EBA Calls for MiCA Expansion Into Crypto Lending, DeFi Gateways and Stablecoin Reform
The EU’s crypto framework could expand beyond its current perimeter as regulators turn their attention to lending, decentralised finance and increasingly complex stablecoin structures.
On 24 September 2026, the European Banking Authority (EBA) published its formal response to the European Commission’s review of the Markets in Crypto-Assets Regulation (MiCA). The EBA recommends changes covering crypto lending and borrowing, CASP-facilitated access to DeFi, third-country multi-issuer stablecoins, reserve requirements, crypto-asset classification and supervisory reporting.
The recommendations are important, but their legal status needs to be clear. MiCA has not been amended by the EBA response. The document feeds into the Commission’s statutory review, and the Commission must present its report on MiCA’s application to the European Parliament and Council by 30 June 2027, accompanied by a legislative proposal where appropriate. Eur-Lex
For CASPs, stablecoin issuers, crypto lenders and businesses connecting customers to DeFi protocols, the response nevertheless provides one of the clearest indications so far of where the EU regulatory perimeter may move next.
For readers’ convenience, we have placed the key official EBA and EU regulatory materials at the end of this article.
Publish Date
29 Sep 2026
Reading Time
11 minutes
Category
Legal News
Jurisdiction
EU
MiCA is already moving from implementation to review
MiCA became fully applicable on 30 December 2024, while its provisions on asset-referenced tokens (ARTs) and e-money tokens (EMTs) had already applied from 30 June 2024. The maximum EU-level transitional period allowing certain pre-existing CASPs to continue under national rules ended on 1 July 2026, although Member States could shorten or decline that transition.
The Commission formally launched public and targeted consultations on the functioning of MiCA on 20 May 2026. Those consultations closed on 31 August 2026 and are intended to inform future EU digital-asset policy and the statutory review of the Regulation. Finance
The EBA’s September response is therefore not an isolated policy paper. It is regulatory input into a review process already required by the existing legislation.
The market is also giving regulators more evidence
The EBA’s own snapshot shows how the regulated market has developed since MiCA became applicable.
As of 1 September 2026, the EBA recorded 39 EMTs issued under MiCA and no authorised ARTs.
That imbalance is relevant to the review. It suggests that practical experience with fiat-referenced EMTs has developed much faster than experience with authorised ARTs, while products such as crypto lending and DeFi interfaces continue developing partly outside MiCA’s express service categories.
The review is therefore likely to involve two different questions: whether existing rules work as intended, and whether activities currently outside the Regulation should be brought within it.
Crypto lending could become a regulated EU crypto activity
One of the EBA’s most significant recommendations concerns crypto lending and borrowing.
The EBA answered the Commission’s question on whether these activities should be regulated with a clear “Yes.” It says crypto borrowing and lending are increasing in volume and value and are taking place across the EU through both intermediated and decentralised models.
This would be a material expansion of the current MiCA perimeter.
Crypto lending is not currently an express MiCA crypto-asset service
MiCA regulates a defined list of crypto-asset services, including custody, operation of trading platforms, exchange, execution of orders, placement, reception and transmission of orders, advice, portfolio management and transfer services.
Crypto lending and borrowing are not expressly established as standalone regulated crypto-asset services under the current MiCA framework. The EBA and ESMA had already highlighted this regulatory position in their earlier work on lending, borrowing and staking.
This does not mean a lending business is necessarily unregulated in every respect. A provider may simultaneously perform MiCA-regulated custody, exchange or other activities, while national law or other EU financial-services rules may also become relevant.
The significance of the EBA recommendation is that lending itself could receive a more explicit EU regulatory framework.
EU regulators have been studying the market for several years
The EBA and ESMA’s 2025 work found crypto lending and borrowing activity being intermediated in at least 16 Member States.
They also identified consumer risks around insufficient disclosure, collateral arrangements, interest and yield, insolvency treatment and the rights of customers whose assets are transferred or deployed by a provider.
The September 2026 response goes further by recommending regulatory action rather than simply analysing the market.
For businesses offering borrowing, lending or “earn” products, that distinction matters.
CASP gateways into DeFi are specifically in the EBA’s sights
The EBA recommendation is not limited to conventional centralised lending platforms.
