France has proposed making regulated cryptocurrency platforms responsible for certain losses suffered by customers accessing decentralized finance protocols through their services, as part of proposed changes to the European Union’s Markets in Crypto-Assets Regulation.
Summary
- France has proposed holding regulated crypto platforms liable for certain DeFi security incidents if they fail to assess protocols properly or ignore known risks.
- Under the proposed MiCA changes, crypto platforms would have to conduct security checks before offering access to DeFi protocols and continue monitoring them for vulnerabilities.
- The proposal would leave self custody wallet developers outside mandatory certification requirements while allowing voluntary certification for wallets offering advanced DeFi services.
- France has called for a review of MiCA’s asset referenced token category after no tokens received authorization under the framework.
In a joint response to the European Commission’s MiCA consultation, France’s Treasury, Financial Markets Authority (AMF), Banque de France and Prudential Supervision and Resolution Authority (ACPR) called for new obligations covering platforms that facilitate access to DeFi applications.
Under the proposal, crypto-asset service providers, or CASPs, would have to assess the security of DeFi protocols before making them available to customers and continue monitoring potential vulnerabilities after access has been provided.
French authorities argued that regulated intermediaries should bear responsibility when they expose customers to known security risks or fail to conduct adequate checks on the protocols they support.
The recommendations form part of the European Commission’s ongoing review of MiCA, which currently excludes services provided in a fully decentralized manner without an intermediary.
France wants crypto platforms to check DeFi protocols before offering access
A central part of the proposal concerns the responsibilities of cryptocurrency exchanges and other regulated service providers that connect their customers to decentralized applications.
France wants these businesses to conduct due diligence before offering access to DeFi protocols, including assessing smart contract security, operational vulnerabilities and potential risks associated with the services.
Once a protocol becomes available, platforms would be expected to continue monitoring its activities for security weaknesses and suspicious behavior.
The authorities supported introducing certification arrangements for DeFi protocols and smart contracts, although certification would not necessarily be mandatory for every protocol accessible through a regulated platform.
Providers could continue offering uncertified protocols if they completed their own due diligence and gave customers enhanced disclosures explaining the associated risks.
As the document explains, the proposed responsibilities would be applied according to the size of the provider, with significant CASPs facing the full requirements while smaller businesses would be subject to proportionate obligations.
The liability provisions would cover certain incidents where a regulated intermediary had actively facilitated customer access, particularly where adequate checks could have identified security problems.
The proposal does not establish automatic compensation for every DeFi exploit, and the authorities have not proposed making regulated platforms responsible for every incident occurring across decentralized networks.
Self-custody wallets would remain outside blanket certification rules
France has taken a different position on non-custodial wallets, arguing against imposing compulsory certification requirements on developers simply because their software allows users to hold and manage cryptocurrencies independently.
Instead, the authorities supported voluntary certification for more advanced wallet applications that integrate DeFi services and other financial functions.
The distinction follows the existing treatment of decentralized activities under MiCA, where services provided without an identifiable intermediary are generally excluded from the regulation.
European lawmakers have already been examining whether DeFi, staking and crypto lending require additional rules, with the European Parliament adopting a policy position in July that called for further consideration of these activities.
The debate has drawn differing responses from industry participants. In its own consultation submission, the Cardano Foundation opposed additional rules for decentralized finance and staking, arguing that European regulators should concentrate on improving the existing framework and distinguishing intermediary services from direct blockchain participation.
France’s recommendations remain proposals submitted during the consultation process and would require legislative changes before becoming enforceable obligations.
France backs direct ESMA supervision of major crypto firms
Beyond decentralized finance, the French authorities supported transferring supervisory responsibility for significant CASPs from national regulators to the European Securities and Markets Authority.
They proposed reducing the existing threshold of 15 million average daily active users in the EU used to identify significant providers, while considering other measures such as assets held in custody, business risks and the complexity of corporate groups.
France argued that relying primarily on user numbers could leave certain large or complex businesses outside centralized supervision despite the risks associated with their operations.
The proposal comes as ESMA prepares for its 2027 supervisory priorities, which include operational resilience, outsourcing arrangements, liquidity risks and ensuring that authorized businesses maintain sufficient operations within the European Union.
The French submission supported centralizing crypto-asset white paper filings and related enforcement responsibilities at ESMA, replacing a system in which national authorities receive notifications and forward them to the European regulator.
Stablecoin rules could face changes under MiCA review
France questioned whether MiCA should retain its asset-referenced token category, which covers cryptocurrencies designed to maintain their value by referencing multiple assets, currencies or other values.
The authorities pointed out that no ARTs had received authorization under MiCA and attributed the lack of adoption to limited market demand, legal uncertainty and demanding regulatory requirements.
Subject to an impact assessment, they favored considering the removal of the category while bringing multicurrency stablecoins under the existing e-money token framework.
The proposal comes as Europe’s stablecoin market continues developing under MiCA. In October, Circle’s USDC received significant token classification, bringing specified aspects of its European operations under direct European Banking Authority supervision beginning November 12.
The European Commission is expected to submit its MiCA review report to EU lawmakers by June 30, 2027, potentially accompanied by legislative proposals addressing activities currently outside the regulation.