France Wants DeFi Gatekeepers Accountable Under MiCA

France wants the European Union to reconsider who is responsible when people lose money through decentralized finance, particularly when a regulated cryptocurrency business helped them access the protocol.

In proposals published on October 20 and publicly presented by the French financial authorities on October 21, 2026, regulators called for changes to the EU’s Markets in Crypto-Assets Regulation, better known as MiCA.

The recommendations would introduce clearer responsibilities for intermediaries connecting customers to DeFi services, encourage independent certification of smart contracts, and establish more explicit obligations for reviewing the risks of decentralized protocols.

Most significantly, France argues that regulated crypto-asset service providers could face liability for certain customer losses when they facilitate access to a DeFi protocol without conducting adequate due diligence or fail to respond to known security problems.

That is a different approach from simply attempting to regulate every decentralized smart contract as though it were a traditional financial institution.

The proposal recognizes that some DeFi systems operate without an identifiable central controller. But it also questions whether businesses that recommend, integrate, distribute, or provide access to those systems should be able to avoid responsibility for the services they offer customers.

The central issue is not whether decentralized finance should be regulated like a bank. It is where responsibility begins when a regulated business connects customers to financial software that no single institution controls.

France is not introducing an immediately enforceable EU-wide DeFi liability regime. The recommendations form part of a response to a European Commission consultation on reviewing MiCA, which closed on September 30.

Any significant change would require further legislative and regulatory action.

Nevertheless, the French submission provides one of the clearest indications of how European authorities are considering the next stage of cryptocurrency regulation.

It also raises difficult questions about security certification, open-source development, wallet interfaces, permissionless liquidity, and who should compensate users when DeFi transactions go wrong.

Key Takeaways

• Four French authorities have proposed changes to MiCA. The French Treasury, AMF, Banque de France, and ACPR published joint recommendations addressing DeFi, staking, crypto lending, stablecoins, and regulatory supervision.
• The proposals focus on identifiable intermediaries. Regulated crypto businesses that actively connect clients to DeFi protocols could face stronger due-diligence, monitoring, and disclosure obligations.
• Intermediary liability would not be automatic for every DeFi loss. The French proposal emphasizes incidents where a provider failed to investigate risks, ignored known vulnerabilities, or maintained access despite serious warning signs.
• Smart-contract certification could become part of the framework. France supports proportionate certification of certain protocols, but its detailed submission does not support a universal ban on access to uncertified DeFi applications.
• Genuinely decentralized protocols would be treated differently from centrally controlled services. The authorities favor examining actual control, governance concentration, and operational influence rather than relying on a project’s claim to be decentralized.
• Staking and crypto lending need clearer rules. The proposal addresses collateral, lock-up periods, slashing, remuneration, customer disclosures, and potential conflicts of interest.
• No new EU-wide DeFi law has been approved. The recommendations are part of the policy review process and should not be presented as obligations already imposed on all DeFi developers or users.

What France Actually Proposed

The French submission was prepared jointly by four institutions:

• The Direction Générale du Trésor, France’s Treasury.
• The Autorité des Marchés Financiers (AMF), the country’s financial markets regulator.
• The Banque de France, its central bank.
• The Autorité de Contrôle Prudentiel et de Résolution (ACPR), the prudential and resolution supervisor.

The institutions responded to the European Commission’s consultation on whether MiCA remains appropriate following its initial implementation and subsequent developments in digital finance.

The consultation opened on May 20, 2026, and closed on September 30.

France’s response extends beyond DeFi. It also recommends adjustments to stablecoin regulation, financial-instrument classification, cross-border supervision, and the relationship between cryptocurrency and existing financial-services legislation.

But the DeFi provisions are especially important because they address activities that do not fit neatly into the conventional model of a financial service operated by an identifiable institution.

Three pillars for DeFi access

The French authorities propose that access to genuinely decentralized protocols through regulated crypto intermediaries should be supported by three principal safeguards.

First, due diligence and ongoing monitoring. Before giving customers access, an intermediary should evaluate relevant technical, financial, governance, and operational risks. Its responsibility should continue after the initial assessment.

Second, protocol certification. Independent assessment could provide additional assurance that selected DeFi systems meet appropriate security and operational standards.

Third, proportionate liability. Intermediaries that actively facilitate access could be accountable for certain losses arising from failures within their own responsibilities.

The proposal does not simply demand a license for every open-source smart contract.

It attempts to identify where regulated financial businesses participate in the delivery of decentralized services and what duties should follow from that participation.

Existing rules versus proposed changes

MiCA Today vs France's Proposed DeFi Changes

Area	Current Position	French Proposal
Fully decentralized services	MiCA recital 22 recognizes activities provided entirely without intermediaries as outside its scope	Clarify how genuine decentralization is assessed and how regulated access points are treated
Regulated DeFi access	Existing CASP obligations apply according to the services actually provided	Introduce more explicit protocol due diligence, monitoring and responsibility
Protocol certification	No universal MiCA certification requirement for all DeFi protocols	Develop proportionate independent certification for relevant protocols
DeFi-related customer losses	Existing legal and contractual responsibilities depend on the activity and circumstances	Clarify liability for certain incidents involving failures by intermediaries
Staking services	Regulatory treatment depends on the structure and services involved	Establish more specific transparency and safeguarding requirements
Crypto lending and borrowing	Not comprehensively covered as dedicated services under MiCA	Introduce targeted duties for regulated intermediaries offering or facilitating them

These differences are central to the story.

