MiCA Compliance

MiCA Article 92 requires every authorised CASP to monitor orders and transactions for signs of market abuse and to file a Suspicious Transaction and Order Report (STOR) with the national competent authority when abuse is suspected. Northgate Compliance builds the software systems that automate this detection and reporting workflow.

The obligation covers both executed trades and unfilled orders, since spoofing and layering patterns often never result in a completed transaction. A surveillance system that only analyses trade data, rather than the full order book, misses the majority of manipulation patterns Article 92 is meant to catch.

In practice this means continuous, automated monitoring rather than periodic manual review. Regulators expect a CASP to demonstrate a working detection process at authorisation and to keep it running afterward, which is why Article 92 compliance software has become a standard purchase for newly authorised exchanges, custodians and brokers.

Northgate Compliance prices its surveillance software in three tiers: the Surveillance module starts at EUR 36,000 for a fixed-scope build, the full STOR-Ready Suite starts at EUR 49,000, and the Watch managed-service edition runs at EUR 8,000 per month. Final cost depends on the number of detection scenarios, venues monitored and data-ingestion volume.

Add-on modules are priced separately: OrderBook Intel for multi-venue analytics starts at EUR 18,000, and the AlertIQ Case Manager starts at EUR 12,000 where a client wants case management without the full detection engine. All fixed-price quotes are valid until 31 December 2026.

Two published market prices exist for adjacent MiCA compliance deliverables we could verify: a EUR 19,900 fixed-fee CASP authorisation package from a Lithuanian law firm and a EUR 2,400-per-month general compliance retainer from a Czech advisory firm, neither of which prices market abuse surveillance software specifically. Our own benchmark table in the Pricing section states plainly where no market price exists rather than guessing one.

Evaluate the vendor's detection-scenario library depth, their order-book ingestion latency, their STOR workflow completeness and whether their team holds direct market microstructure expertise. Ask for evidence of ESMA or NCA submissions passing first review.

Ask every vendor the same question: how many STORs has your platform actually supported, and how many were sent back by the regulator for further information? Northgate Compliance answers with a specific number: every STOR submitted through the platform to date has passed first review, not a vague claim of experience.

Also ask who calibrates the detection scenarios before go-live. At Northgate Compliance, the detection scenario library was built by Dr. Niamh O'Sullivan, drawing on her own decade as surveillance lead at a tier-1 European trading venue, and every new client's thresholds are calibrated against their own historical order-book data before cutover.

A STOR is a formal report filed by a CASP under MiCA Article 92 when its surveillance system identifies a pattern consistent with insider dealing, market manipulation or another form of market abuse. The report is sent to the national competent authority within the jurisdiction where the transaction occurred.

A complete STOR package includes a reconstructed order-book timeline, the participant identities involved, a description of the suspected pattern and a legal assessment of which MiCA provision applies. An incomplete evidence package is the most common reason a regulator asks for further information before accepting a submission.

Northgate Compliance's AlertIQ Case Manager assembles this evidence automatically from the underlying WatchCore alert, so investigators review and approve a structured package rather than compiling one from scratch under deadline pressure.

Northgate Compliance has shipped 31 detection scenarios covering spoofing, layering, wash trading, ramping, insider-dealing timing correlation, cross-venue coordination and pump-and-dump patterns. Each scenario is parameterised and configurable to the client's market structure.

Scenarios are grouped by abuse type in the scenario selection guide above: spoofing and layering (8 scenarios), wash trading (4), pump-and-dump and ramping (5), insider-dealing timing correlation (6), cross-venue coordination (5) and on-chain pre-trade positioning (3). A venue does not need every group active; a spot exchange typically activates a different set than an OTC desk.

New scenarios are added to the library on an ongoing basis as manipulation techniques evolve, and Watch Managed Service clients receive updated scenarios automatically as part of the monthly subscription, at no additional integration cost.

A standard Surveillance engagement runs 10 to 14 weeks from contract signature to go-live, including order-book data-feed integration, scenario calibration, alert-threshold tuning and operator training. The STOR-Ready suite adds approximately three weeks for NCA submission workflow and evidence packaging.

The Gate-to-Alert methodology breaks this into six gates, each with a defined deliverable and a client sign-off before the next gate opens: regulatory scope mapping, data-feed architecture, scenario selection and calibration, a 20-trading-day parallel run, STOR workflow validation and live alert production.

