CFA Level II Exam · Guidance for Standard II: Integrity of Capital Markets

Firewalls and Information Barriers in CFA Level II Ethics

Updated 7 October 2026 · Fact-checked

A firewall (information barrier) is a compliance control that stops material nonpublic information from flowing between departments, such as investment banking and research or trading. Under Standard II(A), firms also use restricted lists, watch lists, and reviews of personal trading to prevent misuse. On the exam, match each tool to the situation.

Understand Firewalls and Information Barriers

Standard II(A) says you must not act or cause others to act on material nonpublic information (MNPI). Individuals must follow this rule. Firms add controls so that no one has the chance to break it, even by accident.

The main control is the firewall, also called an information barrier. It is a set of policies that separates people who may hold MNPI from people who trade or advise. A common example is a bank where the corporate finance team learns about a client's planned merger. The research and trading teams must not learn it. The firewall works through physical separation, restricted access to files and systems, and rules on who may talk to whom.

The Handbook describes several elements of a strong firewall. Information flows only on a need-to-know basis. Employees who must cross the barrier do so through compliance, not on their own. Compliance has the power to review and approve those crossings. Personal trading by employees is monitored or restricted. Proprietary trading is also limited when the firm holds MNPI.

Two lists support the firewall. A watch list is confidential. It names securities the firm is monitoring because of possible involvement in a deal or other MNPI. Compliance reviews trading in these names for unusual activity. Often the firm does not restrict trading yet, so as not to signal that something is happening. A restricted list is for securities where the firm holds MNPI or is actively involved. The firm does not issue research or recommendations on these names and does not trade them for its own account (proprietary trading). It typically restricts employee personal trading in them as well. Solicited client trades may still take place. The restricted list may be shared more widely, often without a reason being given.

The most common approach in the Handbook is an information barrier (firewall). It lets the firm keep operating while keeping MNPI contained, so a blanket ban on communication or activity is usually not the best answer because it is costly. Where the barrier is not enough, or where the firm is itself involved in the deal, the firm can add a prohibition on trading and communication. It places the name on the restricted list and stops research and proprietary trading in that name. Level II tests you on choosing the right tool and spotting weak controls in a vignette.

Key formulas to remember

Firewall purpose: MNPI stays on one side of the barrier; trading and research stay on the other; Information moves only on a need-to-know basis, and crossings go through compliance.
Watch list: Watch list = confidential list of names monitored for unusual trading; no automatic ban; Used early, when a deal is possible but not firm. Limited circulation, compliance only.
Restricted list: Restricted list = names where the firm has MNPI or is involved; no firm research or recommendations, no proprietary trading, and employee personal trading typically restricted; Solicited client trades may still occur. The list can be shared more widely, usually without stating the reason.
Core rule: Standard II(A): do not act or cause others to act on MNPI; Applies to individuals; firm procedures help members comply.
Compliance elements: Barrier + need-to-know + compliance review + personal trading limits + documented procedures; Remember these as the parts of a sound MNPI policy.

How to solve Firewalls and Information Barriers questions

Use this method on any item set question about MNPI controls.

1Read the vignette and mark who holds the information, which team, and which security.
2Decide whether the information is material and nonpublic. If it is public or immaterial, Standard II(A) is not triggered.
3Identify the stage of the deal or event. Early or uncertain points to a watch list. Firm involvement or MNPI in hand points to a restricted list.
4Check whether a firewall exists and whether it is working: separation, need-to-know access, compliance control over crossings.
5Look for failures, such as a banker chatting with a trader, shared files, or no monitoring of personal trades.
6Choose the action that fits: tighten the barrier, place the name on a list, escalate to compliance, or stop research and proprietary trading in that name.
7Pick the answer that cites the control or Standard II(A) exactly and avoids the extreme option unless the facts demand it.

Quickest way: Stage and list matching

When to use it: When the question asks which list or control to use, or what the firm should do next.

Ask: does the firm already hold MNPI or act in the deal? If yes, restricted list.
If it is only possible or early, and the firm wants to watch without signalling, use a watch list.
If the problem is information moving between teams, answer firewall or information barrier.
Remove options that tell staff to ignore the MNPI or that rely only on trust.

