ESMA MIDAS alerts under French criminal procedure

Every two weeks, crypto-asset service providers are to submit their orders and transactions to MIDAS, ESMA’s surveillance system, which runs them through detection indicators and generates market abuse alerts. These alerts name no one and come from no clearly identified authority. Yet they can lead to the public prosecutor. French law already governs that step, through a rule seldom invoked.

In brief

• MIDAS is the central system operated by ESMA to detect market abuse in crypto-assets. Its reporting instructions were published on 21 October 2026.
• ESMA calculates the alerts on behalf of the national authorities, without supervisory powers of its own. The delegation agreements that authorise it have not been published.
• In France, the alert reaches the AMF, which must notify the public prosecutor of any criminal offence of which it becomes aware.
• Confidential information received from a European supervisory authority may not be disclosed without that authority’s express consent (Article L. 632-1-A of the Monetary and Financial Code). This rule governs both the transmission of the alert to the prosecutor and access to it by the defence.

The official account: a technical instrument

Under the instructions published on 21 October 2026, crypto-asset service providers (CASPs) submit their orders and transactions to MIDAS every two weeks, as JSON files, once their national competent authority has approved their release to production.¹ The system checks the data, applies detection indicators and generates alerts.

ESMA presents MIDAS as a tool. The instructions state: “ESMA has no formal supervisory role in MiCA”. Any follow-up rests with the national authorities alone: request for information, investigation, sanction.¹

On this account, the alert remains a signal internal to the authorities. It has, in itself, no effect on the person concerned.

From alert to criminal prosecution

An alert may trigger an AMF investigation. That investigation may lead to a referral to the public prosecutor, then to the criminal court. French law already governs this path, through a rule seldom invoked: the one that governs the use of information received from a European authority.

An alert without an identified legal author

The national authorities have delegated to ESMA the collection and processing of the data, quality control, the calculation of alerts and their distribution. The delegation rests on Article 28 of Regulation (EU) No 1095/2010. According to the instructions, “A delegation can only cover tasks and not supervisory responsibilities”.¹

ESMA entrusted the project to a private contractor selected through public procurement; the cover page of the instructions names it as “Solution Provider”.¹ A “Delegated Project Board” has already extended the scope of the data collected, to refine alert calibration and “minimize false positives”.¹

Article 28(4) of Regulation No 1095/2010 requires ESMA to publish delegation agreements. As at 2 November 2026, its page on these agreements lists none relating to MiCA.² Neither the identity of the signatory authorities nor the terms on which the alert circulates are therefore publicly established.

An alert directed at orders, not persons

In phase 1, MIDAS excludes personal data, suspicious transaction and order reports, and requests for information. The buyer and seller fields carry only a default value (“BUYI” or “SELL”): identity is not reported.¹

The alert therefore cannot identify the client behind the orders. It concerns a CASP and a sequence of orders. Identification then falls to the investigative powers of the national authority. By its nature, the alert is a starting point for an investigation, not evidence.

ESMA’s 2027 work programme announces a phase 2, subject to approval by its Board. According to the instructions, later phases will include “personal identifiers”.³ The question will then arise in different terms.

Channels of transmission to the prosecutor

In France, the alert reaches the AMF, which has power to sanction insider dealing and market manipulation involving crypto-assets (Article L. 621-15, II, d and f, Monetary and Financial Code).

The corresponding criminal offences have covered crypto-assets since 30 December 2024: insider dealing (Article L. 465-1) and market manipulation (Article L. 465-3-1).⁴ The AMF and the national financial prosecutor inform each other before bringing proceedings, and only one route may be pursued (Article L. 465-3-6).

When the AMF becomes aware of an offence, it must also notify the public prosecutor without delay and send “all information, reports and documents relating to it” (Article L. 621-20-1, our translation). The Criminal Chamber of the Court of Cassation has already dealt with this mechanism: a judicial investigation into insider dealing had been extended following a referral from the AMF accompanied by documents from its own investigation.⁵

The speciality principle

Under Article L. 632-1-A of the Monetary and Financial Code, confidential information received by the AMF “from a European supervisory authority” may not be disclosed “without the express consent of the authority” that communicated it and, where applicable, “for the sole purposes for which its consent was given” (our translation).

ESMA is a European supervisory authority: Article 1 of Regulation No 1095/2010 establishes it under that name. It distributes the alerts to the national authorities.¹

The prosecutor may obtain any information from the AMF without professional secrecy being raised against them (Article L. 621-20-1, second paragraph). That right, however, is subject to the third paragraph of Article L. 632-16, which makes Article L. 632-1-A applicable to the AMF’s cooperation with foreign authorities.

The Criminal Chamber has applied this rule. It quashed a ruling that had allowed documents sent to the AMF by the Swiss financial market supervisor to be placed on the file of a judicial investigation. Those documents could be placed in criminal proceedings “only in compliance with the speciality principle” (our translation).⁶ The judgment is unpublished and concerns a third country. The provision applied covers European supervisory authorities in the same terms.

