Market-abuse detection under MiCA Article 92: wash trading, spoofing, ramping and pump and dump
MiCA Article 92 makes anyone arranging or executing crypto trades watch orders and trades for abuse. How wash trading, spoofing, ramping and pump and dump show up, and how an alert becomes a STOR.
MiCA Article 92 requires anyone professionally arranging or executing transactions in crypto-assets to have effective arrangements, systems and procedures to prevent and detect market abuse, and to report any reasonable suspicion to the regulator without delay. In practice that means surveillance: every order and trade is read against patterns such as wash trading, spoofing, ramping and pump and dump, an alert goes to an analyst, the analyst builds a case, and where the suspicion holds, a suspicious transaction and order report (STOR) goes to the national regulator.
What Article 92 asks, and of whom
The duty sits in Article 92(1) of MiCA, Regulation (EU) 2023/1114. It applies to "any person professionally arranging or executing transactions in crypto-assets", which covers a trading platform and also a broker that executes client orders. It reports to the regulator of the Member State where it is registered or has its head office, about orders, transactions, cancellations and modifications, and even about how the ledger itself works, such as its consensus mechanism.
The rules cover crypto-assets admitted to trading, or for which admission has been requested, whether an order or trade happens on a trading platform or not (Article 86).
The detail is in Commission Delegated Regulation (EU) 2025/885, the technical standards made under Article 92. Its main requirements, in short:
Monitor everything. Effective and ongoing monitoring of all orders received and transmitted and all transactions executed (Article 2).
Produce alerts. The systems have to produce alerts indicating activity that needs further analysis, and a trading platform has to be able to analyse each order placed, modified, cancelled or rejected, individually and in comparison with others (Article 3).
Replay the book. The tools have to include systems able to read, replay and analyse order book data after the fact, with capacity for algorithmic trading.
Keep people in the loop. An appropriate level of human analysis is required, and staff need regular training (Article 4).
Write it down. The arrangements are documented and reviewed at least once a year.
What Article 91 counts as manipulation
MiCA defines market manipulation in Article 91. At its core is any order or transaction, unless carried out for legitimate reasons, that gives or is likely to give false or misleading signals about the supply, demand or price of a crypto-asset, or secures its price at an abnormal or artificial level. It also covers deception and spreading false or misleading information, including rumours.
Article 91(3) lists behaviour that counts as manipulation, among them orders, cancellations and modifications that make it harder for others to identify genuine orders, and orders entered "to initiate or exacerbate a trend". It also names voicing an opinion about a crypto-asset after taking a position in it, without disclosing that conflict.
None of the four patterns below is named in the article. Each is a way of producing the effects it describes, and each leaves a recognisable trace in the order book and the trades. Every number in the examples is illustrative, and the tokens XYZ, ABC and QRS are made up.
Wash trading: trading with yourself
In wash trading, the same person, or people acting together, sit on both sides of a trade. Nothing changes hands in substance, but the market shows volume and prices nobody else agreed to.
In the data, the tell is a link between buyer and seller. Two accounts, A and B, were opened a week apart, sign in from the same device and were funded from the same wallet. In one hour they trade XYZ/EUR with each other 40 times, 2,000 XYZ each way, so neither position moves, yet their trades make up 62% of the market's volume for that hour.
Catching it depends on knowing who is behind each account: the identity checks, devices, funding wallets and bank accounts gathered at onboarding and afterwards. One account trading with itself is easy to see; linking accounts that look separate is the harder work.
Spoofing and layering: orders never meant to fill
Spoofing is placing orders to be seen rather than filled. Layering is the same idea spread across several price levels, so the book looks deeper on one side than it really is.
In the example, BTC/EUR has a best bid of 60,000 and only 3 BTC of bids from there down to 59,750. A trader adds five buy orders of 2 BTC each, from 59,950 down to 59,750, so 10 of the 13 BTC on those levels are theirs. Other buyers step up, the trader's own sell of 1.5 BTC at 60,100 fills, and three seconds later all five buy orders are cancelled. None of the 10 BTC was filled.
The alert reads three things together: a large share of one side's depth placed by one account, a fill on the opposite side while those orders stood, and a fast cancellation with little or nothing filled. Any one alone is ordinary, since market makers place and cancel orders all day; that is why the rule asks for human analysis.
Ramping: pushing the price
Ramping is entering orders to start or push a trend that others then follow. It works best in a thin market, where a few aggressive orders move the price a long way.
In the example, one account sends 12 market buys into ABC/EUR in 90 seconds. Each one takes out the cheapest asks, and the price climbs from 1.00 to 1.08, up 8%, with that account behind 70% of the volume. Others chase the move, and within ten minutes the account has sold everything it bought. The price falls back to 1.01.
