Why Is the EBA Calling for a Review of MiCA's Scope?
On September 24, 2026, the European Banking Authority (EBA) published its response to the European Commission's targeted consultation on reviewing the Markets in Crypto-Assets Regulation, commonly known as MiCA. The EBA recommended that the Commission consider regulating crypto-asset lending, including activities connected to decentralized finance (DeFi), while clarifying MiCA's scope and definitions. These are recommendations for the review process, not new rules that automatically place all crypto lending activities under a uniform regulatory regime.
MiCA established a regulatory framework for crypto-asset issuers and service providers in the European Union. However, business models continue to evolve. Centralized platforms may offer lending products, provide interfaces that connect customers to decentralized protocols, or facilitate transactions involving collateral and smart contracts. Such arrangements can make it harder to determine which regulatory requirements apply and which entity is responsible for specific activities.
The EBA has also highlighted uncertainty in the classification of crypto-assets and the boundaries between MiCA and other EU financial services legislation. Greater clarity could reduce unnecessary compliance uncertainty and help businesses assess their obligations before launching products. For platforms, regulatory classification can affect authorization, risk controls, customer disclosures and ongoing supervision.
What Risks Could Crypto Lending and DeFi Access Create?
Crypto lending involves risks beyond market volatility. Customers may face sharp collateral price movements, liquidation mechanisms they do not fully understand, insufficient liquidity, smart contract vulnerabilities and counterparty default. When a centralized service provider offers access to a decentralized lending protocol through its own interface, customers may not clearly understand where the provider's service ends and the third-party protocol begins.
The EBA specifically recommends considering the role of crypto-asset service providers that facilitate access to DeFi lending protocols. Interfaces and automated tools can make decentralized products easier to use, but easier access does not necessarily mean that customers understand the underlying risks. This creates questions about the responsibilities of intermediaries, the quality of risk disclosures and the protection available when a product fails.
Businesses should therefore assess the substance of each service rather than relying solely on product labels. Relevant questions include who controls asset movements, how collateral is managed, who executes liquidations, which smart contracts are involved and how customers can seek assistance after a loss. Disclosures should explain that returns are not guaranteed and that liquidity, market and technology risks can result in losses.
How Can KYT and Transaction Monitoring Support Compliance?
If the MiCA framework is revised, some businesses may need to reassess product classification, customer risk assessments, transaction monitoring and third-party risk controls. Companies should follow the European Commission's review process and distinguish proposals from requirements that have formally entered into force.
Know Your Transaction (KYT) tools can support risk management by analyzing fund flows, transaction paths, address relationships and exposure to identified high-risk entities. These insights can help compliance teams prioritize alerts, investigate suspicious activity and document risk-based decisions. However, blockchain analytics alone cannot establish that a transaction is illegal or replace customer due diligence and other legal obligations.
Platforms can begin with three practical measures. First, maintain a risk inventory covering each product and service. Second, document how customer assets move between the platform and third-party protocols. Third, establish clear escalation and investigation procedures, with records of relevant decisions and actions. Providers that facilitate DeFi access should also review partner arrangements, interface disclosures and smart contract risks regularly.
The EBA's recommendations indicate that EU regulators are examining the increasingly complex relationship between conventional crypto services and decentralized finance. For now, businesses should evaluate their actual activities, clarify their service boundaries and monitor subsequent regulatory developments. Treating recommendations as finalized legal obligations could be just as misleading as ignoring the potential direction of future regulation.