French authorities have proposed revisions to the European Union’s Markets in Crypto-Assets Regulation (MiCA) that would impose liability on crypto-asset service providers (CASPs) for certain decentralized finance (DeFi) incidents. The joint proposal, published Wednesday by France’s Treasury, the Financial Markets Authority (AMF), the central bank, and the Prudential Supervision and Resolution Authority (ACPR), argues that regulated platforms facilitating access to DeFi protocols should be held accountable if they fail to vet those protocols or ignore known security risks.
Currently, MiCA excludes services provided in a fully decentralized manner without intermediaries. The French response to a European Commission consultation seeks to extend investor safeguards by requiring CASPs to conduct due diligence on DeFi protocols before offering access and to monitor them for vulnerabilities and suspicious activity. The authorities also backed certification for protocols and smart contracts. Significant CASPs would face full requirements, while obligations would be scaled for smaller providers. Platforms could still connect customers to uncertified protocols if they perform their own due diligence and provide enhanced risk disclosures.
Beyond DeFi liability, France proposed transferring supervision of "significant CASPs" from national regulators to the European Securities and Markets Authority (ESMA). The authorities suggested lowering the current threshold of 15 million average daily active users in the EU used to identify significant CASPs and recommended considering custody assets, business risks, and group complexity in this determination. Additionally, France called for a review of MiCA’s asset-referenced token (ART) category, noting no ARTs had been authorized under the regulation, and proposed adapting the e-money token framework to cover multicurrency stablecoins.
The French proposal marks a strategic pivot in how EU regulators intend to bridge the gap between centralized exchange infrastructure and decentralized protocol risks. By targeting CASPs as gatekeepers rather than attempting to regulate code directly, authorities are leveraging existing compliance frameworks to enforce security standards on DeFi interactions. This approach acknowledges the practical difficulty of supervising anonymous developers while placing the burden of care on licensed entities that profit from facilitating user access to these complex financial instruments.
If adopted, this shift could significantly alter the operational landscape for major exchanges seeking to offer yield-generating products. The requirement for rigorous protocol vetting and potential liability for security failures introduces substantial legal and financial risk to product listings. Furthermore, the push to centralize oversight of significant CASPs under ESMA suggests a move toward harmonized enforcement across the bloc, potentially raising compliance costs for platforms operating in multiple member states and forcing a reevaluation of which entities qualify as systemically important within the crypto ecosystem.
