Why the EU's Latest Academic Paper on AI and Market Abuse Points to a Cryptographic Future

The Convergence We've Been Anticipating

In September 2025, something remarkable happened in the world of financial regulation. The Malta Financial Services Authority (MFSA), through its newly launched Journal of Financial Supervisors Academy (JFSA), published what may become one of the most consequential academic papers on AI-driven trading since the EU AI Act was adopted.

Professor Filippo Annunziata of Bocconi University—one of Europe's foremost authorities on financial market regulation and a member of the Board of Appeal for EBA, ESMA, and EIOPA—delivered a comprehensive analysis titled "Artificial Intelligence and Market Abuse Regulation." His findings confirm what we at VeritasChain Standards Organization have been building toward: the current regulatory framework lacks the technical infrastructure to actually verify AI trading system compliance.

This isn't just an academic observation. It's a clarion call for the industry to move from trust-based compliance to verification-based compliance. And it happens to describe, with remarkable precision, exactly what the VeritasChain Protocol (VCP) v1.1 was designed to solve.

Who Is Professor Annunziata, and Why Does His Opinion Matter?

Before diving into the substance, let's establish why this paper carries unusual weight in regulatory circles.

Professor Filippo Annunziata is not merely an academic observer of financial regulation—he is deeply embedded in its institutional fabric:

When Professor Annunziata identifies a gap in EU financial regulation, policymakers pay attention. His JFSA paper is not speculative—it's a carefully documented analysis from someone who reviews regulatory decisions at the highest European level.

The Core Argument: AI Creates Risks That Current Frameworks Cannot Address

Professor Annunziata's paper examines the intersection of AI with the Market Abuse Regulation (MAR) through two critical lenses:

Lens 1: Insider Information and Disclosure

AI systems are increasingly involved in processing and acting on potentially price-sensitive information. But here's the problem: when an AI system "decides" whether information is material and when to trigger disclosure obligations, what happens if it fails? What constitutes "insider information" when the "insider" is an algorithm processing data at superhuman speeds?

The current disclosure framework under MAR Article 17 assumes human judgment at critical decision points. AI disrupts this assumption fundamentally.

Lens 2: Market Manipulation and Algorithmic Trading

This is where the paper's implications become particularly relevant to VCP. Professor Annunziata documents how AI-driven trading creates new manipulation risks that existing surveillance frameworks struggle to detect:

The critical insight: these behaviors often cannot be identified post-hoc without complete, tamper-evident, and verifiable audit trails that capture not just what happened, but the AI's decision-making context at microsecond resolution.

The Regulatory Landscape in 2026: Three Frameworks, One Compliance Challenge

To understand why VCP matters, we need to examine the regulatory requirements that algorithmic trading firms now face simultaneously.

Framework 1: EU AI Act (Regulation 2024/1689)

The EU AI Act becomes fully applicable to high-risk AI systems on August 2, 2026. While algorithmic trading systems aren't explicitly listed in Annex III, credit scoring and insurance risk assessment AI are classified as high-risk, and ESMA's guidance suggests similar treatment for trading AI.

"High-risk AI systems shall technically allow for the automatic recording of events ('logs') over the lifetime of the system."
— EU AI Act, Article 12

Framework 2: MiFID II and RTS 25 (Timestamp Precision)

MiFID II Article 17 mandates comprehensive record-keeping for algorithmic trading, but RTS 25 gets specific about precision:

This isn't just about accurate clocks—it's about proving that your timestamps were accurate at the time of recording. Current approaches rely on attestations and periodic audits. They don't provide cryptographic proof.

Framework 3: MAR (Regulation 596/2014) and Surveillance Obligations

MAR Article 12 defines market manipulation to include algorithmic behaviors that:

• Disrupt or delay trading system functioning
• Make identification of genuine orders difficult
• Create false or misleading signals about supply, demand, or price

The surveillance requirements demand continuous monitoring, alert generation, and minimum annual audits.

