Less than two years ago, the Markets in Crypto-Assets Regulation (MiCA) took effect in Europe, establishing a regulatory framework for cryptoassets and intermediaries. Now, the European Commission is reviewing whether the framework remains fit for purpose as crypto markets and the global regulatory landscape evolve. Earlier this year, the European Commission opened up the provisions for review in a public consultation. The review could have significant implications for decentralized finance (DeFi), so DeFi Education Fund (DEF) submitted a response to the Commission’s targeted consultation. 

Our overarching message is simple: MiCA’s framework already draws the right line for DeFi technology and developers. Regulation should attach to whoever controls user assets, not to the non-custodial software people use to interact with open blockchain networks. We encourage EU regulators to hold and sharpen this position. 

What is the MiCA consultation?

MiCA has been fully applicable since December 30, 2024 and sets EU-wide rules for crypto-asset issuers, stablecoins, and crypto-asset service providers (CASPs).

MiCA also requires the Commission to review the framework and report on how the regulation is working and on the latest developments in crypto-asset markets. On May 20, 2026, the Commission launched a targeted consultation for industry participants and public authorities, alongside a public consultation for individuals.

The questionnaire includes 86 questions across four areas:

• Scope and definitions: where MiCA ends and other financial services legislation begins.
• Stablecoins: reserves, redemption rights, and the treatment of global stablecoins.
• CASPs: regulated services, prudential rules, and access to global liquidity.
• Beyond MiCA: DeFi, lending and borrowing, staking, and NFTs.

The Commission’s report is due by June 30, 2027, and may, where appropriate, be accompanied by a legislative proposal.

This review is unique because it explicitly asks about DeFi. The questionnaire floats ideas such as certification schemes for smart contracts, due-diligence duties for CASPs that connect users to DeFi protocols, potential new decentralization criteria, and redemption rights that depend on whether a stablecoin holder uses a regulated intermediary. Each of these, if applied incorrectly, reach past intermediaries to the software and to users themselves.

Our Throughline: Regulate Intermediaries, Not Code

Technology that does not take custody of assets, control transactions, or exercise control over the underlying network should not be regulated as though it were an intermediary. Treating software as though it were an intermediary does not protect users. Instead, it threatens to push software developers out of Europe, leaves users with fewer and worse options, and fails to reach the underlying protocol, which remains accessible anyway. Importantly, this principle is already embedded in MiCA through Recital 22, which excludes fully decentralized crypto-asset services without any intermediary , and Recital 83 which excludes non-custodial hardware and software wallets. 

Here are some of the key themes of our submission:

1. Maintain MiCA’s existing regulatory perimeter: The scope of crypto‑asset services as defined in Article 3(16) is fit for purpose and should not be expanded to include DeFi. We write: 

“The regulatory framework should maintain a clear distinction between activities involving custody or control of users’ assets and the use of non-custodial technology that allows users to interact with public blockchains. This distinction is important for both regulatory considerations and the continued development of DeFi. MiCA’s Recital 83 is already clear that non-custodial hardware and software wallets are not in scope and this should be maintained. […] Non-custodial front-ends should remain outside the scope of MiCA where the software provider does not custody user assets, exercise independent control over those assets, execute transactions on behalf of users, or control the underlying protocol or network architecture.”

2. Protect Self-Custody: The consultation’s stablecoin section asks whether redemption rights could be weakened or delayed for holders who do not keep their tokens with an EU intermediary, or limited to stablecoins “genuinely circulating” in the EU.

We rated these ideas “highly ineffective” for three reasons:

• They cannot be administered. On a public blockchain, an issuer can trace transfers between addresses but generally cannot tell who holds an address or where they are. Geographic circulation cannot be reliably measured, and custody status cannot be reliably verified.
• They would create a serious privacy problem in exchange for little benefit. Tying addresses to identities in order to sort eligible from ineligible holders would open a window onto people’s entire financial histories, visible to anyone with an internet connection, with real safety risks attached.
• They could punish user choice. Two people holding the same token have the same claim on the same issuer. Giving one of them weaker rights because they chose self-custody penalizes the core feature of permissionless networks, disadvantages wallet and app developers, and incentivizes activity to move offshore.

The Commission should keep rules that strengthen an issuer’s financial resilience separate from rules that regulate where consumers custody their own assets. 

3. Embrace global exchange: Stablecoins are already global infrastructure, with a market capitalization standing at roughly $320 billion as of the end of May 2026 (BIS) and adjusted transaction volume reaching an estimated $28 trillion in 2025 (Chainalysis). In DEF’s view, global stablecoins benefit EU users across every use case addressed in the consultation, because their value lies in what they do, not where their issuer is incorporated.

