CFA Level I Exam · Guidance for Standard II: Integrity of Capital Markets

Firewalls, Information Barriers and Handling MNPI

Updated 7 October 2026 · Fact-checked

A firewall, or information barrier, is a set of firm policies that stops material nonpublic information (MNPI) moving from one department to another. Under the guidance for Standard II(A), firms use barriers, restricted lists, watch lists and compliance review to prevent trading on MNPI. To answer questions, find where the information sits and which control fits.

Understand Compliance Procedures: Firewalls and Insider Information

Standard II(A) says members and candidates must not act or cause others to act on material nonpublic information that could affect the value of an investment. Information is material if disclosure would likely affect the price of a security or if reasonable investors would want it before deciding. It is nonpublic until it is available to the marketplace at large.

Large firms have many units. An investment bank may advise a company on a takeover while its research and asset management arms analyse that same company. If information flows between them, someone may trade on it or issue a biased view. The firewall (also called an information barrier) is the firm's policy that blocks this flow.

The guidance calls the information barrier the primary method for preventing misuse of MNPI. A strong one has several parts: physical and electronic separation of departments, limited access to files, restrictions on who may talk to whom, and an independent compliance function that controls any crossing of the barrier. Employees who are "wall-crossed" need approval, and the firm records it.

Two lists support the barrier. A watch list is a confidential list of companies the firm is monitoring because it may hold MNPI about them (for example, a pending deal). It is used to monitor trading, with limited, confidential distribution. When the barrier is working, the firm can keep a name on the watch list. The firm may limit or restrict research and recommendations on those names, as its policy dictates. A restricted list is a list of securities on which the firm will not make recommendations or trade for its own account. It is shared with employees without giving reasons, so it does not reveal the deal, and firm policy also restricts employee trading in those names. The firm uses it when it is in possession of MNPI and cannot isolate it with a barrier. The main difference is confidentiality and what is restricted: the watch list is for monitoring, the restricted list is for stopping the firm's proprietary trading and recommendations.

When a firm cannot use a firewall to isolate MNPI, it should place the security on a restricted list. It then stops proprietary trading and stops soliciting or recommending the security until the information becomes public. The firm may continue to execute unsolicited client trades. A firm should also encourage a culture of compliance, review employee trading and keep records. Do not take firewalls as a substitute for a code of ethics. They work together.

Key formulas to remember

Standard II(A) core rule: Do not act or cause others to act on MNPI; Applies to material information that is not yet public. Information is public once available to the marketplace at large.
Materiality test: Material = likely to affect price OR reasonable investors would want it; Source and reliability of the information also matter.
Firewall components: Barrier + limited access + compliance control + records; The information barrier is the primary method the guidance gives for preventing MNPI misuse within a firm.
Watch list vs restricted list: Watch list = monitor, confidential, limited distribution; Restricted list = firm stops proprietary trading and recommendations, shared with employees without reasons; Watch list names are monitored for trading, and the firm may limit or restrict research and recommendations on them as its policy dictates. Restricted list names are circulated to employees without reasons, the firm stops proprietary trading and recommendations on them, and employee trading is also restricted under firm policy.
When the firm cannot isolate MNPI: Barrier not enough → restricted list → stop proprietary trading and recommendations; The firm should not trade for its own account or recommend the security until the information is public. Unsolicited client trades may continue.

How to solve Compliance Procedures: Firewalls and Insider Information questions

Use this order for any firewall or MNPI compliance question.

1Identify the information. Ask if it is material and whether it is nonpublic.
2If it is public or not material, Standard II(A) is not triggered, so pick the answer that allows normal activity.
3If it is MNPI, identify where it sits in the firm (for example, investment banking) and who else wants it.
4Match the control to the need: a firewall to block flow, a watch list to monitor while the barrier works, a restricted list to stop proprietary trading and recommendations when the barrier cannot isolate the information.
5Check if the firm has a working barrier. If not, the safe action is to use a restricted list and stop proprietary trading and recommendations. Unsolicited client trades may continue.
6Choose the option that follows the Standard strictly, even if it costs the firm or client a profit, and reject answers that disclose or trade.

Quickest way: Three-question MNPI filter

When to use it: Use it when a stem describes an analyst, banker or trader who receives or holds information about a company.

Is it material? Would it move the price?
Is it nonpublic? Has the market at large seen it?
If both yes, which option blocks flow or stops trading? Pick it and drop options that trade, tip or publish.

