France Proposes MiCA Rules to Hold Crypto Platforms Liable for DeFi Access Failures

Published October 21, 2026, 4:50 PM PKT. Based on the joint response published by France's AMF, Treasury, Banque de France and ACPR on October 21, 2026 (primary source), with reporting from CoinTelegraph on October 21, 2026 and Basis Desk (secondary sources).

France's financial authorities have proposed that crypto platforms which actively connect customers to decentralized finance protocols should face liability for certain client losses when they fail to vet the protocols or ignore known security risks, according to a joint response published on October 21, 2026 by the Autorite des Marches Financiers (AMF), the French Treasury, the Banque de France and the Prudential Supervision and Resolution Authority (ACPR). The proposal, submitted to the European Commission's consultation on reviewing the EU Markets in Crypto-Assets Regulation (MiCA), would close a gap the authorities say leaves customers exposed when a regulated platform acts as the gateway to a DeFi protocol. "CASPs should be liable for certain incidents affecting clients where they actively facilitated access," the French authorities said, using MiCA's term for crypto-asset service providers.

The DeFi liability proposal

MiCA currently excludes crypto services provided in a fully decentralized manner without any intermediary, according to CoinTelegraph's account of the proposal. France's plan does not try to regulate fully decentralized protocols directly. Instead, it targets the regulated middleman: a platform that routes its customers into a protocol would carry new duties, and liability would follow when it actively facilitated access without proper checks. That distinction matters for exchanges and wallet apps that list DeFi features beside ordinary trading, because the proposal treats the act of connecting customers as the trigger for responsibility, not merely the existence of the underlying protocol.

The proposal is a consultation response, not a law. The European Commission is reviewing whether MiCA needs updating as crypto markets develop, and its consultation sought views on activities outside the law's original scope, including DeFi. The responses will inform a report to EU lawmakers due by June 30, 2027, which could include proposals to amend the law, according to CoinTelegraph. Nothing in the French response changes any platform's obligations today, and any liability rule would still have to survive the Commission's report and the EU legislative process.

What platforms would have to do

Under the French proposal, platforms would have to vet DeFi protocols before offering access to customers and monitor them for vulnerabilities and suspicious activity, according to CoinTelegraph. The authorities also backed certification of protocols and smart contracts, along with platform liability for certain incidents. Platforms could still connect customers to uncertified protocols, but only if they conduct their own due diligence and provide enhanced risk disclosures, the authorities said.

The requirements would apply fully to significant CASPs, with obligations scaled for smaller providers, according to CoinTelegraph. The scaling point matters because the same rulebook would otherwise land hardest on small firms: a large exchange with a dedicated compliance team would face the full regime, while a smaller provider would face proportionate duties. The French authorities did not publish a detailed liability test in the summaries of their response, such as which incidents would trigger payment or how losses would be measured, leaving the hardest design questions for the Commission's review.

ESMA and the significant CASP test

Beyond DeFi, France backed plans to transfer supervision of significant CASPs from national regulators to the European Securities and Markets Authority (ESMA), according to CoinTelegraph. The authorities also proposed lowering MiCA's current threshold of 15 million average daily active users in the EU for identifying significant CASPs. They suggested considering custody assets, business risks and group complexity when deciding which platforms should fall under ESMA supervision.

The French push aligns with ESMA's own consultation response, which proposed a new regulated crypto-asset service covering access to DeFi protocols where a CASP acts on behalf of its clients as a gateway to such services, according to a Mondaq summary of ESMA's response. Under ESMA's version, the gateway CASP would face obligations on disclosure of protocol-related risks, protocol selection and routing criteria, conflicts of interest, due diligence on the protocols made available to clients, and operational and cybersecurity safeguards. ESMA also argued that the absence of a precise definition of DeFi is generating divergent interpretations and a risk of decentralisation washing, where arrangements are presented as decentralised despite identifiable operators or intermediaries.

Stablecoins and the ART category

France also called for a review of MiCA's asset-referenced token (ART) category, which covers tokens designed to maintain a stable value by referencing assets or combinations of assets, according to CoinTelegraph. The authorities noted that no ARTs had been authorized under MiCA and proposed adapting the e-money token (EMT) framework to cover multicurrency stablecoins. The point is a practical one: if the ART category has produced zero authorizations, the framework built around it is not describing the stablecoin market as it actually exists, and France wants the EMT rules stretched to cover tokens that reference more than one currency.

The stablecoin push sits beside France's separate domestic tax debate, which MABOnChain covered on October 17, 2026, when the National Assembly backed taxing crypto-to-stablecoin swaps at 31.4%. The MiCA review proposal is different in kind: it is about who supervises platforms and stablecoin issuers across the EU, not about what French taxpayers owe on a swap. Readers should not confuse the two tracks, even though both landed in the same October budget and regulatory season.

Wallets and what happens next

The authorities also addressed non-custodial and self-custodial wallets by opposing blanket certification requirements for developers, according to CoinTelegraph. They favored voluntary certification for more advanced wallets that integrate DeFi services. The stance draws a line the rest of the proposal does not: developers who publish wallet software without holding customer funds would not face mandatory certification, while platforms that actively intermediate customer access to DeFi would.

What happens next is procedural. The Commission will evaluate consultation feedback, including the French response, and submit its assessment report to EU lawmakers by June 30, 2027. That report could propose amendments to MiCA, or it could conclude that existing rules suffice. Until then, the French proposal is best read as a negotiating position from one of the EU's largest financial centres: platforms that intermediate DeFi access should be treated as responsible for the doors they open, significant firms should answer to ESMA rather than only to national regulators, and the stablecoin categories should be rebuilt around the products that actually exist.

This article is news reporting and is not investment advice.

Sources

• AMF, MiCA review: The AMF, ACPR, Banque de France and French Treasury publish their joint proposals (October 21, 2026), primary source
• CoinTelegraph, France Proposes Crypto Exchange Liability for DeFi Access (October 21, 2026), secondary source
• Basis Desk, France Proposes MiCA DeFi Liability for Crypto Exchanges (October 21, 2026), secondary source
• Mondaq, Response To The European Commission's Consultation On The Review Of MiCA (ESMA consultation response summary, background), secondary source