The authorities are asking the European Union to develop a more complete framework. They have not established that every decentralized exchange, lending protocol, or cryptocurrency wallet must obtain certification immediately.

Why DeFi Creates a Regulatory Problem for MiCA

Decentralized finance, or DeFi, refers to financial services implemented partly or wholly through blockchain-based applications and smart contracts.

These services can include token exchanges, lending, borrowing, collateral management, derivatives, and liquidity provision.

A smart contract is software deployed on a blockchain that executes specified operations when its conditions are satisfied.

For example, a lending protocol may automatically release collateral or calculate an amount owed using predefined rules.

Unlike a conventional bank, the protocol may operate without employees approving each transaction.

But the absence of manual approval does not necessarily mean that no one exercises control over the service.

A development team might retain the ability to upgrade contracts.

A foundation might control important governance decisions.

A small group of token holders might determine fees or protocol parameters.

An identifiable company might operate the main website through which customers access the application.

These arrangements can create financial services that are technologically decentralized in some respects while remaining centrally influenced in others.

What MiCA currently says about decentralization

MiCA was adopted in 2023 and began applying in stages during 2024.

It introduced EU-wide rules for covered crypto-asset issuers and crypto-asset service providers, commonly abbreviated CASPs.

A CASP is a business providing specified crypto-asset services professionally under the relevant regulatory framework.

MiCA recital 22 recognizes that services performed entirely in a decentralized manner without any intermediary should fall outside the regulation’s scope.

However, the recital also addresses activities performed or controlled directly or indirectly by identifiable persons, including when only part of the activity is decentralized.

That distinction is crucial.

MiCA does not establish that attaching the label “DeFi” to a product automatically exempts an identifiable operator from applicable financial regulation.

Nor does it mean that every individual using a genuinely decentralized protocol automatically becomes a regulated service provider.

The legal analysis depends on the actual activity and the persons involved.

Our earlier article on what decentralization means under crypto regulation examines this distinction in more detail.

Why the existing boundary is difficult to apply

Consider a decentralized lending protocol with immutable contracts and no active administrator.

Users might access those contracts directly through blockchain transactions.

Now imagine a licensed exchange adds a button allowing customers to deposit funds into the same protocol.

The underlying contracts remain unchanged.

But the exchange has introduced a new commercial relationship.

It may select the protocol, display expected returns, charge fees, integrate wallets, and communicate risk information to customers.

Should the exchange’s regulated status affect its responsibilities when something goes wrong?

France’s answer is that active facilitation should carry meaningful obligations.

The protocol’s decentralization should not automatically remove responsibility from an identifiable business that chooses to offer the service to its customers.

That does not mean the exchange must guarantee every investment result.

It means the exchange’s own conduct deserves scrutiny.

What Counts as a DeFi Gatekeeper?

The term gatekeeper is useful editorial shorthand, not a new legal category formally established by France’s proposal.

It describes an intermediary that influences how users reach a decentralized service.

Different types of gatekeepers can exercise different powers.

A centralized exchange might integrate a lending protocol directly into its application.

A wallet provider might offer built-in swaps or staking options.

An investment platform might recommend particular yield strategies.

An institutional custodian might connect clients to a liquidity protocol.

These activities are not automatically subject to identical regulation.

The relevant issue is what service the business actually provides.

Access is different from control

A software interface can make a decentralized protocol easier to use without necessarily controlling its underlying smart contracts.

A protocol operator may control administrative functions without providing a consumer-facing wallet.

A licensed exchange may both provide access and manage customer assets.

These are separate roles.

France’s detailed submission emphasizes effective control, including the ability to upgrade, pause, or modify important functions.

It also considers governance concentration, management of user interfaces, control over critical infrastructure, financial benefits, and the ability to restrict access.

No single factor should automatically determine whether a protocol is genuinely decentralized.

For example, the existence of a website does not prove that its operator can alter the underlying blockchain contracts.

Likewise, having thousands of governance-token holders does not prove meaningful decentralization if a small group controls most voting power.

Who Might Be Responsible in a DeFi Transaction?

Participant	Role	Regulatory Question
Direct protocol user	Signs transactions with a self-custody wallet	No automatic regulated intermediary merely because a blockchain is used
Regulated crypto exchange	Offers customers a DeFi product or connection	Potential duties arising from active facilitation and existing regulated activities
Wallet application provider	Provides a wallet interface or embedded protocol integration	Treatment depends on its actual activities, control and relationship with users
Protocol operator	Controls critical contracts, administration or service functions	May already fall within applicable regulation where identifiable services are provided
Independent open-source developer	Publishes code without necessarily controlling a live service	Not automatically equivalent to operating a regulated financial intermediary
Protocol certifier	Evaluates code or system properties against defined standards	Certification scope and responsibility would need explicit rules

The practical difficulty is that one DeFi service can involve several of these participants simultaneously.

