What a Wall Street scandal teaches anyone who keeps an insider list
Thirty people charged in the US, several of them corporate lawyers who allegedly opened deal files they were never staffed on. For anyone who keeps an insider list, that last detail is the whole story.
Sujeet Indap's piece in the Financial Times this summer, "Wall Street law firms ponder fresh era of insider trading risks", describes a scenario every managing partner works to prevent: a firm's own lawyers trading on confidential client information, which is about as fundamental a breach of professional duty as the profession has. In May 2026, federal prosecutors in the District of Massachusetts charged 30 individuals with securities fraud said to have generated tens of millions of dollars in illicit profits over roughly a decade. At the centre of it, according to the indictments, sat corporate lawyers who had worked at elite firms including Goodwin, Latham & Watkins, Wachtell Lipton, Sidley Austin and Weil Gotshal. The deals allegedly exploited were not obscure: Johnson & Johnson, Cigna and Occidental Petroleum among them. Bloomberg, reporting the same indictments, put it bluntly, describing elite M&A lawyers who allegedly fed a massive insider-trading ring across nearly 30 transactions.
None of the firms is a target of the investigation, and each told the FT it was shocked and is cooperating. For the rest of us, the useful question is not how a handful of individuals allegedly went bad, but how they allegedly got the information in the first place.
They didn't need to be on the deal
One detail matters more than the rest for compliance teams. According to the indictments, which centre on a 2011 Yale Law graduate named Nicolo Nourafchan and an alleged co-conspirator, the lawyers obtained confidential deal information by accessing their firms' electronic document management systems, including on matters they were not working on. Nourafchan, who worked at firms including Goodwin and Latham between 2013 and 2023, pleaded not guilty on 1 June. He is alleged to have worked with a New York personal injury lawyer, Robert Yadgarov, to turn the tips into trades in exchange for kickbacks.
What stands out is that last part, matters they were not working on. Not a locked deal room breached, not a password stolen, but a lawyer with a valid firm login opening a folder for a transaction they had no business reason to see, and the system letting them. Reuters and the ABA Journal reported the same mechanism, describing lawyers who accessed their firms' internal networks to read confidential documents on pending mergers, then passed tips down the chain for kickbacks. As Devika Kewalramani, a legal ethics partner at FisherBroyles, told the FT, "How electronic client data is properly secured and protected and stored has become a huge conundrum for all law firms and lawyers." She makes a sharper point too: firms have to comply with securities law and professional conduct standards, but "there is no universal or uniform standard on how to do all of this". Each firm is left to work it out alone.
Insider trading law has a long habit of being shaped by lawyers. Georgetown's Donald Langevoort notes as much in the FT piece, and past cases back him up: Ilan Reich, a young Wachtell partner, fed deal tips into the Milken-Boesky scandals of the 1980s, and the US Supreme Court's decision against Minnesota lawyer James O'Hagan nearly thirty years ago still forms part of the backbone of American insider trading doctrine. What has changed since is not the temptation. It is the surface area. Legal advice on deals has expanded into a lucrative industry, and the information behind it has been digitised into systems that make it trivially easy to look at far more than your own caseload.
Why this lands the same way under MAR
None of this is a US-only problem, and the framing under the Market Abuse Regulation (MAR) makes the exposure obvious rather than abstract. MAR requires an issuer, and anyone acting on its behalf or on its account, to draw up and maintain an insider list: a record of every person with access to inside information relating to that issuer. Advisers are squarely inside that obligation. When a listed company runs a deal, the law firm, the bank, the accountants and the PR advisers are all handling inside information, and every individual with access is meant to be on a list, with the date and time their access began.
A list is only as honest as the access it describes. If a lawyer can open a deal folder they were never staffed on, they have access to inside information, and they are almost certainly on nobody's insider list for that deal. This is not a filing technicality. An insider list is the document a regulator asks for first when it wants to know who knew what and when, and a list that records the four-person deal team while a fifth person quietly browses the folder is worse than useless: it is confidently wrong. Under MAR the obligation runs to persons discharging managerial responsibilities (PDMRs) and persons closely associated (PCAs) as well, but the deal-team access point is where the gap in this case would open.
Software helped create the problem, and Indap notes that some firms now pitch software as the fix. Specialist providers argue for role-based access controls, so a sensitive document is visible only to the deal team members who actually need it, backed by intelligent alerts that flag suspicious activity, a paralegal opening a folder untouched for months, for instance. Whether or not any particular tool delivers on that, the underlying principle is the right one, and it is the same principle that sits behind a properly kept insider list: access should be deliberate, recorded, and reviewable after the fact.
The practical lesson
For a UK or EU compliance team, the useful takeaway is a modest one. Ask the firms you instruct a direct question: who at your firm can see the documents for our deal, and can you show me that only they can? Ask it of your own house too. Then make sure the insider list reflects the answer, so that the record of who held inside information matches the reality of who could reach it.
That reconciliation, between who is on the list and who can actually open the file, is precisely the discipline an audit trail exists to enforce, and it is the work InsiderList is built to take off a compliance team's desk: every access change captured with a timestamp, every list current the moment it changes rather than at the end of a busy week. Kewalramani's closing line to the FT is the honest one, and worth keeping: "Nobody has the silver bullet. This is about risk management." No system removes the human temptation at the centre of a case like this. What good controls do is make sure that when someone reaches for information they should never have touched, the reaching leaves a mark.
Sources: Sujeet Indap, "Wall Street law firms ponder fresh era of insider trading risks", Financial Times, 25 June 2026. Charging details corroborated by ABA Journal, Bloomberg, Reuters/Insurance Journal and Yahoo Finance coverage of the May 2026 indictments in the District of Massachusetts.
