The long-standing crypto industry claim that “we are DeFi, so MiCA does not apply” is facing a much stricter regulatory reality in Europe. According to the source material, European supervisors are not persuaded by technical branding alone. Instead, the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) focus on a functional question: who actually controls the protocol, infrastructure, governance, and user-facing operations?
That distinction is crucial under the EU’s Markets in Crypto-Assets Regulation (MiCA). While MiCA’s Recital 22 suggests that services provided in a fully decentralised manner without any intermediary should fall outside the regulation’s scope, the article argues that this exemption is much narrower than many DeFi founders assume. In practice, the threshold is so high that only a small number of projects are likely to meet it.
A Substance-Over-Form Regulatory Test
The article stresses that MiCA does not simply ask whether a platform uses blockchain rails, smart contracts, or non-custodial software. Regulators instead apply a substance-over-form approach. That means a project’s legal analysis turns less on its marketing language and more on the operational reality beneath the interface.
If a single entity or identifiable group can influence governance, alter protocol parameters, push upgrades, manage administrative keys, control the front end, or pause and modify smart contracts, regulators may conclude that the project is not truly fully decentralised. In that case, MiCA obligations may still apply, and the operator could fall within the scope of rules applicable to crypto-asset service providers, or CASPs.
The source explains that the text of MiCA itself does not provide a fully worked-out definition of “fully decentralised” in its operative articles. The concept mainly appears in the recitals, which creates interpretive uncertainty. That uncertainty has shifted practical importance to the guidance, consultation papers, and reports produced by ESMA and EBA.
ESMA and EBA See Decentralisation as a Spectrum
One of the article’s central themes is that European regulators do not treat decentralisation as a binary concept. ESMA’s position, as described in the source, is that decentralisation exists on a spectrum, ranging from clearly centralised arrangements to systems with varying degrees of autonomy and distributed control.
This matters because many DeFi systems that appear decentralised at a technical level still retain identifiable chokepoints. According to the January 13, 2025 Joint Report cited in the article, DeFi accounts for roughly 4% of global crypto-asset market capitalisation. Yet the same report indicates that very few DeFi systems achieve the kind of full decentralisation envisioned by Recital 22 of MiCA. In many cases, there are still actors with influence over governance, deployment, fee structures, upgrades, or protocol administration.
The article distills the regulatory assessment into two practical conditions. First, no single entity should exercise control over protocol parameters, governance mechanisms, or the core technological infrastructure. Second, users should be accessing something more like a common good resource, rather than purchasing a service from a designated provider under an identifiable contractual relationship.
Public Blockchains Do Not Automatically Shield Operators
The article draws an important distinction between permissionless blockchain infrastructure and the applications built on top of it. ESMA’s analysis, as presented in the source, suggests that permissionless distributed ledgers may be viewed as a form of common good. In other words, using a public blockchain such as Ethereum does not, by itself, create a third-party outsourcing relationship under Article 73 of MiCA.
But that does not mean a project deployed on a public chain is automatically outside the regulatory perimeter. The key issue remains whether the operator retains functional control over the application layer. If a team can upgrade smart contracts, control access through the front-end interface, manage admin keys, freeze assets, or otherwise shape the user experience and protocol behavior, that project may still be captured by MiCA regardless of the permissionless nature of the underlying ledger.
This is one of the article’s strongest conclusions: the regulatory test is functional, not technological. Europe’s supervisors are asking what the operator can do in practice, not merely what technology stack the project uses.
The Arbitrum Example and Operational Control
To illustrate how thin the line can be between perceived and actual decentralisation, the article points to a specific April 21, 2026 event involving Arbitrum. According to the source, Arbitrum’s Security Council froze more than 30 ETH, described in the article as approximately USD 71 million, linked to the Kelp DAO exploit. A governing body of 12 members was able to move the funds to an intermediary wallet, where the assets could only be released through a governance vote.
The article uses this event to make a broader legal point. Even where a network is widely described as permissionless and architecturally decentralised, the existence of a body capable of intervening in user assets may demonstrate discretionary operational control. Under a MiCA analysis, that kind of authority could undermine claims that the arrangement is “fully decentralised.”
For regulators applying a substance-over-form test, such powers are highly relevant. They show that practical control may survive even within systems that are branded as open or trust-minimised.
Software Developers Are Not Automatically CASPs
The source also addresses the position of software and hardware developers. It notes that simply creating and selling non-custodial tools, software applications, or platforms does not automatically make an entity a CASP. This reflects a more nuanced regulatory line than some market participants expect.
However, the article also makes clear that this is not a blanket safe harbor. If developers or operators retain sufficient influence over the crypto-assets, protocol, software, platform functionality, or ongoing user relationships, the analysis changes. In that scenario, their role may cross the threshold from pure technology provision into regulated crypto-asset services.
This mirrors the broader theme running through the article: labels alone do not determine legal status. A team may present itself as merely building software, but if it continues to govern, maintain, influence, or operationally steer the system, regulators may take a very different view.
FATF Logic Continues to Influence the Framework
The article further situates MiCA and European guidance within the wider logic of the Financial Action Task Force, or FATF. FATF’s 2021 updated guidance on virtual assets and VASPs, as cited in the source, says that a person creating or selling a software application or platform may not be a VASP if they are doing only that. The critical word is “solely.”
Once creators, owners, operators, or other identifiable actors maintain control or exert meaningful influence over a DeFi arrangement, FATF’s framework suggests they may still be treated as service providers. According to the article, that influence may appear through governance rights, protocol administration, control over assets or smart contracts, or ongoing business relationships with users.
That FATF reasoning aligns closely with ESMA’s approach. Both point to the same core principle: partial automation does not eliminate accountability where human or corporate control remains materially present.
Why the Exemption Is So Hard to Claim
The article’s overall conclusion is stark. The “fully decentralised” exemption under MiCA is available in theory, but in practice it is exceptionally narrow. To qualify, a project must avoid not only obvious custody and intermediation features, but also less visible forms of influence across governance, ownership, interfaces, upgrades, and core operational functions.
That is a high bar. Most DeFi projects still have some combination of founding teams, multisigs, security councils, upgrade mechanisms, token-based governance concentration, emergency controls, or controlled front ends. Any of these factors could become relevant in a MiCA assessment.
The article therefore warns that DeFi teams entering the EU should not assume that technical decentralisation narratives are enough. A protocol may run on a permissionless chain and still face MiCA scrutiny if real-world control is retained by identifiable actors.
Implications for Teams Expanding Into Europe
For projects considering EU expansion, the source material sends a clear message: compliance analysis must go beyond architecture diagrams and decentralisation claims. Legal review needs to examine who owns what, who governs what, who can intervene, who controls the interface, and whether users are truly interacting with a neutral public resource or functionally relying on a service provider.
In that sense, the article is less a rejection of DeFi than a warning against overestimating how much decentralisation has actually been achieved. Under MiCA, the difference between a genuinely decentralised system and a regulated crypto service may depend on hidden governance levers rather than public rhetoric.
The result is a regulatory environment in which DeFi builders must be ready to prove, not merely assert, that no one retains operational control. And based on the EBA and ESMA perspective described in the source, that will be difficult for most projects to do.