The European Banking Authority called on Thursday for crypto lending and borrowing to be regulated under the EU’s Markets in Crypto-Assets framework, including services that connect users to decentralized finance protocols. The recommendation, part of the EBA’s response to the European Commission’s targeted consultation on the MiCA review, would mark the first time the bloc’s crypto rulebook reaches directly into DeFi lending markets.
The EBA published its response on September 24, laying out what it wants changed when the Commission revises the regulation. The authority recommended suitability tests for users, limits on leverage, detailed risk disclosures, and restrictions on access to lending that involves asset-referenced tokens. It also proposed a certification regime for the resilience of DeFi lending protocols to cyberattacks.
The EBA recommends regulating crypto-asset lending, including activities linked to decentralised finance, the authority said in its press release.
What the EBA actually proposed
The core ask is scope. MiCA today covers issuers of stablecoins and crypto-asset service providers such as exchanges and custodians, but it does not regulate lending activity, and fully decentralized protocols sit largely outside its perimeter. The EBA wants that gap closed, arguing that services which route users into DeFi lending should carry the same obligations as other crypto businesses.
The regulator also flagged risks from multi-issuer stablecoin schemes and called for stricter rules in that area, along with a comprehensive reporting mandate for issuers and crypto-asset service providers. A separate recommendation asks for clarifications to MiCA’s scope so that the classification of crypto-assets is more consistent across the bloc, which the EBA said would support innovation rather than hinder it.
Regulatory arbitrage was a recurring theme in the response. The EBA warned that differences in how member states classify and supervise crypto activities let businesses shop for the lightest regime, and it framed the lending rules as a way to level the field across the single market.
The market it wants to regulate
The push comes as on-chain lending has become a large business again. Data cited alongside the EBA’s response put active loans across decentralized lending protocols at more than $30 billion, with Aave and Morpho among the largest venues. Aave’s new V4 markets alone crossed $1.2 billion in deposits this month after doubling in four weeks, according to figures reported earlier this week.
Tokenized real-world assets have added a new layer to the collateral pool. A CoinShares and Token Terminal report found deposits of tokenized Treasuries, private credit and other conventional assets on lending platforms and decentralized exchanges more than tripled over the past year to $7.4 billion, even as total DeFi deposits fell about 15%. Regulators are now looking at collateral pools that include BlackRock’s tokenized treasury fund and gold-backed tokens, not just volatile crypto assets.
That composition matters for the policy debate. When the assets being lent against are tokenized government debt and money-market funds, the argument that DeFi lending is a crypto-native sideshow gets weaker. European supervisors have watched US tokenization projects grow all year, and the EBA’s language suggests it sees lending as the point where those assets start behaving like bank balance sheets.
Stablecoins in the crosshairs
The stablecoin recommendations may matter as much as the lending ones. The EBA said the framework needs strengthening around multi-issuer stablecoin schemes, an arrangement where several entities issue the same token under shared reserves. MiCA already imposes reserve and redemption requirements on issuers, but the authority appears to want clearer rules for schemes that spread issuance across multiple legal entities and jurisdictions.
The EBA also wants a reporting mandate covering both issuers and crypto-asset service providers, which would give supervisors a standing data feed rather than relying on ad hoc requests. Reporting duties of that kind have historically preceded tougher enforcement, because they make non-compliance visible.
What happens next
Nothing changes immediately. The EBA’s response is advice to the Commission, which ran the targeted consultation as part of its scheduled review of MiCA. Any extension of the framework to lending and DeFi would require legislative amendments, a process that typically takes well over a year in the EU and involves the Parliament and Council.
The direction of travel, though, is clear. The EBA has previously signaled discomfort with the DeFi gap in joint reports with ESMA, and the certification idea for protocol resilience echoes how the EU already treats critical financial infrastructure. If the Commission adopts the recommendation, DeFi front-ends and the services that connect users to protocols would face authorization, disclosure and consumer-protection duties similar to those already imposed on exchanges.
For protocol teams, the practical questions are whether certification would be mandatory for market access in the EU, how leverage caps would be enforced on permissionless code, and whether front-end operators would be treated as the regulated entity even when the protocol itself is decentralized. The EBA’s response does not settle any of those questions, but it puts them on the formal agenda for the MiCA review.
Industry reaction has split along predictable lines. Compliance-heavy firms have generally welcomed clearer rules, arguing that uncertainty is the bigger cost, while DeFi advocates argue that applying intermediary rules to autonomous protocols is technically unworkable and would push activity offshore. Several exchanges operating in the EU declined to comment publicly ahead of the Commission’s response.
The timing also intersects with developments elsewhere. The United Kingdom is consulting on its own crypto framework, the United States is drafting rules under the GENIUS Act for stablecoins, and Asian regulators have moved ahead with tokenized securities regimes. How the EU handles DeFi lending will influence whether its market stays attractive to protocol teams or loses them to lighter jurisdictions.