The European Central Bank published Working Paper No. 3208, "Who to Regulate? Identifying Actors Within DeFi's Governance," in March 2026. The paper, authored by Alexandra Born, Zakaria Gati, Claudia Lambert, Mahvish Naeem, and Antonella Pellicani, analyzed on-chain governance data from four prot...
"Their dataset is hand collected from public sources, public DeFi data is pseudonymous and incomplete, and they note possible inaccuracies or missing information. So, maybe garbage out because garbage in." — Bill Hughes, Senior Counsel, Consensys
The European Central Bank published Working Paper No. 3208, "Who to Regulate? Identifying Actors Within DeFi's Governance," in March 2026. The paper, authored by Alexandra Born, Zakaria Gati, Claudia Lambert, Mahvish Naeem, and Antonella Pellicani, analyzed on-chain governance data from four protocols — Aave, MakerDAO, Ampleforth, and Uniswap — and concluded that voting power is concentrated among a small number of wallets. The top 100 governance token holders control more than 80% of token holdings across all four protocols, according to the paper.
The findings arrive 53 days before the July 1, 2026 deadline for MiCA crypto-asset service provider (CASP) authorization. MiCA's Recital 22 exempts services provided in a "fully decentralized manner without any intermediary," but the ECB paper argues most DeFi DAOs fail that test. If European regulators adopt this interpretation, protocols operating in the EU will need to obtain licenses, maintain capital reserves, and implement compliance infrastructure identical to centralized exchanges — or exit the market entirely.
ECB Working Paper No. 3208 used on-chain data collected up to May 2023 from four DeFi protocols: Aave, MakerDAO (now Sky), Ampleforth, and Uniswap. The researchers examined token distribution, delegation patterns, and voting records to map governance power structures.
The paper identified three layers of governance actors: token holders, delegates, and active voters. In most cases, these groups overlap unevenly. Approximately half or more of governance token holdings across the four protocols were linked to the protocols themselves or to centralized exchanges, rather than to independent community participants.
A central finding: 1.2% of token holders control over 90% of voting power across the top 20 DeFi protocols. Retail participation typically hovers below 3%. Venture capital firms and early investors were identified as primary drivers of token concentration, having acquired large allocations during initial funding rounds that translated into outsized governance influence.
The paper's authors stated that identifiable points of control — developers, token treasuries, and exchange listings — could serve as practical "regulatory anchor points" for supervision.
The data reveals significant variation in concentration across the four protocols studied:
Ampleforth showed the highest concentration. The top 20 voters controlled approximately 96% of delegated voting power. This effectively means fewer than two dozen addresses determine all governance outcomes.
MakerDAO exhibited the second-highest concentration. The top 10 voters held 66% of delegated votes. The top five wallets alone controlled between 36% and 59% of total token supply across the sample.
Uniswap was comparatively less concentrated but still showed meaningful centralization. The top 18 voters controlled 52% of voting power. However, the protocol's lower voter turnout means this 52% still translates to effective governance control.
Aave demonstrated concentration patterns consistent with the broader sample. The top 100 holders across all four protocols controlled more than 80% of all governance token holdings.
A transparency issue compounds the concentration problem. Roughly one-third of top voters across the sample could not be identified. These anonymous wallets exercise substantial governance power without public accountability, making it difficult for regulators — or community members — to assess potential conflicts of interest.
The paper also found that delegates, rather than direct token holders, dominate active voting. In many cases, the identity of these delegates could not be linked to underlying token holders, creating an additional layer of opacity.
MiCA's Recital 22 provides a carve-out for crypto-asset services rendered in a "fully decentralized manner without any intermediary." The regulation does not define what "fully decentralized" means in practice, and no quantitative thresholds have been established.
The ECB paper defines true decentralization as software that is "entirely autonomous and effectively immutable in operation." By this standard, virtually no current DeFi protocol qualifies. Every protocol in the sample has governance mechanisms that allow parameter changes, upgrades, or treasury allocations — features that inherently involve human decision-making.
Only 13 of 27 EU member states had fully transposed MiCA into national law as of the paper's publication date in March 2026. After July 1, 2026, any entity providing crypto-asset services to EU clients without MiCA authorization will be in breach of EU law.
The practical consequence: if the ECB's interpretation prevails, protocols that currently operate under the assumption they are exempt from MiCA may find themselves reclassified as regulated entities. Lending protocols, liquid staking services, and yield aggregators with concentrated governance tokens face the highest reclassification exposure, according to the paper.
The European Securities and Markets Authority (ESMA) has developed a complementary "spectrum of decentralization" assessment framework. Unlike the ECB's binary approach, ESMA recognizes that decentralization exists on a continuum rather than as an on/off switch.
The ESMA framework evaluates centralization points across several dimensions: front-end websites, infrastructure providers (such as Infura and Alchemy, both of which rely on Amazon Web Services hosting), governance token concentration, and the ability of identifiable parties to modify protocol parameters.
Notably, the framework sets no hard thresholds. A protocol with a Nakamoto coefficient of 50 is not automatically classified as decentralized, nor is one with a coefficient of 5 automatically centralized. This ambiguity leaves individual national regulators with substantial interpretive latitude, creating potential for inconsistent enforcement across EU member states.
The European Commission's own DeFi assessment report is due by mid-2026 and is expected to provide additional clarity. The ECB staff paper is explicitly positioned to influence that formal rulemaking process.
The paper has drawn sharp criticism from the DeFi industry.
Bill Hughes, Senior Counsel at Consensys, challenged both the methodology and the conclusions. He argued the paper "stacks real numbers, then applies a subjective reading of the spectrum between centralization and decentralization." Hughes noted the dataset was "hand collected from public sources" and that the authors themselves acknowledged "possible inaccuracies or missing information."
