UK Crypto Market Abuse Rules: Insider Dealing, Market Manipulation and Surveillance Controls

By CRYPTOVERSE Legal Consultancy

A successful listing attracts the wrong kind of trading

A crypto platform announces that a new token will become available to customers.

Trading begins strongly. Volumes rise, spreads narrow and the commercial team celebrates a successful launch.

The surveillance team notices something different.

Several accounts repeatedly trade with one another. Large buy orders appear and disappear before execution. Another account accumulated tokens shortly before the confidential listing decision became public.

Each pattern may have an explanation. Together, they require investigation.

The platform’s challenge is to establish what happened, preserve the evidence and decide whether action is needed.

For firms preparing for FCA cryptoasset authorisation, market surveillance should be designed before trading begins.

What are the UK crypto market abuse rules?

The UK crypto market abuse framework addresses insider dealing, unlawful disclosure of inside information and market manipulation, supported by systems and controls for relevant trading platforms and intermediaries.

The FCA’s final PS26/9 sets out the Market Abuse Regime for Cryptoassets—MARC. Relevant statutory provisions include regulation 18 on inside information, regulation 22 on insider dealing, regulation 24 on unlawful disclosure and regulation 28 on manipulation. Application depends on the asset, activity and statutory scope. fca.org.uk

Firms should distinguish this framework from the rules already applicable to other financial instruments, including tokenised securities where relevant.

The practical preparation question is:

Can the business identify suspicious behaviour, investigate it competently and take appropriate action?

Assess the activities and assets within scope

A surveillance policy should begin with a legal scope assessment.

For practical preparation, we recommend identifying:

• The assets and related instruments involved.
• Their admission or proposed admission status.
• The firm’s role as platform operator, intermediary or another participant.
• Where orders are received, executed and settled.
• Which entities hold relevant information.
• Applicable commencement and transitional provisions.

Avoid assuming that every cryptoasset falls within identical market abuse rules.

Equally, offshore activity or an external wallet should not be dismissed without assessing the relevant legal and factual connections.

The result should be a clear map connecting legal obligations with the trading activity the firm actually handles.

Identify information that could create an unfair advantage

Inside information analysis concerns characteristics such as precision, public availability and potential price significance.

For practical review, sensitive events could include:

• A confidential admission or removal decision.
• An undisclosed security vulnerability.
• A significant change to token supply.
• A material problem affecting a stablecoin’s backing.
• A planned announcement about an important project relationship.
• Information about a customer’s pending order.

Not every confidential fact qualifies as inside information. The firm should establish a process for assessing the legal criteria and recording its reasoning.

The FCA’s guidance also distinguishes publicly accessible blockchain information from non-public information. Public wallet movements do not automatically constitute inside information. fca.org.uk

An investigator should therefore examine what information a person possessed, when they obtained it and how it relates to the behaviour under review.

Control access before information is misused

A practical information control framework should address who receives sensitive information and why.

We recommend considering:

• Restricted access to listing decisions and confidential project materials.
• Separation between customer order handling and proprietary trading.
• Controls over shared drives, messaging channels and provider access.
• Procedures for confidential discussions with external parties.
• Staff trading restrictions appropriate to the risk.
• Approval and timing of public announcements.

A policy prohibiting insider dealing has limited value if confidential information is routinely accessible to people who have no business need for it.

Controls should also cover contractors and group personnel where their access creates similar risks.

Recognise manipulation indicators without jumping to conclusions

Market manipulation analysis requires attention to the conduct, context and applicable legal tests.

For surveillance design, useful patterns to investigate may include:

These are investigation prompts, rather than automatic findings of abuse.

A cancelled order may reflect legitimate risk management. A sharp price rise may reflect genuine news. The firm needs a reasoned assessment rather than a rule that treats every unusual event as misconduct.

Build surveillance around the market model

An order-book platform and an OTC intermediary see different information.

For practical preparation, we recommend designing surveillance around the firm’s own activity, customer base and assets.

Assess whether the available data can reveal:

• Order entry, modification and cancellation.
• Execution timing and allocation.
• Account relationships.
• Staff or related-party trading.
• Activity around confidential events.
• Relevant wallet movements.
• Patterns across time and multiple accounts.

Use accurate timestamps and preserve links between records. Fragmented data can make a suspicious sequence difficult to reconstruct.

Coverage should also reflect operating hours. A market that runs continuously needs a credible approach to urgent alerts outside normal office hours.

Use blockchain analytics with other evidence

Blockchain analytics can help identify movements and relationships. Its findings need interpretation.

A wallet cluster may suggest common control, but the strength of that conclusion depends on the method and supporting evidence. A transfer may represent a purchase, internal movement, custody change or another event.

The final rules impose additional relevant-wallet on-chain monitoring and information-sharing requirements on large platform operators. CRYPTO 4.7.20R–4.7.22R should be assessed against the applicable classification and scope; they do not require monitoring the entire blockchain indiscriminately. fca.org.uk

For practical investigations, combine blockchain findings with account records, order data and communications where lawfully available.

Document uncertainty rather than presenting an analytical inference as an established identity.

Turn alerts into accountable decisions

An alert is the beginning of an assessment.

We recommend a workflow that records:

1. The behaviour detected and relevant period.
2. The accounts, assets and transactions involved.
3. The information available to the reviewer.
4. Alternative explanations considered.
5. Whether further evidence is required.
6. The grounds for escalation or closure.
7. Any protective action or notification decision.

Set clear responsibilities and review deadlines according to risk.

A system producing thousands of unread alerts offers weak protection. Monitor backlog, reviewer capacity and the quality of case decisions.

A low alert count also needs examination: it may reflect low risk, missing data or ineffective thresholds.

Prepare the correct notification route

Firms should distinguish market abuse notifications from AML suspicious activity reports and other regulatory notifications.

Under regulation 30(3) and accompanying FCA guidance, relevant intermediary notifications go to the appropriate UK platform operator or operators. CRYPTO 4.8.20G–4.8.24G addresses timely notification and case-by-case assessment; every internal alert should not automatically become a notification. fca.org.uk

For practical implementation, establish:

• Who decides whether notification is required.
• Which recipient and channel apply.
• What evidence supports the suspicion.
• How confidentiality is protected.
• How other legal reporting duties are assessed separately.

Templates should support informed judgment rather than substitute for it.

Test the controls before relying on them

A vendor demonstration does not establish that the configured system works for the applicant’s business.

We recommend testing representative scenarios using controlled data or simulations.

For example:

• Would the system identify repeated trading between connected accounts?
• Can reviewers reconstruct activity before a listing announcement?
• Does missing cancellation data weaken detection?
• Can an urgent case reach an authorised decision-maker?
• Are case closure reasons sufficiently supported?

Record failures, improvements and subsequent testing.

An application should clearly distinguish operational controls from features still under development.

Build an application evidence pack

For practical preparation, organise evidence around:

The evidence should describe one consistent operating model.

Returning to the opening scenario

The platform investigates the unusual trading rather than assuming its successful launch proves healthy market activity.

It examines account connections, order patterns and access to the confidential listing decision. It documents the explanations, escalates the relevant findings and assesses required notifications.

Management also reviews whether the event exposed gaps in information access or surveillance coverage.

The platform can now explain how its controls support orderly trading and how concerns lead to action.

How CRYPTOVERSE can support your preparation

CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.

We can help connect your market abuse scope assessment, information controls, surveillance procedures and notification arrangements with your proposed UK operating model, working alongside surveillance and technology specialists.

Contact CRYPTOVERSE to review whether your market integrity framework is ready to support your FCA cryptoasset authorisation application.

FAQs