It specifically says regulation should be considered where CASPs facilitate customer access to decentralised lending protocols.
This is an important distinction because it avoids reducing the policy question to whether a decentralised protocol itself should be treated as an ordinary regulated company.
The regulatory focus may fall on the interface
The EBA observes that CASPs increasingly make DeFi easier to access through interfaces.
Its analysis suggests that these gateways can blur the boundary between centralised and decentralised finance because customers may interact with a regulated business even where the underlying lending mechanism uses decentralised smart contracts. The EBA also notes that general-purpose AI can make technical access to such protocols easier.
For CASPs, this raises a practical perimeter question.
A company may consider itself merely providing an interface to a third-party decentralised protocol. Regulators may instead examine what the CASP actually does for the customer: how the service is presented, whether the firm facilitates execution, whether it controls access, whether it receives remuneration and what information or safeguards it provides.
This does not mean the EU has decided to regulate all DeFi
That distinction should be preserved.
The EBA has recommended regulating crypto lending, including CASP-facilitated access to decentralised lending protocols. It has not announced a general licence for every decentralised protocol or stated that all DeFi activity automatically falls within MiCA.
Any actual expansion would require further EU policymaking and, where the Level 1 Regulation needs amendment, legislation.
Businesses should therefore treat the EBA position as a strong regulatory direction rather than a new legal obligation already in force.
Stablecoin lending creates a potential yield arbitrage issue
The intersection between stablecoins and lending is another reason the EBA wants the perimeter reviewed.
Under Articles 40 and 50 of MiCA, issuers and CASPs are prohibited from granting interest in relation to ARTs and EMTs respectively. The prohibition is drafted broadly enough to cover certain remuneration or benefits connected to how long the holder holds the token. Eur-Lex
The EBA now points out that lending an EMT can create an opportunity to earn yield even though the issuer and CASPs are prohibited from offering interest on the EMT itself. It identifies this as a potential regulatory-arbitrage concern.
This does not mean every third-party lending return automatically breaches MiCA’s interest prohibition.
It does mean that businesses designing stablecoin yield products should not assume that separating the lending layer from issuance automatically removes regulatory scrutiny.
For CASPs offering “earn”, lending, collateral or DeFi-access products involving EMTs, the economic substance of the product is likely to become increasingly relevant.
Multi-issuer stablecoins are another major EBA priority
Stablecoins are already extensively regulated under MiCA, and the EBA does not propose rewriting the entire regime.
It says the current requirements applicable to ART and EMT issuers are broadly appropriate based on the experience available so far. The main concern is more targeted: third-country multi-issuer stablecoin schemes.
These arrangements can arise where economically or technically equivalent tokens are issued by multiple entities in different jurisdictions, including an EU issuer and one or more third-country issuers.
The EBA sees material risk in third-country multi-issuer structures
The EBA describes the risks arising from such schemes as ranging from significant to very significant and recommends regulatory changes to strengthen the framework.
The concern is commercially important for global stablecoin groups.
A stablecoin may circulate across a single global blockchain ecosystem while legal issuance, reserve assets, redemption liabilities and supervisory responsibility are distributed between different entities.
That raises questions about which issuer ultimately carries the obligation to EU holders and whether the EU-regulated reserve and redemption framework sufficiently captures the risks associated with tokens circulating globally.
Redemption consistency is part of the problem
MiCA already gives holders redemption rights, but the EBA sees room for greater clarity on the maximum timeframe for redemption in normal conditions.
The detailed response notes emerging practices such as T+1, T+2 and T+4 and says greater consistency could improve legal certainty. For third-country multi-issuer schemes, aligned redemption periods may also help avoid incentives for holders to run against one issuer rather than another during periods of stress.
For stablecoin groups, this means future regulation may look beyond the EU issuing entity and assess how the broader global issuance and redemption structure operates.
Stablecoin reserve rules could also change
The EBA also recommends reconsidering part of the reserve framework.
Specifically, it says the Commission should review reserve requirements, including the minimum amount of reserves that issuers must hold as deposits, while preserving effective risk management.
This does not amount to a recommendation to weaken stablecoin backing.
It reflects a more specific prudential question: how the required reserve should be allocated between bank deposits and other eligible liquid assets while managing liquidity, concentration and counterparty risk effectively.
