I've spent quite a lot of time recently working through the FCA's final rules and guidance for the new cryptoasset regime.

One provision in particular got me thinking.

CRYPTO 4.2.4G provides that where a firm has taken all reasonable measures to prevent cryptoasset market abuse, abuse nevertheless committed by an employee on its behalf should not be attributed to the firm.

A safe harbour when an employee goes off on a frolic of their own? Potentially.

But “all reasonable measures” is doing quite a lot of work.

More than surveillance

For crypto intermediaries, the FCA has prescribed detailed arrangements to prevent, detect and disrupt market abuse.

These go beyond conventional order and trade surveillance. They include monitoring communications and social media, investigating employee wallet activity and, particularly interestingly, having arrangements with clients that allow firms to intervene where potential market abuse is identified — including restricting or terminating the client relationship.

That distinction matters.

This is not simply surveillance designed to identify suspicious activity after the event and submit a report. The expectation is that firms should have arrangements capable of preventing and disrupting the activity itself.

MAR versus MARC

The existing Market Abuse Regulation already places extensive surveillance and reporting obligations on firms.

But MARC appears more explicit — and in places more interventionist — about prevention and disruption.

That raises an interesting question.

Are we creating a two-tier market-abuse control framework? Or is MARC showing us where the wider regulatory approach may eventually be heading?

There are reasons why cryptoasset markets may warrant different treatment. Market structure, technology, the role of intermediaries and the ways in which abusive behaviour can occur are not identical to traditional financial markets.

So it would be too simplistic to conclude that MARC merely represents a higher standard.

But the regulatory philosophy is interesting. Surveillance becomes not simply a means of detecting misconduct, but part of a broader framework designed to give firms the practical ability to intervene.

The effectiveness question

For firms subject to MARC, this has an immediate consequence.

A surveillance system and a well-drafted market-abuse policy will not, by themselves, demonstrate that a firm has taken all reasonable measures to prevent abuse.

Firms will need to consider whether their arrangements actually allow them to identify emerging behaviour, investigate it, escalate it and - where necessary - do something about it.

That shifts the conversation from whether a control exists to whether it is capable of achieving its intended outcome.

And that may ultimately be the more interesting lesson from MARC.

As regulators increasingly focus on the effectiveness of compliance arrangements, the distinction between detecting misconduct and having the capability to prevent or disrupt it may become increasingly important well beyond cryptoassets.