A South African or Turkish trading group operates execution and liquidity businesses on EU markets, with surveillance analysts outside the EU. Its AML tool monitors transactions, but nobody has documented how a market-conduct alert becomes a reporting decision. The immediate task is to identify the responsible entity, establish the applicable rules and give that entity an escalation process with named decision-makers and records.
Crypto market abuse controls need a defined scope, human assessment and accessible evidence. The review produces four connected outputs: a market-conduct scope and gap assessment; insider-information and employee-dealing procedures; a suspicious transaction and order report (STOR) workflow; and a surveillance outsourcing schedule with remediation priorities. The responsible business retains accountability when analysts or technology suppliers work abroad. Implementation starts with the entity and instrument assessment, then assigns reporting decisions, records and vendor obligations. An AML monitoring tool can support this work, but its financial-crime process does not establish compliance with MiCA’s separate market-abuse requirements. (MiCA, art 92; Commission Delegated Regulation (EU) 2025/885, arts 2–6.)
Who needs this review?
The service is for EU crypto-asset service providers (CASPs) and overseas firms professionally arranging or executing crypto-asset transactions. It is particularly relevant when a group adds execution services, signs a liquidity agreement, changes its monitoring vendor or moves analysts abroad.
MiCA’s market-abuse rules concern crypto-assets admitted to trading, or for which admission has been requested. They extend to relevant conduct outside a platform and to acts or omissions outside the EU. Financial instruments fall outside MiCA; securities tokens and derivatives need a separate assessment under the Market Abuse Regulation (MAR), including its instrument and trading-venue connections. (MiCA, arts 2(4)(a), 86; Regulation (EU) No 596/2014, art 2.)
The duty to maintain preventive and detective controls attaches to a person professionally arranging or executing transactions, often called a PPAET. CASP authorisation and this test answer different questions. A proprietary trader’s position requires assessment of its actual professional activity; absence of a CASP licence does not establish an exemption. ESMA’s question on Article 92’s personal scope remains unanswered. The scope assessment therefore records the legal uncertainty and the operating facts supporting the proposed treatment. (MiCA, art 92; ESMA Q&A 2769, status at 4 November 2026.)
Four outputs and the order of work
1. Market-conduct scope and gap assessment
We map the legal entities, services, instruments, venues and order flows. The assessment identifies which entity carries each obligation, the reporting route and the evidence needed to resolve uncertain classifications.
We then compare the existing controls with the applicable requirements. For an in-scope PPAET, surveillance covers received and transmitted orders, executions and relevant distributed-ledger activity, including consensus mechanisms. It must support human analysis. Systems must be proportionate, while retaining the required capability for automated deferred reading, replay and analysis of order-book data. Platform operators have additional order-book monitoring responsibilities. (Regulation 2025/885, arts 2–3.)
The output is a prioritised gap register with owners, dependencies and required evidence. It includes training, at least annual audit and internal review, and reassessment when services or trading arrangements change. A policy document alone cannot demonstrate that detection works. (Regulation 2025/885, arts 2(3), 4.)
2. Insider-information and employee-dealing procedures
We identify who receives listing plans, client-order information and other potentially price-sensitive information. The procedure sets access permissions, information barriers, escalation and dealing restrictions around the legal test: precise, non-public information likely to have a significant price effect. Pending client orders have their own express inclusion. (MiCA, arts 87, 89–90.)
For CASPs, the employee-dealing procedure also addresses the applicable connected-person transaction rules. These include identifying or notifying the relevant transactions before the execution decision, appropriate approval processes, prompt transaction notification and records. Any additional restricted lists or dealing windows are designed around the business; MiCA does not simply import every MAR procedure. (Commission Delegated Regulation (EU) 2025/1142, arts 1, 6.)
The review covers liquidity incentives, related accounts and trading patterns that may indicate false volume or artificial prices. It tests rebates and remuneration against genuine liquidity objectives and conflict rules. Wash-trading indicators require examination of the actual orders, relationships and economic purpose; an alert is not a finding of misconduct. (MiCA, arts 72, 76(13), 91; Regulation 2025/1142, art 5.)
The output includes information-handling rules, a dealing procedure and escalation responsibilities. Where an entity is an issuer, offeror or person seeking admission, we separately assess its public-disclosure duties and any lawful delay. Those duties do not attach to every surveillance provider merely because it holds information. (MiCA, art 88.)
3. STOR decision and record-keeping workflow
The workflow takes an alert through human assessment, evidence preservation, a documented decision and any required submission. It names the responsible decision-maker, a substitute and an escalation route for conflicts or absence. Internal approvals must allow reporting without delay once reasonable suspicion has formed. Proof of abuse is not required. (MiCA, art 92(1); Regulation 2025/885, arts 5–6.)
The recipient is the relevant competent market authority under Article 92’s notification rules. The workflow confirms the entity’s registered office, head office or branch and the applicable national channel. A firm operating wholly outside the EU needs its reporting route resolved specifically; the venue’s location alone should not be treated as a complete answer.