The Gap That No Existing Solution Fills

Here's the uncomfortable truth that Professor Annunziata's analysis illuminates: no currently deployed solution provides verifiable compliance across all three frameworks simultaneously.

FIX Protocol

• Standardized trading messages

• No cryptographic integrity
• No tamper detection
• No AI governance metadata

ISO 20022

• Open standard for financial messaging

• Designed for payments, not trading
• No audit trail mechanisms
• No AI-specific extensions

Blockchain/DLT Solutions

• Cryptographic integrity
• External verifiability

• Not designed for trading events
• Latency inappropriate for HFT
• No AI governance integration

RegTech Platforms

• Trading surveillance
• Some AI integration

• No cryptographic proof
• Proprietary, vendor-locked
• Trust-based, not verification-based

How VCP v1.1 Addresses Every Requirement

The VeritasChain Protocol v1.1 was designed from first principles to provide cryptographically verifiable compliance across the EU regulatory framework.

Three-Layer Architecture

VCP-CORE: Foundation Logging

VCP-GOV: AI Governance (EU AI Act Compliance)

VCP-PRIVACY: GDPR Compliance Through Crypto-Shredding

The Completeness Guarantees: VCP's Decisive Advantage

VCP v1.1's most significant innovation is completeness guarantees—the ability to prove not just that data wasn't altered, but that all data was recorded.

How It Works

1. Continuous Merkle Root Computation: At regular intervals, VCP computes a Merkle root over all events in the batch
2. External Anchoring: This root is committed to an external, independently verifiable timestamp service
3. Consistency Proofs: Between consecutive batches, VCP generates Merkle consistency proofs per RFC 6962
4. Split-View Attack Detection: Any attempt to present different logs to different parties is cryptographically detectable

Regulatory Significance

For EU AI Act Article 12: Post-market monitoring requires confidence that logs are complete. VCP's external anchoring provides mathematical proof that no events were omitted.

For MAR Surveillance: When investigating potential manipulation, regulators need assurance that the audit trail is comprehensive. VCP's completeness guarantees eliminate the possibility of selective evidence destruction.

For MiFID II RTS 6 Annual Self-Assessment: Firms must certify their algorithmic trading governance annually. VCP's verifiable completeness transforms this from an attestation-based process to a cryptographically provable one.

Tier-Based Implementation: From HFT to Retail

VCP v1.1 recognizes that different market participants have different precision requirements.

The Strategic Imperative: 2026 and Beyond

The August 2026 Deadline

When EU AI Act high-risk requirements take full effect on August 2, 2026, firms operating AI-driven trading systems will face a stark choice:

1. Trust-based compliance: Attestations, policies, manual audits—and hope regulators accept them
2. Verification-based compliance: Cryptographic proof that satisfies regulatory requirements mathematically

The Enforcement Landscape

Conclusion: From Trust to Verification

The regulatory landscape facing algorithmic trading firms is unprecedented in its complexity and consequence. EU AI Act, MiFID II, and MAR create overlapping but distinct requirements that no existing solution fully addresses.

Professor Annunziata's MFSA/JFSA paper articulates what we've been building toward since VSO's founding: the financial industry needs cryptographic proof, not institutional trust.

The August 2026 deadline is approaching. Harmonized standards are delayed. Enforcement is intensifying.

The firms that adopt verification-based compliance now won't just meet regulatory requirements—they'll demonstrate a level of transparency that becomes a competitive advantage in a market where trust has been repeatedly violated.

Verify, don't trust. That's not just our philosophy. It's increasingly what regulators demand.

Resources

• VCP v1.1 Specification: github.com/veritaschain/vcp-spec
• IETF Internet-Draft: draft-kamimura-scitt-vcp
• Technical Inquiries: technical@veritaschain.org
• Partnership Inquiries: partners@veritaschain.org

VeritasChain Standards Organization (VSO) is a non-profit, vendor-neutral standards body dedicated to developing cryptographic audit trail standards for AI-driven and algorithmic trading systems. VSO has submitted VCP documentation to 67 regulatory authorities across 50 jurisdictions.