In brief
- ESMA wants a new regulated MiCA service for crypto firms that give clients access to DeFi protocols through their own apps or interfaces.
- The EU markets regulator also asks for targeted disclosure and conduct rules for staking, lending and borrowing offered by licensed firms.
- The proposals are ESMA’s answer to the European Commission’s consultation on reviewing MiCA, so nothing changes for firms yet.
The European Securities and Markets Authority wants MiCA to cover crypto firms that act as gateways to decentralised finance. In its response to the European Commission’s MiCA review consultation, published on 30 September, the regulator also proposes tighter rules for staking, lending and borrowing, and for influencer marketing.
The paper comes three months after the MiCA transitional period ended on 1 July 2026. ESMA says it draws on that first round of licensing and supervision.
A licence for DeFi front-ends run by crypto firms
ESMA says licensed crypto-asset service providers (CASPs) increasingly let clients reach DEXs, lending protocols, staking and re-staking, liquidity pools and yield strategies, or offer an interface to unregulated smart contracts. It sees consumer, smart-contract and operational risks, plus conflicts of interest when a firm routes clients to particular protocols.
Its answer is a new “gatekeeper” service. It would apply when a CASP provides a technical interface to DeFi, routes transactions or otherwise sits between clients and DeFi services. Firms would have to disclose protocol risks, explain how they select and route to protocols, manage conflicts and run due diligence on the protocols they list. The obligations would scale with how much control the firm has over the protocol. ESMA stresses that open-source code, self-custody and permissionless infrastructure should not automatically count as regulated activity.
It also wants a clear legal definition of DeFi in MiCA itself, replacing the vague wording in Recital 22. The regulator warns of “decentralisation washing”, where an identifiable operator uses DeFi language to dodge the rules, and says the exemption should be “as narrow as possible”.
What changes for staking and crypto lending?
For staking by licensed firms, ESMA wants disclosures on rewards, lock-up and unbonding periods, slashing risk, validator selection, fees and insolvency treatment. It separates self-directed staking from technical, pooled or custodial staking and from liquid staking tokens, which may need their own classification. The regulator prefers this to “a new heavy authorisation regime”.
Crypto lending gets sharper language. ESMA calls some yield programmes “black boxes”, where clients don’t know who borrows their coins or what collateral is posted, and custody and segregation rules stop applying once assets are lent out. It wants express written client consent and disclosure duties. Borrowing rules would cover liquidation risk, leverage and reuse of collateral.
Stablecoins, scams and binding token calls
Other proposals would bar CASPs from any licensed service involving stablecoins that don’t comply with MiCA, give national authorities power to take down scam websites, and let ESMA order firms to freeze crypto linked to market abuse or terrorist financing. ESMA also asks for power to issue binding opinions on token classification, including hybrid tokens. So far it has issued just one non-binding opinion.
The Commission now decides what goes into its legislative proposal. ESMA wants the review aligned with a separate EU package that proposes moving CASP supervision to ESMA itself. The regulator has already made crypto supervision a priority for 2027.
