Due Diligence & UPSI Sharing — Legitimate Purpose Test

Topic 64 — PIT Regulation 3(3): Legitimate Purpose, Need-to-Know, NDAs & Due Diligence in M&A | SEBI Law Officer

Regulation 3(3) of the PIT Regulations, 2015 contains the legitimate purpose exception — the safety valve that allows businesses to function while prohibiting improper UPSI communication. The tension between two competing interests runs throughout this regulation: on one side, the legitimate business need to share sensitive information for transactions, legal advice, and operational purposes; on the other, the imperative to prevent that information from being misused for insider trading. SEBI has issued guidance, and courts have developed principles, to help navigate this tension. For SEBI Law Officer aspirants, the due diligence context — particularly M&A transactions — is the most commonly examined application of Regulation 3(3).

1. Regulation 3(3) — Full Text & Analysis

Regulation 3(3): Notwithstanding anything contained in sub-regulations (1) and (2), an insider may communicate, provide, or allow access to any unpublished price-sensitive information, relating to a company or securities listed or proposed to be listed, to any person including other insiders if such communication is in furtherance of legitimate purposes, performance of duties or discharge of legal obligations and if before such communication the insider is satisfied that the recipient is aware that the information being shared constitutes unpublished price-sensitive information and the recipient shall keep the information confidential and shall not otherwise trade in or procure trading in securities while in possession of such information.

Five conditions must ALL be satisfied for a valid Regulation 3(3) communication:

Condition	Requirement
1. Legitimate purpose, duty, or legal obligation	The communication must serve a genuine business/legal purpose — not merely satisfy curiosity or benefit the recipient's trading position
2. Recipient is aware it is UPSI	Before sharing, the insider must satisfy themselves that the recipient KNOWS this is UPSI — warning the recipient of the confidential nature
3. Recipient undertakes confidentiality	The recipient must commit to keeping the information confidential — typically through an NDA or written undertaking
4. Recipient must not trade on the UPSI	The recipient is bound not to trade (or procure trading) in the relevant securities while in possession of the UPSI
5. SDD entry must be made	Regulation 3(5): the recipient must be entered in the SDD with all required details

2. What Constitutes a 'Legitimate Purpose'?

SEBI and courts have not provided an exhaustive definition. Based on regulatory practice and case law, the following are accepted legitimate purposes:

Legitimate Purpose	Context	Conditions
M&A due diligence	Target company sharing financial/operational UPSI with potential acquirer/bidder during due diligence phase	NDA mandatory; need-to-know basis; SDD entry; acquirer's team members identified
Fundraising/investment rounds	Company sharing UPSI with potential investors in a private placement or pre-IPO round	NDA; DRHP/offer document to eventually disclose publicly; SDD entry
Legal advice on transactions	Company sharing UPSI with external legal counsel for advice on a proposed transaction	Lawyer-client privilege; SDD entry; counsel cannot trade
Audit/accounting purposes	Company sharing non-public financial data with statutory auditors or internal auditors	Professional confidentiality obligations; SDD entry
Banker advisory	Company sharing UPSI with investment banker managing an M&A or capital raise	NDA; SDD entry; banker's employees on restricted list
Credit assessment by lenders	Company sharing non-public financial data with banks/NBFCs assessing creditworthiness	Confidentiality clause in credit agreement; SDD entry
Board-level decision-making	Executive sharing UPSI with board members to enable informed decision-making	Inherent board confidentiality obligations; SDD for external board advisers
Regulatory compliance	Sharing UPSI with SEBI, NCLT, courts, or other regulators in response to legal process	Compelled by law/process — always legitimate

3. What Does NOT Constitute a Legitimate Purpose?

Certain communications are clearly outside the legitimate purpose exception:

Tipping for personal gain: Sharing UPSI with a friend, relative, or associate specifically so they can trade and profit — no legitimate business purpose.
Speculative sharing: Sharing UPSI out of curiosity or to impress others — without any specific business objective requiring the disclosure.
Selective analyst briefings: Sharing material non-public information with specific analysts before it is disclosed to all — violates both PIT Regulations and LODR non-selective disclosure obligations.
Social/personal relationship sharing: Telling a family member about an upcoming merger at a dinner conversation — even informally, this is a violation of Regulation 3(1) if no legitimate purpose is served.

4. Due Diligence in M&A — The Central Application

M&A due diligence is the most practically important application of the legitimate purpose exception. When a listed company (target) is being acquired:

4.1 Why Due Diligence Necessarily Involves UPSI

Due diligence requires the target company to share detailed financial information — including unpublished results, projections, material contracts, ongoing litigation — all of which may be UPSI.
The potential acquirer needs this UPSI to make an informed decision about the acquisition price and terms.
Without the legitimate purpose exception, M&A transactions involving listed companies would be impossible.

