1. What France Is Asking the European Commission to Do
On October 21, France's Treasury, its markets regulator the AMF, the Banque de France and the prudential supervisor ACPR published a joint position urging the European Commission to make regulated crypto platforms liable for certain client incidents when they give customers access to decentralized finance (DeFi) without adequate checks. The proposal would change how MiCA, the EU's crypto-asset rulebook, reaches DeFi.
The position was submitted as a response to the Commission's targeted consultation on reviewing the Markets in Crypto-Assets Regulation, known as MiCA. It is a policy recommendation, not a legal text. Any amendment to MiCA would have to be proposed by the Commission and then negotiated and adopted by EU lawmakers, a process that normally takes a long time.
The core idea is simple to state. If a licensed exchange or broker chooses to route its customers into a DeFi protocol, the four French bodies argue, that platform should carry part of the responsibility for what follows, particularly where it did not properly evaluate the protocol beforehand.
2. Why Fully Decentralized Services Fall Outside MiCA Today
MiCA regulates identifiable businesses: issuers of crypto-assets and crypto-asset service providers, usually abbreviated CASPs. A CASP is a firm such as an exchange, custodian or broker that is authorized to serve clients in the EU and must meet requirements on governance, safeguarding of client assets and conduct.
Services that are fully decentralized, meaning no person or company controls them, currently sit outside that framework. A lending pool or automated trading venue that runs on smart contracts without an operator has no obvious entity to license, which has long been a puzzle for regulators who want investor protection without banning open protocols.
The French authorities propose a different route. Rather than demanding a full license for protocols that nobody controls, they want EU rules to reach DeFi through the CASPs that stand between users and those protocols. The regulated intermediary becomes the point where obligations attach.
The gap has practical consequences. A customer of a licensed exchange who is routed to an on-chain lending market may assume that the protections attached to the exchange continue to apply, even though the protocol itself is not supervised by anyone. The French proposal tries to narrow the distance between that assumption and reality by giving the intermediary an explicit job.
MiCA itself was designed as a single EU-wide regime so that a firm authorized in one member state can serve clients across the bloc. A review of the regulation is therefore a rare opportunity to adjust how it treats activity that was left at its edges when it was first drafted, which is why national authorities are using the consultation to set out detailed positions.
3. What Are the Three Pillars of the French Proposal?
The response sets out three elements. The first is due diligence and continuing monitoring by CASPs. The second is prior certification of protocols and smart contracts. The third is liability for the CASPs themselves. The authorities say these duties should apply in full to CASPs classed as significant.
Taken together, the pillars aim to combine private checking by the platform with independent verification of the code, and to back both with a legal consequence if the platform fails in its role. The authorities frame the package as preferable to a blanket ban on DeFi access through regulated firms.
4. Which Checks Would a Platform Run Before Offering DeFi Access?
Before opening access to a protocol, a platform would assess whether the protocol is genuinely decentralized. It would also examine weaknesses in the smart contracts, the protocol's audit history and any earlier incidents, along with risks tied to governance, liquidity and oracles, the data feeds that supply prices to on-chain applications.
Exposure to bridges, which move assets between blockchains and have been a frequent target of attackers, would be reviewed as well. The platform would also look for links to illicit funds, using blockchain analytics tools that trace the history of addresses and transactions.
The authorities also recommend that users see a pop-up notice before entering a protocol, telling them that the service is unregulated. The measure is intended to make plain that moving from a regulated platform into DeFi means leaving behind many of the protections that apply to ordinary MiCA services.
5. When Would a Platform Be Held Liable?
The French bodies say CASPs should be liable for certain client incidents where they actively facilitated access to a protocol. The position is strongest in three situations: the platform skipped adequate due diligence, it ignored known vulnerabilities, or it kept access open even though there were clear signs of illicit activity or material operational weaknesses.
