The EU's Markets in Crypto-Assets Regulation (MiCAR) has come into full effect, yet widespread misconceptions persist regarding its applicability to decentralized finance (DeFi) projects. Many teams claim 'we are decentralized, so MiCA does not apply to us.' However, guidelines from the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) have shattered this notion.
In a detailed analysis published by Bitcoin.com News as part of its MiCA Decoded series, Eira Järvi, senior lawyer at LegalBison, explains that MiCAR Recital 22 mentions a possible exemption for services provided in a 'fully decentralized manner without any intermediary.' Yet this exemption is extremely narrow, and the operative articles of the regulation do not define the term 'fully decentralized.' Regulatory authorities will apply a substance-over-form test—assessing who actually exercises operational control, rather than relying on technical architecture or marketing claims.
Recital 22 Conditions and Regulatory Interpretation
MiCAR Recital 22 states that services provided in a fully decentralized manner without any intermediary fall outside the regulation's scope. However, the EBA and ESMA Joint Report of January 2025 (ESMA75-453128700-1391 / EBA/Rep/2025/01) clarifies two essential conditions: First, no single entity may exercise control over protocol parameters, governance mechanisms, or core technical infrastructure. Second, users must interact with what amounts to a 'public resource,' rather than purchasing services from a designated provider.
The report confirms that very few DeFi systems achieve true full decentralization. Even ostensibly decentralized protocols typically involve identifiable entities that wield varying degrees of control over governance, protocol upgrades, smart contract deployment, and fee structures.
The Arbitrum Case: Control in Action
On April 21, 2026, the Arbitrum Security Council froze over 30 ETH (approximately $71 million) linked to a Kelp DAO exploit. The 12-member governance body transferred funds to an intermediate wallet, effectively locking them pending governance votes. This incident reveals the existence of 'discretionary operational control': despite Arbitrum being a permissionless, seemingly fully decentralized Layer-2 network, the exercise of control over user assets fails the MiCAR 'fully decentralized' test. Regulators prioritize substance over form, regardless of whether the underlying ledger is permissionless.
ESMA and EBA's Core View: Decentralization Is a Spectrum, Not Binary
ESMA acknowledges in its consultative papers that decentralization exists on a spectrum. If a platform operator retains control over smart contracts (ability to upgrade, pause, or modify functions), holds administrative keys, or controls the front-end interface, those centralizing elements bring the operator within MiCAR’s scope—even if the underlying ledger is permissionless. ESMA explicitly states: 'Permissionless DLT can be considered a public resource, but if an operator retains functional control over smart contracts deployed on that infrastructure, MiCA compliance cannot be avoided.'
At the same time, merely developing and selling non-custodial software or hardware does not automatically classify an entity as a crypto-asset service provider (CASP). However, if the developer or operator retains sufficient influence over crypto-assets, the platform, or ongoing business relationships with users, the regulatory threshold is triggered.
FATF Framework and Contractual Relationships
The FATF guidelines on VASPs and DeFi provide a foundational framework adopted by ESMA. Key principles include: owners and operators of DeFi arrangements can typically be identified through their association with activities, not by labels; and partial automation via smart contracts does not automatically preclude centralization. MiCAR Article 73 on outsourcing further clarifies that interacting with permissionless blockchains does not require a formal contractual relationship, so such blockchains are not considered third-party providers. In contrast, permissioned DLT operated by commercial enterprises often involves contractual arrangements, constituting third-party provider relationships that may trigger regulatory obligations.
In summary, the 'fully decentralized' exemption under MiCA is extremely narrow. Any project claiming 'we are DeFi, therefore MiCA does not apply' faces scrutiny. EBA and ESMA have sent a clear signal: substance over form governs compliance obligations—control is the decisive factor.
This article is based on research conducted by LegalBison in April 2026 and is provided for informational purposes only, not as legal advice.