The European Securities and Markets Authority (ESMA) has responded to the European Commission’s public consultation on the review of the Markets in Crypto-Assets Regulation (MiCA). The response is dated 30 September 2026. It arrives after 1 July 2026 marked the end of the MiCA transitional period. Nothing in the paper changes the rules today, but it tells an authorised CASP which product lines sit on contested ground.
The Commission decides what goes into a legislative proposal, and the co-legislators decide after that. In our reading, though, a supervisor that has written down where it sees risk is likely to ask about those same areas during authorisation reviews and ongoing supervision long before any amendment lands. This note walks through the six proposals that touch a working exchange or custodian, then the simplification asks, then what has not changed.
Stablecoins: an explicit prohibition
ESMA says the current framework gives rise to uncertainty about the extent to which authorised CASPs may continue to facilitate the availability, use or trading of unauthorised stablecoins. It invites the Commission to amend the Regulation to provide explicitly that a CASP cannot provide any licensable service under MiCA in relation to ARTs or EMTs that are not compliant with MiCA.
This is not a new direction. ESMA points to the Commission’s Q&A 2404 and its own public statement, which already say that the prohibition on offering unauthorised stablecoins may extend to crypto-asset services that amount in practice to seeking admission to trading. The proposal would remove the interpretive room that remains. A CASP that still lists, custodies or exchanges a non-compliant stablecoin for EU clients should expect that room to narrow rather than widen.
Gateways to DeFi
ESMA has observed authorised CASPs facilitating client access to DeFi products or protocols. It proposes a new regulated crypto-asset service covering the provision of access to decentralised protocols or DeFi services by a CASP on behalf of clients. The obligations ESMA lists are disclosure of protocol risks, transparency on protocol selection and routing, management of conflicts of interest, due diligence on the protocols made available, and operational and cybersecurity safeguards.
ESMA also wants a definition of DeFi written into the legal text, and says the exemption should be as narrow as possible to stop it being used to circumvent MiCA. It names the risk as “decentralisation washing”, where an identifiable operator relies on DeFi-type language to avoid MiCA obligations. For a CASP that offers a front end to a DEX or a lending protocol, the practical implication is that protocol due diligence and routing transparency are likely to be treated as expected conduct, whether or not the new service is ever created.
Staking and lending
ESMA asks the Commission to clarify that staking services provided by authorised CASPs should be subject to targeted conduct, disclosure and safeguarding requirements, without automatically treating staking as lending or investment management. The disclosures it lists cover rewards, lock-up and unbonding periods, slashing risk, validator selection, fees, operational dependencies and insolvency treatment. That list reads like a checklist a supervisor could apply to any staking page today.
ESMA describes client lending programmes as effectively black boxes for clients, who entrust their assets in exchange for uncertain returns. It asks for rules on CASPs offering or facilitating lending, such as express written client consent and disclosure requirements. A CASP running a yield programme should be able to explain, in writing, who the ultimate borrowers are, what collateral sits behind the loans and how much yield the CASP keeps. If it cannot, the programme is the kind of product the paper is aimed at.
Nothing in the paper changes the rules today, but it tells an authorised CASP which product lines sit on contested ground.
Cost claims and marketing
ESMA says it has seen CASPs providing exchange services claim zero commission trading and tight spreads when the spread applied is in fact high enough to recoup or exceed the loss from zero commission. It proposes requiring CASPs providing execution, RTO and exchange services to give investors full cost information. Zero-fee headlines on a trading page are, in our view, the single easiest thing for a supervisor to test against a firm’s actual spread.
ESMA says NCAs find it difficult to apply MiCA marketing rules to influencers and third parties promoting crypto-assets on behalf of issuers and CASPs, because MiCA does not apply to them. It proposes that MiCA introduce obligations for influencers and third parties promoting crypto-assets and crypto-asset services. ESMA also wants the reverse solicitation exemption in Article 61 interpreted consistently and as narrowly as possible. Firms that pay promoters, or that rely on reverse solicitation for EU clients, should read both points together.
Simplification for MiFID firms
Today a MiFID II investment firm notifying under Article 60 still needs a separate CASP authorisation under Article 63 to provide crypto-asset transfer services, because transfer services are not on the Article 60(3) list of services deemed equivalent to investment services. ESMA proposes amending MiCA so that transfer services equivalent to investment services a firm is already authorised to provide can be offered through the notification route, without a separate licence under Article 63. For a bank or broker that has stayed out of transfer services because of the second licence, this is the proposal most likely to change a business decision, but only once it is adopted.
What still applies
A consultation response is an input, not an output. ESMA refers to the MISP proposal to transfer CASP supervision to ESMA, and frames some of its asks as applying whether or not that proposal is adopted. So two things are in motion at once: the substance of MiCA, and who supervises CASPs. Neither has moved yet.
ESMA’s own assessment is that MiCA provided a solid framework for investor protection through its conduct, governance and disclosure requirements applicable to CASPs. Those requirements are unchanged by this paper. Authorisation conditions, custody and segregation, conflicts, complaints handling, market abuse and white paper obligations all apply as they did before the transitional period ended. The existing Q&A and ESMA statement on non-compliant stablecoins also stand. The right way to read the response is as a statement of where ESMA thinks today’s rules are hard to enforce, and therefore where it is likely to look hardest.
What firms should do
Inventory the product lines the paper names. List every ART and EMT the firm supports, every DeFi interface, every staking, lending or borrowing programme, every zero-commission claim and every paid promoter, and mark which are live for EU clients.
Test each stablecoin against MiCA compliance now. Where an ART or EMT is not compliant, decide this quarter whether to delist or restrict, using the existing Q&A 2404 and ESMA statement as the standard, and record the reasoning.
Write the staking and lending disclosures ESMA lists, even before they are required. Rewards, lock-ups, slashing, validator selection, fees, insolvency treatment, borrower identity and collateral: if a page cannot answer these, fix the page or pause the product.
Reconcile cost claims with real spreads. Pull a sample of executed trades and compare the all-in cost with what the marketing says.
Document DeFi protocol due diligence and routing logic, and the conflicts policy that governs them.
If the firm is a MiFID investment firm notifying under Article 60, track the transfer services proposal but do not act on it until it is law.
Taft reviews a CASP’s live products against the current rulebook and against the direction supervisors have signalled; a review of live products against the current rulebook is the usual starting point. For the baseline obligations that have not moved, see Taft’s crypto compliance guide for digital assets. Where a delisting or restructuring decision turns on legal classification, take legal advice.
Sources
- ESMA calls for changes to make MiCA clearer, safer and ready for emerging services, ESMA
- 30 September 2026, ESMA
Taft does not provide legal advice. Content is for informational purposes only and subject to regulatory guidance.