Quick overview
By Scorechain
Wednesday, November 11, 2026
MIDAS and the surveillance of crypto-asset markets: what ESMA's instructions mean for CASPs
Global News.png){kind=logo}
On 21 October 2026, ESMA published its instructions on the transmission of data to the MIDAS system. For crypto-asset service providers (CASPs), the subject goes beyond simply preparing a file: they must be able to link the information transmitted to the recorded transactions, explain discrepancies and organise their correction.
MIDAS, which stands for MiCA Digital Assets Surveillance System, receives data on executions and order books to produce alerts on potentially abusive behaviour and to support the market integrity pursued by Title VI of MiCA. ESMA has no direct supervisory role under MiCA: the national competent authorities have delegated to it, on the basis of Article 28 of the ESMA Regulation, the collection, processing and quality control of the data, as well as the calculation and distribution of alerts, and retain supervision and sanctioning powers. The onboarding of CASPs to MIDAS has been open since autumn 2026.
Preparation comes down to three questions: which data to retain and transmit, how to control its quality, and how to align this collection with the market abuse surveillance that MiCA already requires. For compliance, operations and IT teams, the aim is to build a process in which every step can be explained and verified.
MiCA already requires CASPs to keep records of their services, activities, orders, and transactions (Article 68). For trading platforms, Article 76 further requires that the relevant data relating to all orders be kept at the disposal of the competent authority for at least five years, or that the authority be given access to the order book. Article 94 governs the authorities’ information-request powers. The MIDAS instructions cite these three articles as their basis.
Two delegated regulations set out these requirements in detail. Commission Delegated Regulation (EU) 2025/1140 of 27 February 2025, published in the Official Journal on 10 June 2025, defines the records CASPs must keep according to their activities and the services provided. It also lays down uniform standards for communicating certain information to the competent authorities when they request it under Article 94 of MiCA.
Some requirements take up principles and standards already used in traditional finance. This applies to the identification and record-keeping rules associated with MiFIR, the European regulation on markets in financial instruments (Markets in Financial Instruments Regulation). Complementing the MiFID II directive, MiFIR governs market transparency and the reporting to the authorities of certain transactions in financial instruments such as shares, bonds or derivatives.
Under this regime, investment firms report information on the instrument traded, the price, the quantity and the persons concerned. The aim is to enable the authorities to monitor the markets and detect possible abuse. The framework applicable to crypto-assets draws on a comparable logic of traceability and data harmonisation and provides rules adapted to the specific features of crypto-assets. The retention and transmission obligations under MiCA remain distinct from the transaction-reporting regime under MiFIR.
Commission Delegated Regulation (EU) 2025/416 of 29 November 2024, which entered into force on 3 April 2025, specifies, for its part, the content and format of the order books of crypto-asset trading platforms. The relevant data must be kept in JSON format, in accordance with the ISO 20022 methodology.
In practice, record-keeping must allow a transaction to be reconstructed. A simple volume total is not enough to explain the origin of an order, its handling and its possible execution. This reconstruction capability should be verified before working on the transmission format alone.
MIDAS distinguishes two categories of data. The first concerns executed transactions and uses the auth.117 message, entitled CryptoAssetRecordKeeping. It falls within the general record-keeping obligation laid down in Article 68(9) of MiCA, as specified by Delegated Regulation (EU) 2025/1140, with reference to its Article 7 and Table 3 of its Annex. ESMA’s instructions present this flow as applicable to CASPs within the European framework, for the data relevant to their activities.
The second category concerns order book data and uses the auth.118 message, entitled CryptoAssetOrderBook. It relates to the specific obligations of trading platform operators laid down in Article 76(15) of MiCA, whose content and format are specified by Delegated Regulation (EU) 2025/416.
Under the MIDAS instructions, platform operators transmit both categories of data and include, where applicable, the buy and sell sides of an execution in a single record. Other CASPs transmit the relevant execution data, with the side that concerns them.
The transmission takes place under the competent authorities’ information-request powers in Article 94 of MiCA. In its first phase, MIDAS collects only a subset of the data subject to the retention obligations.