Assigning responsibility requires understanding what each party actually controls and promises to customers.

France Wants More Than DeFi Risk Warnings

One of the clearest recommendations concerns due diligence by regulated intermediaries.

A provider would not necessarily satisfy its responsibilities merely by presenting a generic warning that cryptocurrency investments are risky.

The French authorities argue that an intermediary should investigate the actual protocol being offered.

That includes the technical infrastructure, governance structure, liquidity conditions, and known vulnerabilities.

The proposal also calls for ongoing monitoring rather than treating the initial assessment as a permanent assurance of safety.

What a meaningful review could involve

France identifies several relevant areas:

• Smart-contract vulnerabilities, security audits, and previous incidents.
• Governance arrangements and operational control.
• Liquidity conditions and risks involving external price data.
• Bridges and other systems connecting blockchain networks.
• Operational resilience and critical dependencies.
• Exposure to illicit activity identified through appropriate blockchain analysis.
• Conflicts of interest and the clarity of information provided to customers.

The assessment would need to be proportionate to the intermediary and the relevant protocol.

A complex cross-chain lending service may require different technical scrutiny from a simpler system with limited functionality and fewer external dependencies.

Why monitoring must continue after integration

A protocol that appears relatively safe when first reviewed can change.

Administrators may upgrade contracts.

Governance participants may adjust collateral requirements.

A liquidity provider may withdraw substantial funds.

An external oracle may become unreliable.

New vulnerabilities may be discovered in connected infrastructure.

The proposed approach would expect intermediaries to respond to relevant developments instead of relying indefinitely on an earlier assessment.

This raises operational questions.

Who performs the monitoring?

How quickly must providers respond?

What evidence is sufficient to restrict customer access?

When should a warning become a suspension?

Those details have not been finalized.

But they could substantially affect how regulated companies integrate DeFi products.

Could an Exchange Be Liable for a DeFi Hack?

This is the proposal’s most consequential question.

France supports liability for certain incidents affecting clients when regulated intermediaries actively facilitated access and failed to meet appropriate responsibilities.

Examples include failing to conduct adequate due diligence, ignoring known vulnerabilities, or continuing to provide access despite serious operational weaknesses or evidence of illicit activity.

The proposal does not establish automatic compensation whenever a decentralized protocol loses money.

That distinction matters.

Example: a known vulnerability

Imagine a regulated crypto platform integrates a DeFi lending protocol.

Security researchers subsequently publish credible evidence of a vulnerability that could allow collateral to be withdrawn improperly.

The platform receives the warning but continues promoting deposits without meaningful review or appropriate customer communication.

Users then lose assets because the known vulnerability is exploited.

Under the approach proposed by France, the platform’s failure to respond could become relevant when assessing its responsibility.

The underlying smart contract may have caused the immediate loss.

But the regulated intermediary’s conduct might also have contributed to customer exposure.

That is the kind of relationship France wants European rules to address more clearly.

Example: an unknown vulnerability

Now consider a different situation.

A platform conducts a reasonable review, uses an appropriately assessed protocol, provides accurate risk disclosures, and continues monitoring relevant developments.

An attacker later exploits a previously unknown vulnerability that a proportionate review could not reasonably have identified.

The mere occurrence of a loss would not automatically establish that the intermediary violated its duties.

The circumstances would require legal assessment.

Relevant questions could include what the intermediary knew, what it should reasonably have discovered, which obligations applied, and whether any failure caused or contributed to the loss.

The difference is between responsibility for deficient conduct and a guarantee against all possible financial outcomes.

What about ordinary trading losses?

Not every DeFi loss results from a security failure.

A borrower may be liquidated because collateral loses value.

A liquidity provider may experience losses relative to simply holding the deposited assets.

A token may decline sharply because market demand changes.

These outcomes can occur even when a protocol operates according to its published rules.

They should not automatically create liability for an intermediary.

However, misleading descriptions, inadequate disclosures, or conflicts of interest could create separate questions about the intermediary’s conduct.

When Could DeFi Intermediary Responsibility Become Relevant?

Scenario	What Happened	Key Distinction
Known vulnerability ignored	An intermediary continues promoting access despite credible warnings	Potential failure of proposed monitoring and due-diligence duties
Previously unknown vulnerability	A protocol fails despite proportionate review and monitoring	Liability would require case-specific legal analysis
Market price collapse	Collateral falls in value and a user is liquidated under disclosed rules	Not automatically evidence of intermediary misconduct
Misleading product description	A provider presents a risky investment as protected or guaranteed	May raise existing and proposed disclosure or conduct issues
Direct permissionless use	A user interacts with a protocol without an identifiable intermediary	No automatic CASP responsibility merely because a transaction occurred

The eventual liability framework would need to define the relevant obligations, standards of care, causation requirements, remedies, and limits.

France’s submission identifies the direction of reform but does not resolve every one of those questions.

Our earlier reporting on emergency intervention after a DeFi security incident examines how the ability to intervene and the responsibility to protect users can create difficult technical and governance decisions.

