Source: OJ L, 2025/885, 20.8.2025

Article 3 Prevention, monitoring and detection

Summary What does Article 3 of the RTS on market abuse say?

This is a detailed, technical article that builds directly on the high-level obligations established in Article 2, fleshing out the specific operational requirements for the arrangements, systems and procedures that persons professionally arranging or executing transactions in crypto-assets must have in place.

It covers four main areas: the functional capabilities those systems must deliver, the requirement for human analysis to complement automated monitoring, the use of ICT systems (including those capable of handling algorithmic trading environments), and the rules around outsourcing these functions to third parties or group entities.

Crucially, even where outsourcing is permitted, full regulatory responsibility remains with the person outsourcing.

The article closes with a five-year record-keeping obligation covering all analysis conducted in relation to potential market abuse.

Important points:

Ensure your monitoring systems cover all trading activity, generate alerts for further analysis, and are capable of individual and comparative analysis of orders and transactions both on and off a trading platform, including DLT-related activity.
Human analysis must remain part of the detection process alongside automated systems, and any additional personal data collected may only be used for that purpose.
Outsourcing of market abuse monitoring functions is permitted under a written agreement, but you remain fully responsible for compliance and must retain the expertise and direct access to information necessary to supervise the provider.

Springlex's summary of the article, a reading aid, not a substitute for the legal text.

1. The arrangements, systems and procedures referred to in Article 92(1) of Regulation (EU) 2023/1114 shall:
  1. cover the full range of trading activities undertaken by the persons professionally arranging or executing transactions in crypto-assets;
  2. produce alerts indicating activities requiring further analysis to detect potential market abuse;
  3. enable crypto-asset service providers operating a trading platform to:
    analyse, individually and comparatively, each transaction executed, and each order placed, modified, cancelled, or rejected in the systems of the trading platform;
    prevent the occurrence of repeated behaviours observed on the same trading platform;
  4. enable persons professionally arranging or executing transactions in crypto-assets to analyse, individually and comparatively each transaction executed and each order placed, modified, cancelled or rejected inside and outside a trading platform, irrespective of whether or not the orders and transactions are placed and executed by means of the distributed ledger, and aspects of the functioning of DLT that could constitute market abuse.
1. Persons professionally arranging or executing transactions in crypto-assets shall put in place and maintain arrangements and procedures that ensure an appropriate level of human analysis in the prevention, monitoring, detection and identification of transactions, orders and aspects of the functioning of the distributed ledger technology that indicate the likelihood or existence of market abuse behaviours. Persons professionally arranging or executing transaction in crypto-assets shall collect additional personal data, only for the sole purpose of ensuring appropriate level of human analysis.
1. For the purposes of Article 92(1) of Regulation (EU) 2023/1114, persons professionally arranging or executing transactions in crypto-assets shall, to a degree which is appropriate for, and proportionate in relation to, the scale, size, and nature of their business activity, employ ICT systems.
2. The ICT systems referred to in the first subparagraph shall include ICT systems capable of deferred automated reading, replaying and analysis of order book data. Such systems shall have sufficient capacity to operate in an algorithmic trading environment.
3. For the purposes of the second subparagraph, algorithmic trading means trading in crypto-assets where a computer algorithm automatically determines individual parameters of orders, including as to whether to initiate the order, the timing, price or quantity of the order, or how to manage the order after its submission, with limited or no human intervention, and does not include any system that is only used for the purpose of routing orders to one or more trading platform or for the processing of orders involving no determination of any trading parameters or for the confirmation of orders or the post-trade processing of executed transactions.
1. Persons professionally arranging or executing transactions in crypto-assets may by written agreement outsource to a third party or delegate to a legal person forming part of the same group, as defined in Article 2, point (11), of Directive 2013/34/EU of the European Parliament and of the Council(⁶) (‘providers’), the functions relating to the prevention, monitoring, detection and identification of orders, transactions or other aspects of the functioning DLT that could constitute market abuse, including analysis of data, including order and transaction data, and the generation of alerts. Persons delegating or outsourcing those functions shall remain fully responsible for complying with all of their obligations under this Regulation and Article 92 of Regulation (EU) 2023/1114. Where those functions are outsourced to a third party, persons outsourcing those functions shall comply with the following requirements at all times:
  1. retain the expertise and resources necessary to:
    evaluate the quality of the services provided and the organisational adequacy of the providers;
    supervise the outsourced services;
    manage of the risks associated with the outsourcing of those functions on an ongoing basis;
  2. they shall have direct access to all the relevant information about the data analysis and the generation of alerts.
2. The written agreement referred to in the first subparagraph shall describe the rights and obligations of the person delegating or outsourcing the functions and those of the provider. It shall also set out the grounds on the basis of which the person delegating or outsourcing the functions can terminate that agreement.
1. As part of the arrangements, systems and procedures referred to in the first and second subparagraphs, persons professionally arranging or executing transactions in crypto-assets shall maintain the information documenting the analysis carried out with regard to orders, transactions and aspects of the functioning of DLT that could constitute market abuse for a period of 5 years. That information shall include the analysis made and the reasons for submitting or not submitting a STOR. Persons professionally arranging or executing transactions in crypto-assets shall provide that information to the competent authority upon request.