For a firm offering several services, the perimeter should be documented by entity, activity and source system. Holding a CASP authorisation does not, on its own, determine which files to produce. The treatment of periods without any relevant transaction should be clarified with the MIDAS service provider and the national authority, as each file must contain at least one record.
Onboarding follows four steps: an access request by email to ESMA support, with the IP addresses and public SSH keys; the provision of test (UAT) and production SFTP access points; the preparation of a representative file and then a full set in UAT; and the move to production after the agreement of the CASP’s national authority, on an agreed date. The publication of the instructions therefore does not set a deadline common to all providers.
In its statement of 28 November 2025, ESMA indicated that the national authorities planned to start requesting order book data in the new JSON format within six months of the publication of the schema. That indication concerned requests for order book data and does not, on its own, amount to a universal start date for MIDAS for all CASPs. The statement also recalls the LEI and DTI identification requirements applicable under the conditions laid down by the texts; the first phase of MIDAS excludes personal identifiers.
MIDAS is being deployed in phases, an approach ESMA justifies by the limitation of costs, complexity and operational risk. The first phase collects a restricted subset of on-chain and off-chain elements intended for market abuse surveillance and the production of alerts. It excludes personal data, CASPs’ non-public transaction and supervisory data, and information gathered for investigation or enforcement purposes, such as suspicious transaction and order reports and information requests (section 3.1 of the instructions).
The instructions indicate that future phases will extend the perimeter to supervisory data, including personal identifiers where necessary. ESMA’s 2027 work programme provides for the deployment of phase 2 in the fourth quarter of 2027, subject to the approval of its Board. This phase is to bring new analytical functionalities and widen the categories of data; it is a programme objective, not a general date for the transmission of personal identifiers.
The documents do not specify whether personal identifiers will be collected from phase 2, which persons would be concerned or what the access and retention rules would be. CASPs’ clients could be concerned, but that remains a hypothesis. It would be premature to assert that the data of all Union investors will be centralised.
If personal data is integrated, the legal basis, the necessity and proportionality of the processing, data minimisation, retention periods and access rights will need to be examined. Regulation (EU) 2018/1725 applies to processing by Union institutions and bodies; the GDPR applies to the relevant processing by CASPs and national authorities. An impact assessment will be required where the applicable legal conditions are met. The security of any concentration of data is also an issue: access controls, traceability and incident management will need particular attention. This is a risk to anticipate; it does not prejudge any vulnerability in MIDAS.
The sample files published by ESMA show what is expected. The one devoted to executions contains a transaction identifier, a date and time, quantities, prices and asset identifiers, and illustrates the encoding of decimal values as character strings. A sample file helps in understanding a structure; it does not replace the validation rules of Annex 3 of the instructions, which distinguish rejection rules from qualitative warnings.
Preparation follows three steps. They belong to internal control and are not additional obligations created by the instructions.
For each piece of information to be transmitted, a mapping table specifies the source system, the transformation rule, the person responsible and the control performed. Differences in time zones, decimal precision or asset identification must be handled explicitly: a silent conversion can produce a readable file whose content remains inaccurate. One test is to select a transaction and trace the complete path between the initial record and the exported data; where several systems are involved, the reconciliations must explain the discrepancies without overwriting the original values. This is the reconstruction logic of Regulation 2025/1140.
The extracted volumes are compared with the expected volumes, then a sample of events is checked: order creations, modifications, cancellations and executions according to the activity. A missing period, a duplicate or an inconsistent quantity must be explained before sending, and the results of these controls kept with the batch transmitted.
The monitoring distinguishes the data prepared, the data submitted and the data actually accepted. For each anomaly, a responsible person, a cause and a corrective action can be identified, and the link between the initial submission, the feedback file and the correction is kept. This organisation lets teams deal with recurring errors at their source: manually correcting each file without changing the source system reproduces the anomaly at every extraction. Reporting quality becomes a subject shared between the business lines, compliance and the technical teams.