For EMT and ART issuers, changes in this area could directly affect banking relationships, treasury architecture and the cost of maintaining compliant reserves.
Prospective stablecoin issuers should therefore avoid assuming that the present reserve composition will necessarily remain unchanged through the next phase of MiCA.
Crypto-asset classification remains a practical problem
Another major EBA concern is classification.
MiCA was designed to create a harmonised regulatory perimeter, but the EBA says classification difficulties are creating avoidable costs and product-launch delays for both firms and supervisors. It warns that this can impede innovation and weaken EU competitiveness.
The issue extends beyond determining whether something is an ART, EMT or another MiCA crypto-asset.
The boundary with other financial legislation remains important
MiCA applies to crypto-assets not already captured by specified areas of existing EU financial-services legislation.
A token may instead qualify as a financial instrument under MiFID, a deposit governed by banking legislation, or another regulated product.
The EBA says some of the underlying concepts are not fully harmonised in EU law, limiting how far supervisory guidance alone can resolve the boundary.
This is particularly relevant for tokenised financial products.
Gold and other commodity-linked tokens are proving difficult
The EBA specifically identifies commodities-linked tokens, including gold tokens, as an area where classification has proved challenging.
Difficulties can arise from incomplete descriptions of holder rights, whether the token represents rights to identified property or merely a value, what the reference asset actually is and whether the product is more appropriately classified as an ART, EMT or financial instrument.
The EBA also points to structures that may be deliberately designed to appear to fit a less restrictive classification, creating concerns about regulatory arbitrage.
For token issuers, this reinforces a practical lesson: classification needs to be completed at product-design stage, not immediately before a white paper or authorisation filing.
Tokenised deposits also sit on the MiCA boundary
Tokenised deposits provide another example of why classification matters.
The EBA has previously concluded that recording a bank deposit claim using DLT does not, by itself, change the claim’s fundamental legal character as a deposit. Genuine tokenised deposits can therefore fall within banking regulation rather than MiCA.
The September review again considers the boundary between MiCA and other financial legislation, including tokenised deposits.
For banks and fintech businesses building tokenised-money products, small structural differences can therefore produce significantly different regulatory outcomes.
A product labelled a “deposit token”, “stablecoin” or “tokenised cash” should not be classified solely by branding.
Reporting requirements may become broader and more systematic
The EBA also wants the Commission to review MiCA’s reporting framework for both issuers and CASPs.
Its stated objective is to improve supervisory risk monitoring and give regulators the information needed to identify emerging risks and take timely supervisory or enforcement action.
MiCA already contains reporting obligations, including specific requirements for ART and EMT issuers and information supplied by CASPs.
The review opens the possibility of a more comprehensive framework as regulators gain experience with the market.
For firms, this matters well before any new templates are adopted.
Licensing and compliance architectures should be capable of producing reliable product, customer, transaction and exposure data without relying on manual reconstruction when a regulator requests information.
Multi-function crypto groups may face closer supervisory coordination
The EBA’s review response also addresses groups combining several crypto services with other regulated or unregulated activities.
That issue is increasingly important as major crypto groups combine exchange, custody, issuance, lending, staking, payments and other services within one corporate structure. The EBA’s formal response identifies multi-function groups as one of the areas considered in its MiCA review work.
For market participants, the direction is significant even before legislative changes are proposed.
EU supervisors are increasingly examining crypto businesses at a group and value-chain level rather than treating each individual permission or product as entirely separate.
What the EBA recommendations do not change today
The 24 September 2026 response is influential regulatory input, but it is not legislation.
Businesses should avoid several premature conclusions.
First, crypto lending has not automatically become a new MiCA-regulated crypto-asset service because the EBA recommends regulating it.
Second, CASPs do not suddenly need an additional MiCA authorisation merely because they provide a DeFi interface. The current perimeter must still be assessed under the law in force.
Third, existing ART and EMT reserve rules continue to apply. The EBA has proposed that some elements be reviewed; it has not replaced them.
Fourth, the EBA’s concerns over classification do not suspend the existing classification framework.
The current MiCA Regulation, applicable technical standards, ESA classification guidelines and other relevant EU financial-services legislation remain the legal starting point.