France Proposes Smart-Contract Certification, but Not a Universal Ban

The French authorities also want an independent certification framework for certain DeFi protocols and smart contracts.

Certification would involve assessing whether a system meets defined technical and operational criteria.

The objective would be to provide more structured information about protocol safety and functionality.

This is more ambitious than simply requiring a project to publish a security-audit report.

But certification should not be confused with government insurance or a guarantee that users cannot lose funds.

How the certification system might work

France’s detailed submission favors an approach led initially by private-sector certification and assessment against public standards.

The authorities envisage public institutions setting standards and supervising the certification ecosystem rather than performing every technical assessment themselves.

The submission also discusses codebase-level certification, possible three-year validity, and recording certification information onchain.

Those are proposed design features, not elements of an operational EU certification regime already established by law.

The authorities suggest that certification requirements could focus on genuinely decentralized protocols reaching a certain level of significance.

Total value locked, often abbreviated TVL, is one possible measure, although the submission recognizes that other indicators of activity or risk may also matter.

A protocol with substantial activity could present greater consequences if a critical defect affects many users.

However, a smaller protocol is not necessarily safe merely because its total value locked is low.

The important exception for uncertified protocols

The French submission contains a particularly important qualification.

Although it generally favors certification before intermediaries provide access, it does not support a blanket prohibition on regulated businesses connecting customers to uncertified protocols.

The detailed response allows for access subject to the intermediary’s own due diligence and enhanced disclosures.

That position attempts to balance investor protection with the ability to reach innovative and globally accessible services.

It also recognizes that universal mandatory certification could create unnecessary barriers for smaller projects or new development.

The distinction should not be lost when summarizing the proposal.

France supports stronger certification and accountability, but it has not recommended that every uncertified smart contract immediately become inaccessible to European users.

Can certification guarantee DeFi safety?

No.

Certification can provide evidence that specified properties were examined against defined standards at a particular time.

It cannot establish that every economic, governance, operational, or market risk has disappeared.

What DeFi Protocol Certification Could and Could Not Protect

Risk Area	Potential Certification Value	Remaining Limitation
Known code vulnerabilities	Assessment against defined security standards and known weaknesses	Cannot guarantee discovery of every future or unknown exploit
Documented functionality	Review whether code behaves as specified within the assessment scope	Cannot guarantee every economic outcome
Access controls	Assessment of privileged functions and relevant governance mechanisms	Cannot guarantee future administrators act appropriately
Oracle dependencies	Identify dependencies and examine relevant failure protections	Cannot guarantee external price data always remains accurate
Liquidity and market risks	Identify relevant design assumptions and risk controls	Cannot guarantee adequate liquidity during a market crisis
Future upgrades	Document assessed code and applicable version	Cannot automatically certify materially changed code or configuration

One particularly difficult question concerns upgrades.

If a protocol receives certification and subsequently changes its contracts, the previous assessment may no longer cover the deployed system.

Even unchanged code can behave differently when external dependencies, configurations, or economic conditions change.

A meaningful certification system would therefore need clear rules concerning scope, versioning, material changes, and reassessment.

Why earlier French research matters

This proposal did not appear without preparation.

An ACPR-AMF working group began examining smart-contract certification in 2024.

It published findings for consultation in February 2025, followed by a summary of industry responses in July 2025.

That work addressed the technical and operational issues involved in evaluating decentralized financial software.

The October 2026 recommendations build on that earlier research.

However, working-group findings, consultation responses, and legally binding technical standards are different stages of policymaking.

The existence of an earlier report does not mean a European certification authority has already been established.

Why the Proposal Matters for Non-Custodial Wallets

Wallet applications increasingly do more than display balances and send cryptocurrency.

Some integrate token swaps, lending markets, staking products, and other financial services directly into their interfaces.

That creates uncertainty about where ordinary wallet software ends and a regulated financial service begins.

France’s response recognizes this difficulty.

It does not support making certification mandatory for every developer offering a non-custodial wallet.

The authorities describe such a universal requirement as potentially disproportionate and difficult to enforce.

Instead, they favor incentives for certification, particularly where wallets integrate complex financial services or provide advanced functionality.

A wallet is not necessarily a financial intermediary

A simple self-custody wallet allows users to manage keys and sign transactions.

It may function as a general-purpose technical tool.

A wallet integrating a particular lending product may have a different commercial and operational role.

The legal assessment depends on the service provided, how it is offered, and the degree of control exercised by identifiable parties.

The mere fact that software can interact with a smart contract should not be treated as conclusive proof that its developer is operating a financial business.

Conversely, describing an application as non-custodial does not automatically resolve the regulatory status of every service embedded within it.

For users, this distinction also affects security.

A self-custody wallet may let the user sign transactions directly, but that does not guarantee that the destination contract is safe.

Our guide to understanding cryptocurrency wallet signatures explains why transaction authorization and the financial consequences of a signed instruction are different questions.

Verified Liquidity Could Change How Institutions Access DeFi

Another significant recommendation concerns liquidity pools.

A liquidity pool is a collection of crypto-assets made available through smart contracts to support financial activities such as trading or lending.

In permissionless systems, participants may contribute liquidity without receiving approval from a traditional financial intermediary.