The wording is deliberately conditional. It does not suggest that platforms would be answerable for every loss in every protocol. The test turns on what the platform knew, what it should have checked and whether it acted on the warning signs that were available to it.
The authorities also acknowledge an unresolved question: who is responsible for assets that a client has deposited into a DeFi protocol. They say this point needs clarification from the European Commission and the European Supervisory Authorities, the EU bodies that coordinate financial supervision.
In practice, a liability rule of this kind changes incentives. A platform that knows it may have to answer for an incident has reason to document its assessment, to refresh that assessment as a protocol changes and to withdraw access when new warning signs appear. Conversely, a platform that cannot assess a protocol credibly would have reason not to list it at all.
6. How Would Certification of Protocols Work?
The four bodies back an independent certification scheme for protocols and smart contracts. A certificate would be tied to a specific code base, would remain valid for three years and would be recorded on-chain, so that anyone could check it against the code that is actually running.
Certification would not be demanded of everything. Only fully decentralized protocols above a significance threshold would need one, with total value locked, the amount of assets deposited in a protocol, given as an example of a measure that could set the line.
The authorities add a flexibility: the absence of a certificate would not by itself block access. A platform could still offer a protocol if it carried out its own review and gave clients more information about the risks involved.
They also say that requiring certification from every developer of a non-custodial wallet would be disproportionate for now. A non-custodial wallet lets users hold their own keys, and the response treats that category as too broad and too different from lending or trading protocols to be captured at this stage.
Recording certificates on-chain also serves a practical purpose. Because a certificate would be bound to a particular code base, a change to the code would call for a new review rather than leaving an old approval in place, which addresses a familiar weakness of one-off audits that quickly become out of date when a protocol is upgraded.
7. Certification, Not a Ban: The Policy Rationale
The response states a clear preference. A harmonized EU framework built on due diligence, certification, verified liquidity and monitoring is, in its view, better than a blanket ban. The approach tries to keep regulated customers able to reach on-chain markets while placing a duty of care on the firm that makes the connection.
That position reflects a tension regulators across many jurisdictions face. Open protocols can offer services that regulated firms cannot easily replicate, but users who lose funds to a coding flaw or a manipulated price feed have no regulator to turn to. Placing responsibility on the intermediary offers a point of accountability without trying to license software.
Supporters of this model argue that it keeps innovation within reach of European users. Critics of liability rules, however, tend to warn that they may push platforms toward a cautious list of a few established protocols, and that point is likely to feature in the wider debate as the Commission weighs the responses it has received.
8. Where Protocols Are Not Truly Decentralized
The French bodies insist that decentralization be real. Protocols that are not fully decentralized should be treated as MiCA service providers, in their view. The response says the status of DeFi must remain the exception, not the rule.
The point matters because many projects describe themselves as decentralized while an identifiable team retains control through upgrade keys, administrative permissions or front-end interfaces. Under the French position, a platform's checks would have to test that claim rather than accept it, and a protocol that fails the test would fall under ordinary service-provider rules.
9. Stablecoins and Supervision: Other Recommendations
The submission goes beyond DeFi. It asks that EU-authorized providers be explicitly barred from offering services on stablecoins that do not meet MiCA requirements. This would close a gap in which a licensed firm could handle a token that the regulation itself would not allow to be marketed in the EU.
It also calls for a larger role for ESMA, the European Securities and Markets Authority, in supervising significant CASPs. Today much of the supervision of crypto firms is carried out by national authorities, and the French response points toward more centralized oversight for the largest players.
10. What Happens Next
The document is an input to the Commission's review of MiCA and carries no binding force. The Commission will weigh it alongside other responses to the consultation, and any change to the regulation would need to go through the EU legislative process before it applied to platforms.
For crypto exchanges and brokers in Europe that offer, or plan to offer, access to DeFi, the proposal signals the direction in which at least four influential French authorities want the rules to travel: more documented checks before access, clearer warnings to clients and a legal consequence for platforms that ignore evidence of risk.