The reporting pack uses the prescribed STOR template and relevant supporting evidence. It records the chronology, orders and transactions, grounds for suspicion and available identifying information. It also provides for later evidence and explains any retrospective discovery. Records of the analysis and reasons for reporting or not reporting must be retained for five years. CASP service and transaction records have additional requirements, including extension to seven years on a timely authority request. (Regulation 2025/885, arts 3(5), 5–6 and Annex; MiCA, art 68(9).)
Access rules protect alerts, assessments and reporting decisions. The subject must not be told, and information must not be requested from that person merely to complete a STOR field. (Regulation 2025/885, art 5(3).)
4. Surveillance outsourcing schedule and remediation priorities
We review the allocation of monitoring, investigation support and escalation between the responsible entity, group teams and the vendor. Permitted outsourcing does not transfer the entity’s regulatory responsibility. For external providers, the entity needs sufficient expertise and resources to supervise the work and direct access to the relevant analysis and alerts. (Regulation 2025/885, art 3(4).)
The contractual schedule defines service coverage, data access, escalation, confidentiality, subcontracting, record retrieval, supervisory cooperation, termination and exit. CASP outsourcing must preserve effective supervision and the relevant access rights. Data-processing and international-transfer arrangements require their own assessment. The Digital Operational Resilience Act (DORA) adds information and communication technology (ICT) contracting requirements where the entity and service fall within its scope. (MiCA, art 73; GDPR, arts 28, 44–49; Regulation (EU) 2022/2554, arts 2, 28–30.)
The final remediation plan separates legal drafting, operational implementation and technical validation, with an owner and evidence requirement for each action.
Keep financial-crime and market-conduct reporting distinct
AML suspicious-activity or transaction reports concern the applicable money-laundering and terrorist-financing tests and go to the financial intelligence unit (FIU). MiCA STORs concern suspected market abuse and go to the competent market authority. One event can trigger both routes, but neither report replaces the other. National AML implementation determines the precise local process. (Directive (EU) 2015/849, arts 33, 39; MiCA, art 92.)
Shared analysts and tools need permissions that respect each regime’s confidentiality rules. Group membership does not authorise unrestricted circulation of reports. Broader onboarding, financial-crime monitoring and FIU procedures belong within the related AML / KYC and financial-crime engagement.
Check the group’s home-country rules
Home-country rules also affect the design. A regulated Turkish crypto-asset service provider cannot outsource its internal audit, internal control or risk-management activities. That restriction requires a functional assessment; an analyst’s location alone does not establish the entity’s regulatory status. (SPK Communiqué III-35/B.1, art 31(2)(ç).)
For a South African group, the scoping work must identify domestic client-service permissions, Financial Intelligence Centre (FIC) reporting duties, data-sharing restrictions and the funding route. The data review includes any applicable prior-authorisation requirement for processing conduct information for third parties. The EU venue’s authorisation does not resolve these questions. (FAIS Act 37 of 2002, ss 1, 7; FIC Act 38 of 2001, s 29; POPIA, ss 20–21, 57–58, 72; Exchange Control Regulations 1961, reg 2.)
Our analysis of crypto market making from Türkiye addresses the trading and permission perimeter. The Exchanges page covers the broader platform context. This engagement focuses on conduct controls, reporting ownership and supporting evidence.
What we need to scope the work
- The group structure, entity locations, authorisations and proposed services.
- Instrument and venue lists, liquidity agreements and diagrams showing orders, execution and settlement.
- Existing AML and surveillance policies, sample alerts and escalation records, suitably minimised for review.
- Listing-information access, staff-dealing rules and relevant incentive arrangements.
- Vendor contracts, analyst responsibilities, data locations and access permissions.
- The intended reporting authorities, available record exports and known control gaps.
Questions buyers ask
Can we keep our existing AML tool?
Potentially. We assess its role, coverage and records against the conduct requirements. Technical specialists must establish whether its data, detection logic and alert performance meet the required operating design.
Does trading only our own money remove the need for review?
No. Own-account activity may fall outside CASP authorisation without falling outside market-abuse prohibitions. Article 92’s professional-activity assessment remains a separate question. (MiCA, arts 86–92; ESMA Q&A 2293, Commission answer of 6 June 2025.)
Should we wait until an investigation proves abuse?
No. The STOR threshold is reasonable suspicion. Human assessment should establish whether that threshold is met; the reporting process must then operate without delay. (Regulation 2025/885, arts 5–6.)
Can analysts remain outside the EU?
Analysts may remain outside the EU where the arrangement preserves responsibility, lawful information access and effective supervision. Applicable local outsourcing restrictions, report secrecy and international data-transfer requirements must also be satisfied.
Does the engagement include running surveillance?
The scope is legal assessment, procedures and contractual design. Daily monitoring, alert handling, regulatory submissions, software configuration and technical detection testing require separately assigned operational responsibilities. The deliverables do not certify a system or guarantee regulatory acceptance.
Review your crypto market conduct controls
Contact Licentium with your operating entities, trading model, analyst locations and current monitoring arrangements to scope the review.