4.2 Regulatory Requirements for Valid M&A Due Diligence

Confidentiality Agreement (NDA): A formal NDA must be executed before any UPSI is shared. The NDA must expressly prohibit trading based on the UPSI.
Need-to-know restriction: UPSI is shared only with members of the acquirer's due diligence team who actually need it — not the acquirer's entire organisation.
SDD entry: Every member of the due diligence team who receives UPSI must be entered in the target company's SDD.
Virtual data room (VDR): UPSI is shared through a secure VDR with access logs — enabling the SDD to be updated with accurate records of who accessed what information.
Trading restrictions on due diligence team: All members of the acquirer's due diligence team are added to the target company's restricted trading list — they cannot trade in the target's securities while they have access to UPSI.

5. The 'Satisfying Oneself' Standard — What is Sufficient?

Regulation 3(3) requires the insider to be 'satisfied' that the recipient knows about the UPSI nature and will maintain confidentiality. What standard applies?

Signed NDA: Strongest form of compliance — a signed, written NDA expressly acknowledging that information is UPSI and that the recipient cannot trade.
Email acknowledgment: In less formal settings, an email from the recipient acknowledging the confidential nature may suffice.
Professional obligations: For professionals (lawyers, chartered accountants), their professional code of conduct itself imposes confidentiality — but best practice is still to execute an NDA or obtain an express undertaking.
Verbal acknowledgment: Least reliable — verbal communication that information is confidential UPSI may not be sufficient by itself. Should be followed by written confirmation.

6. SEBI's Informal Guidance on Legitimate Purpose

SEBI has provided informal guidance on several aspects of the legitimate purpose test:

Sharing UPSI with a potential strategic investor during negotiations: legitimate — subject to NDA and SDD entry.
Sharing UPSI with a journalist for a story: NOT legitimate — the journalist has no business obligation requiring access; sharing constitutes a violation.
Sharing UPSI with a rating agency for credit rating purposes: legitimate — rating agencies have professional obligations and contractual confidentiality; still requires NDA and SDD.
Sharing UPSI with an employee who does not need it for their role: NOT legitimate — the need-to-know principle applies even within the company.

7. Model Examination Questions

Q1. Explain the legitimate purpose test under Regulation 3(3) of the PIT Regulations, 2015. How does it apply in M&A due diligence?

Legitimate Purpose Test — Regulation 3(3) & M&A Due Diligence

Model Answer — REGULATION 3(3) EXCEPTION: UPSI may be communicated for legitimate purposes, performance of duties, or discharge of legal obligations — notwithstanding the general Regulation 3(1) prohibition. Five conditions must all be met: (i) legitimate purpose; (ii) recipient is aware it is UPSI; (iii) recipient undertakes confidentiality; (iv) recipient must not trade on the UPSI; (v) SDD entry made. WHAT IS LEGITIMATE: M&A due diligence; legal advice; audit purposes; banking/investment advisory; credit assessment; regulatory compliance; board decision-making. WHAT IS NOT LEGITIMATE: Tipping for personal gain; speculative sharing; selective analyst briefings; casual social sharing. M&A DUE DILIGENCE APPLICATION: (i) NDA executed before any UPSI is shared; (ii) only due diligence team members who need the information receive it (need-to-know); (iii) all team members entered in SDD with timestamps; (iv) virtual data room with access logs; (v) all team members added to restricted trading list for target's securities. THE 'SATISFYING ONESELF' STANDARD: Signed NDA = strongest; email acknowledgment = acceptable; professional obligations = recognised; verbal only = insufficient. In SEBI v. Samir Arora (SAT 2004), the court noted that legitimate professional functions may justify access to non-public information without triggering insider trading liability — the key is that trading (not access) is the violation.

🎯 EXAM POINTERS — Topic 64: Legitimate Purpose Test [Regulation 3(3)]

Regulation 3(3): UPSI may be shared for legitimate purposes, duties, or legal obligations — notwithstanding Regulation 3(1).
FIVE CONDITIONS: (1) legitimate purpose; (2) recipient aware it is UPSI; (3) confidentiality undertaking; (4) no trading; (5) SDD entry.
Legitimate purposes: M&A due diligence; legal advice; audit; banker advisory; credit assessment; board decision-making; regulatory compliance.
NOT legitimate: tipping for personal gain; speculative sharing; selective analyst briefings; social sharing.
M&A due diligence: NDA mandatory; need-to-know; SDD entry for all team members; VDR with access logs; restricted trading list.
NDA = strongest form of satisfying the 'awareness + confidentiality' requirement. Verbal only = insufficient.
After receiving UPSI for legitimate purpose → recipient becomes INSIDER → cannot trade until UPSI becomes GAI.
SDD must record ALL recipients — even those receiving UPSI for legitimate purposes.
Need-to-know: share MINIMUM necessary UPSI to minimum necessary persons — even within legitimate purpose context.
Rating agencies receiving UPSI: legitimate — but still requires NDA and SDD entry.

← Topic 63: Structured Digital Database (SDD) | Next → Topic 65: Insider Trading via Algorithmic & Digital Trading

Published on The Legal Bridge — Study Notes for SEBI Law Officer, Judiciary Aspirants, AIBE, CLAT & University Exams