In the data, the signs are one account's share of the aggressive volume during a sharp move, and a reversal of its position soon after.
Pump and dump: buy quietly, sell loudly
A pump and dump has three stages: buy quietly, promote loudly, sell into the demand. The promotion usually happens outside the exchange, in posts and chat groups, and can itself be manipulation under Article 91 when it spreads misleading information or comes from someone who holds a position and does not say so.
In the example, six accounts linked by one funding wallet buy 1.2 million QRS over five days at about 0.40 EUR, each order small enough to pass unnoticed. On the sixth day the posts start. In two hours volume reaches 14 times its 30-day average, 900 accounts trade QRS for the first time, and the price climbs to 0.96, up 140%. The six accounts sell 1.1 million QRS into that demand, and by the evening the price is 0.45.
The exchange sees its own half of the story: concentrated buying beforehand, a surge of first-time buyers, and the earlier buyers selling. Putting that next to the posts outside is the analyst's job.
Alerts and the thresholds behind them
Each pattern becomes an alert: a rule that compares what happened with a threshold. The thresholds are the operator's own settings, tuned per market, because 62% of an hour's volume means something different in a deep market and in a token that trades a few times a day. The settings below are illustrative only.
Pattern | What the alert compares | An illustrative setting |
|---|---|---|
Wash trading | Trades where both sides are the same person or linked accounts, as a share of a market's volume | Over 20% of a market's volume in one hour |
Spoofing and layering | Size placed and cancelled unfilled near the best price, around a fill on the other side | Over 50% of one side's depth, over 90% cancelled within 5 seconds |
Ramping | One account's share of the aggressive volume in a sharp move, and whether it sells after | A move over 5% in 2 minutes, one account over 50% of it |
Pump and dump | A token's volume and first-time buyers against its own history, and who is selling | Over 10 times its 30-day average volume, with earlier buyers selling |
Setting a threshold is a trade-off. Too tight, and analysts drown in alerts about market makers doing their job; too loose, and real abuse passes. The annual review is the natural point to check both. Alerts sit beside, not instead of, transaction monitoring for money laundering, which looks at deposits and withdrawals rather than at the book, though both end as cases with the evidence attached, ready for compliance reporting.
You can see this in Marengo, our exchange: alongside transaction monitoring and sanctions screening, it detects market abuse in its own monitoring. The licensed operator stays responsible for the arrangements Article 92 asks for; software supports them.
From an alert to a STOR
An alert is not yet a suspicion. Most are closed, each with a reason someone can read later.
Triage. An analyst looks for an innocent explanation: a market maker quoting both sides, an arbitrage, a mistyped order.
Case. If it holds up, the analyst opens a case: the orders and trades, a replay of the book around them, the linked accounts, the identity records, past alerts on the same people and any news or posts.
Decision. The analyst decides whether there is a reasonable suspicion, and records the analysis and the reasons either way. Those records are kept for five years.
Report. Where the suspicion is reasonable, a STOR goes to the competent authority, without delay once the suspicion is formed (Article 6), through the electronic means that authority names on its website. A suspicion that forms later, from new events, is still reported, with the delay explained.
The STOR follows the template in the Annex to the Delegated Regulation, in six sections: who is reporting, the orders, transactions or ledger behaviour, the nature of and reasons for the suspicion, the suspected person, additional information, and the documents attached. The first four sections are mandatory, with "NA" and a short reason where a field cannot be filled.
One more rule shapes the workflow: no tipping off. The person reported, and anyone inside the firm who does not need to know, must not learn of the alert, the assessment or the report (Article 5(3)). So surveillance cases are kept apart from customer support, and the STOR is completed without asking the customer. A suspicion of money laundering is a separate report, made under anti-money-laundering rules to a different authority.
Frequently asked questions
Does Article 92 apply only to trading platforms? No. It applies to anyone professionally arranging or executing transactions in crypto-assets, so a broker executing client orders has the same duty, including for trades outside a platform.
Can market-abuse surveillance be outsourced? Yes, by written agreement, but the firm stays fully responsible, has to keep the expertise to supervise the provider and needs direct access to the analysis and the alerts.
Is every alert reported? No. An alert only marks activity for analysis. A STOR follows when the analysis leaves a reasonable suspicion, and the reasons for reporting or not reporting are kept for five years.
See it working
Surveillance is easiest to picture next to a live order book. Open Marengo at marengo.paynoramic.com and watch a market's book and trades in Pro, or read about our white-label crypto exchange and the rest of a platform's obligations in the MiCA checklist.
