The European Securities and Markets Authority on September 30 submitted six proposals to expand the Markets in Crypto-Assets Regulation, targeting DeFi access providers, staking, lending, influencer marketing, non-compliant stablecoins, and cross-border enforcement. The proposals, filed in respon...
"Disappointed by the European Central Bank's and European Banking Authority's responses to the MiCA consultation." — Stani Kulechov, Founder, Aave
The European Securities and Markets Authority on September 30 submitted six proposals to expand the Markets in Crypto-Assets Regulation, targeting DeFi access providers, staking, lending, influencer marketing, non-compliant stablecoins, and cross-border enforcement. The proposals, filed in response to the European Commission's 86-question public consultation, represent the most detailed attempt by an EU supervisory body to extend regulated-service requirements to the interface layer between centralized finance and permissionless protocols.
ESMA's approach stops short of regulating smart contracts directly. Instead, it proposes a new licensable crypto-asset service category for firms that route users into DeFi — web interfaces, self-custody wallets, and centralized aggregators. Only 281 of 1,343 monitored EEA crypto service providers obtained MiCA authorization before the July 1, 2026, transition deadline. The remaining 1,062 were forced to exit, restructure, or transfer customers. Expanding the perimeter to DeFi gateways would widen the compliance burden further at a time when the industry is still absorbing the first wave of MiCA enforcement.
Industry response was immediate. Circle, Aave Labs, the Hyperliquid Policy Center, and more than 50,000 EU citizens filed submissions before the September 30 deadline. The consultation responses will inform reports due under MiCA Articles 140 and 142 by June 30, 2027, which may include a legislative proposal.
ESMA's submission (reference ESMA75-113276571-1721) outlines six discrete changes to MiCA:
1. Influencer marketing controls. Stricter requirements for crypto-asset marketing where products are promoted by influencers and third parties. Paid endorsements would need to be recognizable as advertising. MiCA currently targets authorized providers, leaving third-party promoters largely unregulated.
2. Disclosure duties for staking, lending, and borrowing. Proportionate requirements including written information on costs, risks, returns, collateralization, and potential losses before investors commit funds.
3. A new licensable service for DeFi protocol access. Firms giving users access to DeFi protocols — via interfaces, transaction routing, or other customer-facing services — would require explicit authorization.
4. Supervisory powers to block fraud and freeze assets. Authority to detect, block, and deactivate fraudulent websites and freeze crypto-assets where market abuse or terrorist financing is suspected.
5. Tightened controls on reverse solicitation. Strengthened powers over third-country firms that approach EU investors without MiCA authorization.
6. Explicit ban on non-compliant stablecoin services. Regulated crypto firms would be prohibited from offering services around stablecoins that do not meet MiCA requirements.
These are advisory proposals, not formal amendments. No implementation timeline has been set.
ESMA's most consequential proposal is the creation of a new regulated crypto-asset service for DeFi access providers. The regulator stated that the DeFi exemption in MiCA "should be as narrow as possible to avoid being used as a way of circumventing the application of the MiCA regime."
The distinction matters. DeFi represents approximately 4% of the global crypto-asset market value, according to ESMA's assessment. Decentralized exchanges account for roughly 10% of global crypto trading volume. Total DeFi value locked reached $95.42 billion at the end of Q3 2026, up 37.9% from June 30, according to industry data.
ESMA's framework targets three categories of access providers: application interfaces (front-ends), self-custody wallets with integrated DeFi access, and centralized platforms that route transactions to decentralized protocols. The proposal would require these entities to obtain MiCA authorization, meet conduct requirements, and implement investor-protection measures.
The proposal also asks ESMA be granted binding opinion authority on token classification, addressing the hybrid-token problem where assets straddle multiple regulatory categories. This would centralize interpretive authority at the EU level rather than leaving classification to 27 national regulators.
ESMA recognized a regulatory gap. Staking is a core technical function of proof-of-stake networks, and the regulator acknowledged it should not automatically be treated as lending or portfolio management. However, intermediary staking arrangements — where a service provider pools user assets and distributes rewards — present investor-protection risks that MiCA does not currently address.
The proposed framework would place intermediary staking and lending products inside a common EU regulatory perimeter. Service providers would face disclosure obligations covering: the nature of the service, fee structures, risk of loss (including slashing risk for staking), collateral arrangements for lending, and the terms under which assets can be withdrawn.
The European Banking Authority, in a separate submission filed September 24, went further. The EBA urged the Commission to bring crypto borrowing and lending inside MiCA as a fully regulated service, not merely subject to disclosure requirements.
This creates a two-tier regulatory pressure: ESMA pushing for proportionate conduct rules, the EBA pushing for full service-level regulation. The Commission will need to reconcile both positions.
The most contested element of the MiCA review is not in ESMA's proposals but in the ECB and EBA's parallel submissions: extending MiCA's existing ban on stablecoin yield to cover indirect returns through lending, borrowing, and staking.
Under current MiCA rules, e-money token issuers cannot pay interest directly to holders. The ECB and EBA want to close the loop by preventing authorized crypto-asset service providers from offering yield on stablecoins through DeFi protocols — effectively blocking the on-ramp from compliant services to non-custodial yield.
