Europe’s securities regulator wants the EU’s crypto rulebook stretched to cover the parts of the market that currently sit outside it. In its response to the European Commission’s MiCA review, published September 30, ESMA proposed a new licensable service for firms acting as gateways to decentralized finance, plus targeted conduct, disclosure and safeguarding rules for staking and crypto lending.
The response, referenced ESMA75-113276571-1721, landed on the final day of the Commission’s public consultation on the review of the Markets in Crypto-Assets Regulation. ESMA draws on roughly a year of implementation experience: July 1, 2026 marked the end of the MiCA transitional period, so firms across the bloc have been operating under the full regime for a full quarter.
ESMA frames its aim in three parts: simplify the framework, improve investor protection and capture business models that emerged after the rules were drafted. The document is a wish list rather than law, but the Commission invited exactly this input, and the supervisor’s reading of where MiCA falls short carries weight in Brussels.
A new licence category for DeFi access
The most consequential block concerns business models ESMA observed during early implementation. Authorised crypto asset service providers increasingly facilitate client access to DeFi protocols: decentralized exchanges, lending and borrowing markets, staking and re-staking mechanisms. Those arrangements fall into a gap. MiCA governs the CASP, not the protocol, and a firm’s clients may not understand what they are actually exposed to when a licensed intermediary routes them into an unlicensed smart contract system.
ESMA’s answer is a new regulated service for firms that give users access to DeFi, which would require authorisation and carry conduct-of-business obligations. Alongside it, the authority proposes clearer criteria for when an activity genuinely counts as decentralized, a question firms have gamed since the framework was drafted. ESMA also wants the power to issue binding opinions on token classification, an area where issuers and national regulators have repeatedly disagreed and where a token’s legal treatment can swing on one national supervisor’s view.
Staking is not lending, mostly
On staking, ESMA took a line that will reassure the industry. It recognizes staking as a core technical function of proof-of-stake networks and says it should not automatically be treated as lending or investment management. That distinction matters: treating staking as a portfolio management service would have forced many CASPs into heavier authorisation categories and complicated products that millions of EU retail clients already use.
But the regulator still wants staking services offered by authorised CASPs to face targeted conduct, disclosure and safeguarding requirements. It flags the convergence risk that the industry itself acknowledges: the two activities start to look alike when providers reuse or rehypothecate client assets to generate yield, whether through liquid staking tokens or structured yield products. Disclosure of what happens to deposited assets is the minimum ask.
Lending called a black box
Lending drew harsher language. ESMA describes client lending programmes at CASPs that borrow crypto from clients and on-lend it to third parties as, in its own words, “effectively black boxes for clients”. It proposes requirements including express written client consent, disclosure duties and a limit on the yield a CASP retains from the spread.
The regulator notes that cascading failures are a real possibility when borrowed client assets are pledged onward. A client’s legal and economic position changes significantly once assets are pledged or reused: in a counterparty failure the client may hold an unsecured claim rather than a custody entitlement. That is the same lesson insolvency practitioners learned through the Celsius and Voyager failures of 2022, and ESMA is citing it as justification for acting before the next stress event rather than after.
Stablecoins and influencer marketing
The response also tightens the screws on unapproved stablecoins, proposing stricter restrictions on services tied to tokens that lack authorisation under MiCA’s e-money or asset-referenced token regimes. Issuers serving EU users without a licence would find the intermediaries around them squeezed first, since the proposed rules target the services that make unapproved tokens usable rather than the tokens alone.
Marketing gets its own section. ESMA proposes stricter advertising requirements, explicitly covering promotion by influencers and other third parties. The regulator has spent much of 2026 fielding complaints about paid promotion of speculative tokens, and it wants the party paid to promote a crypto asset held to disclosure standards, not just the issuer. Several national authorities have already flagged influencer campaigns as a supervisory priority this year.
Tokenised markets on the side
One quieter section may matter to banks more than the DeFi parts. ESMA uses the response to back the development of tokenised capital markets in the EU, arguing the review should keep the door open for tokenised versions of traditional securities under existing financial rules rather than pulling them into MiCA. Large institutions piloting tokenised bonds and funds have pushed for exactly that clarity.
What happens next
Nothing becomes law here directly. ESMA’s response sits with the Commission, which will decide whether the MiCA review leads to a legislative proposal amending Regulation (EU) 2023/1114. A proposal could follow in 2027. ESMA’s published 2027 work programme already shifts its crypto focus from rulemaking to supervision, so enforcement capacity is being built in parallel while the legislative track grinds on.
For exchanges and custodians, the near-term ask is documentation: ESMA wants consent flows, disclosure of asset reuse and clarity on yield splits written into lending and staking products now, well before any amendment forces the issue. Firms building DeFi access products for EU users should also note that a licence category named after their business model is now formally on the table, and that several member state regulators are watching how the Commission responds.