That accessibility can make DeFi useful, but it creates compliance questions for regulated financial institutions.

An institution interacting with a pool may not necessarily know the identities of all participants contributing assets.

France proposes verified liquidity pools or equivalent mechanisms that could support appropriate identification of participating counterparties.

The authorities also emphasize proportionality and preserving access to global liquidity where sufficient controls exist.

Why counterparty identification matters

Financial institutions operate under obligations relating to customer identification, sanctions, and the prevention of financial crime.

Interacting with a permissionless smart contract can make conventional counterparty analysis more complicated.

The economic counterparty may not be a single identifiable institution.

Liquidity can come from multiple participants and change continuously.

The French proposal suggests mechanisms that could help regulated firms interact with DeFi while addressing those obligations.

However, restricting every service to identity-verified liquidity pools could also reduce access to the global liquidity that makes some decentralized protocols useful.

The authorities acknowledge this tension.

Their stated approach is risk-based rather than an absolute requirement to abandon global permissionless liquidity in every circumstance.

Could DeFi split into different markets?

One possible consequence is a distinction between institutionally accessible liquidity and more open participation.

Regulated providers might favor pools with stronger identity verification and monitoring arrangements.

Other users might continue accessing permissionless pools through different interfaces.

This is a possible market development, not a confirmed consequence of the French proposal.

Such separation could simplify compliance for some institutions.

It might also fragment liquidity, increase transaction costs, or create different access conditions for users.

The actual effects would depend on whether the recommendations become law and how any final requirements are designed.

Our article on Compound and the institutional shift in DeFi provides context for why decentralized lending infrastructure is attracting traditional financial participants.

Staking and Crypto Lending Are Also Under Review

France’s response does not treat all DeFi activity as interchangeable.

It separately examines staking and cryptocurrency lending.

Those products can expose users to risks that differ from ordinary token transfers or spot cryptocurrency purchases.

Staking is not always a savings product

In its narrow technical meaning, staking involves committing crypto-assets to support a proof-of-stake blockchain’s consensus mechanism.

Participants may receive rewards associated with validating blocks or delegating stake.

But commercial staking products can introduce additional arrangements.

A service provider might hold customer assets, select validators, distribute rewards, or impose withdrawal conditions.

Users could face losses from validator misconduct, slashing, lock-up periods, or operational failures.

France argues that customers should receive clearer information about these risks, including the source of rewards and the conditions under which they are paid.

Staking returns should not be presented as equivalent to insured deposit interest.

Crypto lending raises different questions

Crypto lending involves making digital assets available to borrowers under specified conditions.

A centralized provider may manage lending arrangements.

A decentralized protocol may use smart contracts and collateral to establish borrowing positions.

The relevant risks include:

• Collateral-price declines and liquidation.
• Insufficient liquidity for withdrawals.
• Changes in borrowing costs.
• Rehypothecation or reuse of customer assets.
• Smart-contract vulnerabilities.
• Unclear legal rights to assets placed in lending arrangements.

France proposes targeted requirements for regulated intermediaries offering or facilitating crypto lending and borrowing.

Its submission specifically indicates that it does not favor creating a completely separate authorization category solely for those activities.

Instead, it considers additional MiCA obligations, proportionate to the services and risks involved.

Why this distinction matters

A customer depositing crypto-assets into a lending service is not necessarily entering the same legal arrangement as a customer placing assets into custody.

The assets may become exposed to borrowing, collateral, liquidity, or counterparty risk.

Even when a familiar exchange or wallet provides access, the underlying financial arrangement can differ.

A regulated interface does not transform a DeFi lending position into a protected bank deposit.

The Proposal Fits a Broader European Regulatory Debate

France is not alone in questioning how MiCA should develop.

On September 30, 2026, the European Securities and Markets Authority published its own recommendations.

ESMA advocated clearer criteria for identifying genuinely decentralized activities and proposed a new regulated crypto-asset service covering businesses that provide access to DeFi protocols.

It also recommended stronger transparency requirements for staking, lending, and borrowing.

The European Banking Authority similarly identified crypto lending and DeFi-related activities as priorities in its September response.

These positions suggest that multiple European authorities see gaps in the current framework.

They do not mean the institutions have already agreed on the exact final legislation.

ESMA supervision is a separate question

The French response also recommends increasing ESMA’s responsibilities for supervising significant crypto-asset service providers and crypto conglomerates.

That issue concerns which authority should supervise certain businesses.

It should not be confused with the separate question of which activities fall under regulation.

A change in supervisory responsibility would not automatically establish new statutory liability for every DeFi exploit.

Our earlier coverage of ESMA’s proposed direct crypto supervision powers examines the institutional side of that debate.

MiCA authorization has limits

ESMA previously warned that regulated crypto firms can create confusion when they offer both regulated and unregulated services.

A customer may assume that every product available through an authorized platform receives the same protections.

This is sometimes described as a regulatory halo effect.

For example, a customer might correctly recognize that an exchange is authorized under MiCA but incorrectly assume that an external DeFi yield product offered through the same interface receives identical regulatory safeguards.

