France Proposes Platform Liability for DeFi Incidents in Joint MiCA Revision

France Files Joint MiCA Revision Proposals

France’s Treasury, the Financial Markets Authority (AMF), Banque de France and the Prudential Supervision and Resolution Authority (ACPR) filed a joint package of revision proposals on Wednesday, October 21 aimed at the European Union’s Markets in Crypto-Assets Regulation, and the document places liability for decentralized finance (DeFi) security failures on regulated platforms. The submission went in as France’s response to the European Commission’s consultation on whether MiCA needs updating, a review that explicitly sought views on activities outside the law’s original scope, including DeFi. The joint submission argues that crypto-asset service providers, or CASPs, should be liable for certain incidents affecting clients where they actively facilitated access to DeFi protocols, particularly where adequate checks could have identified the security problem in advance. Under the plan, a platform would have to vet a protocol before making it available to customers, assessing smart contract security and operational weaknesses across everything from DEX venues to lending markets, and then keep monitoring the protocol for vulnerabilities and suspicious behavior after access goes live. France’s authorities also support certification arrangements for DeFi protocols and smart contracts, although certification would not be mandatory for every protocol reachable through a regulated platform. A provider could still connect customers to uncertified protocols if it ran its own due diligence and gave customers enhanced disclosures explaining the associated risks. Obligations would scale with the size of the business: significant CASPs would face the full requirements, while smaller providers would carry proportionate duties. The proposal stops short of automatic compensation for every exploit on decentralized networks, and it does not make platforms responsible for incidents they could not have detected. The current framework excludes services provided in a fully decentralized manner without an intermediary, which is why the French text extends safeguards only where a regulated intermediary sits between the user and the protocol.

ESMA Powers and the Unused ART Category

Beyond DeFi, the submission backs transferring supervision of significant CASPs from national regulators to the European Securities and Markets Authority (ESMA). MiCA currently flags a provider as significant once it reaches 15 million average daily active users in the EU, a threshold written into the 2023 regulation text, and France wants that number lowered. The authorities also suggest weighing custody assets, business risks and corporate group complexity when identifying which platforms belong under ESMA, arguing that user counts alone can leave large or complex firms outside centralized supervision. France would additionally centralize crypto-asset white paper filings and related enforcement at ESMA, replacing the present arrangement in which national regulators receive notifications and forward them onward. The European regulator is already preparing its 2027 supervisory priorities, which cover operational resilience, outsourcing arrangements, liquidity risks and whether authorized businesses keep sufficient operations inside the EU. On stablecoins, France questions whether MiCA should retain its asset-referenced token (ART) category, which covers tokens designed to hold a stable value against a basket of assets: no ART has been authorized under the framework, a shortfall the submission attributes to limited demand, legal uncertainty and demanding requirements. Subject to an impact assessment, the authorities favor scrapping the category and adapting the e-money token framework to cover multicurrency stablecoins instead. The debate runs alongside a live European rollout: Circle’s USDC received significant token classification in October, placing specified parts of its European operations under direct European Banking Authority supervision beginning November 12. Self-custody software receives lighter treatment: the authorities oppose blanket certification for wallet developers, whether the product is a hardware wallet or a browser extension, and support only voluntary certification for advanced applications that integrate DeFi services. Industry responses diverged in the same consultation: the Cardano Foundation argued that European regulators should improve the existing framework and separate intermediary services from direct blockchain participation rather than add rules for decentralized finance and staking, a position echoing the European Parliament’s July call for further study of those activities.

The French paper is a consultation response, not law: nothing binds any entity until legislators act, and the Commission’s review report to EU lawmakers is due by June 30, 2027, potentially accompanied by amendment proposals covering activities currently outside MiCA. Our reading of the filing is that the liability clause would change conduct first if adopted. Platforms bridging customers to DeFi would have strong reasons to trim protocol lists, demand third-party audits and price due diligence into their services, effectively deciding which decentralized applications reach EU users. That gatekeeping role would likely lift demand for DeFi insurance products priced against specific protocol failures, while the carve-out for non-custodial software keeps the existing MiCA boundary between intermediated services and direct blockchain participation intact.