The MiCA Review: What ESMA Asked the Commission to Change, and What Is Not Law Yet

On 30 September 2026, three months after the end of the MiCA transitional period, the European Securities and Markets Authority published its response to the European Commission's consultation on reviewing the EU crypto-asset regulation. It proposes a new regulated service for firms that give clients access to DeFi, targeted rules for staking, lending and borrowing, a ban or limits on some marketing practices, mandatory cost disclosure and a rule against offering services on non-compliant stablecoins. This article reads the 16-page document itself, sets it next to the legal text that triggers the review, and separates what is a proposal from what is law. Nothing described below is in force.

The short version

• Status: advice only. ESMA's response is an input to a Commission report that, under Article 140 of MiCA, is due by 30 June 2027 "accompanied, where appropriate, by a legislative proposal". We found no legislative proposal yet, so we cannot give a date for any new rules.
• DeFi: ESMA asks for a legal definition of what counts as "fully decentralised" and wants the exemption "as narrow as possible", citing a risk of "decentralisation washing".
• New service: a regulated "gateway" service for authorised crypto-asset service providers (CASPs) that give clients access to DeFi protocols.
• Staking, lending, borrowing: targeted disclosure and conduct rules, not a heavy new licence. ESMA explicitly says staking should not automatically be treated as lending or portfolio management.
• Stablecoins: a CASP should not be allowed to provide any MiCA-licensable service in relation to stablecoins that do not comply with MiCA.
• Costs: firms providing execution or exchange services should give full cost information, because some advertise zero commission while applying a high spread.
• For you today: nothing changes. What is useful now is the problem ESMA describes about costs and marketing, which you can check for yourself.

Where the review comes from

The review is written into the regulation. Article 140 of Regulation (EU) 2023/1114 says: "By 30 June 2027, having consulted EBA and ESMA, the Commission shall present a report to the European Parliament and the Council on the application of this Regulation accompanied, where appropriate, by a legislative proposal." The report must cover, among other things, the experience with classifying crypto-assets, whether white papers for tokens other than stablecoins need an approval mechanism, and the number and value of frauds, scams, hacks and thefts reported in the Union.

A separate article, Article 142, asked the Commission to report on developments not addressed in the regulation, including "an assessment of the necessity and feasibility of regulating decentralised finance", an assessment of "regulating lending and borrowing of crypto-assets", the treatment of services linked to the transfer of e-money tokens, and the regulatory treatment of non-fungible crypto-assets.

According to law-firm summaries of the Commission's consultation, a targeted consultation was published on 20 May 2026 with responses invited until 31 August 2026. The topics reported include scope and definitions, requirements for asset-referenced and e-money tokens, the regime for service providers, and areas beyond today's scope such as DeFi, staking, lending, borrowing and NFTs. We have not been able to read the Commission's own page, so treat those details as secondary. We covered the consultation when it opened in our May article.

The link with the supervision package

ESMA's paper also refers to the Market Integration and Supervision Package (MISP) that the Commission adopted on 4 December 2025. ESMA's document discusses "the MISP proposal to transfer CASP supervision to ESMA" and asks that the MiCA review stay consistent with it. In plain terms: the Commission has separately proposed that supervision of crypto-asset service providers moves from national authorities to ESMA, and that proposal is not part of this consultation. ESMA says its own proposals should hold "whether the MISP proposal ... is adopted or not".

What ESMA actually proposes

1. Classification of tokens

ESMA calls classification "one of the most important issues under MiCA", because questions arise at the boundary between MiCA crypto-assets and financial instruments under MiFID II, between asset-referenced and e-money tokens, and between MiCA tokens and assets outside it. It names hybrid tokens, fractionalised NFTs, wrapped or tokenised arrangements and governance tokens as hard cases. Today, national authorities can ask ESMA for a non-binding opinion under Article 97(3). ESMA says it has "so far only issued one non-binding opinion" and proposes that it, with the EBA, be able to issue binding opinions on classification, including on its own initiative when it sees recurring patterns. It also asks the Commission to clarify that a derivative settled in a stablecoin can still be a financial instrument under MiFID II.

2. Unauthorised stablecoins

ESMA says there is uncertainty about how far authorised CASPs may facilitate "the availability, use or trading of unauthorised stablecoins". It invites the Commission to amend the regulation to say "explicitly" that a CASP "cannot provide any licensable service under MiCA in relation to ARTs or EMTs that are not compliant". ESMA calls this a "binary supervisory test" that would be enforceable. For users, the practical consequence would be that a licensed platform could not list or offer services on a stablecoin that lacks MiCA authorisation.

3. DeFi: a definition and a gateway service

MiCA's Recital 22 says the regulation does not apply to services provided "in a fully decentralised manner without any intermediary". ESMA says views diverge on what that means and that this has increased "the risk of 'decentralisation washing', where an identifiable operator relies on DeFi-type language to avoid MiCA obligations". It asks the Commission to put a clear definition in the legal text and keep the DeFi exemption "as narrow as possible". As an alternative it suggests empowering ESMA to issue technical guidelines.

