Access Points

The European Securities and Markets Authority has asked Brussels to create a new licensed category for firms that give retail users access to DeFi protocols, rather than regulating the underlying code itself. For banks, exchanges and wallet providers operating in the EU, the proposal would extend MiCA’s licensing perimeter to the on-ramps that connect customers to decentralized markets, not the smart contracts behind them.

• ESMA’s response to the European Commission’s MiCA review calls for a new regulated crypto-asset service covering DeFi access points.
• An EBA-ESMA report found DeFi made up roughly 4% of global crypto-asset market value and 10% of global trading volume.
• Only 281 of 1,343 monitored crypto firms in the European Economic Area held MiCA authorization when the transition period closed on July 1.

• 4% DeFi’s share of total global crypto-asset market value
• 10% share of global crypto trading volume run through DEXs
• 281 of 1,343 EEA crypto firms holding a MiCA license

The European Securities and Markets Authority (ESMA), the EU’s markets regulator, said in its response to the European Commission’s consultation on the review of the Markets in Crypto-Assets Regulation (MiCA) that Brussels should create a new regulated service for companies that give users access to decentralized finance protocols. Instead of licensing the permissionless software, the watchdog wants to bring the exchanges, wallet apps and transaction-routing services that sit between retail customers and DeFi markets inside the licensing regime, an approach first detailed by Cryptopolitan.

MiCA is the EU’s license-based framework for crypto-asset issuers and service providers. Its current text largely exempts DeFi deemed “fully decentralized,” a carve-out ESMA now wants narrowed.

ESMA Wants the DeFi Exemption “As Narrow As Possible”

ESMA’s response argues that clearer criteria are needed to separate genuinely decentralized activity from systems that still depend on human operators.

The regulator wrote that “the ‘DeFi’ exemption should be as narrow as possible to avoid being used as a way of circumventing the application of the MiCA regime,” language aimed at closing a route firms could otherwise use to sidestep licensing entirely.

The proposal also asks for binding ESMA opinions on token classification, including hybrid tokens that blur the line between utility and security instruments, to stop the same product being treated differently across member states.

The watchdog’s EBA-ESMA report identified application interfaces, self-custody wallets and centralized platforms as the three main routes users take into DeFi, data that underpins the case for regulating the gateway layer rather than the protocols.

EBA Wants DeFi Lending Regulated Directly, Not Just Access Points

The EBA-ESMA report put DeFi’s footprint at about 4% of total global crypto-asset market value and 10% of global trading volume, a small slice next to centralized exchanges but large enough to draw targeted scrutiny.

ESMA’s response pairs that data with calls for stricter marketing rules for influencers, clearer cost and risk disclosures, and proportionate requirements specifically for staking, lending and borrowing products.

The European Banking Authority went further in its own submission, pushing to regulate crypto lending directly, particularly DeFi-related lending practices, where protocols already run formal governance processes to manage risk.

ESMA separately wants expanded powers to take down fraudulent websites, freeze assets tied to suspected market manipulation or terrorist financing, pursue unauthorized third-country firms, and bar regulated exchanges from offering services linked to non-compliant stablecoins.

Just 281 of 1,343 EEA Firms Cleared MiCA’s Licensing Bar

MiCA’s transition period for crypto-asset service providers closed on July 1, 2026, and by that date only 281 of the 1,343 monitored firms in the EEA had secured authorization, roughly one in five.

That gap shows how much compliance friction MiCA has already introduced before any DeFi-specific licensing category exists, and ESMA’s proposal would add a new layer on top for any firm that routes customers into decentralized markets.

In practice, a wallet app or exchange that currently operates outside MiCA because it merely links to a DeFi protocol could need a license even though the protocol itself stays unregulated. That shifts compliance risk onto the customer-facing layer, which is exactly where enforcement actions have historically been easiest to bring.

The open question ESMA’s response does not resolve is how regulators will actually test for “meaningful human control” versus genuine decentralization, since a protocol can look distributed while a small group still controls key parameters. A January 2026 study found that regulatory announcements move individual tokens rather than the whole market, with governance and DEX tokens the most sensitive, suggesting enforcement against specific access points could hit targeted names hard even if total DeFi value is small. A Bank for International Settlements report adds that DeFi replicates traditional finance functions with greater risks of transparency, information gaps, and financial instability, the systemic risk ESMA’s licensing push is ultimately aimed at closing.

The CCS read. We read this as a filter that favors scale. Licensed exchanges and wallet providers with compliance teams can absorb a new access-point category; smaller interface builders and aggregators cannot, which pushes DeFi traffic toward a narrower set of regulated front ends even as the protocols underneath stay untouched. That consolidation at the gateway layer, not the 4% market share figure, is the number worth tracking.

The European Commission will now weigh ESMA’s response alongside the EBA’s parallel submission as it drafts its formal MiCA review, with no confirmed date yet for when a DeFi access-point licensing rule would reach the European Parliament for a vote.