Relevant recitals

Recital 2 Appropriate monitoring systems and human analysis

To ensure that prevention and detection of market abuse is effective, appropriate systems should be in place to monitor orders, transactions and other aspects of functioning of the DLT, in accordance with the scale, size and nature of the business activity of the person professionally arranging or executing transactions. Such systems should provide for human analysis carried out by appropriately trained staff based on objective information at the disposal of the reporting entity. The entity should collect additional personal data, only to ensure appropriate human analysis. To allow for further analysis of potential insider dealing or market manipulation or attempted insider dealing or market manipulation, the systems for monitoring market abuse should be capable of producing alerts in line with specified parameters. The access to such alerts should be recorded to ensure that they are only used for detecting market abuse. The whole process is likely to require some level of automation.

Recital 6 Outsourcing with retained responsibility

To share resources, to centrally develop and maintain monitoring systems, and to build expertise in the context of monitoring suspicious orders and transactions, persons that professionally arrange or execute transactions in crypto-assets should be able to delegate the prevention and detection of such orders, transactions and other aspects of the functioning of DLT within a group, or to delegate the data analysis and the generation of alerts, subject to appropriate conditions. Such delegation should neither prevent the competent authorities from assessing at any time, whether the arrangements, systems and procedures of the person to whom the functions are delegated are effectively in line with the obligation to prevent and detect market abuse. The obligation to report and the responsibility to comply with this Regulation and with Article 92 of Regulation (EU) 2023/1114 should remain with the delegating person.

Recital 7 Trading rules, order book replay and single STOR template

Crypto asset service providers operating a trading platform should have appropriate trading rules that contribute to the prevention of market abuse. Those entities should also have facilities to replay the order book in order to analyse the trading activity.

A single and harmonised template for electronically submitting a suspicious transaction and order report (‘STOR’) should facilitate the efficient sharing of information on suspicious orders and transactions between competent authorities in cross-border investigations.

Recital 10 Case-by-case reporting, not all alerts

Persons professionally arranging or executing transactions in crypto-assets should not notify all orders received or transactions conducted that have triggered an internal alert. Such a requirement would be inconsistent with the requirement to assess on a case-by-case basis whether there are reasonable grounds for suspicion.

Recital 15 Refining surveillance and recording non-STOR analyses

To prevent market abuse to the maximum extent possible, persons professionally arranging or executing transactions in crypto-assets should be able to refine their surveillance systems and to detect patterns of repeated behaviour, the aggregate of which could, considered as a whole, result in a reasonable suspicion of market abuse. Those persons should therefore be required to analyse suspicious orders, transactions, behaviours and other aspects connected to the functioning of the distributed ledger technology which did not lead to a STOR and record such analyses. Such records should also assist such persons in evidencing compliance with Article 92 of Regulation (EU) 2023/1114 and should facilitate the performance by competent authorities of their supervisory, investigatory and enforcement functions under Article 92 of Regulation (EU) 2023/1114.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.