The same logic applies to liquidity. Fragmenting liquidity along EU-only lines risks shallower markets, wider spreads, and worse execution for European users. A rule that stops CASPs from reaching non-EU liquidity could even conflict with MiCA’s own best-execution requirements.

DEF’s specific recommendations:

• Build an equivalence regime for stablecoins and crypto-asset services from comparable jurisdictions, backed by cross-border supervisory cooperation. The GENIUS Act’s Digital Asset Service Provider (DASP) definition, which focuses on control over customer assets, is a natural reference point for defining the DeFi perimeter consistently across the Atlantic.
• Clarify that CASPs can source onchain liquidity through DeFi protocols. Permissionless networks do not follow borders, and imposing geographic limits on the network itself are unlikely to work, while restrictions imposed on regulated firms could harm EU users.

4. Decentralization is fundamentally a question of control: The consultation proposes several indicators for judging whether a DeFi application is “not fully decentralised.” We write: 

“[T]he indicators are not easily rated as written; their significance often depends on facts the indicator itself does not capture. For instance, while the presence of control over keys by a group of persons can be an indicator of something being less decentralised, it matters what exactly the keys allow someone to do and whether the group is coordinated or simply a diverse group of holders with no affiliation. Similarly, ‘custody’ is not an appropriate framing for the action of a user deploying assets in a smart contract. This is not in itself an issue if that protocol is decentralised and the user retains full control to withdraw their assets at all times.

Decentralisation is best understood as whether a person or group of persons retains unilateral control over user assets or data. Indicators of decentralisation are useful only to the extent that they help establish whether a person or group of persons, including persons acting under common control, retains the practical ability to exercise unilateral authority over the relevant system.”

Instead, DEF proposed a principles-based assessment built around five key questions:

• Control over assets: Can a person or group of persons unilaterally initiate, block, or control user transactions?
• Control over the protocol: Can a person or group of persons unilaterally upgrade, pause, or materially alter it?
• Ability to exclude: Can a person or group of persons unilaterally decide who may use or build on it?
• Operational authority: Is there an identifiable person or coordinated group retaining continuing authority over material functions?
• Revocability: Where authority is delegated, can it be unilaterally revoked or replaced?

The approach should stay technology-neutral and case-by-case, and should not create a new decentralization regime. We also flagged a framing problem in the questionnaire itself: protocols that are not decentralized are, by definition, not DeFi. Treating a middle zone as a separate category risks regulating software indirectly.

5. There should not be a certification regime for protocols: Several questions ask whether the EU should certify DeFi protocols and smart contracts, or require CASPs to take on due diligence for the DeFi protocols their customers use. DEF opposed both approaches for structural reasons: 

• Certification needs a party to certify. It assumes someone who applies, receives approval, and stays accountable. A decentralized protocol has no such party, and creating one would recentralize the very system the rule is meant to govern.
• Certification promises what it cannot deliver. An audit captures a point in time; it cannot guarantee future behavior or resilience against every dependency. A regulatory stamp would create false assurance while raising barriers to deploying open-source software. Plus, the ecosystem already does the work: audits, formal verification, bug bounties, continuous monitoring, and incident response are standard practice. Initiatives such as SEAL and DEF’s Open Protocol Security Coalition are building shared standards, tools, training, and war games that protocol teams can use in-house. 

To be clear, this is not a case against risk management; CASPs already vet the protocols they support, as any regulated firm vets its vendors and infrastructure, and should disclose that work to customers. The difference is between a CASP choosing to assess a protocol and MiCA making the CASP responsible for it. The latter could effectively extend MiCA to activities outside its intended scope and give CASPs an incentive to restrict access to permissionless DeFi protocols to limit their liability.

DEF’s Ask of EU Regulators

DEF asks EU regulators to ensure three key protections:

• Protect developers. People who write and publish software should not be subject to regulatory obligations or inherit liability for how third parties use their software, or be classified under regimes that do not describe the activities they actually perform.
• Protect user autonomy. Self-custody and privacy-enhancing technology should be clear, affirmative, enforceable rights, not features that cost users their protections.
• Protect permissionless infrastructure. Definitions should be accurate and technology-neutral, and should preserve the line between non-custodial software and the intermediaries that control customer assets.

MiCA has a head start in clarifying the line between control and code, and we encourage the Commission to ensure these same standards apply as they build their report and consider any future amendments to MiCA. 

If you have any questions about DEF’s submission, please do not hesitate to contact DeFi Education Fund at info@defieducationfund.org.

---