The Codename Worked. The Trading Controls Did Not

A search box, eight days early

Eight days before Volkswagen and Rivian told the world they were forming a joint venture, one of the engineers who knew about it typed a phrase into a search box: statute of limitations insider trading. That detail sits in an indictment unsealed on 24 July by the US Attorney's Office for the Southern District of New York, which also records that a close family member of the second engineer searched, in German, for how insider trading is prosecuted.

The two men, Michael Stamp and Marcus Plank, both living in San Jose, are alleged to have bought Rivian stock and options after learning that their employer planned a joint venture with the carmaker, known internally as Project Climb, and before any public announcement. Rivian shares rose 23 percent when the deal was disclosed on 25 June 2024. Prosecutors put the combined gains above 300,000 dollars, roughly 250,000 for Stamp and 50,000 for Plank, with about 12,000 more for a close family member. Both were arrested and are due to appear in federal court in California, and both face up to 25 years if convicted of securities fraud. These are allegations, and neither man has been tried.

Volkswagen's response was brief and, on the facts as charged, fair: the action is focused on specific individuals and does not involve allegations against the company. That is exactly why the case is worth an owner's attention. Nothing here required a corporate failure of integrity. It only required a gap in a list.

The codename was a confidentiality control, not a securities control

Project Climb did its job. The deal did not leak, the market did not move before the announcement, and the 23 percent jump on 25 June 2024 is the proof that secrecy held right up to the moment it was meant to end. A codename protects a transaction from competitors, journalists and internal gossip. It does nothing whatsoever about the people inside the codename buying shares.

Here is the structural problem. Restricted trading lists are almost always built from the organisation chart and the deal team roster. Officers, finance, legal, investor relations, the corporate development team. Engineers pulled in to assess vehicle architecture and software integration are, in most companies, on neither document. They receive the codename, the technical scope and an NDA, and then they go back to work with material non-public information and no trading restriction attached to their name.

For a listed European company this is not merely good practice. Under the EU Market Abuse Regulation, and its UK equivalent, an issuer has to maintain an insider list covering everyone with access to inside information, updated as people are added. The obligation already exists. The failure mode is not the absence of a rule, it is a list maintained by a legal or compliance function that never sees the engineering briefing calendar.

Two years of quiet was not a clean bill of health

The most useful number in this case is not the 300,000 dollars. It is the gap between June 2024, when the joint venture was announced, and July 2026, when the indictment was unsealed. For roughly two years, a company with a genuine control gap had no signal that anything had gone wrong, because the signal does not come from inside the company. It comes from a regulator reconstructing trading records long afterwards.

That timing dismantles the most common form of reassurance, which is that nothing has happened so far. In this class of failure, nothing happening is the normal state right up until an indictment appears, and the years of quiet in between carry no information at all about whether the controls are sound.

The joint venture itself has only grown more significant in the meantime. Volkswagen's initial 5 billion dollar commitment, released against milestones, has since expanded to 5.8 billion, and Volkswagen is now Rivian's largest shareholder. The larger the programme, the more technical staff cycle through it, and each one arrives before the paperwork does.

What to change before the next diligence kickoff

The fix is administrative and cheap, which is the reason it goes undone. Make the trigger for the restricted list the briefing, not the announcement. When someone is told the codename, their name goes on the list that day, alongside the date and the reason. That single sequencing change closes most of the exposure in this case.

Then run the comparison, because it is the fastest audit available to you. Put the current insider list next to the diligence roster and the calendar invitations for the technical workstreams. If those documents were produced by different teams, and they usually were, the names will not match, and every mismatch is someone holding inside information without a restriction.

Last, move the warning to where it will be read. A securities-law paragraph in a compliance handbook is not the document an engineer opens on the first day of a diligence workstream. The NDA is. Put the restriction there, in plain language, with the specific instruction not to trade in either company's shares, and have it acknowledged in writing before the technical scope is shared.

Read next: Volkswagen's 25,000-Euro EV Comes With a Catch  |  Mobileye Raised Its Profit 88 Percent On A Tax Law