EBA Wants MiCA at DeFi's Front Door and the Gateway Is the Target

The European Banking Authority is not asking Brussels to police every smart contract. Its September 24 response to the MiCA review points instead at the regulated firms that make DeFi lending easy to reach, proposing rules for crypto borrowing, lending and crypto asset service providers that route clients into protocols. That distinction is the real market consequence. A recommendation recirculating on October 22 has not changed EU law, but it sketches a path that could turn exchange apps, curated vaults and one click protocol access into regulated services.

For practical risk controls, review AirdropHotList's crypto safety guide.

The headline is new but the EBA recommendation is not

The timing matters. The EBA published its position on September 24, 2026, almost one month before the latest headlines. It asked the European Commission to consider regulating crypto lending, including cases where licensed crypto asset service providers, or CASPs, facilitate access to decentralized lending protocols.

This is a recommendation rather than an enacted MiCA amendment. The Commission's targeted MiCA consultation closed on September 30, and its findings may inform a future report and, if warranted, a legislative proposal. No new lending license, leverage cap or DeFi certification requirement took effect on October 22.

The signal is still stronger than one agency acting alone. On September 30, the European Securities and Markets Authority separately proposed a new regulated crypto asset service for firms providing access to DeFi protocols. ESMA also backed proportionate disclosure requirements for staking, borrowing and lending. Together, the positions show EU supervisors converging on the distribution layer between regulated platforms and onchain finance.

MiCA could reach DeFi without controlling the underlying code

The EBA's detailed submission asks the Commission to conduct a cost benefit analysis on two potential changes: adding intermediated crypto borrowing and lending to MiCA's list of regulated CASP services, and imposing requirements on CASPs that give clients access to DeFi through interfaces or products providing protocol exposure.

Its policy options are unusually concrete. They include suitability tests, leverage limits, detailed risk disclosures, additional warnings for DeFi access, restrictions involving unauthorized stablecoins and a possible certification regime assessing whether lending protocols can withstand cyberattacks.

This creates the central investor paradox: the easier regulated companies make DeFi to use, the easier DeFi becomes to regulate. A protocol may remain autonomous, permissionless and accessible through a self-hosted wallet. A licensed exchange that embeds the same protocol into an app, chooses the markets, curates the collateral or packages the exposure for retail users could acquire obligations that the underlying contracts do not have.

The unresolved question is where "facilitating access" begins. A simple link, an integrated interface, an automatically routed trade and a managed vault represent very different degrees of control. The final definition could determine whether Europe gets a narrow conduct framework for intermediaries or a broad compliance perimeter covering much of consumer-facing DeFi.

The lending market is shrinking as the perimeter expands

The regulatory push is arriving during a contraction rather than a lending boom. Galaxy Research found that total crypto-collateralized lending fell by $11.33 billion, or 16.78%, during the second quarter of 2026, ending June at $56.16 billion. Outstanding borrowing through DeFi lending applications fell 27.61% to $20.43 billion, while centralized lending declined 9.62% to $22.98 billion.

Galaxy characterized the retreat as measured deleveraging rather than a replay of the cascading failures seen in 2022. That distinction matters for the EU debate. Supervisors are not reacting only to insolvencies at centralized lenders; the EBA highlights persistent structural risks including collateral chains, automatic liquidation cascades, commingled assets, weak disclosures, hacks and the absence of conventional creditworthiness checks.

New obligations would nevertheless change product economics in a market already operating with smaller loan books. Suitability assessments, protocol reviews, disclosure systems and leverage controls would raise the fixed cost of offering lending access. Large licensed CASPs may be able to absorb that burden, while smaller gateways could limit supported protocols or avoid lending products entirely. That consolidation outcome is analysis, not an announced policy objective, but it follows directly from placing responsibility on the intermediary.

Stablecoins make the gateway question immediate

Stablecoins connect the proposed lending rules to MiCA's existing enforcement machinery. The EBA says two stablecoins dominate borrowing and lending activity in line with their market capitalizations. Its submission describes one as an authorized e-money token and the other as meeting the e-money token definition even though its issuer had not sought MiCA authorization.

The agency also identifies a potential arbitrage: MiCA restricts issuers and CASPs from offering interest on e-money tokens, while users may still pursue yield by lending those tokens. The EBA therefore suggests that CASPs could be prohibited from intermediating or facilitating loans involving asset-referenced tokens or e-money tokens whose issuers lack the required authorization.

That suggestion sits beside a more immediate supervisory action. On October 8, ESMA told national regulators that MiCA-authorized CASPs should stop providing services related to noncompliant stablecoins. Pre-existing exposures should be remediated as soon as possible and no later than three months after the opinion, leaving continuation only for limited activities such as liquidation, conversion, withdrawal, transfer or safekeeping.

For DeFi gateways, the practical issue is no longer limited to whether a lending service might be added to MiCA later. Licensed platforms already need controls preventing clients from acquiring or increasing exposure to noncompliant stablecoins through covered services. A future lending amendment could make the same firms responsible for which protocol markets they expose and how those markets are presented.

Regulation could also create an institutional DeFi channel

The bear case is that compliance walls reduce protocol access and liquidity for European users. The counter-case is that a defined service category gives banks, exchanges and asset managers a clearer route into onchain credit. Certification could become restrictive if poorly designed, but it could also give regulated firms a common standard for assessing smart contract security, governance controls and operational resilience.

Intermediated onchain credit is already becoming a distinct business model. Galaxy's GOFR program, launched in July, aggregates financing across protocols including Aave, Morpho, Spark and Kamino while presenting Galaxy as the client's counterparty. The product is aimed at institutions rather than EU retail users, but it illustrates exactly why regulators are focusing on the gateway: protocol exposure can be packaged behind a conventional commercial relationship.

The likely dividing line is therefore not CeFi versus DeFi. It is unassisted protocol use versus mediated access carrying interface design, asset selection, custody, routing or counterparty promises.

Related Opportunities

Compare similar airdrops

Before choosing one campaign, compare trust signals, effort level, and reward potential.

Arcus Exchange View details → JoinCare View details → Breath of Estova View details →

The four signals investors should watch

• The Commission's next text: whether its MiCA report or legislative proposal explicitly adds lending and borrowing to the CASP service list.
• The gateway definition: whether "facilitating access" captures only managed products or also interfaces, routing tools and other integrations.
• The safeguards that survive: especially suitability tests, leverage limits, protocol certification and restrictions tied to unauthorized stablecoins.
• Stablecoin enforcement: how national regulators apply ESMA's October 8 opinion to exchanges and other CASPs offering routes into onchain markets.

Conclusion

The EBA has not brought DeFi lending under MiCA, and today's renewed attention should not be mistaken for a new rule. What is confirmed is a coordinated regulatory direction: both the EBA and ESMA want supervised firms to carry responsibility when they turn decentralized protocols into accessible financial products.

That makes the gateway more important than the smart contract for Europe's next phase of crypto regulation. If the Commission follows through, DeFi itself may remain open while its easiest, most liquid and most institution-friendly entrances become licensed territory.