Malta’s Financial Services Authority has opened a public consultation on whether DeFi protocols that keep centralized features should fall within the scope of the EU’s Markets in Crypto-Assets Regulation, or MiCA. The discussion paper was published on June 12, 2026, and responses are open until July 10.
The paper accepts that MiCA excludes crypto-asset services delivered in a fully decentralized way without any intermediary. At the same time, the authority argues that many DeFi protocols still retain clear control points. Admin keys, concentrated governance, upgrade rights, and control over user-facing interfaces may be enough to pull a protocol back inside the regulatory perimeter. MFSA also states that the paper does not set out a policy position, and the proposals are not binding at this stage.
MFSA says MiCA lacks a clear test for full decentralization
According to the paper, MiCA Recital 22 places services operating without an intermediary outside the regulation, but it does not provide a precise threshold for what “fully decentralized” means in practice. MFSA says that question has to be assessed case by case, with attention to governance, operational design, and control features.
The authority lists several signs of incomplete decentralization: an identifiable intermediary, admin-key control over critical functions, concentrated governance power, custody of user assets by the protocol, closed-source code, and marketing carried out by an identifiable entity. It also asks whether decentralization should be viewed as a spectrum instead of a binary state. For authorized crypto-asset service providers that integrate DeFi elements, the paper raises possible requirements such as smart-contract audits, governance reviews, and risk assessments.
Financial crime concerns sit alongside the scope debate
The consultation also links DeFi oversight to financial crime risk. MFSA points to the Financial Action Task Force principle of “same risk, same rule,” under which persons exercising control over a protocol may qualify as virtual asset service providers. Citing FATF and Chainalysis data, the paper says stablecoins accounted for about 84% of illicit virtual asset transaction volume in 2025.
That issue becomes more immediate as licensed firms expand under MiCA. The paper notes that players such as BVNK are passporting stablecoin infrastructure across the European Economic Area, adding weight to the question of how DeFi-linked services should be treated when they connect with regulated markets.
Legal wrappers for DeFi are also under review
MFSA is not only examining regulatory scope. It is also considering legal structures that could give DeFi projects a clearer footing. One idea is to recognize software-based organizations as a legal category, with decentralized autonomous organizations, or DAOs, treated as one form within it. Another option is the use of segregated cell companies, which could ring-fence assets across internal cells in a way that mirrors on-chain modularity. Even here, the authority notes a tension: the presence of a central entity could itself be read as evidence of centralization.
The review also covers guardian agents and account abstraction. MFSA asks when guardian authority amounts to effective control, and says a provider that holds signature weight or controls validation logic in a smart contract account may be carrying out custody captured by MiCA. The authority will review the responses before deciding whether to develop more detailed proposals.