The European Banking Authority on September 24 published its formal response to the European Commission's targeted consultation on MiCA, recommending that crypto lending and DeFi access be brought under the regulation's scope. MiCA Recital 94 deliberately excluded lending when the regulation was ...
"The classification of crypto-assets under MiCA is a challenge for industry and supervisors and results in avoidable costs and delays for firms." — European Banking Authority, MiCA Review Response, September 2026
The European Banking Authority on September 24 published its formal response to the European Commission's targeted consultation on MiCA, recommending that crypto lending and DeFi access be brought under the regulation's scope. MiCA Recital 94 deliberately excluded lending when the regulation was adopted in May 2023. The EBA now argues the gap has become untenable: crypto borrowing and lending activity has been documented in at least 16 EU member states, DeFi lending protocols hold approximately $50 billion in deposits globally across 637 protocols, and AI-powered intermediation tools are collapsing the barrier between regulated CASPs and unregulated DeFi pools.
The proposed measures include suitability testing for retail users, leverage limits, enhanced pre-contractual disclosures, restrictions on lending involving MiCA-authorized stablecoins, and — most notably — a certification regime for DeFi protocols that EU-licensed firms may connect to. If adopted, the changes would represent the first direct regulatory contact between EU law and decentralized protocol infrastructure. The Commission's consultation closes September 30, 2026, with legislative reports due by June 30, 2027.
MiCA, adopted on May 31, 2023, entered full application on December 30, 2024 (Titles III and IV launched June 30, 2024). The regulation established a licensing framework for crypto-asset service providers (CASPs), stablecoin issuers, and token offerings. It did not regulate lending.
Recital 94 of MiCA states explicitly that the regulation "should not address the lending and borrowing of cryptoassets, including e-money tokens." Article 142 directed the Commission to assess whether regulating crypto lending is feasible and necessary — a deferred question now actively under review.
The gap is structural. A MiCA-licensed CASP can custody assets, execute trades, and advise clients. That same CASP can also facilitate crypto lending — including routing client funds to DeFi protocols — without triggering any lending-specific compliance obligation. The EBA and ESMA identified this asymmetry in their January 2025 joint report, which found crypto borrowing and lending intermediated in at least 16 EU member states.
MiCA's maximum transitional period for providers operating under national regimes expired on July 1, 2026. Every firm serving EU clients with crypto services now requires a MiCA license. As of September 1, 2026, the EBA reports 39 electronic money tokens (EMTs) authorized under MiCA and zero asset-referenced tokens (ARTs) authorized under Title III.
The EBA's response to the Commission's targeted consultation, published September 24, outlines six specific measures for study:
1. Add Lending to MiCA's Service List. The EBA recommends the Commission conduct a cost-benefit analysis of adding intermediated crypto borrowing and lending to the regulated services enumerated under MiCA. This would require CASPs offering lending to meet dedicated compliance requirements.
2. Suitability Tests. Retail users accessing lending services would face suitability assessments, similar to MiFID II's appropriateness testing for complex financial instruments. The goal is to verify that borrowers understand leverage mechanics and liquidation risk.
3. Leverage Limits. The EBA proposes caps on borrowed amounts relative to collateral. The January 2025 joint report flagged excessive leverage and collateral reuse across transaction chains as systemic risks.
4. Enhanced Disclosures. Pre-contractual and ongoing disclosure requirements would apply to all crypto lending products, with additional obligations when the lending destination is a DeFi protocol. Information gaps for users were cited as a primary concern.
5. Stablecoin Lending Restrictions. Access to borrowing and lending involving asset-referenced tokens and e-money tokens requiring MiCA authorization may be restricted. MiCA prohibits issuers and CASPs from paying interest on EMTs and ARTs; the EBA flags that lending these tokens generates returns resembling interest, creating regulatory arbitrage.
6. DeFi Protocol Certification. The most structurally significant proposal: a certification regime for DeFi lending protocols. Under this framework, EU-licensed firms intermediating DeFi lending would only be permitted to connect to protocols meeting defined stability and compliance standards.
The DeFi lending market provides the empirical backdrop to the EBA's regulatory push. According to DefiLlama data, ten crypto lending platforms hold $44.14 billion — representing 88.5% of a $49.87 billion market spread across 637 protocols. The top five by TVL as of September 2026:
| Protocol | TVL (USD) | Market Share | |----------|-----------|-------------| | Aave V3 | $17.35B | ~35% | | Morpho Blue | $9.66B | ~19% | | Lido (liquid staking/lending) | ~$26.0B | — | | Compound | $2.08B | ~4% | | JustLend | >$1.0B | ~2% |
Aave crossed $1 trillion in cumulative lending volume in February 2026 — the first DeFi protocol to reach that milestone. CEO Stani Kulechov confirmed the figure publicly. Aave currently claims approximately 60-62% of the DeFi lending market share across 23 chains, with $25.59 billion supplied and $11.21 billion in active loans.
The broader DeFi ecosystem has contracted. Total value locked across all DeFi fell from $115 billion in January 2026 to approximately $70-94 billion by September — a decline of 18-39% depending on the measurement date. Ethereum holds $52.7 billion in TVL, Solana $6.2 billion, and Base $5.9 billion.
The crypto lending platform market overall was valued at $10.68 billion in 2025, projected to reach $12.69 billion in 2026 at a CAGR of 18.8%, according to Research and Markets.