Separately, ESMA describes a business model it has seen in the first phase of MiCA: authorised CASPs that help clients reach DeFi products, such as decentralised exchanges, lending and borrowing protocols, staking and re-staking, or that provide an interface to unregulated smart contracts. It identifies risks to consumers, operations and smart contracts, and conflicts of interest if the CASP routes client activity to particular protocols. ESMA proposes a new regulated service covering a CASP that gives access to DeFi on behalf of clients, with duties such as risk disclosure, transparency on protocol selection and routing, conflict management, due diligence on the protocols offered and operational and cybersecurity safeguards. ESMA adds that the proposal "would preserve innovation by recognising that open-source development, self-custody, automated smart contracts and permissionless infrastructure should not automatically amount to regulated intermediation", and that obligations should be proportionate to the control the CASP has over the protocol.

4. Staking

ESMA recognises staking as "a core technical function" of proof-of-stake networks that "should not automatically be treated as lending or portfolio management". But it lists the investor risks: marketing that stresses rewards and plays down risk, slashing (the loss of part of staked assets through validator misconduct or failure), lock-up periods that limit access, unclear asset segregation if the provider becomes insolvent, and reliance on third-country infrastructure. It asks the Commission to make staking by authorised CASPs subject to "targeted conduct, disclosure and safeguarding requirements" and to distinguish four cases: self-directed staking with no intermediary, technical staking services, pooled or custodial staking, and liquid or yield-bearing staking products that may raise separate classification questions. For CASP staking it asks for enhanced disclosure on rewards, lock-up and unbonding periods, slashing risk, validator selection, fees, operational dependencies and insolvency treatment. It says the approach should stay "proportionate" and not become "a new heavy authorisation regime".

5. Lending and borrowing

On lending, ESMA says it has observed that crypto lending "can cause cascading failures due to CASPs borrowing crypto-assets from clients (sometimes without collateral) and on-lending them to third parties", and that once assets are lent out, MiCA's custody and segregation rules "no longer apply". Clients are often not told who the final borrowers are, what collateral exists, or the gross yield, which makes such programmes "effectively black boxes". ESMA proposes rules such as express written client consent and disclosure, and says it is not proposing a newly authorised service. On borrowing, it points to rapid liquidation, leverage, collateral volatility, smart-contract risk and opaque reuse of collateral, and asks for targeted conduct, disclosure and risk-management requirements, particularly for retail clients or leverage.

6. Marketing and influencers

ESMA says MiCA's marketing provisions are "very high level", which makes enforcement hard, and that the rules do not reach influencers and other third parties who promote crypto-assets on behalf of issuers and CASPs. It invites the Commission to consider banning or limiting certain marketing practices, in line with the approach under MiFID II, and to introduce obligations for influencers and third parties together with matching supervisory powers. It also asks for specific powers against third-country firms that actively solicit EU investors without authorisation, and for the "reverse solicitation" exemption in Article 61 to be applied "in as narrow a way as possible".

7. Cost transparency

This is the section with the most direct consequence for ordinary users. ESMA says it "has witnessed misleading costs' information being displayed to investors", for example "some CASPs providing exchange services claim zero commission trading and tight spreads when the spread applied is in fact high and allows the CASP to recoup or even exceed the loss coming from the 'zero commission' trading". It proposes that CASPs providing execution, order-routing and exchange services give full cost information so that clients can compare prices across platforms.

8. Supervisory powers against fraud and for freezing assets

ESMA proposes that national authorities get explicit powers to order the removal of scam or unauthorised websites, and that, where there are reasonable grounds to suspect assets are linked to market abuse, financial crime, money laundering or terrorist financing, ESMA itself be able to require a CASP to freeze them "as long as needed" for investigation. Its reasoning is that with current procedures, "when the freezing of suspicious crypto assets ... is requested, it is often too late and the assets have disappeared". ESMA also asks for the power to take permanent product intervention measures, not only temporary ones.

9. Simplification and tokenisation

The paper is not only about tightening. ESMA asks to centralise white paper notification at ESMA and clarify when a white paper is "duly notified", to remove a duplicate authorisation for transfer services for investment firms that already notify under Article 60, and to align capital requirements with other EU frameworks. In its last section it argues for clearer rules on tokenised securities and on-chain settlement and mentions, over time, an optional EU-level "28th regime".

What this means for you now

• No new obligations and no new protections yet. Everything above needs the Commission to propose, and Parliament and Council to adopt, a legal change. The next fixed date in the law is the Commission report due by 30 June 2027.
• The cost problem is checkable today. ESMA describes "zero commission" offers with high spreads. Compare the price you would get for the same order across platforms, not the headline fee.
• Be careful with yield products. ESMA's description of lending programmes as "black boxes" and of staking marketing that downplays slashing and lock-ups matches the questions to ask any provider: who holds the assets, where are they lent or staked, what happens in an insolvency. Our guide to staking under MiCA covers what applies today.
• Check a provider's authorisation. MiCA's registers are the basis of any protection; see our MiCA compliance guide.

What we could not verify

• The Commission's own consultation page and questionnaire, which we could not read. The consultation dates and topics come from law-firm summaries.
• The full text of the December 2025 supervision package. We rely on ESMA's description of it and on law-firm summaries.
• The responses of other bodies, such as the EBA, national authorities or industry groups.
• Any Commission legislative proposal. We found none; if one appears, this article will need updating.

An earlier article on this site (MiCA 2: the EU's next crypto regulation, April 2026) predates the consultation. Its timeline for enforcement was an estimate, not a decision, and should be read in that light.

Frequently asked questions