Hughes also challenged the paper's definitional framework, arguing it establishes a standard "that virtually no current project can meet." By defining true decentralization as fully autonomous and immutable software, the ECB effectively eliminates the regulatory carve-out for all existing protocols.
The criticism highlights a genuine methodological limitation. DeFi data is pseudonymous by design. On-chain analysis can identify wallet addresses but cannot always determine who controls them or whether multiple addresses are controlled by the same entity. The ECB acknowledged this limitation but proceeded to draw regulatory conclusions from the incomplete data.
The concentration dynamics the ECB describes played out in real time at Aave in early 2026. In December 2025, delegates discovered that the integration of trading aggregator CoWSwap into Aave's interface had redirected swap-related fees away from the community treasury to an external recipient. This triggered a months-long dispute over whether Aave Labs or the DAO controlled protocol revenue.
On April 13, 2026, Aave governance passed the "Aave Will Win" proposal, redirecting 100% of revenue from all Aave-branded products — including lending markets, swaps, and other protocol activity — to the DAO treasury and AAVE token holders. The distribution method (buybacks, staking rewards, or other mechanisms) was deferred to future governance votes.
The episode illustrates both the promise and the problem of concentrated governance. A small number of engaged delegates identified the revenue diversion, organized opposition, and ultimately restructured the protocol's economic model. But the outcome was determined by a concentrated voting bloc — precisely the pattern the ECB paper flags as inconsistent with genuine decentralization.
The Aave case also demonstrates how governance concentration interacts with economic stakes. Following a $293 million KelpDAO exploit in April 2026, Aave moved to overhaul its collateral and listing standards, with governance decisions affecting billions in deposited assets being made by a relatively small number of active voters.
DeFi total value locked fluctuated between $80 billion and $140 billion through the first five months of 2026, according to DefiLlama data. The $13 billion TVL decline following the KelpDAO hack in April 2026 — with $8.45 billion in deposits exiting Aave alone within 48 hours — demonstrated how security incidents can rapidly destabilize the sector.
At the same time, institutional capital has deepened its engagement with DeFi governance structures. In February 2026, Apollo Global Management signed a cooperation agreement to acquire up to 90 million MORPHO tokens — roughly 9% of supply — over 48 months. BlackRock brought its tokenized Treasury fund BUIDL on-chain through UniswapX and purchased UNI tokens. MORPHO surged 17.8% on the announcement.
These institutional entries complicate the decentralization question. Apollo's potential 9% stake in Morpho governance tokens would make it one of the protocol's largest governance participants. Whether a $700 billion asset manager holding a controlling governance stake in a lending protocol constitutes "decentralized finance" is the question European regulators are now forced to answer.
The regulatory calendar is compressed. Three deadlines converge in mid-2026:
July 1, 2026: MiCA CASP authorization deadline. Entities providing crypto-asset services without a license must cease operations in the EU.
Mid-2026: European Commission DeFi assessment report due. This document is expected to provide formal guidance on what constitutes "fully decentralized" under MiCA.
Ongoing: National transposition of MiCA. With only 13 of 27 member states having fully transposed the regulation as of March 2026, enforcement capacity varies across the bloc.
The practical effect on DeFi protocols operating in Europe depends on how regulators interpret the spectrum. Under the ECB's strict reading, most protocols would require licensing. Under a more permissive interpretation, protocols with sufficiently distributed governance — if such a threshold is established — could continue operating under the exemption.
For protocols currently serving EU users, the calculus involves weighing the cost of compliance (licensing fees, capital requirements, KYC/AML infrastructure) against the cost of geo-blocking European users. Several protocols have already implemented IP-based access restrictions for certain jurisdictions as a preemptive measure.
The ECB's Working Paper No. 3208 found that the top 100 governance token holders control over 80% of holdings across Aave, MakerDAO, Ampleforth, and Uniswap. Approximately 1.2% of token holders control 90% of voting power across the top 20 DeFi protocols.
MiCA's "fully decentralized" exemption lacks a quantitative definition. The ECB paper sets an impossibly high bar — fully autonomous, immutable software — that no existing protocol meets.
Only 13 of 27 EU member states had fully transposed MiCA into national law as of March 2026, creating an uneven enforcement landscape ahead of the July 1 deadline.
Institutional entries by Apollo (90 million MORPHO tokens) and BlackRock (UNI tokens, BUIDL on UniswapX) introduce new governance concentration vectors that will test whatever decentralization framework regulators adopt.
Industry critics argue the ECB's methodology relies on incomplete, pseudonymous data and applies subjective interpretive standards to reach regulatory conclusions.
The European Commission's mid-2026 DeFi assessment report will likely determine whether the ECB's strict interpretation or a more nuanced standard prevails.
The ECB paper surfaces a genuine tension in DeFi governance: protocols designed to operate without intermediaries are, in practice, governed by small groups of token holders and delegates. The data on concentration is clear, even if the methodology has limitations.
The regulatory question is not whether concentration exists — it does — but what level of concentration is compatible with the "fully decentralized" exemption under MiCA. The ECB's answer appears to be: none of the protocols studied qualify. The industry's answer is that the ECB's definition sets an unattainable standard.
With 53 days until the MiCA authorization deadline and the European Commission's DeFi assessment report due by mid-year, protocols operating in Europe face a narrow window to either demonstrate decentralization or prepare for licensing. The outcome will shape whether DeFi in the EU operates under a regulatory framework designed for centralized intermediaries, or under a distinct regime that accommodates the technology's structural differences.