employee does not notice is regulated. It reads the draft at the moment before send, flags the exposed phrase, and offers a safer version or a clear “do not send”. It will not stop a determined bad actor who intends to leak, and it is not a security boundary against a compromised or prompt-injected agent. Someone set on wrongdoing will route around any advisory prompt.

That boundary is what makes it complement, rather than replace, the tools you already run. Archiving and supervision platforms such as Smarsh and Proofpoint capture and review what was sent. They work after the message exists. A pre-send check sits upstream, so fewer risky lines reach those queues in the first place, which means fewer alerts to triage and fewer reconstructions to explain later. The two layers point the same direction: catch the phrase earlier, and there is less to catch downstream.

For a fuller breakdown of how everyday messages map to specific MAR provisions, see our guide to market abuse in financial services.

The takeaway

Do this: take the four-family taxonomy above, put it in front of your desk and markets teams, and make one rule stick. If a draft carries “between us”, “off the record”, “you did not hear it from me”, an unpublished figure, or a collective steer on price, it stops for a second look before it sends. Those five triggers cover most of the accidental exposure that ends up in an enforcement file. The message that becomes evidence is almost never the one someone agonised over. It is the quick line sent without a second thought, and the second thought is the entire fix.

This is general information, not legal advice. Assess your own obligations under MAR, Regulation FD, and applicable local rules with qualified counsel.

See it on your own emails

VerbaPulse flags risky wording as you write in Outlook and Gmail, then offers a safer phrasing before you send. Run it against your own messages and your own rules in a 30-day pilot.

Start a pilot

Up to 10 seats. EUR 120, credited to your plan if you continue.

See how VerbaPulse flags risk before an email is sent, right inside Gmail and Outlook.

See VerbaPulse in action →
← The Human-Communication Layer of the EU AI Act, After the Omnibus