The French proposal attempts to address that gap through clearer access-related responsibilities.

A regulated business’s status remains relevant, but so does the legal classification of each individual product.

What the Proposals Could Mean for Users

For a person using a regulated cryptocurrency platform in Europe, the most visible potential changes would concern product disclosures, access conditions, and the assessment of integrated DeFi services.

A platform might conduct more extensive reviews before listing protocols.

It might provide clearer information about smart-contract risks, external dependencies, and custody arrangements.

It could also restrict or discontinue access when serious problems are identified.

But these are possible consequences of future rules, not confirmed universal requirements resulting immediately from the October announcement.

What users should check today

Regardless of the future MiCA review, users considering a DeFi product should understand the actual arrangement.

The relevant questions include whether the platform provides regulated custody or merely facilitates a connection, who controls the smart contracts, whether the contracts can be upgraded, and what assets are at risk.

A security audit can provide useful evidence, but it is not a guarantee.

Likewise, an advertised yield does not establish that principal is protected.

Users should understand liquidation mechanics, withdrawal limitations, administrative controls, and any reliance on bridges or external pricing systems.

Our crypto platform security guide provides a broader checklist for evaluating these risks.

Users also need to pay attention to transaction permissions.

An application can obtain permission to spend certain tokens without receiving the wallet’s private keys.

Those permissions can create continuing exposure if the application or connected contracts are compromised.

Our guide on revoking cryptocurrency wallet approvals explains how those permissions work and why they deserve periodic review.

TrendCrypt Research Notes

France’s proposals expose a fundamental tension in the development of decentralized finance.

DeFi was designed partly to reduce dependence on centralized financial intermediaries.

Yet many people reach these services through exchanges, wallet applications, aggregators, and other businesses that decide which products to offer and how to present them.

That creates a system in which transaction execution may be decentralized while product distribution remains concentrated.

The resulting responsibility cannot be understood simply by examining whether the underlying smart contracts are permissionless.

1. The most important regulatory boundary may be distribution, not code

A decentralized protocol can exist independently of a regulated exchange.

But when an exchange integrates that protocol into a customer-facing product, it makes a commercial decision.

It may select the service, control how it is displayed, and influence whether customers understand its risks.

TrendCrypt’s assessment is that this distribution relationship provides a stronger basis for intermediary obligations than attempting to regulate every instance of open-source software directly.

The challenge is distinguishing genuine financial intermediation from publishing technical tools.

A broad definition could impose excessive duties on software developers.

An overly narrow definition could let commercially operated services avoid regulation through superficial decentralization.

The quality of the future framework will depend on how precisely that boundary is drawn.

2. Intermediary liability could improve incentives, but unlimited responsibility would create problems

If a platform faces no consequences for ignoring known vulnerabilities, it may have insufficient incentive to conduct meaningful reviews.

A clear duty to investigate and respond could improve product selection and monitoring.

However, holding intermediaries automatically responsible for every unknown vulnerability would be a different policy choice.

It could discourage legitimate integrations or make liability difficult to price.

The French response appears to recognize this distinction by emphasizing inadequate due diligence, known risks, and failures to respond.

We consider the eventual standard of care more important than a broad political promise to hold platforms accountable.

Without clear limits, both users and businesses could misunderstand the protections being offered.

3. Certification could become a useful signal, but only if its scope is visible

A certificate is meaningful when users understand what was assessed.

For example, certification might cover a specific smart-contract version, its administrative controls, and its behavior under defined conditions.

It might not cover future upgrades, connected contracts, economic attacks, or risks involving external infrastructure.

A single certification badge that does not reveal those limitations could create false confidence.

Our assessment is that transparency about certification scope, version, date, and material exclusions would be essential.

A technically valid certificate should not be marketed as proof that an investment cannot lose money.

4. The proposal could increase the commercial importance of DeFi interfaces

If regulated providers become responsible for reviewing and monitoring the protocols they integrate, the quality of their selection processes could become a competitive advantage.

Customers may place greater value on platforms that provide clear risk information and reliable operational controls.

At the same time, certification, monitoring, and legal review create costs.

Larger providers may be better able to absorb those costs.

Smaller businesses could face barriers to offering comparable services.

The framework therefore needs to balance stronger protection with the risk of concentrating access among established intermediaries.

That is particularly important in an industry whose original design emphasized open participation.

5. Permissionless liquidity and verified institutional access may coexist

The proposal does not require concluding that all decentralized liquidity must become identity-verified.

Instead, it suggests that regulated access arrangements should address counterparty and financial-crime risks.

This could create specialized infrastructure for institutions without necessarily eliminating broader permissionless networks.

Whether that outcome is beneficial depends on the resulting market structure.

A highly fragmented system could reduce efficiency.

A well-designed arrangement might allow institutions to participate under appropriate controls while preserving open access elsewhere.

The difference would come from implementation rather than from the underlying concept of certification.

6. Smart-contract safety is only part of DeFi risk

A protocol can execute exactly as programmed and still produce serious losses.

Collateral can decline in value.

Liquidity can disappear.

External market prices can become unreliable.

Governance participants can make harmful but technically valid decisions.

