MiCA Review: ESMA Moves to Close Stablecoin and DeFi Loopholes

The European Securities and Markets Authority (ESMA) on September 30 published its recommendations for the review of the Markets in Crypto-Assets Regulation (MiCA), asking the European Commission to restrict licensed firms from offering services linked to non-compliant stablecoins and to create a new regulated category for businesses that give users access to decentralized finance protocols. The watchdog also wants stronger powers against unauthorized foreign companies targeting EU investors. The paper arrived on the last day of the Commission’s extended MiCA review consultation, roughly three months after the transitional period for crypto-asset service providers expired across the EU on July 1.

Licensed exchanges would lose the side doors to unlicensed stablecoins

MiCA already restricts the public offering and admission to trading of electronic money tokens (EMTs) whose issuers lack EU authorization, and most large exchanges delisted such tokens for EEA users between December 2024 and March 2025. ESMA is going after what remained open: lending products, collateral acceptance and conversion services in which a licensed firm handles a non-compliant token without formally listing it.

The European Banking Authority (EBA) described one such case in its September 24 response, an EMT-like stablecoin used in crypto lending whose issuer chose not to seek MiCA authorization. The EBA also wants tighter rules for multi-issuer structures, where a company issues interchangeable stablecoins through entities in several jurisdictions. Holders could redeem in the EU while the backing reserves sit abroad.

Classification is the quieter proposal with the widest reach. Hybrid tokens that mix features of several MiCA categories can be treated one way in one member state and differently in another, and the EBA noted that this uncertainty raises costs and delays product launches. Binding ESMA opinions would settle the question once for the whole bloc. Today a national authority can only request a non-binding opinion, and ESMA has issued just one so far.

39 e-money tokens and not one asset-referenced token

Source: EBA, data as of September 1, 2026

Fiat-backed tokens found issuers willing to meet the rules. The category built for coins backed by baskets of currencies or commodities has attracted none so far. Banks are starting to take part. As of September 1, three credit institutions issued EMTs directly and one had set up a subsidiary for the purpose, according to the EBA, while a consortium of EU banks is preparing its own euro token.

The website in front of a DeFi protocol would need its own licence

MiCA exempts services provided in a fully decentralized manner without an intermediary. Few users, however, touch a lending protocol directly. They reach it through a website, a wallet integration or an app run by an identifiable company that decides which protocols to show, how yields are presented and what warnings appear.

ESMA’s new category targets that company. The smart contracts would remain outside the perimeter, while the business connecting European customers to them would need authorization and would have to disclose DeFi risks, explain how it selects protocols and routes transactions, manage conflicts of interest and run due diligence on the protocols it offers. ESMA wants those duties scaled to how much control the firm has over the protocol, and says open-source development, self-custody and permissionless infrastructure should not on their own count as regulated intermediation. ESMA also wants the exemption itself narrowed. It reports that national authorities read “full decentralisation” differently, warns against “decentralisation washing” by identifiable operators that use DeFi language to escape MiCA, and asks the Commission to write a legal definition of DeFi into the regulation.

The EBA arrived at the same point from the lending side. It supports regulating cases where centralized firms route clients into decentralized lending protocols, citing misleading marketing, weak risk disclosure and the risk that lending is used to sidestep MiCA’s ban on paying interest on stablecoins. A joint EBA-ESMA report from January 2025 had already found intermediated crypto lending in at least 16 member states.

Central banks want MiCA’s 30% bank deposit floor scrapped

The ECB and the EU’s national central banks filed their own submission on September 22, and their main proposal would loosen an existing rule.

The logic concerns how deposits behave under stress. A stablecoin issuer with reserves concentrated at a few banks is a very different depositor from millions of households. If holders rush to redeem, the issuer pulls those deposits at once and the banks lose funding at the worst moment, so a rule written to protect token holders could pass a stablecoin run into the banking system. Short-dated assets would give issuers redemption cash without leaning on bank balance sheets. The same submission pushes the other way on yield. The central banks back MiCA’s ban on paying interest on stablecoins and want it extended to returns generated through lending, borrowing and staking, which would shut the route the EBA flagged from the lending side.

Malta’s 2025 licensing review still drives the push for ESMA control

National authorities license most crypto-asset service providers, and a firm authorized in one country can passport across the European Economic Area. Everything depends on the quality of that first approval. In July 2025 an ESMA peer review of Malta’s Financial Services Authority found that some material issues were not fully resolved before a licence was granted and that certain risk areas were not adequately assessed, although ESMA credited the Maltese regulator’s expertise. The Commission has since proposed giving ESMA direct oversight of crypto firms, and the ECB supports the move.

The end of the transition period showed the size of the enforcement gap. ESMA’s register listed 244 crypto groups authorized to serve EU customers as of June 26. The end of the transition period showed the size of the enforcement gap. ESMA’s register listed 244 crypto groups authorized to serve EU customers as of June 26, and ESMA’s response now asks for specific powers against third-country firms that solicit EU investors without a licence, with the reverse-solicitation exemption read as narrowly as possible.

Exchange earn products and EU-facing DeFi apps would feel it first

Licensed exchanges would have to review every product touching non-compliant tokens, including earn programs and collateral lists that survived the 2024-2025 delistings. Aggregators and apps that route EU users into DeFi protocols would need authorization or would have to stop serving them, while pure self-custody wallets and open-source developers would stay outside under ESMA’s wording. Smaller interface operators without compliance budgets face the hardest choice.

For issuers, a win for the central banks would push reserves toward very short-dated securities and change which banks hold their cash.

The Commission’s review report is expected by June 2027 and may come with legislative proposals, which the European Parliament and the Council would then need to approve. On a parallel track, the ECB launched Pontes on September 21 to settle tokenized wholesale transactions in central bank money, with full implementation planned by 2028, and ESMA has named tokenization a 2027 supervisory priority.