Insider trading policies in 10-K filings: Exhibit 19, Item 408(b) and what roster companies filed

Yes. Since the SEC's 2022 insider trading rules took effect, a company filing a Form 10-K has to say under Regulation S-K Item 408(b) whether it has adopted insider trading policies and procedures and must file them as Exhibit 19, and of the 819 roster 10-Ks the record could read, 264 attach that exhibit to the report itself. Another 488 list Exhibit 19 in the exhibit index and point to an earlier filing where the policy already sits, so 752 of the 819 tie the 10-K to a filed policy one way or the other.

The CFO Tribune roster holds 831 companies, each with its principal financial officer as the signature page of its latest 10-K prints the name. For this study the record read each of those 10-Ks once on November 12, 2026: the filing index on sec.gov, the 10-K document, and every document filed under the exhibit type EX-19. The count below is what the filings show. It is about the companies' policies, not about any person's trades.

What Item 408(b) and Exhibit 19 require

Item 408 of Regulation S-K, at 17 CFR 229.408, has two parts that are easy to confuse. Paragraph (a) is about people: it asks a company to disclose whether any director or officer adopted or terminated a Rule 10b5-1 trading arrangement during the quarter. Paragraph (b) is about the company. Item 408(b)(1) asks the registrant to "Disclose whether the registrant has adopted insider trading policies and procedures" governing the purchase, sale and other dispositions of its securities by directors, officers and employees, or by the company itself, that are reasonably designed to promote compliance with insider trading laws and any listing standards. A company that has none must "explain why it has not done so."

Item 408(b)(2) adds the document. A registrant with such policies "must file such policies and procedures as an exhibit." Item 601(b)(19) gives the exhibit its number and name, "Insider trading policies and procedures," and covers any policies and procedures, "or amendments thereto," that are the subject of the Item 408(b) disclosure. In the exhibit table of Item 601, the row for exhibit 19 is marked for one form only, Form 10-K. There is one exception in the text of the rule: if the policies are all contained in the company's code of ethics, and that code is filed as an exhibit, the requirement is met.

The rule came from Release No. 33-11138, issued December 14, 2022 and effective February 27, 2023. Section III of the release set the compliance dates. Issuers other than smaller reporting companies had to comply "in the first filing that covers the first full fiscal period that begins on or after April 1, 2023." Smaller reporting companies had six more months: the first full fiscal period beginning on or after October 1, 2023. For a company with a calendar fiscal year, the first full fiscal year to begin after either date was 2024, so the 10-K filed in early 2025 was its first with an Item 408(b) statement and an Exhibit 19.

The roster 10-Ks read here are a year later than that. All 819 cover fiscal years ending between July 31, 2025 and 2026: 696 have a period of report in 2025 and 123 in 2026. Every one of them falls under the rule.

Where the statement goes in the 10-K

Form 10-K places Item 408(b) in Part III. Item 10, Directors, Executive Officers and Corporate Governance, asks the registrant to furnish the information required by Items 401, 405, 406, 407(c)(3), (d)(4), (d)(5) and 408(b). General Instruction G(3) lets a company supply Part III from its definitive proxy statement, if that proxy statement is filed "not later than 120 days after the end of the fiscal year covered by the Form 10-K." The release made the same disclosure a proxy statement item as well.

So the statement can live in either document. Many 10-Ks write the Item 408(b) paragraph into Item 10 and leave the rest of Part III to the proxy. Others incorporate the whole of Item 10 by reference and say nothing about the policy in the 10-K at all. The exhibit cannot move that way: it is a 10-K exhibit, and the proxy statement has no exhibit 19.

Item 408(a), the plans of named officers, sits elsewhere: Item 9B(b) of the 10-K for the fourth quarter, and Part II, Item 5 of Form 10-Q for the other three. Form 10-Q carries no Item 408(b) statement and no exhibit 19. That paragraph is personal trading information, and this study does not read it.