Article 92(1) of MiCA requires persons professionally arranging or executing transactions in crypto-assets to have in place effective arrangements, systems and procedures to prevent and detect market abuse. It also requires them to report without delay to the competent authority any reasonable suspicion regarding an order, a transaction, their modification or cancellation, or certain aspects of the functioning of distributed ledger technology.
Commission Delegated Regulation (EU) 2025/885, which entered into force on 9 September 2025, details these requirements. Its Articles 2 and 3 provide for surveillance of the orders and transactions falling within the activity of the person concerned, as well as the analysis of modifications, cancellations, rejections and aspects of the functioning of the DLT capable of revealing market abuse. The arrangement must ensure an appropriate level of human analysis and be assessed regularly, at a minimum through an annual audit and internal review, and then updated where necessary. Finally, the information documenting the analysis of situations capable of constituting market abuse, including the reasons for reporting or not reporting, must be kept for five years.
The transmission of data to MIDAS and the reporting of a suspicion therefore serve different functions. The former gives the authorities usable material for their own surveillance; the latter brings to their attention a suspicious situation identified by the CASP. A fortnightly transmission schedule does not justify waiting to report a suspicion falling under Article 92, and the existence of MIDAS does not relieve the CASP of its own detection arrangements.
The responsibility for producing the files and the responsibility for analysing the alerts should be assigned separately, with defined exchanges between the two. A data anomaly can distort an analysis; conversely, an investigation can reveal missing information or an error in the records. The internal file must allow both to be traced.
MIDAS collects a subset of on-chain and off-chain market data. As part of their own investigations, CASPs can enrich the analysis of trading data with a reading of the flows recorded on the blockchain.
Scorechain’s tools help analysts read these flows. Wallet Screening lets teams assess the risks associated with an address and its direct or indirect exposures; Transaction Monitoring watches transactions according to configurable scenarios and alerts; Graph and Flux Analysis helps visualise the relationships between addresses and the movements of funds. Depending on the data available and the networks covered, this information can help document an investigation.
Tools dedicated to market surveillance and market abuse detection, such as those offered by Seqlense, a Scorechain partner, can complement this analysis by helping CASPs identify potentially suspicious trading behaviour.
Combining trading data with the on-chain context, where relevant, can improve the understanding of a situation. A risky exposure or an alert is not, on its own, proof of market abuse: each situation needs an appropriate analysis.
The CASP remains responsible for its surveillance arrangements, its transmissions to MIDAS and the applicable reports. Any connection or export functionalities towards MIDAS must be verified with the suppliers concerned.
For providers, record-keeping must be linked to a transmission and control chain. This work has points in common with investment firms’ reporting arrangements, even though the regimes and data differ. Platforms may face added complexity because of order book events. For each CASP, the burden depends on its activities, its model and the relevant data. Five workstreams should be launched:
The expected result is that the CASP can explain every piece of data transmitted, trace its source and show how an error was corrected, and that the surveillance and reporting MiCA requires in any event stay in place.
To see how Scorechain’s wallet screening, transaction monitoring and flow analysis can support your MiCA market abuse investigations, book a demo with the Scorechain team.
The instructions present the execution flow (auth.117) as mandatory for CASPs within the Union framework, for the data relevant to their activities. The order book flow (auth.118) concerns the operators of trading platforms. Each provider must confirm its perimeter, the applicable requests and its timetable with the competent authority and the MIDAS service provider.
The national competent authorities. They have delegated to ESMA the collection, processing and calculation of alerts, but retain supervision and the powers of investigation and sanction. The alerts produced by MIDAS are distributed to them.
No. Article 92 of MiCA and Delegated Regulation (EU) 2025/885 require the CASP to have its own detection arrangements and to report any reasonable suspicion without delay, irrespective of the transmission schedule.
The first phase excludes personal data, CASPs’ non-public transaction data, supervisory data and information gathered for investigation purposes. Future phases could include personal identifiers. Phase 2 is planned for the fourth quarter of 2027 subject to the Board’s approval, with no confirmation that these identifiers will be included from that stage.
.webp)