The Stand With Crypto EU advocacy group reported that more than 50,000 people across the bloc emailed the Commission asking it to permit regulated stablecoins to offer rewards, cashback, and lower fees. A separate petition gathered over 126,600 signatures calling for the yield ban to be dropped entirely, provided the stablecoin is backed by safe, interest-bearing assets.
Circle, in its October 1 policy submission, called for changes covering cross-border issuance, reserve assets, and recognition of foreign-regulated stablecoins. The company noted that only three of the top 30 global stablecoins currently meet MiCA standards. Circle also asked policymakers to reconsider the requirement that e-money token issuers keep at least 30% of backing assets in commercial bank deposits, arguing mandatory deposits expose issuers to banking risks. Circle cited its own experience when $3.3 billion of USDC reserves became trapped during the Silicon Valley Bank collapse in 2023.
The consultation deadline produced a wave of detailed industry responses.
Aave Labs, which operates as a MiCA-authorized service provider, submitted its formal response on September 30. Founder Stani Kulechov posted on X on October 2 that he was "disappointed" by the ECB and EBA positions. He warned that proposals including suitability tests and potential certification for DeFi lending protocols risk creating "walled gardens" that would undermine open financial networks. Kulechov stated: "It is unclear how these requirements would work in practice." He concluded: "DeFi will win."
Hyperliquid Policy Center took a different approach, urging the Commission to treat crypto perpetual futures as derivatives under MiFID II — the EU's existing financial instruments rulebook — rather than expand MiCA to cover them. This reflects an emerging industry argument that existing securities law, not crypto-specific regulation, should govern financial products built on blockchain infrastructure.
Circle pushed for multi-issuance frameworks that would allow globally circulating stablecoins to be issued through both EU-authorized and foreign-regulated entities, an arrangement that would effectively preserve the competitive position of USDC and similar assets operating across multiple jurisdictions.
The divergence is notable. Aave argues for minimal DeFi regulation. Hyperliquid wants existing financial regulation applied rather than new crypto-specific rules. Circle seeks practical accommodations within MiCA's existing framework. None of the three accept ESMA's proposals at face value.
The ESMA proposals land in the context of MiCA's first full quarter of enforcement.
Before MiCA, more than 3,000 crypto service providers operated across Europe. As of September 28, 2026, 359 firms hold MiCA authorization in the ESMA CASP register, according to tracker data. Germany leads with 56 authorizations, followed by the Netherlands (26), France (21), Malta (15), Cyprus (13), and Ireland (12).
The compliance cliff has measurable effects. Ethereum-based DeFi applications lost an estimated 15% of their European user base, according to industry surveys, with users migrating to more permissive jurisdictions. DeFi platforms saw a 16% drop in usage across the EU. Over 47% of DeFi projects in Europe have transitioned to fully decentralized governance models to avoid MiCA enforcement — a regulatory arbitrage that ESMA's gateway proposal is explicitly designed to close.
DeFi TVL globally rose 37.9% in Q3 to $95.42 billion. Ethereum's share climbed from $37.35 billion to $53.54 billion as ETH rose 67% during the quarter, representing 56.1% of total DeFi TVL. The question is how much of this growth will remain accessible to European users if ESMA's proposals advance.
The European Commission has until June 30, 2027, to deliver its MiCA review reports under Articles 140 and 142. These reports may — but are not required to — include legislative proposals.
The path from ESMA advisory opinion to binding law runs through the Commission, the European Parliament, and the Council of the EU. Even if the Commission accepts ESMA's recommendations in full, legislative passage would take 12-24 months under standard procedures, placing any binding DeFi gateway requirements no earlier than mid-2028.
In the interim, national regulators retain discretion over enforcement. The 27 EEA member states have shown divergent approaches to DeFi supervision, which is one reason ESMA is seeking binding opinion authority on token classification.
The parallel U.S. regulatory track adds a competitive dimension. The SEC's recent self-custody proposal for fund advisers and the passage of the GENIUS Act stablecoin framework represent a different regulatory model — one that several MiCA consultation respondents explicitly referenced as more accommodating.
ESMA's six proposals represent a methodical attempt to extend MiCA's regulatory perimeter without triggering the jurisdictional impasse of trying to regulate permissionless protocols directly. The gateway approach — licensing the on-ramp rather than the destination — has a clearer enforcement path than alternatives. Whether it addresses the underlying economic activity or merely pushes it to unregulated access points is the open question.
The industry's fragmented response reveals no unified position. Stablecoin issuers, DeFi protocols, and derivatives platforms each want different outcomes, which may give the Commission room to pick a middle path. The 47% of European DeFi projects that restructured into fully decentralized governance to avoid MiCA enforcement suggest that regulatory arbitrage is already well advanced.
The data points to a structural tension. MiCA's first 90 days reduced the number of operating European crypto firms by roughly 88% — from 3,000+ to 359 authorized providers. Expanding the perimeter to DeFi gateways would compound the compliance load. Whether the resulting market looks more like "investor protection" or "financial exclusion" depends on where the Commission draws the line when its Article 140 and 142 reports come due in June 2027.