The EBA's January 2025 joint report with ESMA found crypto borrowing and lending activity in at least 16 EU member states. The same report noted 13 protocols distributed 86% of the total market — a concentration level that introduces systemic risk through correlated liquidation cascades.
MiCA prohibits issuers and CASPs from paying interest on e-money tokens and asset-referenced tokens. The prohibition is designed to ensure stablecoins function as payment instruments, not deposit substitutes.
Lending creates a workaround. When a CASP routes client EMTs or ARTs into a lending protocol, the returns generated functionally resemble interest. The EBA identifies this as regulatory arbitrage: the interest ban applies to token issuers and service providers, but the lending protocols generating the yield are outside MiCA's jurisdiction.
The problem compounds with third-country stablecoin issuers. The EBA flagged multi-issuer stablecoin schemes originating outside the EU as posing "significant to very significant" risks. These tokens can be borrowed and lent through EU-licensed CASPs without triggering the interest prohibition, creating a parallel yield-bearing system invisible to regulators.
With 39 EMTs now authorized under MiCA and growing institutional interest in yield-generating strategies, the arbitrage channel is expanding rather than closing.
The EBA's proposal for a DeFi protocol certification regime is without direct precedent in EU financial regulation. Under the framework as described, crypto firms intermediating DeFi lending services would only be permitted to connect to protocols that meet defined stability and regulatory compliance standards.
The certification concept implicitly acknowledges that DeFi protocols are not regulated entities and cannot be directly supervised. Instead, the EBA targets the CASP-protocol interface: the regulated firm becomes the compliance checkpoint. A protocol that fails certification criteria would not become illegal — it would simply become inaccessible through licensed EU intermediaries.
This approach mirrors how traditional finance handles the regulated-unregulated boundary. Banks face restrictions on counterparty exposure to unregulated entities. MiFID II limits the venues through which investment firms can execute orders. The DeFi certification regime would create an analogous gatekeeping function.
The practical challenges are substantial. DeFi protocols are upgraded through governance votes, not corporate decisions. Smart contract risk profiles change with each deployment. Code audits provide point-in-time assessments, not ongoing assurance. How certification would handle protocol upgrades, governance attacks, or cross-chain deployments remains undefined.
The EBA noted that easier access to DeFi through crypto firms and AI tools is increasingly blurring the boundary between centralized and decentralized finance. The certification proposal is a direct response to that convergence.
The proposals, if adopted, would affect three categories of market participants:
CASPs offering lending. The 80+ firms that have secured MiCA licenses across the EU — a figure that doubled over recent months — would face additional compliance burdens. Adding lending to the regulated service list means license amendments, staffing for suitability assessments, disclosure infrastructure, and leverage monitoring systems. Smaller CASPs may exit lending entirely.
DeFi protocols with EU exposure. Protocols seeking certification would need to demonstrate compliance standards without having a corporate entity to bear the obligation. Aave, which launched its institutional product Aave Horizon in August 2026 specifically for regulated participants lending against tokenized real-world assets, is positioned ahead of competitors. Protocols lacking governance transparency or audit histories face exclusion from the EU market.
Institutional allocators. Galaxy Digital placed $100 million of DeFi yield on its balance sheet in September 2026. As more institutional capital flows through DeFi lending, regulatory clarity becomes a prerequisite for treasury allocation. The EBA's framework would provide that clarity — at the cost of reduced protocol choice and potentially compressed yields.
The Aave KelpDAO incident earlier in 2026, which saw Aave's TVL drop 46% from $26.4 billion to $14.3 billion in days, illustrates the systemic risk the EBA is targeting. Cascade liquidations across concentrated lending markets are precisely the scenario leverage limits and disclosure requirements are designed to mitigate.
The regulatory pathway from EBA recommendation to enforceable law involves multiple stages:
| Date | Event | |------|-------| | May 20, 2026 | EC launches targeted MiCA consultation (86 questions) | | June 29, 2026 | EC extends consultation deadline | | July 1, 2026 | MiCA transitional period expires for all CASPs | | September 24, 2026 | EBA publishes formal consultation response | | September 30, 2026 | Consultation closes | | June 30, 2027 | Commission reports due under Articles 140 and 142 | | 2027-2028 (est.) | Legislative proposal, if warranted | | 2028-2029 (est.) | Earliest possible enforcement of amended regulation |
The timeline suggests no regulatory changes before mid-2027 at the earliest. The Commission must first compile all consultation responses, produce its Article 142 report, and then decide whether to propose legislative amendments. Any proposal would require approval from the European Parliament and Council of the EU.
The EBA's September 24 consultation response marks the formal beginning of the EU's effort to extend MiCA into crypto lending and DeFi intermediation. The gap left by Recital 94 was intentional in 2023 — the data available then showed limited EU consumer engagement with crypto lending and no systemic risk. Two years later, the market has shifted: cumulative DeFi lending volume exceeds $1 trillion on Aave alone, 16 member states report intermediated crypto lending activity, and AI-powered tools are making DeFi protocols accessible to users who may not understand the risks they are taking.
The certification proposal for DeFi protocols is the most structurally significant element. It creates a regulatory category for code-governed financial infrastructure without attempting to regulate the code itself — a pragmatic approach that acknowledges both the immutability of deployed smart contracts and the supervisory need for quality standards.
Whether the Commission will adopt the EBA's recommendations in full, in part, or not at all remains an open question. The consultation closes in six days. The Commission's report is due by June 30, 2027. Between now and then, the crypto lending market will continue operating in the gap between what MiCA regulates and what the EBA believes it should.