France's four principal financial regulators — the Treasury, Financial Markets Authority (AMF), Banque de France, and Prudential Supervision and Resolution Authority (ACPR) — on October 21, 2026, filed a joint submission to the European Commission proposing that crypto-asset service providers (CA...
"A harmonised EU framework based on due diligence, certification, verified liquidity and ongoing monitoring is preferable to a blanket prohibition." — French Treasury, AMF, Banque de France, and ACPR Joint Submission
France's four principal financial regulators — the Treasury, Financial Markets Authority (AMF), Banque de France, and Prudential Supervision and Resolution Authority (ACPR) — on October 21, 2026, filed a joint submission to the European Commission proposing that crypto-asset service providers (CASPs) bear legal liability for losses sustained by customers who access decentralized finance protocols through their platforms. The proposal, submitted as part of the MiCA regulation review consultation that closed September 30, 2026, would require exchanges to vet DeFi protocols before offering access, conduct ongoing monitoring for vulnerabilities, and support an independent certification regime for smart contracts.
The submission does not carry the force of law. It is one of dozens of responses to the Commission's targeted consultation, alongside filings from ESMA, the EBA, and the ESCB. But France's proposal is the most prescriptive DeFi framework to emerge from any EU member state to date, and it arrives at a moment when the bloc is deciding whether to regulate decentralized protocols by regulating the intermediaries that connect retail users to them.
With 377 CASPs now licensed under MiCA across 27 EEA states — down from over 3,000 pre-regulation operators — the proposal would add a new compliance layer to an industry already absorbing significant regulatory cost. The European Commission must report to EU lawmakers by June 30, 2027, and may include legislative proposals to amend MiCA at that time.
France's joint submission rests on three interlocking obligations for licensed crypto platforms.
Pillar 1: Due Diligence and Ongoing Monitoring. CASPs that connect customers to DeFi protocols would be required to assess those protocols before offering access. The assessment scope includes smart contract vulnerabilities, audit history, past security incidents, governance structure, liquidity risks, oracle dependencies, bridge exposures, and potential connections to illicit funds via blockchain analytics. Platforms must continue monitoring protocols after initial listing. The requirements scale: significant CASPs face full obligations, while smaller providers face proportionate versions.
Pillar 2: Protocol Certification. The proposal calls for an independent certification scheme that would issue three-year certificates recorded onchain. Only protocols above a significance threshold — and those claiming full decentralization — would require certification. Platforms may still offer access to uncertified protocols if they conduct independent assessments and provide enhanced risk disclosures, including mandatory pop-up warnings informing users that protocols are unregulated.
Pillar 3: CASP Liability. The core sentence in the filing reads: "CASPs should be liable for certain incidents affecting clients where they actively facilitated access, particularly if they failed to perform adequate due diligence" or ignored known vulnerabilities. This is not a blanket compensation guarantee. The proposal does not establish automatic restitution for every DeFi exploit. Liability attaches where the platform facilitated access and where adequate checks could have identified the security problem before customer exposure.
MiCA reached full enforcement on July 1, 2026. The regulation covers crypto-asset issuance, stablecoins, and the authorization of service providers. It does not cover decentralized finance. Article 22 of MiCA explicitly exempts crypto-asset services provided in a "fully decentralised manner without any intermediary." This exemption was always understood as temporary. The regulation included a mandate for the Commission to review its scope by mid-2027.
The gap is material. DeFi total value locked stood at approximately $88.6 billion as of October 18, 2026, according to DefiLlama. DeFi lending TVL alone reached $56 billion by mid-October, up 55% from its July 2026 low. These are markets that MiCA currently does not reach, but that MiCA-licensed CASPs routinely connect their customers to.
Meanwhile, the number of licensed operators has compressed sharply. Before MiCA, more than 3,000 crypto service providers operated across Europe. As of October 19, 2026, only 377 hold CASP authorization in the ESMA register. Crypto-native firms account for 59% of licenses (223 firms), with traditional finance firms holding 41% (154 firms). The most common firm types are crypto brokers (63), crypto exchanges (52), and investment firms (43).
The French regulators' argument is straightforward: if licensed intermediaries are the gateway through which EU retail users access DeFi, then those intermediaries should bear responsibility for what they connect users to.
France is not the only authority pushing for DeFi oversight. The European Commission opened its MiCA review consultation on May 20, 2026, with a deadline of September 30 (extended from August 31). The consultation posed 86 questions, including several on DeFi and the scope of the decentralization exemption.
ESMA filed its response on September 30. The regulator recommended creating a new regulated crypto-asset service category for firms providing access to DeFi protocols. ESMA noted "divergence of views in the EU regarding the notion of full decentralisation" and argued the exemption "should be as narrow as possible to avoid being used as a way of circumventing the application of the MiCA regime."
