European Banking Authority urges European Commission to review MiCA rules for crypto firms facilitating DeFi lending

The European Banking Authority has asked the European Commission to examine new MiCA rules for crypto firms that connect customers to DeFi loans.

Its September 24 response calls for a cost-benefit analysis of possible duties for intermediated borrowing and lending, and for crypto-asset service providers (CASPs) that give clients access to DeFi lending through interfaces or products.

A loan can run on an on-chain protocol while a company supplies the app that brings a customer to it. The EBA’s recommendation puts that company-controlled route within the Commission’s review, and it is a request to assess legislation, so the EBA’s response itself changes no lending rule.

The regulator said consumer risks prompted its call to examine the issue.

The EBA identified two possible changes. The first would add intermediating crypto borrowing and lending to MiCA’s list of CASP services, while the second would set requirements for CASPs facilitating access to DeFi lending protocols, whether through an interface or a product offering exposure to DeFi.

The Commission would need to weigh the scale of these activities, retail participation and the seriousness of the risks before deciding whether to pursue legislation.

Suitability tests could assess whether a customer should take part, while leverage caps and fuller disclosures could address borrowing risks.

For DeFi access, the EBA suggested extra warnings that activity through a truly decentralized protocol may lack regulatory safeguards. It also floated certification of lending protocols for resilience to cyberattacks.

A separate option concerns tokens whose issuers lack required MiCA authorization. The EBA said CASPs could be prohibited from intermediating or facilitating borrowing and lending involving assets that meet MiCA’s definition of an asset-referenced or e-money token but have no authorized issuer. The proposed restriction limits CASPs' access to those lending activities.

The response describes potential consumer harms behind the proposals, such as incomplete information about fees, yields, or changes to collateral requirements, leverage that can amplify losses, and risks from commingling, outages, hacks, and poor recordkeeping.

It also flags the absence of creditworthiness checks and possible over-indebtedness.

An app can connect a user to DeFi loans

MetaMask’s lending guide describes in-app access to Aave stablecoin pools, with mobile steps for depositing tokens. Aave’s access guide says users can reach the protocol through its interface, other applications, or direct smart contract interaction.

The documents show how users can access lending infrastructure through different routes.

Neither guide establishes whether MetaMask’s feature is available to EU customers or how any named operator would be classified under a future CASP rule. The EBA’s proposal specifically discusses CASPs that facilitate access.

Future lawmakers would still have to define that activity and decide how to treat direct smart contract use. Depending on those choices, an app could face checks or warnings at its entry point while a protocol continues executing loans on-chain.

The Commission’s targeted consultation closes on Sept. 30 at 11:59 p.m. Central European Summer Time. Feedback will inform its report on MiCA’s application and crypto-market developments.

The Commission says it may accompany that report with a legislative proposal if warranted. Until then, the EBA’s proposals signal a possible access and compliance boundary, with its reach and requirements still to be decided.

The EBA's document also points to why an access rule could differ across products. It asks the Commission to consider the nature and scale of an activity, the extent of retail participation, and the materiality of its risks.

The response mentions an interface giving protocol access, a service that intermediates a loan, and a product providing DeFi exposure. Any future measure would have to translate those distinctions into clear obligations for firms and customers, including the checks and disclosures attached to each route.