How many roster 10-Ks attach Exhibit 19

The cleanest test is the filing index. Every EDGAR filing has one, and it lists each document with the exhibit type the company assigned. Of the 831 roster 10-Ks, the record read the index and the 10-K document of 819. For the other 12 one of the two could not be read, and those are counted as not established.

Of the 819:

• 264 attach an Exhibit 19. The index lists at least one document of type EX-19, EX-19.1 or similar. Eight of the 264 attach two or three, for example a general policy with a separate pre-clearance or trading window procedure, or a separate policy for the company's own transactions in its shares.
• 488 point to an earlier filing. No EX-19 document is attached, but the exhibit index lists exhibit 19 with a reference to another filing, usually "incorporated by reference to Exhibit 19.1" of a previous 10-K. In 454 of those 488 entries the latest year the entry prints is 2024 or 2025, the year of the first annual report the rule covered.
• 12 say the policy is filed with the report, and the index lists no EX-19 document. The 10-K's own text says the policy is filed as an exhibit, and the record found neither an attached document nor a reference to an earlier filing in the exhibit list.
• 9 leave the statement to the proxy statement. The only mention of the policy in the 10-K points to a section of the proxy, and the record found no exhibit 19 entry.
• 10 name the policy, and the record could not read where it sits. The policy appears in the text, for example in an exhibit table whose columns the text version runs together, without a clear filed-here or filed-before marker.
• 3 say the company has not adopted an insider trading policy. Item 408(b)(1) allows that answer, as long as the filing explains why.
• 33 do not mention an insider trading policy anywhere in the 10-K document. Sixteen of the 33 are trusts or exchange-traded funds. For the rest, the 10-K document does not establish where a policy is, and the count leaves it at that.

Two outcomes the record looked for did not occur: no roster 10-K filed its policy under a different exhibit number, and the record found none whose only answer was the code of ethics.

The split between attaching and pointing back is the main finding. Most roster companies filed the policy once, in the first 10-K that needed it, and since then list it in the exhibit index with a reference to that filing. A reader who wants the policy of a company in the second group has to open last year's or the year before's 10-K to find it.

The split by filer category

The filer category is the one EDGAR reports for each company, the same field the record's guide to filer status uses.

Category	10-Ks read	Exhibit 19 attached	Earlier filing
Large accelerated filer	588	197	367
Accelerated filer	45	11	34
Non-accelerated filer	119	33	59
Category not established	67	23	28

Large accelerated filers attach the exhibit in 197 of 588 10-Ks and point back in 367. Accelerated filers do the same, 11 attached and 34 pointing back, with no other outcome in the group. The non-accelerated filers carry most of the rest: 18 of the 33 10-Ks with no mention of a policy are theirs, as are 5 of the 12 that say the policy is filed with no exhibit in the index.

What the statement says, and where it says the policy is

Of the 819 10-K documents, 763 mention the company's insider trading policy in at least one sentence. The wording tends to follow the rule's own. In 226 the 10-K says the policy is "reasonably designed to promote compliance" with insider trading laws, the phrase Item 408(b)(1) uses.

Adobe's 10-K for the fiscal year ended November 28, 2025 shows the pattern in two sentences. It says the company "believes that its insider trading policy is reasonably designed to promote compliance with insider trading laws, rules and regulations, as well as applicable listing standards," the Item 408(b)(1) standard, and then: "A copy of Adobe's insider trading policy is filed as Exhibit 19.1 to this report." The filing lists that document as EX-19.1 in its index, so it counts as attached. The first lines of that exhibit are annotated in the next section.

In 153 of the 763, a sentence about the policy points to the proxy statement, either for the Item 408(b) information or for a description of the policy. In 17, a sentence about the policy names a website. A website is not a substitute for the exhibit. Some commenters on the proposal suggested letting companies post the policy online and give the address, as Item 406(c)(2) allows for a code of ethics; the final rule requires the exhibit instead.

Three filings answer that the company has not adopted a policy. Each gives a reason, and two of the three say the company intends to adopt one. The record does not name them: the answer is a disclosure the rule permits, and this study counts it as such.