The EBA, filing on September 24, urged the Commission to bring crypto borrowing and lending inside MiCA as a regulated service. The ESCB (European System of Central Banks) submitted its own response supporting expanded scope.
France's filing goes further than ESMA's in one key respect: it proposes direct liability for CASPs, not merely a new license category. Where ESMA wants a new service type that would require authorization, France wants authorized CASPs to face financial consequences for inadequate due diligence on the protocols they offer.
ESMA Chair Verena Ross has signaled broader priorities. In a June 2026 speech, she stated: "We want innovation to flourish within a framework that provides clarity for firms, safeguards for investors and confidence in the markets." ESMA's 2027 work program emphasizes shifting MiCA oversight "from rulemaking towards supervision and convergence."
The compliance cost structure of France's proposal is layered. Protocol assessment requires security expertise — smart contract auditors, blockchain analysts, and ongoing monitoring infrastructure. For significant CASPs, the proposal implies dedicated teams evaluating DeFi protocols before listing and continuous surveillance after.
This creates economies of scale that favor larger exchanges. A platform with 50 employees and a single compliance officer would struggle to maintain the proposed assessment cadence. A platform with 500 employees and a dedicated security research division would not. The likely outcome, if adopted, is a narrowing of DeFi access points. Smaller CASPs would either limit DeFi offerings or exit the market for DeFi connectivity entirely.
The certification requirement adds another cost layer. While the French proposal does not specify who would operate the certification body, onchain recording of three-year certificates implies infrastructure development and audit costs that would ultimately be borne by protocols seeking certification or by CASPs paying for independent assessments when connecting to uncertified protocols.
For DeFi protocols themselves, the incentive structure shifts. Protocols seeking distribution through EU-licensed exchanges would benefit from obtaining certification, as it reduces the compliance burden on their CASP partners. Protocols that do not seek certification remain accessible, but only through CASPs willing to shoulder the full due diligence burden and associated liability.
The data supporting some form of intermediary responsibility is substantial. DeFi hacks in 2026 have exceeded $1.3 billion through mid-year. Compromised private keys overtook smart contract bugs as the leading attack vector for the first time on record, accounting for 72% of losses. The two largest incidents — the Drift Protocol exploit ($285 million, April 1) and the KelpDAO exploit ($290 million, April 18) — together represented over $575 million, or roughly 44% of all stolen funds.
North Korea's Lazarus Group, specifically its TraderTraitor subunit, has been attributed to at least $575 million in 2026 DeFi losses, according to multiple security firms.
The French regulators' implicit argument: a platform that connects a retail user to a protocol with known vulnerabilities, insufficient audits, or links to illicit fund flows bears some responsibility for the outcome. This mirrors traditional financial regulation, where brokers face liability for recommending unsuitable products.
The counterargument is also clear. DeFi protocols are open-source and permissionless. A CASP cannot control a protocol's codebase or governance decisions after listing. Liability for events outside a platform's control introduces moral hazard and may push CASPs to whitelist only a narrow set of well-capitalized protocols, reducing user choice.
Several elements are notably absent from the submission.
No mandatory wallet certification. The French authorities explicitly oppose mandatory certification for developers of non-custodial or self-custodial wallets. They support voluntary certification only for advanced wallets that integrate DeFi services. This preserves the self-custody principle.
No ban on DeFi access. The submission explicitly favors a "harmonised EU framework" over prohibition. Platforms can still connect users to uncertified protocols under enhanced disclosure.
No direct regulation of protocols. The proposal targets intermediaries, not protocols themselves. It does not attempt to impose KYC, AML, or licensing requirements on decentralized protocol governance or smart contract developers.
No change to the ART framework. The submission notes that no asset-referenced tokens (ARTs) have been authorized under MiCA and recommends reviewing whether the category should be eliminated or merged with existing e-money frameworks. But this is a separate track from the DeFi proposal.
France's joint filing represents the most detailed attempt by an EU member state to close MiCA's DeFi gap through intermediary liability rather than direct protocol regulation. The economic logic is straightforward: if 377 licensed CASPs are the primary gateway for EU retail users to access $88.6 billion in DeFi TVL, those gatekeepers should bear due diligence obligations comparable to what they face for centralized asset listings.
Whether the European Commission adopts France's approach, ESMA's lighter-touch license model, or some hybrid will not be known until mid-2027 at the earliest. What is clear is that the regulatory consensus across ESMA, the EBA, the ESCB, and France has converged on a single principle: the MiCA decentralization exemption must narrow. The question is no longer whether CASPs will face DeFi-related obligations, but how broad those obligations will be and who bears the cost when things go wrong.