How to Defend a Market Abuse Investigation in Belgium (2026): Who Investigates, Immediate Steps, and Director Liability

Market abuse investigations in Belgium have entered a decisive new phase, driven by a modernised Belgian Criminal Code and intensified enforcement from the Financial Services and Markets Authority (FSMA). For in-house counsel, compliance officers and company directors, the practical question is no longer whether an inquiry might arise but how to respond decisively in the critical first hours and days. This guide sets out who investigates, the immediate steps to take on notification, how privilege and evidence preservation work in practice, and how recent reforms reshape personal exposure for directors. Read it as an operational playbook, one built around Belgian procedure and EU rules rather than generic principles.

What is market abuse in Belgium? (definitions and examples)

Market abuse in Belgium is governed principally by the EU Market Abuse Regulation (MAR), which is directly applicable across all Member States, and by Belgian implementing rules enforced by the FSMA. Because MAR applies directly, its definitions form the backbone of any market abuse investigation Belgium may launch, whether the matter is pursued administratively or criminally.

Legal definitions under MAR and Belgian implementing rules

MAR captures three core categories of prohibited conduct:

• Insider dealing. Using inside information, precise, non-public, price-sensitive information relating to a financial instrument, to acquire or dispose of instruments to which that information relates, or to cancel or amend an order.
• Unlawful disclosure of inside information. Passing inside information to another person outside the normal exercise of employment, profession or duties.
• Market manipulation. Conduct that gives, or is likely to give, false or misleading signals as to supply, demand or price; securing an artificial price level; or disseminating false or misleading information.

The FSMA supervises Belgian markets and issues guidance on how these obligations apply to issuers, market participants and their staff. In an insider trading Belgium scenario, the decisive question is usually who held price-sensitive information, whether that information was genuinely inside information at the relevant time, and how it was used or communicated.

Common fact patterns that trigger investigations

Most market abuse Belgium matters arise from recognisable fact patterns. Understanding them helps compliance teams identify risk early:

• Trading ahead of an announcement. A director or employee trades in the company’s shares shortly before a results release, a profit warning or an M&A announcement.
• Selective disclosure. Inside information is shared with an analyst, journalist or counterparty before public release, breaching the unlawful disclosure prohibition.
• Market manipulation . Layered orders, marking the close, wash trades, or the dissemination of misleading statements designed to move a price or create a false impression of liquidity.
• Delayed or defective disclosure. An issuer fails to publish inside information as soon as possible, or mishandles the conditions for a legitimate delay.

For example, if a board member sells shares two days before an unexpected profit warning, the FSMA will typically examine trading records, communications and the timing of the individual’s knowledge. Even where trades are innocent, the appearance of suspicious timing can be enough to open a market abuse investigation Belgium regulators take seriously.

Who investigates market abuse in Belgium? (authorities, powers and parallel probes)

One of the most confusing aspects of market abuse investigations Belgium companies face is that several authorities can act, sometimes simultaneously. Knowing which body is involved, and its powers, is the foundation of any defence strategy.

FSMA, administrative investigations and sanctions

The FSMA is the front-line supervisor for Belgian markets. It monitors trading, receives suspicious transaction and order reports, and conducts administrative investigations into suspected market abuse. FSMA market abuse enforcement can lead to administrative fines and other measures through its sanctions procedure, which separates the investigative function from the sanctions body that imposes penalties. FSMA investigators can request documents, data and explanations, and can refer matters to the public prosecutor where criminal conduct is suspected.

Public prosecutor, Belgian criminal investigations

Serious market abuse can be prosecuted criminally through the ordinary Belgian criminal justice system. The public prosecutor directs investigations and an investigating judge may be seized for the most intrusive measures. When an investigating judge conducts the investigation, police can execute searches, commonly described as dawn raids, seize documents and electronic data, and interview witnesses and suspects. Criminal exposure sits alongside, and is distinct from, FSMA administrative action.