The reach of the rule depends on the conditions set by the originating authority. In that case, Swiss law allowed onward transmission to criminal authorities to enforce stock market regulation, not to prosecute an ordinary forgery.⁶ For MIDAS, those conditions belong in the delegation agreement, which has not been published.

Article 100 of MiCA does not resolve the difficulty. It permits disclosure necessary for criminal proceedings, but covers only information “exchanged between the competent authorities”.⁷

One objection must be addressed: is the alert information received from ESMA, or AMF information produced on its behalf by a delegate? The instructions describe alerts calculated and distributed by ESMA. Until the delegation agreement is published, the question remains open.

Defence access to the data behind the alert

Challenging an alert requires three elements: the indicator that triggered it, its calibration at the relevant date, and the records on which it was calculated. None of them is, as a rule, on the file.

The last calls for particular care. According to the instructions, a record rejected at validation “is not held in MIDAS and will not appear in any surveillance output”.¹ The sequence run through the indicator may therefore differ from the one the CASP reported. MIDAS does, however, retain the earlier version of any corrected record “for audit purposes”.¹

Two sources allow these data to be reconstructed. They are not subject to the same regime.

The first is the AMF, which holds the alert. The route open to the defence to obtain it depends on the procedural framework.

In a preliminary investigation, the defence can only submit observations to the public prosecutor, once the file has been made available to it. They may address “the need to carry out new steps” (our translation); the prosecutor’s refusal may be challenged before the prosecutor general (Article 77-2, Code of Criminal Procedure).

If a judicial investigation is opened, the defence may ask the investigating judge for any step that appears “necessary to establish the truth” (Article 82-1, our translation). A judge who refuses must issue a reasoned order within one month; the appeal is screened by the president of the investigating chamber (Article 186-1).

Where the case is brought by summons, the criminal court may be asked, by written submissions, to order any step necessary to establish the truth. A refusal must be specifically reasoned (Article 388-5).

Each of these routes meets Article L. 632-1-A. If the alert is information received from ESMA, the AMF cannot disclose it without ESMA’s consent, whoever makes the request and whatever the stage of the proceedings.

The second is the CASP itself. MiCA requires it to keep a record of all orders and transactions it carries out (Article 68(9)) and, if it operates a trading platform, to keep order data at the disposal of the competent authority for at least five years (Article 76(15)). For each submission, it also receives from MIDAS a feedback file that identifies rejected records and remains on its server for seven years.¹

The CASP holds neither the alert nor the indicator. It holds the data from which the alert was computed, and those data are its own: it did not receive them from ESMA. Article L. 632-1-A, which governs only information received from a European authority by the AMF, the Prudential Supervision and Resolution Authority and the Banque de France, therefore does not prevent their production. The public prosecutor during an investigation (Article 77-1-1) and the investigating judge (Article 99-3) may require the CASP to hand them over, if need be at the defence’s request made through the routes described above.

The principle of fairness in obtaining evidence (loyauté de la preuve) offers no purchase here: it sanctions a stratagem used by “a public official” (our translation) to taint the search for evidence,⁸ which a detection indicator is not. The relevant provision is Article 427 of the Code of Criminal Procedure: the court may base its decision only on evidence “discussed before it in adversarial proceedings” (our translation). An alert whose indicator, calibration and source data remain out of reach cannot be so discussed. It cannot, on its own, ground a finding of guilt.

The reform under negotiation: the MISP package

The Commission’s proposal of 4 December 2025 places all authorised CASPs under ESMA supervision, market abuse included. Suspicious transaction reports would be sent to ESMA, which would have power “to refer matters for criminal prosecution”.⁹

On 9 October 2026, the Council agreed the key elements of its position: only the most significant cross-border CASPs would come immediately under ESMA supervision, replacing the blanket regime proposed by the Commission.¹⁰ As at 2 November 2026, the European Parliament’s ECON committee had not adopted its report.¹¹

If the text is adopted on that basis, the alert will become, for those CASPs, the act of an authority with supervisory and referral powers of its own. The current regime will remain for all others.

Conclusion: the answer lies with the AMF

As long as the delegation agreements remain unpublished, only one authority can state what use it makes of a MIDAS alert: the AMF. Only the AMF knows whether it obtained from ESMA the express consent that Article L. 632-1-A requires before any transmission to the prosecutor. Failing an answer from the AMF, it will be for the defence to raise the question, at whatever stage the proceedings have reached, through the routes described above.

Provisions cited: Regulation (EU) 2023/1114, Articles 68, 76 and 100; Regulation (EU) No 1095/2010, Articles 1 and 28; Monetary and Financial Code, Articles L. 465-1, L. 465-3-1, L. 465-3-6, L. 621-15, L. 621-20-1, L. 632-1-A and L. 632-16; Code of Criminal Procedure, Articles 77-1-1, 77-2, 82-1, 99-3, 186-1, 388-5 and 427.