On April 21, 2026, Arbitrum's Security Council froze more than 30 ETH (approximately $71 million) associated with the Kelp DAO exploit. A 12-member governing body moved the funds into an intermediary wallet, requiring a governance vote for release. This event directly triggers the EU MiCA regulation's 'substance-over-form' test — any entity exercising operational control over user assets fails the 'fully decentralized' exemption, even if the underlying ledger is permissionless.
How Narrow Is MiCA's 'Fully Decentralized' Definition
MiCAR Article 3(1) defines distributed ledger technology, but the term 'fully decentralized' appears only in Recital 22, part of the preamble rather than legally binding provisions. The recital states that crypto-asset services provided 'in a fully decentralised manner without any intermediary' fall outside the regulation's scope. Yet in a joint report published on January 13, 2025, the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) note that DeFi accounts for only about 4% of global crypto market cap and very few systems achieve true full decentralization.
ESMA's second consultation package proposed a definition of 'permissionless distributed ledger': no entity controls the ledger or its use, and anyone can set up nodes. However, the authority acknowledged that 'the exact scope of this exemption remains uncertain' and requires a case-by-case assessment of system features.
Two Key Conditions for Decentralization Assessment
Based on Recital 22 and subsequent guidance, a service falls outside MiCA's scope if no single entity controls protocol parameters, governance mechanisms, or core infrastructure, and users access a 'common good resource' rather than purchasing from a designated provider with a contractual relationship. Arbitrum's Security Council freeze clearly violates the first condition — despite Arbitrum being a permissionless Layer 2 network, the council as an entity exercised control over user funds.
LegalBison senior lawyer Eira Järvi notes that in the on-chain legal world, the line between full decentralization and lack of it is thinner than it seems. Teams often overestimate their decentralization level. Lawyers must analyze technical architecture, ownership logic, and governance rules, applying a substance-over-form assessment. ESMA and EBA fully endorse this approach.
Hardware and Software Providers May Also Be in Scope
ESMA guidance also addresses providers of hardware and software ancillary to CASP services. Entities merely creating and selling development tools, apps, or platforms are not automatically CASPs if activities are confined to that. However, if they retain control or sufficient influence over crypto-assets, software, protocols, platforms, or user relationships, they may be considered CASPs. The critical test is substantive control, not technical architecture.
For DeFi teams planning to expand into EU markets, simply claiming 'we are DeFi, so MiCA does not apply to us' no longer holds. EBA and ESMA's clear stance shows regulators will pierce the technical veil to examine who actually wields operational control. Legal compliance is no longer optional — it is the ticket to the EU market.