Why multiple authorities can act in parallel

Parallel proceedings are a defining feature of market abuse investigations Belgium enterprises must manage. The FSMA may run an administrative investigation while the public prosecutor pursues a criminal file. These authorities coordinate and the FSMA may refer a matters to the prosecutor’s office, but they apply different procedures, standards and remedies. Managing the interaction, and avoiding self-incrimination across forums, is central to defence.

Table A: Investigator powers and procedures compared

Immediate steps when you are notified of a market abuse probe, a 10-point checklist

The first days of a market abuse investigation Belgium companies encounter are decisive. Actions taken, or omitted, in this window shape privilege, evidence integrity and the credibility of any later cooperation. Defending a market abuse investigation begins with disciplined, sequenced steps rather than improvisation.

The 10-point immediate steps checklist

1. Establish a small response team (first hours). Convene a tight group, general counsel, a nominated senior executive and external counsel. Keep the circle small to protect confidentiality and privilege.
2. Issue a legal hold and containment (first hours). Suspend routine document destruction and auto-deletion of emails, chats and trading records. Preserve everything potentially relevant.
3. Engage external counsel and set the privilege strategy (first 24 hours). Instruct experienced Belgian white-collar counsel before conducting substantive internal fact-finding, so that investigative work is structured to maximise privilege protection.
4. Control communications (first 24 hours). Restrict internal messaging about the matter. Avoid speculation in writing. Prepare holding lines and identify who may speak to regulators, staff and, if listed, the market.
5. Prepare for a possible dawn raid (first 24–48 hours). Brief reception and IT on how to respond to an unannounced visit, who to call, and how to record what is seized. Have counsel contactable at short notice.
6. Preserve IT and forensic data (first 48 hours). Image relevant devices, preserve server logs, and secure trading and communications data with an intact chain of custody.
7. Map the notifications (first 48–72 hours). Identify regulatory notification obligations, board reporting duties and, for listed issuers, any disclosure considerations, taking care not to trade or leak inside information.
8. Prepare for witness statements (first week). Prepare the people that are te be interviewed by means of dry run.
9. Scope the internal investigation (first week). Define the questions, timeframe and data sources. Keep the scope defensible and proportionate.
10. Assess cross-border and mutual-assistance exposure (first two weeks). Identify data located abroad, group entities in other jurisdictions, and any international dimension that could trigger cross-border evidence requests.

Tactical dos and don’ts

• Do document every interaction with investigators, names, times, documents seized, and questions asked.
• Do route substantive analysis through counsel to support privilege claims.
• Don’t delete, alter or “tidy up” any records, this risks obstruction exposure and destroys credibility.
• Don’t conduct unstructured interviews before the privilege framework and protocol are set.
• Don’t make public or internal statements asserting innocence or guilt before the facts are established.

For an internal legal hold, model wording can be as simple as: “On advice of counsel, all documents and electronic records relating to [matter] must be preserved. Do not delete, modify or discuss these records outside the response team. Direct all queries to [named contact].” Keeping such memos short and factual reduces the risk that they themselves become problematic evidence. A dedicated dawn raids and evidence preservation checklist should support this stage.

Privilege, internal investigations and managing evidence in a market abuse investigation Belgium

Handling privilege and evidence correctly is where many market abuse investigations Belgium businesses face are won or lost. The interaction between internal fact-finding, legal advice and disclosure to authorities requires careful structuring from day one.

Professional secrecy and privilege in Belgium, scope, limits and risks

In Belgium, the confidentiality of communications with an in-house lawyer differs fundamentally from the professional secrecy (professional privilege) of members of the bar.  The risks are heightened during internal investigations: interview notes, factual chronologies and forensic reports may not automatically attract protection unless they are properly framed as part of the provision of legal advice by external counsel. Instructing external counsel to lead and structure the work strengthens the position, and communications should be marked and channelled deliberately rather than circulated widely.