Common mistakes in Compliance Procedures: Firewalls and Insider Information

Treating the watch list and restricted list as the same thing.
Both relate to companies involved in deals, so they sound alike.
Fix: Remember: watch list is confidential monitoring; restricted list is shared with employees without reasons and goes with the firm stopping proprietary trading and recommendations, with employee trading also restricted under firm policy.
Thinking a firewall allows trading on MNPI as long as the barrier exists.
Students see the firewall as permission.
Fix: The firewall only helps prevent misuse. Anyone holding MNPI still cannot trade or cause others to trade.
Assuming information is public because it is widely rumoured.
Rumours feel like public knowledge.
Fix: Information is public only when disseminated to the marketplace at large. Unconfirmed tips from insiders are still nonpublic.
Choosing to share MNPI with a client because it helps them.
Loyalty to clients seems to outweigh the rule.
Fix: Standard II(A) applies to all. Do not act or cause others to act on MNPI, even for a client.
Thinking compliance should do nothing when MNPI is found.
Students forget active duties.
Fix: Compliance should review the information. If the barrier is effective, it places the security on the watch list. If the MNPI cannot be isolated, it places the security on the restricted list and the firm stops proprietary trading and recommendations.

Worked examples

Example 1

An investment bank's corporate finance team is advising Company X on a takeover. The bank's research department covers Company X. The bank has no effective barrier and cannot isolate the information. Which action best follows the guidance on Standard II(A)? A. Let the research analyst attend the deal meetings so the rating is accurate. B. Place Company X on the restricted list and stop proprietary trading and recommendations until the deal is public. C. Allow research to continue but ask analysts not to trade personally.

Show the solution

Information: the takeover is material and nonpublic.
The bank holds MNPI in one department, and research is another.
Option A moves MNPI across the barrier, so it breaks the firewall idea.
Option C leaves research active and relies only on personal restraint, which risks leaking or biasing a view.
The stem says the bank cannot isolate the information, so a barrier and watch list alone are not enough. The guidance then calls for a restricted list and for the firm to stop proprietary trading and recommendations until the information is public. Unsolicited client trades may continue. That is option B.

Answer: B

Example 2

A compliance officer wants a confidential list of companies on which the firm may hold MNPI so trading can be monitored without alerting staff to the deals. Which list is this? A. Restricted list. B. Watch list. C. Public disclosure list.

Show the solution

The list is confidential and used to monitor, not to stop the firm's own trading or recommendations.
A restricted list is shared with employees without reasons and is used when the firm stops proprietary trading and recommendations.
A public disclosure list is not a list in the guidance and would defeat confidentiality.
So the monitoring list is the watch list.

Answer: B

Exam tips

Expect stems about an investment bank with a research or asset management arm. The answer is usually the barrier, the restricted list, or stopping proprietary trading and recommendations.
Learn the difference in one line: watch list monitors, restricted list stops the firm's proprietary trading and recommendations (and employee trading is also restricted).
Read the stem for whether a working barrier exists. If it does, think barrier and watch list. If the information cannot be isolated, think restricted list and stop proprietary trading and recommendations.
Reject any option that tips, trades or lets MNPI cross to another department without compliance.
Check the facts first: if the information is public or immaterial, Standard II(A) does not apply.
Name Standard II(A) in your head and pick the option that follows it strictly, even if it seems costly.

Practice questions from Guidance for Standard II: Integrity of Capital Markets

Compliance Procedures: Firewalls and Insider Information in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Compliance Procedures: Firewalls and Insider Information: frequently asked questions

What is an information barrier in CFA Level I?

It is a firm policy, also called a firewall, that stops MNPI passing between departments. It includes separated access, limited communication and compliance control. The guidance calls it the primary method for preventing misuse of MNPI inside a firm.

What is the difference between a restricted list and a watch list?

A watch list is confidential, has limited distribution and is used to monitor trading in companies where the firm may hold MNPI. A restricted list is shared with employees without reasons, and the firm stops proprietary trading and recommendations on the named securities; employee trading is also restricted under firm policy. A firm uses it when it cannot isolate the MNPI, though unsolicited client trades may continue.

How should a firm handle MNPI?

It should limit access, keep departments separated, route any crossing through compliance and record it. It should also review trading in affected names. If it cannot isolate the MNPI, it should use a restricted list and stop proprietary trading and recommendations on that security until the information is public.

Does Standard II(A) apply if I only pass on MNPI and do not trade?

Yes. The Standard forbids acting or causing others to act on MNPI. Tipping someone who then trades can breach it, even if you do not trade yourself.