ESMA Proposes New DeFi Gateway Rules Under MiCA Review

The European Securities and Markets Authority (ESMA) has proposed a new regulatory category for crypto-asset firms that connect users to decentralized finance (DeFi) protocols, alongside new requirements for staking and crypto lending under the European Union’s Markets in Crypto-Assets Regulation (MiCA).

In its response to the European Commission’s consultation on the review of MiCA, ESMA proposed a “gateway” service category covering crypto-asset service providers that offer technical interfaces or route customer transactions to decentralized protocols.

Under the proposal, these firms would face obligations covering protocol due diligence, risk disclosures, transaction-routing practices and conflicts of interest, as well as operational resilience and cybersecurity safeguards.

The recommendations have been submitted to the European Commission as part of its MiCA review and are not yet adopted rules. For EU users accessing DeFi through an intermediary interface, the proposed framework would place responsibilities on that intermediary rather than automatically bringing the underlying software or protocol within MiCA.

ESMA Targets the Gateway to DeFi

ESMA is also calling for an explicit ban on crypto-asset service providers offering MiCA-regulated services involving asset-referenced tokens or e-money tokens that do not comply with the regulation.

The proposal would extend the restriction to custody and transfer services. Earlier ESMA guidance issued in January 2025 had required such services to remain available.

MiCA currently excludes services that are provided in a fully decentralized manner without an intermediary. At the same time, activities can fall within the regulatory perimeter when identifiable individuals or companies exercise direct or indirect control over them.

ESMA is therefore seeking greater legal clarity around what qualifies as DeFi, arguing that the exemption should remain as narrow as possible to prevent operators from using claims of decentralization to avoid regulatory obligations.

The authority also draws a line between decentralized protocols and the infrastructure around them. Open-source software development, self-custody, automated smart contracts and unlicensed infrastructure should not automatically be treated as regulated intermediation, ESMA said. The obligations imposed on a gateway should instead reflect the degree of control the provider has over the underlying protocol.

ESMA Outlines New Rules for Staking

The proposed framework would introduce additional conduct, disclosure and asset-protection requirements for regulated crypto-asset service providers offering staking services, rather than creating a separate licensing regime.

Among the proposed disclosures are details on rewards, fees, withdrawal delays and the selection of validators. ESMA also proposes mechanisms to account for losses to staked assets resulting from validator misconduct or failures.

The authority distinguishes between direct self-staking without an intermediary, technical or pooled staking services, custody-based arrangements and liquid staking products.

The proposals build on MiCA’s existing custody requirements. According to ESMA’s consultation response, staking itself would not require a separate MiCA authorization, but service providers holding customers’ crypto-assets for staking purposes would need authorization to provide custody services.

Crypto Lending Faces New Safeguards

Crypto lending and borrowing are currently outside MiCA’s specific scope, although national laws can still apply.

ESMA is proposing that customers provide explicit written consent before crypto-asset service providers conduct or facilitate lending activities. Providers would also have to give customers specific disclosures about the arrangements.

The authority is not proposing a standalone regulated crypto-lending service.

For borrowing arrangements, ESMA wants specific requirements covering conduct, disclosures and risk management. These would include risks linked to collateral liquidation and the reuse of collateral, with the proposed framework focusing primarily on intermediaries rather than standalone protocols.

The recommendations follow an earlier call from the European Banking Authority for an economic feasibility assessment of bringing lending and borrowing conducted through intermediaries within regulated crypto-asset services, alongside potential requirements for DeFi gateways.

MiCA Review Could Redefine DeFi’s Regulatory Perimeter

The European Commission’s targeted consultation on MiCA closed on September 30, with responses expected to contribute to its review report. The Commission could accompany that report with legislative proposals if it determines that changes to the existing framework are necessary.

ESMA’s recommendations suggest that the review could focus less on regulating decentralized protocols themselves and more on the access points through which users reach them.

That distinction could become increasingly important as DeFi services expand. The regulatory challenge is to establish where open software and decentralized protocols end and where a company begins providing an identifiable service to customers or exercising meaningful control over their access to the system.

The same question extends to staking and lending. As these services become more sophisticated, regulators will need to determine who should carry responsibility for disclosures, operational risks and customer-asset protection without extending MiCA to software and protocols over which regulated entities have no direct control.