Handling forensic IT, log preservation and vendor management

Digital evidence dominates modern market abuse cases. Trading logs, order histories, emails and messaging platforms must be preserved with an unbroken chain of custody. A practical chain-of-custody checklist should record: what was collected, by whom, when, from which device or system, how it was stored, and every subsequent access. Forensic vendors should work under counsel’s instruction, and preservation should extend to backups and mobile devices, not just primary mailboxes. A copy should be kept of all evidence seized by or handed over to the authorities.

Producing to FSMA or prosecutors, common pitfalls and protective measures

When producing material, common pitfalls include inadvertently waiving confidentiality, over-producing irrelevant sensitive data, and disclosing documents inconsistently across parallel proceedings. Protective measures include a clear redaction protocol, redacting privileged legal advice and irrelevant personal data while keeping an audit log of every redaction and its basis, and a single, coordinated production strategy that accounts for FSMA and prosecutorial requests. Consistency across forums is essential, because divergent disclosures can be exploited.

Administrative sanctions vs criminal prosecution, procedure and remedies

A defining strategic issue in market abuse investigations Belgium defendants encounter is the parallel existence of administrative and criminal tracks. They differ in procedure, burden of proof, remedies and appeal routes, and a defence must be calibrated to both. The interaction of the two tracks is also shaped by the principle against being tried or punished twice for the same conduct (ne bis in idem), which requires careful analysis in any given case.

The FSMA sanctions process

The FSMA sanctions procedure typically moves from investigation, through a statement of objections or notice, to a hearing before the sanctions committee, followed by a decision that may impose fines or other measures. Decisions are subject to appeal before the Markets Courts. The process separates investigation from adjudication, and cooperation and remediation can be relevant to the outcome.

Criminal procedure before the Belgian courts

Criminal proceedings follow the general structure of Belgian criminal procedure: an investigative phase directed by the prosecutor (or, in case coercive measures are taken, an investigating judge), a pre-trial phase, and trial before the competent court, with sentencing on conviction. The safeguards, including rights of the defence and the presumption of innocence, apply throughout, and the standard of proof is higher than in administrative proceedings. Appeal is possible before the ordinary Court of Appeal.

Practical differences that shape strategy

The two tracks diverge in ways that directly affect defence choices: timelines, the standard and burden of proof, disclosure obligations, and the weight given to remediation as mitigation. Statements made in one forum can have consequences in another, so coordinating positions is critical.

Table B: Administrative (FSMA) vs criminal sanctions compared

A dedicated comparative guide on FSMA vs criminal proceedings in Belgium can help teams model these differences before committing to a strategy.

Penalties and director liability under the reformed Belgian Criminal Code

The reform of the Belgian Criminal Code is an important development that market abuse investigations Belgium directors now need to understand. The consolidated statutory texts are published through the Belgian Official Gazette / e-Justice portal (Moniteur belge / Belgisch Staatsblad). Because reform provisions may enter into force in stages, directors should confirm which text applies to the conduct in question, depending on the date of the facts.

Typical penalties and ancillary measures

Penalties in market abuse cases can include:

• Financial penalties. Fines calibrated to the seriousness of the conduct and, in some cases, linked to the advantage gained.
• Custodial sentences. Imprisonment for the most serious criminal market abuse.
• Disqualification. Measures affecting the ability to hold certain functions or rights.
• Ancillary measures. Confiscation of proceeds and other consequences that can extend beyond the headline penalty.

The precise levels of fines and imprisonment depend on the applicable statutory provisions in force at the relevant time and should be confirmed with counsel against the current text.

How directors can limit liability

Director liability exposure is not fixed at the moment an investigation opens; it can be materially influenced by the response. Practical levers include:

• Governance and documentation. Demonstrable compliance systems, records of decisions and evidence that the director acted properly reduce the risk of personal attribution.
• Early remediation. Prompt corrective action shows good faith and can influence both administrative and criminal outcomes.
• Cooperation, calibrated with care. Constructive engagement can help, but must be balanced against the right against self-incrimination and the risk of criminal referral.
• Independent advice. Where interests between the company and individual directors may diverge, separate representation protects the director’s position.

