MIDAS, ESMA’s tool against market abuse that changes day-to-day operations for CASPs

In this article, Daniel ARROCHE, Partner at d&a partners, presents MIDAS, ESMA’s surveillance system for crypto-asset markets, and what it means for crypto-asset service providers.

Are you a CASP preparing to submit your data to MIDAS? The law firm d&a partners can assist you.

Until now, a crypto-asset service provider authorized in the European Union had to keep records of its orders and transactions, and hand them over to its regulator upon request.

This is changing. That data will now leave the firm at regular intervals, in a set format, for a central system designed to detect market abuse.

On October 21, 2026, the European Securities and Markets Authority (ESMA) published the reporting instructions for MIDAS, its central surveillance system for crypto-asset markets.

This technical document, seemingly meant for IT teams, in fact sets out a new architecture for market surveillance. Who must send what, who monitors, and what should providers anticipate?

From record keeping to a data feed

The MiCA Regulation governs, among others, crypto-asset service providers (CASPs), that is, firms authorized to provide clients with services such as operating a trading platform, exchanging crypto-assets for funds, executing orders, or receiving and transmitting orders.

Its Title VI prohibits market abuse involving crypto-assets: insider dealing, unlawful disclosure of inside information and market manipulation.

To support the detection of such abuse, MiCA does not provide, unlike the rules applicable to financial instruments, for systematic transaction reporting to the authorities.

First, it requires all CASPs to keep records of their services, activities, orders and transactions.

Second, it requires trading platforms to keep order data at the disposal of the authorities for at least five years.

Third, it gives national competent authorities the power to require any person to provide information and documents.

In other words, the framework relied on record keeping and disclosure upon request.

MIDAS turns this into a feed: CASPs must now send their data on a set schedule and in a set format, so that it can be screened by detection algorithms.

The comparison with investment firms comes naturally. They report their transactions in financial instruments to their regulator no later than the following working day, under MiFIR.

Who sends what, and how

The instructions distinguish between two data flows, identified by the reference of their message:

(1) executions data, which records executed transactions and must be submitted by all CASPs;

(2) order book data, which covers the full life cycle of orders (entry, modification, cancellation, partial or full execution) and must be submitted only by CASPs operating a trading platform, in addition to their executions data.

The mechanics are strictly standardized. Data is uploaded as JSON files to a dedicated secure access point (SFTP) every two weeks, although a different frequency may be agreed with ESMA’s technical provider and the national authorities.

Files go through three levels of checks, covering transmission, the file itself and its content. A file that does not follow the naming convention or the format is automatically rejected, and none of its records are processed.

Feedback files are placed in the CASP’s SFTP directory, normally within two hours of receipt, with no email notification.

A provider that does not read these feedback files may therefore believe it has met its obligations while part of its data has been rejected.

Onboarding takes place on a case-by-case basis. The CASP sends an onboarding request to ESMA’s MIDAS support team, runs tests in a dedicated environment, and its national competent authority then approves the move to production.

Regular submissions then start on a set date. There is therefore no common EU-wide start date.

Who monitors: ESMA detects, national authorities sanction

The document is explicit about the allocation of roles. It recalls that ESMA has no formal supervisory role under MiCA: national authorities remain responsible for supervision and enforcement.

They are the ones that collectively decided to centralize the technical capability to collect and analyze data. Through delegation agreements, they have entrusted ESMA with collecting, processing and quality-checking the data, as well as generating and distributing alerts.

The instructions do not, however, specify the number or the identity of the national authorities that have signed these agreements.

Personal data, the issue for the next phase

MIDAS is being rolled out in phases. The first phase excludes personal data, non-public CASP data, supervisory data and information related to investigations, such as suspicious transaction and order reports or requests for information.

Future phases may extend the scope to supervisory data, including personal identifiers, where supervision requires it.

ESMA’s 2027 work programme plans the roll-out of this second phase in the fourth quarter of 2027, subject to the approval of its Board.

The document does not specify whom these identifiers will relate to. If, as one might expect, they relate to CASPs’ clients, personal identifiers of investors from across the Union would be centralized in a single system.

This prospect calls for two observations. On the one hand, data protection requires that the necessity and proportionality of such centralization be justified.

On the other hand, the security of the system would itself become a market integrity issue: a database of this kind would be a prime target, at a time when data breaches regularly make the news.

What CASPs should anticipate

For providers, record keeping becomes a reporting chain in its own right, calling for an organization comparable to the one investment firms have set up for their transaction reporting.

In practice, several workstreams appear to require immediate attention:

(1) map executions data, and for platforms order book data, against the required fields and JSON format;

(2) set up the technical SFTP upload chain and organize testing with ESMA’s provider;

(3) appoint a person responsible for monitoring feedback files and corrections, failing which rejections could go unnoticed;

(4) document the arrangements in compliance and market abuse prevention procedures, and report on them to the management body;

(5) prepare now for the next phase, by anticipating the data protection questions raised by the transmission of personal identifiers.

Trading platforms are the most exposed, as their data volumes are on a different scale from those of other providers. But submitting executions data is mandatory for all CASPs.

A de facto Europeanization

MIDAS is part of a broader debate. The Market Integration and Supervision Package (MISP), proposed by the European Commission in December 2025, contemplated giving ESMA direct supervision of all CASPs.

Yet, without waiting for the outcome of these negotiations, the detection of market abuse involving crypto-assets is already being centralized at EU level, through the technical and contractual route of delegation agreements.

National authorities retain investigations and sanctions, but it is an EU tool that will generate the alerts that may trigger them.

Conclusion

Behind a technical document lies a change in the nature of CASPs’ obligations: passive record keeping is giving way to regular transmission, checked and analyzed by detection algorithms.

The firm advises CASPs on the analysis of these obligations and on the adaptation of their procedures.

---

Disclaimer. This article is published for general information purposes only. It reflects the texts and publications available as of October 28, 2026, and will not be updated. It does not constitute legal advice and does not create a lawyer-client relationship. Any specific situation requires an analysis based on its own facts. Neither d&a partners nor the author accepts any liability for decisions made solely on the basis of this article.