Topics the filed policies cover

The 264 attached policies can be read in full. The record read each one and searched its text for eleven topics. The median policy runs to 4,026 words; the shortest is 385 words, and the longest 14,957.

The core of an insider trading policy is almost universal. Of the 264, 258 name Rule 10b5-1 trading plans, 254 a pre-clearance step for trades, 252 blackout periods or trading windows, 252 hedging and 248 pledging. All five appear together in 226 policies. The next group covers the instruments and accounts that a policy usually restricts: 240 mention publicly traded options, puts or calls, 236 short sales and 229 margin accounts. Family and household members appear in 256 policies and gifts of securities in 235. The least common topic in the list is what happens after a person leaves the company, named in 163.

These are counts of words, not of rules. A policy that names hedging may forbid it, allow it with approval, or define it and say nothing more. The study reads which topics a policy addresses and leaves what it says about each to the policy's own text.

How the requirement differs for smaller reporting companies

The text of Item 408(b) makes no exception for smaller reporting companies. A smaller reporting company makes the same statement and files the same exhibit; the difference the release sets is the compliance date, six months later. In the roster, EDGAR flags 119 of the 819 read 10-Ks as smaller reporting companies. Of those, 24 attach an Exhibit 19 and 68 point to an earlier filing, against 240 attached among the other 700.

The other outcomes weigh more heavily in this group. Eighteen of the smaller reporting companies' 10-Ks do not mention a policy in the 10-K document, five say it is filed with no exhibit in the index, three name it in a way the read could not place, and one says no policy has been adopted. A policy the read did not find may still be filed somewhere the main 10-K document does not show, so the not-found counts here are a ceiling on the gap, not a measure of it.

What the policies do not show

Exhibit 19 is the rulebook. It does not say who traded, when, or under which plan, and this study does not either. The trading plans of named officers and directors, the Item 408(a) disclosure in each 10-Q and 10-K, are personal trading information and are out of scope: no person's plan, trade or holding appears here. Officers' and directors' own transactions are reported on Forms 3, 4 and 5, which the record does not read for this study. Nothing in this count says whether any policy was followed.

The SOX certifications in the same 10-Ks, and the other Part III items, are covered in the record's guide to SOX compliance in the annual report. The Form 10-K glossary entry sets out the parts of the report.

Method

How the counts were made:

• The roster. The record's 831 verified roster seats at November 12, 2026, each tied to a 10-K by the sec.gov link in its source. The roster holds the S&P 500 seats and the companies whose CFO changes the record has reported, so large companies weigh heavily in it; it is not a sample of all SEC registrants.
• What was read. For each roster 10-K, once, through the site's EDGAR client at no more than four requests a second: the filing index, the 10-K document, and every document of type EX-19. The roster coverage page lists the seats.
• Exhibit 19 attached. The filing index lists a document whose type starts with EX-19.
• Earlier filing. No EX-19 document, and an exhibit 19 entry in the 10-K's exhibit list that refers to another filing (it names a Form 10-K, 10-Q or 8-K, or says "incorporated by reference"), or a sentence about the policy that says it is incorporated by reference as Exhibit 19.
• The other outcomes. Read from the sentences of the 10-K that mention an insider trading, securities trading or similar policy, in the order shown on the chart: a statement that no policy has been adopted, a statement that the policy is filed as an exhibit, a reference to the proxy statement, a mention with no location, and no mention.
• Topics. A keyword search of each attached policy's text, for example "blackout", "trading window" or "window period" for blackout periods, and "pre-clear" or "pre-approv" for pre-clearance.
• Filer category. The category field in each company's EDGAR submissions file, read November 10, 2026.
• What is not counted. Item 408(a), the trading plans of any named person, and every Form 3, 4 or 5.
• Recomputing. scripts/articles/insider-trading-policy-exhibit-19-item-408-roster-10-ks.mjs reads EDGAR with --fetch, keeps flags only (no name and no policy text), and computes every figure here from what it saved.