ESMA’s Review of the MiCA Regulation: Risk Factors and Proposed Regulatory Solutions
Key Takeaways from
On September 30, 2026, the European Securities and Markets Authority (ESMA) published its formal response to the European Commission's consultation on reviewing Regulation (EU) 2023/1114, widely known as the Markets in Crypto-Assets (MiCA) regulation. Drawing on its initial implementation experience since the end of the MiCA transitional period on July 1, 2026, ESMA detailed key risks across the crypto landscape and outlined policy solutions to eliminate legal uncertainty, prevent regulatory arbitrage, and protect investors.
Below is an overview of the key risk factors identified in the document, alongside ESMA’s recommended solutions.
-
Decentralized Finance (DeFi) & "Decentralisation Washing" • Risk Factors: o Uncertainty regarding what constitutes "full decentralisation" creates opportunities for regulatory arbitrage. o "Decentralisation washing" occurs when an identifiable operator uses DeFi terminology to evade MiCA obligations. o Crypto-Asset Service Providers (CASPs) facilitating client access to unregulated DeFi products (e.g., DEXs, yield strategies, liquidity protocols) expose retail consumers to smart-contract risks, operational failures, and conflicts of interest in transaction routing. • Proposed Solutions: o Define DeFi clearly within the main legal text of MiCA, keeping the "fully decentralised" exemption as narrow as possible. o Introduce a new regulated service for CASPs acting as "gateways" to DeFi protocols on behalf of clients. Gateway CASPs would be subject to strict protocol due diligence, risk disclosures, conflict-of-interest management, and cybersecurity safeguards.
-
Token Classification & Legal Perimeter Uncertainty • Risk Factors: o Questions frequently arise regarding the regulatory boundary between MiCA crypto-assets and MiFID II financial instruments, Asset-Referenced Tokens (ARTs), Electronic Money Tokens (EMTs), and assets outside MiCA (such as NFTs or wrapper tokens). o These issues are prevalent with hybrid tokens or complex structures like fractionalized NFTs, leading to inconsistent classifications across Member States, forum shopping, and an uneven playing field. o Non-binding opinions issued by European Supervisory Authorities (ESAs) upon National Competent Authority (NCA) request are insufficient to establish uniform supervisory practice. • Proposed Solutions: o Provide explicit legal certainty on token classification criteria directly in Level 1 legislation. o Empower ESMA (in consultation with the EBA) to issue binding opinions on token classification, including on its own initiative when recurring patterns emerge across the EU.
-
Unauthorized Stablecoins • Risk Factors: o Ambiguity exists regarding whether authorized CASPs can continue to facilitate the use, availability, or trading of non-MiCA-compliant stablecoins (ARTs and EMTs). o Facilitating unauthorized stablecoins causes divergent supervisory practices across the EU, hinders effective enforcement, and creates an uneven playing field between compliant and non-compliant issuers. • Proposed Solutions: o Amend MiCA to explicitly state that a CASP cannot provide any licensable service in relation to ARTs or EMTs that are non-compliant with MiCA requirements.
-
Misleading Marketing & Third-Party Influencers • Risk Factors: o High-level MiCA provisions make it difficult for supervisors to enforce marketing rules or discipline influencers and third-party promoters acting on behalf of issuers or CASPs. o Promotional materials frequently feature disputable predictions or recommendations that fall outside traditional market abuse definitions. o Third-country firms actively solicit EU investors without MiCA authorization by abusing the "reverse solicitation" exemption. • Proposed Solutions: o Introduce explicit bans or limits on specific high-risk marketing practices, modeled on MiFID II standards. o Extend direct regulatory obligations to influencers and third parties promoting crypto-assets, granting NCAs corresponding supervisory and enforcement powers. o Establish targeted powers to ensure the reverse solicitation exemption is interpreted narrowly.
-
Crypto Staking Services • Risk Factors: o Marketing materials for staking often highlight high yield potential while failing to adequately disclose operational risks, liquidity lock-up periods, and slashing risks (where assets are forfeited due to validator misconduct or protocol failures). o Unclear asset segregation raises insolvency risks, and reliance on third-country validator infrastructure introduces operational and legal enforcement hurdles. • Proposed Solutions: o Clarify that CASP-provided staking services are subject to targeted conduct, governance, asset safeguarding, and risk disclosure obligations. o Distinguish regulatory intensity across four categories: self-directed staking, technical staking, custodial/pooled staking, and liquid or yield-bearing staking tokens.
-
Crypto Lending and Borrowing • Risk Factors: o Lending: CASPs borrowing crypto-assets from clients (often without collateral) to re-lend to third parties present significant systemic risks. Once lent out, custody and asset-segregation protections no longer apply, turning lending arrangements into "black boxes" where investors lack information on yield sources, borrower creditworthiness, or underlying collateral. o Borrowing: Retail clients often perceive borrowing as a simple liquidity tool without grasping exposure risks such as rapid automatic liquidation, high leverage, collateral volatility, smart contract vulnerability, and rehypothecation. • Proposed Solutions: o Apply mandatory conduct rules, express written client consent, collateral requirements, and comprehensive risk disclosures to CASPs facilitating lending programs. o Mandate targeted risk disclosures and risk-management controls for borrowing services (covering collateral terms, liquidation triggers, and rehypothecation practices).
-
Opaque Pricing and Hidden Trading Costs • Risk Factors: o Some CASPs display misleading cost information to retail clients, promoting "zero commission" trading while embedding wide bid-ask spreads to recoup or inflate trading fees. • Proposed Solutions: o Require CASPs providing execution, order transmission, or exchange services to deliver full, itemized cost disclosures so clients can compare true platform pricing.
-
Cross-Border Online Fraud & Supervisory Gaps • Risk Factors: o Fraudulent websites and scam domains are frequently registered and hosted outside the EU, creating enforcement delays and fragmented responses among national supervisors. o Lengthy procedural timelines for asset freezing mean suspicious crypto-assets linked to financial crimes or money laundering often vanish before action can be taken. o Repeated short-term renewals of temporary product interventions create excessive administrative friction. • Proposed Solutions: o Grant NCAs explicit legal powers to order the immediate deactivation and removal of scam or unauthorized websites. o Assign direct legal authority to ESMA to require CASPs to immediately freeze crypto-assets suspected of being linked to financial crime, money laundering, or terrorist financing during ongoing investigations. o Enable ESMA to issue permanent product intervention measures across the Union to respond swiftly to widespread market risks.
-
Administrative Friction and Capital Requirements • Risk Factors: o MiFID II investment firms seeking to offer crypto transfer services as part of their existing operations face duplicative licensing burdens under MiCA. o White paper notifications to NCAs involve a short 5-day filing window that hampers meaningful compliance reviews. o Current prudential capital requirements do not properly capture varying risk profiles across different service classes or group structures. • Proposed Solutions: o Remove separate licensing requirements for transfer services provided by investment firms already regulated under MiFID II. o Centralize the Title II white paper notification process directly at ESMA. o Align CASP prudential capital requirements with the Investment Firms Regulation/Directive (IFR/IFD) framework.