MiCA review timeline
What CASPs and crypto businesses should assess now
| Date | Development | Significance |
|---|---|---|
| 30 June 2024 | MiCA ART and EMT provisions became applicable | EU stablecoin regime became operational |
| 30 December 2024 | Most remaining MiCA provisions became applicable | CASP and wider crypto framework took effect |
| 20 May 2026 | Commission opened public and targeted MiCA review consultations | Formal evidence-gathering for review began |
| 1 July 2026 | Maximum MiCA CASP transitional period expired | EU market moved beyond the principal grandfathering period |
| 31 August 2026 | Commission consultations closed | Stakeholder evidence-gathering phase concluded |
| 24 September 2026 | EBA published its formal response | EBA called for stablecoin, classification, lending/DeFi and reporting reforms |
| 30 June 2027 | Commission Article 140 report due | Report may be accompanied by a legislative proposal |
The final row is especially important. 30 June 2027 is a statutory review deadline, not a date on which the EBA recommendations automatically become law. Eur-Lex
Businesses do not need to redesign their entire MiCA compliance framework around recommendations that have not yet become legislation.
They should, however, identify where their business models are exposed to the areas now under regulatory review.
CASPs offering lending or earn products
Map the legal and operational structure of each product.
Important questions include who receives the customer’s assets, who becomes borrower or counterparty, whether collateral is taken, how yield is generated and whether custody, exchange or other regulated MiCA services are provided alongside lending.
Products involving EMTs deserve additional attention because of MiCA’s existing interest prohibition.
CASPs providing access to DeFi protocols
Analyse what the interface actually does.
A business should understand whether it merely provides information or whether it facilitates execution, routing, custody, transfer, customer onboarding or other activity around a decentralised protocol.
The EBA’s focus makes this distinction increasingly important.
Stablecoin issuers and global stablecoin groups
Groups using multiple issuers should map issuance, reserves, redemption rights and liabilities across legal entities and jurisdictions.
EU structures should not be assessed in isolation where the same token circulates through a global arrangement.
Reserve composition and banking dependencies should also be stress-tested against possible future adjustments to MiCA.
Token issuers
Classification should be documented before launch.
Products referencing commodities, investment funds, fiat currencies or complex asset pools need particular care because the boundary between ARTs, EMTs, financial instruments and other products may determine the entire authorisation route.
Businesses preparing EU market entry
Prospective applicants should distinguish between current licensing requirements and potential future perimeter expansion.
A CASP authorisation obtained today should be built around the law currently applicable. At the same time, a business heavily dependent on lending, DeFi gateways or yield products should factor possible regulatory change into its operating model and compliance roadmap.
Legasset advises crypto, fintech and payment businesses on MiCA authorisation, CASP structuring, crypto-asset classification, stablecoin regulation, regulatory perimeter analysis, AML/CFT and EU market entry. We can also support existing CASPs reviewing lending, yield and DeFi-related products ahead of potential changes to the EU framework.
MiCA Review 2026 FAQ
Has the EU already expanded MiCA to cover crypto lending?
Is crypto lending currently a MiCA crypto-asset service?
Is the EBA proposing to regulate DeFi?
Why is the EBA concerned about stablecoin lending?
What is a multi-issuer stablecoin scheme?
In broad terms, it involves the same or economically equivalent stablecoin being issued by more than one issuer, potentially across EU and non-EU jurisdictions.
The EBA is particularly concerned about third-country multi-issuer schemes and has recommended strengthening MiCA to address the risks they create.
Is the EBA proposing to change stablecoin reserve requirements?
It recommends reviewing the reserve framework, including the minimum amount of reserve assets that must be held as deposits, while maintaining effective risk management.
No change to the existing requirement follows automatically from the recommendation.
Why does crypto-asset classification remain a MiCA issue?
Are tokenised bank deposits covered by MiCA?
When could MiCA actually change?
Under Article 140 of MiCA, the Commission must present its report on the Regulation’s application by 30 June 2027 and may accompany that report with a legislative proposal.
Any legislative amendment would then need to proceed through the applicable EU legislative process. Eur-Lex
What should CASPs do before the 2027 review?
CASPs should continue complying with the current MiCA framework while identifying business lines potentially affected by the review.
Lending, yield products, stablecoin services, DeFi interfaces, multi-function group structures and difficult token classifications deserve particular attention following the EBA response.
