MiCA revision: France wants exchanges to be liable for clients' DeFi losses

If your exchange routes you into a DeFi protocol and your money is lost there, the exchange should share the liability. That is what four French authorities demand in their joint submission on the revision of the EU regulation on markets in crypto-assets.

Here is what is documented so far: the Direction Générale du Trésor, the markets regulator AMF, the Banque de France and the banking supervisor ACPR have published a joint response to the European Commission's MiCA consultation, and it contains the sentence that service providers should answer for certain incidents where they actively facilitated access. Our own assessment follows further down: the proposal mainly shifts the burden of vetting, and it shifts it to where that burden is already cheapest to carry.

What the four French authorities submitted on the MiCA revision

The European Commission has put MiCA up for review and ran a public consultation on it. According to the French Treasury's publication, the procedure ran from May 20 to September 30, 2026. Among the submissions is a joint response from the four bodies named above, which the Treasury dates to October 20, 2026, while the AMF dates its own press release to October 21, 2026. The full paper sits on the Treasury's website as an English-language PDF of around 1.8 megabytes.

That four bodies sign jointly is the real news here. In France, crypto supervision and monetary policy are organised separately: the AMF oversees markets and service providers, the ACPR banks and insurers, the Banque de France the payment systems, and the Treasury is responsible for legislation. A submission carried by all four is not one regulator's opinion but a coordinated negotiating position of a large member state for the coming rounds in Brussels.

Liability for DeFi access: when a provider would have to answer under the proposal

The core for retail investors sits in the DeFi section. The authorities do not want to ban decentralised finance applications in Europe, but to fence them in. The AMF names as building blocks, in its own words, "clearly assigned responsibilities for intermediaries, appropriate due diligence obligations and protocol certification". The Treasury puts the same thought in French as "des responsabilités clairement attribuées aux intermédiaires".

In concrete terms, according to Cointelegraph's reporting on the paper, a licensed service provider should be liable for certain incidents affecting its clients where it actively facilitated access to a protocol. The wording quoted is that providers "should be liable for certain incidents affecting clients where they actively facilitated access". Which incidents exactly fall under that, the paper leaves open according to this report.

Two duties hang on this. First, the platform should vet a protocol before it lets clients anywhere near it. Second, it should keep monitoring that protocol afterwards, for vulnerabilities and for unusual activity. A provider that ignores a known security flaw and keeps access open should no longer be able to argue, under the proposal, that the protocol is somebody else's code.

Why MiCA currently exempts fully decentralised services

The proposal targets a gap that MiCA left deliberately. The regulation covers service providers that custody, exchange or transfer crypto-assets for others. Services provided in a fully decentralised way, without an intermediary, are carved out. A protocol that consists only of smart contracts on a blockchain and is operated by nobody therefore has no addressee that a supervisor could pursue.

In practice that borderline case has stayed rare. Most investors do not reach a protocol through their own software but through an app that builds in the access for them. That is exactly where the French proposal strikes: not at the protocol, but at the door. To see how far a given provider's licence reaches, the houses available in Germany are set out in the overview of regulated crypto exchanges.

Certification of protocols and smart contracts as a new vetting step

Instead of a ban, the authorities bet on a certificate. Protocols and smart contracts should be able to be audited and confirmed, and a platform that connects only certified protocols would have a solid basis for its due diligence. Who issues the certificate, and against which criteria, is not yet settled according to the reporting available.

What matters in practice is the back door the paper leaves open. A platform may also let its clients reach a protocol that is not certified, provided it carries out the vetting itself and flags the risks more prominently. That turns the certificate into something other than a market-access filter: it becomes a liability anchor, shifting the burden of proof over who had to know what when a loss occurs.

Self-custody wallets stay exempt from a certification duty

For holding your own keys, the proposal brings relief. The authorities come out against a blanket certification duty for developers of self-custody wallets, meaning software where the user alone holds the keys. They favour voluntary certification only where a wallet goes further and integrates advanced DeFi services.

Self-custody means the private keys to your crypto-assets sit on your device, not with a provider. That distinction has become the pivot of the European debate in recent months, because any duty on wallet developers would catch open-source software that nobody releases commercially. How separate custody can be handled with dedicated devices is shown in the hardware wallet comparison.

Tiered duties: large service providers carry the full load

The authorities do not want the new duties spread evenly. They should apply in full to significant service providers, called "significant CASPs" in the paper, meaning the large trading venues with many clients. For smaller providers the requirements should be tiered. What that tiering looks like, the report does not say.

The mechanism behind it is familiar from banking regulation: the bigger you are, the more intensively you vet and the more you document. For the market that means two things. The largest houses will either insure their DeFi offerings at greater cost or narrow them, while smaller providers might keep access open and attach more explicit warnings. For customers, that changes where the most convenient route into a protocol lies.