Detailed guidance on director liability under the reformed Belgian Criminal Code should form part of every board’s preparedness planning.

Cross-border and EU enforcement issues 

Many market abuse investigations Belgium businesses face have a cross-border dimension, and the EU enforcement architecture can be decisive. EU instruments for the freezing and confiscation of assets may also be relevant to asset recovery. The FSMA may interact with other European or international administrative authorities to have specific investigative acts carried out in foreign jurisdictions.

Managing cross-border evidence and third-country requests

Practical management of cross-border matters requires early mapping of where data and witnesses sit, coordination of disclosure across jurisdictions, and careful handling of mutual legal assistance and third-country requests. Data protection constraints, differing confidentiality regimes and the risk of inconsistent positions all demand a single coordinated strategy rather than jurisdiction-by-jurisdiction improvisation. 

Defensive playbook: model timeline from notification to resolution

The following model timeline distils the response into decision nodes. It is indicative, every market abuse investigation Belgium teams handle will vary, but it provides a disciplined framework.

• 0–48 hours. Stand up the response team, issue the legal hold, instruct external counsel, control communications, and prepare for a possible dawn raid. Preserve IT and trading data with chain of custody.
• Week 1. Scope the internal investigation, design the witness protocol, map notification obligations, and take an initial view on the likely track (FSMA administrative or criminal). Decision node: whether self-reporting warrants active consideration. Prepare for interrogations.
• Month 1. Complete key factual findings, refine privilege and production strategy, and engage with authorities on process. Decision node: prosecutorial referral risk and FSMA notice response.
• Month 3. Develop the substantive defence, assess remediation credit, and evaluate settlement or resolution options against litigation risk. Decision node: board escalation and mandate for resolution strategy.
• Months 6–12. Progress towards resolution, administrative decision, settlement, or contested proceedings, while maintaining consistency across parallel forums and preserving appeal rights.

The right decision at each node depends on evidence strength, remediation and the interplay between administrative and criminal exposure. Self-reporting, in particular, is never automatic: early voluntary disclosure can be relevant to mitigation in some contexts but may also trigger a criminal referral, and should only follow a clear-eyed assessment with counsel.

Conclusion, key takeaways and immediate next steps

Market abuse investigations Belgium companies and directors face in 2026 are higher-stakes than ever, shaped by the reformed Criminal Code and by coordinated enforcement. Five practical takeaways stand out: act promptly in the first days with a disciplined checklist; identify early which authority is investigating and manage parallel exposure; protect confidentiality by structuring internal work through external counsel; preserve evidence with an intact chain of custody; and treat director liability as a live, manageable risk that rewards early remediation and independent advice. The organisations that respond best are those that have planned the response before the notification arrives.

If you are facing, or anticipating, a market abuse investigation Belgium regulators or prosecutors may pursue, obtaining specialist advice at the outset is the single most valuable step you can take.

For further context, see White-collar crime lawyers Belgium, reformed Criminal Code and the profile of Dirk Libotte, author profile. Complementary practice notes cover FSMA enforcement and sanctions (Belgium), a Dawn raids & evidence preservation checklist, Director liability under the reformed Belgian Criminal Code, guidance, and FSMA vs Criminal Proceedings in Belgium, comparative guide.

This article is general information and does not constitute legal advice.

Sources

1. Market Abuse Regulation (MAR), EU (consolidated text)
2. Financial Services and Markets Authority (FSMA), Belgium
3. European Public Prosecutor’s Office (EPPO)
4. European Anti-Fraud Office (OLAF), European Commission
5. Belgian Federal Public Service Justice (FPS Justice)
6. Belgian Official Gazette / e-Justice portal (Moniteur belge / Belgisch Staatsblad)