Many DeFi teams assume that if their project is decentralized enough, the EU's Markets in Crypto-Assets Regulation (MiCAR) does not apply to them. However, the latest guidance from the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) has thoroughly debunked this myth. The 'full decentralization' exemption is extremely narrow, and regulators will apply a 'substance over form' test to assess operational control, rather than relying on technical architecture or self-declarations.
The Misconception: MiCA Does Not Apply to DeFi and Non-Custodial Services
Recital 22 of MiCAR states that if crypto-asset services are provided 'in a fully decentralized manner with no intermediary,' they should fall outside the regulation's scope. The critical phrases are 'fully decentralized' and 'no intermediary.' Unfortunately, the term 'fully decentralized' is not defined in any binding article; it appears only in the recital, which is non-binding. Consequently, the EBA and ESMA were mandated to draft regulatory and implementing technical standards, which establish two conditions:
- First, no single entity may exercise control over the protocol parameters, governance mechanisms, or core technical infrastructure of the crypto-asset service.
- Second, users must access what is essentially a 'public good,' rather than purchasing services from a designated provider under a contractual relationship.
The Trap of Overestimating Decentralization
On April 21, 2026, the Arbitrum Security Council froze over 30 ETH (approximately $71 million) related to the Kelp DAO exploit. Although Arbitrum is a permissionless L2 network, the governance body's exercise of discretionary control over user assets prevented it from passing MiCAR's 'full decentralization' test. This case illustrates that whenever discretionary operational control exists—regardless of whether the underlying ledger is permissionless—regulatory scope applies.
ESMA and EBA's Stance on DeFi
In its joint report published in January 2025, ESMA recognized that decentralization exists on a continuum, not as a binary state. The report confirmed that very few DeFi systems achieve true full decentralization as envisioned by Recital 22. Most protocols have identifiable entities exercising varying degrees of control over governance, upgrades, fee structures, and other aspects. Even if a platform deploys smart contracts on a permissionless blockchain like Ethereum, retaining the ability to upgrade smart contracts, control front-end access, or hold administrative keys brings the operator within MiCAR's scope.
The FATF Framework and Contractual Relationships
The FATF's guidance on VASPs and DeFi similarly emphasizes that owners/operators of DeFi arrangements can be identified through the degree of control they exert, not by the labels they attach. The analysis of contractual relationships is crucial: permissionless DLT qualifies as a 'public good' and does not create a formal third-party outsourcing relationship under MiCAR Article 73. In contrast, permissioned DLT typically involves contractual arrangements (e.g., white-label blockchain products), constituting a third-party provider relationship. The determining factor is function over technology: what control does the operator actually exercise?
Key Takeaways
- The 'full decentralization' exemption is extremely narrow: Genuinely fully decentralized projects are rare. Any single entity's control over governance, parameters, or infrastructure likely disqualifies the exemption.
- Substance over form: Regulators look beyond marketing and technical jargon to assess actual operational control. Holding administrative keys, controlling front-end interfaces, or being able to upgrade or pause smart contracts triggers regulatory obligations.
- Software developers are not automatically CASPs: Simply developing and selling non-custodial software or hardware does not automatically qualify as a crypto-asset service. However, if the developer retains sufficient influence over the assets, platform, or ongoing business relationships, it may be deemed a CASP.
This article is based on research conducted by LegalBison in April 2026. It is for informational purposes only and does not constitute legal advice.