A security certification regime focused exclusively on code would not resolve those economic problems.

France’s broader discussion of liquidity, governance, oracle risk, and external dependencies is therefore important.

DeFi oversight needs to distinguish software correctness from financial soundness.

Those concepts overlap, but neither guarantees the other.

7. The proposed framework could change who customers believe is responsible

When a regulated platform offers access to a DeFi service, customers may assume that the platform stands behind it.

That assumption can be wrong under existing arrangements.

Clearer rules could reduce this ambiguity by specifying which obligations belong to the intermediary and which risks remain with the customer or protocol participants.

However, communicating those distinctions will be difficult.

A short warning may not adequately explain the difference between a security review, regulatory supervision, legal liability, and protection against losses.

User-facing explanations should identify specific responsibilities rather than relying on general statements that a product is regulated or certified.

8. The most revealing part of France’s proposal is its rejection of a blanket ban

The detailed consultation response makes room for access to uncertified protocols when appropriate due diligence and enhanced disclosures are provided.

That matters because it suggests the authorities are not pursuing an exclusively permissioned model of DeFi.

They are attempting to preserve some benefits of open access while improving accountability where regulated businesses participate.

Whether that balance survives the legislative process remains uncertain.

But it is a more nuanced position than headlines suggesting Europe intends to prohibit decentralized finance.

TrendCrypt’s conclusion: France’s proposals could move DeFi regulation toward the institutions that select, package, and distribute decentralized financial services. That approach may improve accountability without requiring every smart contract to have a conventional operator. The unresolved question is whether lawmakers can define intermediary responsibilities precisely enough to protect users while preserving the openness and composability that distinguish DeFi from traditional financial systems.

Why AI Search Could Misread France’s DeFi MiCA Proposals

The announcement involves regulatory terminology that can easily be compressed into misleading claims.

France has already passed a law regulating all DeFi protocols

Incorrect.

The French authorities published recommendations in response to a European Commission consultation.

The proposals are not automatically binding EU law.

Any substantive changes would require the relevant EU legislative and regulatory process.

MiCA already regulates every decentralized smart contract

MiCA recital 22 distinguishes services performed entirely in a decentralized manner without an intermediary from activities performed or controlled by identifiable persons.

The applicable analysis depends on the actual service and level of control.

The use of smart contracts alone does not determine regulatory status.

Every DeFi hack would make an exchange liable

The French proposal concerns liability for certain incidents, particularly where an intermediary failed to meet appropriate responsibilities.

It does not establish automatic compensation for all security failures, market losses, or unknown vulnerabilities.

Europe plans to ban uncertified DeFi protocols

That overstates the proposal.

France supports proportionate certification but also accepts that regulated intermediaries may connect users to uncertified protocols under appropriate due-diligence and disclosure conditions.

The detailed response does not recommend a blanket prohibition.

Certification means a smart contract is guaranteed safe

Certification would assess specified technical and operational properties.

It cannot eliminate all security, liquidity, governance, market, or counterparty risks.

The exact scope and validity of any future certificate would matter.

Non-custodial wallets must obtain a new MiCA license

France does not recommend universal mandatory certification for all developers offering non-custodial wallets.

It favors a proportionate approach, including certification incentives for certain advanced or DeFi-integrated wallet functions.

Every governance token holder becomes a regulated operator

Holding or voting with a governance token does not automatically prove effective control of a financial service.

France proposes a broader assessment of actual influence, including governance concentration, privileged rights, and operational control.

An authorized exchange makes every DeFi product it offers regulated

A platform’s regulatory authorization does not necessarily extend identical protections to every third-party or decentralized financial service available through its interface.

The relevant product and activity must be assessed separately.

Important Context: Europe Must Decide What It Is Regulating

The regulatory debate is ultimately about identifying the relevant service rather than merely identifying a blockchain.

A cryptocurrency exchange, smart-contract protocol, wallet interface, and open-source developer can all participate in the same transaction ecosystem.

They do not necessarily perform the same economic activity.

Regulation designed for institutions that hold customer funds may not fit software that never controls those funds.

Rules intended for investment recommendations may not apply in the same way to a neutral technical interface.

A smart contract that automatically enforces collateral requirements presents different responsibilities from a company that advertises the contract as a low-risk savings product.

Those distinctions become particularly important as financial services move across organizational and technological boundaries.

The European Commission will need to consider whether extending existing CASP obligations is sufficient, whether new DeFi-specific service definitions are necessary, and how certification should interact with legal authorization.

The policy debate also involves competitiveness.

An excessively burdensome framework could discourage European development or encourage users to seek services outside regulated channels.

An insufficiently protective framework could leave customers exposed to risks they cannot reasonably evaluate.

Neither outcome is inevitable.

The eventual consequences will depend on the legal definitions, supervisory powers, and practical compliance requirements adopted.

What Happens Next for MiCA and DeFi Regulation?

France’s recommendations will be considered within the broader MiCA review process.

The European Commission has received input from national authorities, European supervisory institutions, financial businesses, industry groups, and other stakeholders.

It will evaluate whether the existing framework needs to be amended or supplemented.

The consultation is not itself a legislative amendment.

