Insider list redaction is the removal of personal data from the register an issuer and its advisers must keep under UK MAR Art. 18. The onshored Regulation 596/2014 makes the list a legal obligation, so it is processed under UK GDPR Art. 6(1)(c) rather than consent — and it holds some of the most sensitive fields in a deal, including private phone numbers and home addresses. anonym.plus marks those entries on your device, so the structure stays intact while identities are shielded.
When this applies
The Art. 18 template forces full names, National Insurance numbers, private telephone numbers and home addresses into one file. When the issuer shares an extract with an adviser or an auditor, you trim those entries first.
How anonym.plus handles it
- Open the register in anonym.plus on your device.
- Local OCR reads a scanned or printed extract.
- The tool flags names, NINOs, and contacts.
- Keep the column structure and timestamps intact.
- Swap or black out each confirmed entry.
- Save the clean extract locally.
What you need to provide
- The register (CSV export, PDF, DOCX, or scan).
- An operator (Redact suits a shared extract).
- Optional name map, kept under strict control.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | insider L. Fairbanks → [PERSON] |
| Identifiers | UK_NINO | National Insurance no. → [NINO] |
| Contact | PHONE_NUMBER | private +44 7700 900512 → [PHONE] |
| Contact | EMAIL_ADDRESS | home email → [EMAIL] |
| Location | LOCATION | home address → [ADDRESS] |
| Dates | DATE_TIME | access 12/03/2025 → [DATE] |
Compliance achieved
- Handles the register required by UK MAR Art. 18 in the prescribed template format, private contact fields included.
- Art. 18(2) makes each listed person acknowledge their duties in writing — keep that acknowledgement with the master copy.
- Art. 18(5) requires the list to be retained for at least five years, so redact an extract and never the master.
- Holding the list rests on UK GDPR Art. 6(1)(c), a legal obligation, so it cannot simply be deleted on request.
- Supports the information barriers described in FCA SYSC 10.2 when a list is split between teams.
Anonymise insider lists offline — see plans & start free →
Limitations & cautions
Art. 18 requires the issuer to keep the full register for at least five years, so never destroy the master. Redact only a shared extract. A role plus an access timestamp can still hint at identity, so review extracts with care.
Frequently asked questions
Should I redact the master register itself?
No. UK MAR Art. 18 requires you to keep the complete list, and Art. 18(5) sets a five-year retention floor. Redact only an extract you share onward.
Which fields does Article 18 force into the list?
The prescribed template covers full name, date of birth, national identification number (the National Insurance number in the UK), work and personal telephone numbers, personal home address, and the times access began and ended. anonym.plus flags each one.
Can an insider ask to be erased from the list?
Not while the retention duty runs. The list is processed under UK GDPR Art. 6(1)(c) to meet a legal obligation, so erasure does not override UK MAR Art. 18(5).