The slowest step is usually the parallel-run gate, which deliberately runs WatchCore alongside any existing process for 20 trading days before cutover, so a client's compliance team can compare alert volumes and confirm thresholds before relying on the new system alone.

MiCA defines market abuse for crypto-assets by reference to three categories: insider dealing, unlawful disclosure of inside information and market manipulation. Market manipulation itself covers wash trading, spoofing, layering, ramping and coordinated cross-venue activity intended to distort a price.

The regulation applies these categories to crypto-assets admitted to trading on a CASP's platform, extending a framework originally built for regulated securities markets under the Market Abuse Regulation (EU) 596/2014. A CASP is expected to build detection scenarios for each category, not just the ones that are easiest to automate.

In Northgate Compliance's own detection library, market manipulation scenarios (spoofing, layering, wash trading, ramping, cross-venue coordination) account for 24 of the 31 shipped scenarios, with the remainder targeting insider-dealing timing correlation and on-chain pre-trade positioning.

WatchCore is a market abuse surveillance platform, not a full AML/KYC onboarding system, but it does integrate on-chain risk signals relevant to the FATF Travel Rule and to AML monitoring through Chainalysis, Elliptic and TRM Labs, plus native OpenVASP support for VASP transfer data.

This matters because on-chain transfers are sometimes used to fund or coordinate a manipulative trading strategy. A participant flagging in Chainalysis for a high-risk wallet cluster while simultaneously placing a spoofing pattern in the order book produces a compound alert that neither an AML system nor an order-book system alone would generate.

For a full AML and KYC policy pack outside the surveillance layer, Northgate Compliance quotes a fixed EUR 5,000 fee for the transaction-monitoring policy configuration; onboarding-side KYC and KYB workflow remains outside our scope and is typically handled by a dedicated KYC provider.

Every STOR submitted through the Northgate Compliance platform to date has passed first review with the relevant national competent authority, meaning zero requests for further information on procedural grounds across all submissions filed to date.

If a STOR ever did come back with a procedural request for further information, the STOR-pass commitment in our contract terms means Northgate Compliance reworks the evidence package at no additional cost. This is a formal guarantee, not a best-effort promise.

The reason first-review pass rates matter so much is timing: a STOR sent back for rework delays the regulatory record by weeks, during which the underlying suspected abuse pattern may still be active. Our dual-control review workflow, requiring two investigators to approve a STOR before submission, exists specifically to catch evidence gaps before the NCA does.

Yes. WatchCore ingests order-book and trade data over FIX (4.2, 4.4 and 5.0), WebSocket order-book feeds and REST trade-history backfill, so it connects to the matching engine most centralised exchanges and derivatives platforms already run, without requiring a migration.

For custodians and wallet providers without a traditional order book, WatchCore's on-chain transaction feed and OpenVASP integration provide the equivalent surveillance signal from on-chain transfer activity and VASP-to-VASP transfer data instead.

Case management and alert data are also exposed through a documented REST API and SDK, so a client's existing compliance dashboard or ticketing system can pull WatchCore and AlertIQ data rather than requiring investigators to work in a second tool.

DORA (the Digital Operational Resilience Act, Regulation (EU) 2022/2554) requires financial entities including CASPs to maintain a documented ICT risk management framework, an incident classification and reporting process, and periodic resilience testing. It is a separate regulation from MiCA, but the two obligations overlap operationally.

WatchCore's immutable, append-only audit trail and documented incident-response playbook satisfy the core DORA ICT continuity requirement for the surveillance platform itself, and this coverage is included in every Surveillance and STOR-Ready engagement, not sold as a separate add-on.

DORA compliance for a CASP's wider technology estate, beyond the surveillance platform, is outside Northgate Compliance's scope. We cover the piece of DORA that touches the systems we build and operate, and we say so plainly rather than claiming broader DORA coverage we do not deliver.

The Surveillance module (WatchCore, from EUR 36,000) covers detection: order-book ingestion, the 31 detection scenario library and the alert dashboard. It tells a compliance team when something looks like market abuse.

The STOR-Ready Suite (from EUR 49,000) adds everything needed to act on that alert: the AlertIQ Case Manager for structured investigation, NCA submission templates for 12 EU member states, a tabletop STOR submission exercise before go-live and the dual-control review workflow behind our first-review pass record.

Most clients start with WatchCore alone when they need Article 92 detection coverage quickly and already have an internal STOR filing process, then add the STOR-Ready Suite once detection volume makes a manual filing process unsustainable. Both share the same underlying data pipeline, so upgrading later does not require a second integration project.