Common mistakes in Firewalls and Information Barriers

Treating the watch list and restricted list as the same thing.
Both involve names the firm tracks, so they look alike.
Fix: Watch list is confidential monitoring. Restricted list stops the firm issuing research or recommendations and doing proprietary trading in the name, and typically limits employee personal trading.
Believing a firewall is only a physical wall.
The word suggests separate offices.
Fix: A firewall includes policies, system access limits, need-to-know rules, and compliance oversight.
Assuming the firm's controls remove the individual's duty.
Students think compliance procedures replace personal responsibility.
Fix: The member must still not act on MNPI. Firm procedures support compliance but do not replace it.
Choosing the answer that bans all communication between departments when the facts do not call for it.
It sounds the safest.
Fix: A blanket ban is not usually the best answer. An effective firewall with compliance review is. A ban on trading and communication is correct when the facts show the barrier is inadequate or the firm is itself involved.
Putting a name on a widely circulated restricted list too early or revealing the reason.
Students ignore the signalling risk.
Fix: Use the confidential watch list early. Share a restricted list without disclosing the underlying information.
Applying Standard II(A) to information that is public or immaterial.
Students react to the word 'confidential' in the vignette.
Fix: Test materiality and nonpublic status first. Both must hold.

Worked examples

Example 1

Vignette: Corvane Securities has an investment banking team advising Altor Ltd on a possible acquisition that has not been announced. The head of research, Mira, learns of it in a corridor chat with a banker and asks the trading desk to reduce its holding in Altor. Compliance later finds the firm has no restricted list and no barrier between banking and research. Q1: Which standard is most directly at risk? Q2: What control is missing that would have stopped the information moving? Q3: What should compliance do for Altor now?

Show the solution

Q1: The acquisition is material and nonpublic. Mira acted, and caused trading to act, on it. This is Standard II(A), Material Nonpublic Information.
Q2: The information moved between banking and research with no controls. The missing control is a firewall (information barrier) with need-to-know access and compliance oversight.
Q3: The firm is now involved in the deal and holds MNPI, so Altor belongs on the restricted list. The firm should stop issuing research or recommendations on Altor and stop proprietary trading in it, typically restrict employee personal trading, and put a proper barrier in place.

Answer: Q1: Standard II(A). Q2: A firewall or information barrier. Q3: Add Altor to the restricted list, halt research and proprietary trading in it, and put a barrier in place.

Example 2

Vignette: Pellam Capital's compliance team hears that a client, Rexon Inc., may seek a financing from the firm's banking arm, but no mandate has been signed. Compliance wants to detect any unusual trading in Rexon without alerting staff. Q1: Which tool fits? Q2: Should employees be barred from trading Rexon now? Q3: If Pellam later signs the mandate and learns confidential deal terms, what changes?

Show the solution

Q1: The event is uncertain and early, and the goal is quiet monitoring. A watch list fits.
Q2: A watch list does not itself ban trading. Banning now would signal that something is happening. Compliance monitors instead, so no automatic bar.
Q3: Once the firm holds MNPI and is involved, Rexon moves to the restricted list. The firm stops issuing research or recommendations and stops proprietary trading in Rexon, typically restricts employee personal trading, and the firewall must keep the terms inside the deal team.

Answer: Q1: Watch list. Q2: No, monitor rather than bar. Q3: Move Rexon to the restricted list, stop research and proprietary trading in it, and enforce the firewall.

Exam tips

Link each list to a stage: early and uncertain means watch list, firm involved means restricted list.
Check the vignette for whether the information is both material and nonpublic before choosing a Standard.
Prefer answers that use an information barrier with compliance review over answers that ban all contact or rely on trust.
Look for personal trading or shared systems in the vignette. These are common hidden control failures.
Name the Standard II(A) wording when the question asks why the action is a violation.

Firewalls and Information Barriers in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Firewalls and Information Barriers: frequently asked questions

What is the difference between a watch list and a restricted list?

A watch list is confidential and used to monitor trading in names tied to possible deals. A restricted list names securities where the firm holds MNPI or is involved. The firm issues no research or recommendations and does no proprietary trading in them, and employee personal trading is typically restricted. The restricted list may be shared more widely without giving reasons.

Does a firewall make a firm immune from MNPI violations?

No. It is a control that lowers the risk. Individuals must still not act on MNPI, and the firm must enforce the barrier through compliance review.

Which Standard covers information barriers?

Standard II(A), Material Nonpublic Information. The Handbook's compliance guidance under it describes firewalls, lists and limits on information flow.

Can a firm just ban all communication between departments?

It can, but that is a blunt approach and is usually not the best answer. The Handbook describes an information barrier with need-to-know access and compliance control over crossings as the most common approach. A prohibition on trading and communication is appropriate where the barrier is not enough, for example when the facts show it is inadequate or the firm is itself involved.