Stablecoins: a ban on services involving non-MiCA-compliant tokens

A second block of the paper concerns stablecoins, tokens pegged to a currency. The authorities explicitly call for service providers licensed in the Union to be barred from offering services on stablecoins that do not meet the MiCA requirements. Today that line is softer in daily practice than the regulation suggests.

There is also a push on so-called multi-issuance, the case where the same stablecoin is issued both in the EU and in a third country. The authorities want that construction regulated, through equivalence assessments of third-country supervision, through cooperation between supervisors, and through additional guarantees on reserves and on the right of redemption. Euro stablecoins and tokenised bank deposits, by contrast, they want to see move faster, especially in cross-border payments.

ESMA supervision and crypto conglomerates: competences would move upwards

Institutionally, the paper aims at a shift. The role of the European securities regulator ESMA should be strengthened, in supervising significant service providers and the crypto business of conglomerates, meaning corporate groups that run exchange, custody, issuance and lending under one roof.

Today each national supervisor grants its own licence, in Germany BaFin, and a licensed house may then operate across the entire EU. A stronger ESMA would place those licences for the largest providers under one shared supervisor. Which obligations a MiCA licence triggers today is set out in our overview of the MiCA duties for crypto companies.

Staking, lending and borrowing: the rules the authorities want clarified

A further point concerns services that have long been routine for investors. The authorities propose clarifying the rules for staking and for the lending and borrowing of crypto-assets. Staking means you lock up tokens to help secure a network and receive a reward for it. With lending you make tokens available as credit and receive interest.

Both fall only partly under MiCA today, depending on how a provider structures its product. That vagueness has produced very different offerings across the single market in recent months, as the interview with BTCS adviser Wojciech Kaszycki on crypto lending under MiCA on cryptoticker.io also shows. Until the rules are clarified, which counterparty you face when you lend out your tokens sits in each provider's fine print.

What the proposal changes for investors in Europe

Nothing changes today. A submission to a consultation is not a law, and MiCA continues to apply unchanged. The paper is nevertheless not without consequence, because providers plan their products with lead time. A liability rule that is seriously on the table shapes product design long before it takes effect.

In practice that means three things. First, check whether your provider offers DeFi access at all and what it calls it, because labels such as Earn, Vault or Swap often obscure whose code ends up holding your money. Second, look at who your counterparty is if something fails: the licensed service provider, or a protocol with no operator. Third, expect convenient in-app routes to disappear or to acquire additional warning screens if the liability question prevails in Brussels. Custody you can make independent of all this, by moving holdings you intend to keep for longer onto your own device.

From the September 30 consultation deadline to the Commission report

The timetable is the calm part of this story. The consultation closed on September 30, 2026, and the French response was published three weeks later. The submissions feed into a report from the Commission to the EU legislators, which according to Cointelegraph is due by June 30, 2027 and may contain proposals to amend MiCA. Only after that does the actual legislative procedure with Parliament and Council begin.

cryptoticker.io has already reported on the start of that procedure, back when the deadline for submissions to the MiCA consultation was still running. What was an open deadline then is a position on the table now. Between those two steps lie no changes to the law, but arguments.

Our assessment: the proposal shifts the vetting burden, not the risk

From the editorial desk's point of view this is the most honest part of the paper and at the same time its weak spot. In its favour: the authorities do not invent an addressee where there is none. The protocol remains untouched, and the party put under obligation is the licensed provider, which already has a licence, an address and a supervisor. The approach is documented by the AMF's quoted formula, which assigns responsibilities to intermediaries, and by the carve-out for self-custody developers, which shows the authorities know the difference between an operator and a tool.

Against it stands the fact that a smart contract does not become safer through certification. The risk stays in the code; it merely migrates into an audit report and an insurance premium. In our assessment that premium ends up with the customer, and anyone suffering a loss must still prove the platform breached its duty to vet. Which incidents are covered at all, the paper so far leaves open, and that is precisely where it will be decided whether the liability becomes a claim or a formula. None of this is investment advice, and with crypto-assets a total loss remains possible.

DeFi liability under MiCA: Brussels decides by June 30, 2027

1. Check in your account which products your provider uses to offer DeFi access, and compare its licence with the other houses in the overview of regulated crypto exchanges.
2. Separate holdings you intend to keep for longer from your trading accounts and move them to a dedicated device from the hardware wallet comparison.
3. With interest and staking offers, read carefully who your contractual counterparty is, and line the terms up side by side in the lending comparison.

(As of October 22, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Sources: AMF press release on the MiCA revision and publication by the Direction Générale du Trésor.