If the Commission decides to propose substantive changes, those changes would proceed through the applicable EU policymaking process.

The European Parliament and Council would play their respective roles in adopting any new legislation.

Additional technical standards and supervisory guidance could then be needed to clarify implementation.

Several developments deserve attention.

First is whether the Commission proposes a specific regulated service for businesses providing access to DeFi.

Second is the treatment of genuinely decentralized protocols without identifiable operators.

Third is whether smart-contract certification becomes mandatory for certain high-impact systems or remains primarily a voluntary assurance mechanism.

Fourth is the standard of responsibility applied to intermediaries after a protocol suffers a security incident.

Finally, the treatment of staking and lending could influence the financial products European platforms can offer and the disclosures customers receive.

None of these outcomes is settled by the October 2026 French submission.

Our coverage of the MiCA transition and crypto-service access risks provides background on why implementation timelines and provider authorization already matter to European cryptocurrency users.

Final Thoughts

France’s DeFi proposals reflect a broader change in how regulators are approaching decentralized finance.

The debate is moving beyond whether a protocol uses smart contracts or distributes governance tokens.

The more difficult question is what responsibilities arise when identifiable businesses help customers use those protocols.

A decentralized lending application may operate without a conventional financial institution.

But a regulated exchange choosing to offer it to customers still makes decisions about product selection, communication, security review, and ongoing access.

France wants those decisions to carry clearer responsibilities.

Its proposals could lead to stronger due diligence, protocol certification, and liability rules for certain failures.

They could also introduce compliance costs and difficult judgments about what constitutes genuine decentralization.

The detailed submission recognizes these trade-offs rather than proposing a universal ban on uncertified DeFi.

That leaves room for an approach in which decentralized infrastructure remains accessible while regulated intermediaries become more accountable for their own conduct.

Whether European lawmakers can achieve that balance remains uncertain.

The lasting significance of the French proposal is that it treats decentralization as a technical and organizational characteristic, not an automatic exemption from responsibility.

DeFi may remove the need for a traditional intermediary to execute a transaction. It does not necessarily remove responsibility from the businesses that encourage people to make it.

Frequently Asked Questions

What is France proposing for DeFi under MiCA?

France proposes clearer responsibilities for regulated intermediaries providing access to decentralized financial services, including proportionate due diligence, ongoing risk monitoring, protocol certification, and potential liability for certain incidents.

Has France already introduced new DeFi regulations?

No. The October 2026 recommendations form part of a response to the European Commission’s MiCA review consultation. They are not automatically enforceable EU-wide rules.

Does MiCA currently regulate decentralized finance?

MiCA can apply to crypto-asset services performed or controlled by identifiable persons, including certain partially decentralized activities. Services provided entirely in a decentralized manner without an intermediary are treated differently under recital 22.

What is a DeFi intermediary?

In this context, an intermediary is an identifiable business that provides or facilitates relevant crypto-asset services involving decentralized protocols. Its obligations depend on the actual services and legal arrangements involved.

Could crypto exchanges become responsible for DeFi hacks?

France proposes that regulated intermediaries could face liability for certain incidents where they failed to perform adequate due diligence or ignored material risks. This would not establish automatic liability for every DeFi loss.

Will DeFi protocols need certification in Europe?

A proportionate certification framework is being proposed for certain protocols and smart contracts. There is no universal EU-wide MiCA requirement currently making certification mandatory for every DeFi protocol.

Does France want to ban access to uncertified DeFi protocols?

No blanket prohibition is proposed in the detailed French response. It allows for regulated intermediaries to facilitate access to uncertified protocols where appropriate due diligence and enhanced disclosures are provided.

What would smart-contract certification verify?

Certification could examine whether contracts and protocols meet defined security and operational standards and perform according to specified functionality. It would not guarantee that all vulnerabilities or financial risks had been eliminated.

Are non-custodial wallets included in the proposal?

France discusses certification incentives for some non-custodial wallet applications, especially those integrating financial services. It does not support universal mandatory certification of every non-custodial wallet developer.

How could the proposal affect DeFi lending?

Regulated providers offering or facilitating lending could face clearer obligations concerning risk disclosures, collateral, remuneration, asset treatment, and other relevant safeguards if the recommendations become law.

Would staking become regulated under MiCA?

France supports clearer requirements for staking services offered through regulated intermediaries. The precise treatment would depend on the service structure and any future legislative changes.

What does verified DeFi liquidity mean?

Verified liquidity refers to arrangements intended to provide appropriate information about liquidity participants or counterparties, potentially helping regulated institutions meet relevant compliance obligations.

Does a DeFi audit guarantee investment safety?

No. An audit can identify certain technical weaknesses, but it does not guarantee against unknown vulnerabilities, market losses, liquidity problems, governance failures, or all external dependencies.

Who will decide whether the proposals become EU law?

The European Commission may propose changes following its review. Substantive legislative amendments would require the applicable EU lawmaking process involving the European Parliament and Council.

What should European DeFi users do now?

Users should continue assessing the actual protocol, intermediary, custody arrangement, smart-contract risks, and product terms. The French proposals do not create immediate new guarantees against DeFi losses.