CASPs

The European Banking Authority has told Brussels that crypto lending, including loans routed through decentralized finance protocols, needs new rules under the Markets in Crypto-Assets framework. With the European Commission’s public feedback window closing Wednesday, September 30, 2026, at 11:59 p.m. CEST, just four days from today, wallets, exchanges and lending apps operating in the EU face the prospect of new suitability checks, leverage caps and disclosure duties on DeFi-linked products.

• EBA’s September 24, 2026 response urges Brussels to regulate crypto-asset lending, including DeFi-linked loan access.
• The proposal would add intermediated borrowing and lending to MiCA’s list of regulated crypto-asset service provider activities.

• Sept 30 deadline for the EC’s MiCA consultation, four days after the EBA’s letter
• 39 e-money tokens authorized under MiCA since mid-2024
• 0 asset-referenced tokens authorized under the same 21-month-old framework

The European Banking Authority has asked the European Commission to examine new MiCA obligations for crypto firms that connect customers to DeFi loans. Its September 24 response, first reported by CryptoSlate, calls for a cost-benefit analysis of duties for intermediated borrowing and lending and for crypto-asset service providers (CASPs) that give clients access to DeFi lending through interfaces or products.

A loan can run entirely on-chain while a separate company supplies the app that brings the customer to it. The EBA wants that company-controlled route brought inside the Commission’s review, though its letter itself changes no rule today.

EBA Proposes Two Concrete MiCA Changes for Lending Apps

The regulator identified two specific options for lawmakers to weigh. The first would add intermediating crypto borrowing and lending to MiCA’s existing list of regulated CASP services, alongside custody and exchange functions already covered.

The second would set requirements for CASPs that facilitate access to DeFi lending protocols, whether through a branded interface or a product offering exposure to DeFi yields.

Before drafting legislation, the Commission would need to weigh the scale of these activities, the extent of retail participation and the seriousness of the risks involved, the EBA said in its press release accompanying the response. Suitability tests could screen whether a customer should take part at all, while leverage caps and fuller fee and yield disclosures could address borrowing risk directly. For DeFi access specifically, the EBA suggested warnings that a truly decentralized protocol may carry no regulatory safeguards, plus voluntary certification of protocols for resilience against cyberattacks.

A separate, narrower option targets tokens whose issuers lack MiCA authorization. CASPs could be barred from intermediating or facilitating borrowing and lending involving any asset that meets MiCA’s definition of an asset-referenced or e-money token but has no authorized issuer behind it, tightening the on-ramp for unlicensed stablecoin-like assets.

Zero Authorized Asset-Referenced Tokens Expose a Gap in MiCA’s Framework

The lending recommendation sits inside a wider set of priorities the EBA laid out for the MiCA review. The authority said existing rules for issuers of asset-referenced and e-money tokens are broadly appropriate, but flagged “significant to very significant risks” from third-country multi-issuer stablecoin schemes and called for reserve requirements to be reviewed.

The authorization numbers underline the gap. As of September 1, 2026, 39 e-money tokens have been issued under MiCA since Titles III and IV took effect on June 30, 2024, yet zero asset-referenced tokens have been authorized in the same period, a disparity the EBA’s document does not explain but that leaves the ART category effectively dormant under a 21-month-old framework.

The consumer-harm list behind the lending proposal includes incomplete disclosure of fees and yields, leverage that amplifies losses, and risks from commingling, outages, hacks and poor recordkeeping. The EBA also cited the absence of creditworthiness checks and the potential for over-indebtedness among retail borrowers.

What remains unsettled is definitional. Neither MetaMask’s in-app guide to depositing tokens into Aave’s stablecoin pools nor Aave’s own access guide establishes how a future CASP rule would classify the operator of a lending front end versus the protocol itself. The EBA’s proposal targets CASPs that “facilitate access,” but