EBA Calls for Crypto Lending and DeFi Rules Under MiCA
The European Banking Authority has submitted formal recommendations to the European Commission urging that crypto lending and intermediated access to decentralised finance protocols be added to the scope of the Markets in Crypto-Assets regulation. For accounting firms, auditors, and CFOs whose clients operate as crypto-asset service providers anywhere in the EU, the message is direct: the compliance perimeter under MiCA is likely to expand, and the time to prepare is now, not when the legislative text arrives.
What the EBA Actually Proposed
The EBA's submission forms part of the European Commission's targeted consultation on MiCA, the review mechanism built into the regulation itself to assess whether its scope remains fit for purpose as markets evolve. The authority made three substantive clusters of recommendation.
Bringing lending into the regulated services list
The EBA recommended that the Commission carry out a cost-benefit analysis of legislative changes that would add intermediating crypto borrowing and lending to the list of services that trigger MiCA authorisation. Currently, lending activity sits in a regulatory gap: a crypto-asset service provider can facilitate lending without that service being a named, licensable activity under MiCA. The EBA wants that gap closed. If the Commission acts on this recommendation, firms offering any form of crypto credit intermediation would face the same authorisation, capital, and conduct requirements that govern trading, custody, and exchange services today.
Rules for DeFi access providers
Separately, the EBA called for specific requirements on CASPs that give clients access to DeFi lending protocols. This is a meaningful distinction from direct DeFi participation. The authority is targeting the centralised front-door to decentralised infrastructure: the broker, wallet provider, or platform that routes a retail or institutional client into a DeFi lending pool. Proposed measures include user suitability assessments, leverage limits, and enhanced disclosure obligations. The EBA also raised the possibility of restricting access to lending that involves asset-referenced tokens or e-money tokens already subject to MiCA authorisation, and of introducing a certification regime for DeFi lending protocols themselves.
The broader MiCA review context
These lending-focused recommendations sit within the EBA's wider input to the Commission's MiCA review, which also covers stablecoin reserve and liquidity rules, crypto-asset classification, and reporting requirements. This is not an isolated opinion: it follows the European Central Bank and the European System of Central Banks raising their own concerns about MiCA's treatment of stablecoin yield and liquidity in the same consultation window. The regulatory pressure on EU crypto compliance is coming from multiple directions simultaneously. For context on the ECB's parallel intervention, the ECB push to extend the MiCA stablecoin yield ban to lending and staking covers the complementary thread of that same debate.
Why the EBA Is Moving Now
Lending activity is already widespread across the bloc
The EBA cited its own prior research showing that crypto borrowing and lending is active in at least 16 EU member states. That is not a marginal or exotic activity limited to a handful of specialist platforms. It is mainstream enough that a regulatory gap covering it represents a systemic concern. The authority also noted that easier access to DeFi through centralised intermediaries and increasingly through AI-assisted tools is blurring the boundary between centralised and decentralised finance in ways that the original MiCA text did not fully anticipate.
The AI-DeFi convergence factor
The EBA's specific mention of artificial intelligence tools as a vector for DeFi access is notable. It suggests the authority is watching the emergence of AI-driven portfolio or yield optimisation tools that may automatically route user funds into DeFi lending positions. If such tools are provided by a regulated CASP, the EBA's proposed framework would likely treat that routing as a regulated lending intermediation service, triggering the full suite of proposed obligations. Accounting and compliance teams should flag this now, particularly where clients are building or acquiring AI-adjacent products.
MiCA Compliance Implications for CASPs and Their Advisers
Authorisation scope and licensing strategy
If the Commission adopts the EBA's recommendation and tables a legislative amendment, any CASP currently providing crypto lending or DeFi access without that service being covered by its existing MiCA authorisation will need to extend its licence. For firms advising CASPs on their regulatory structuring, now is the right time to audit the product list: does the client offer any form of yield, credit, or DeFi-routing product? If yes, a gap analysis against the proposed requirements, suitability testing, leverage limits, disclosure, potential protocol certification, is warranted before the legislative clock starts.
Conduct and product governance obligations
Suitability testing and leverage limits are not novel concepts in EU financial services: they are familiar from MiFID II's appropriateness and suitability regimes for complex instruments. If the EBA's template is followed, crypto lending could be treated analogously to leveraged derivative products for retail clients. That would require firms to collect information about client knowledge, experience, and financial situation before providing access, and to cap leverage at levels defined in the technical standards. For CFOs and compliance officers at CASPs, this means product governance frameworks, client categorisation processes, and pre-sale disclosure documents will need to be drafted or substantially revised.
DeFi protocol certification: an audit opportunity
The certification regime for DeFi lending protocols is the most structurally novel element of the EBA's proposals. If protocols must meet defined criteria to be accessible to regulated CASPs, a new layer of technical and financial due diligence emerges. Accounting and audit firms with crypto-native capability are well positioned to help CASPs assess whether a given protocol meets the certification threshold, and to document that assessment for regulatory purposes. The MFSA FinTech2030 takeaways on MiCA, stablecoins and DeFi accounting provide useful framing for how smaller jurisdictions within the EU are already thinking about DeFi oversight, which informs what certification criteria might look like in practice.
Accounting and Reporting Considerations
Recognition and measurement of crypto lending positions
Under IFRS, crypto assets are currently accounted for under IAS 38 (intangible assets) or, where held for trading, at fair value through profit or loss under IFRS 9, depending on the entity's business model. Crypto loans extended or received introduce additional complexity. A loan of a crypto asset may need to be accounted for as a derecognition of the lent asset and recognition of a receivable, or as a collateralised borrowing, depending on whether the risks and rewards of the lent tokens genuinely transfer. If MiCA brings lending into scope with specific reserve or collateral requirements, those requirements will affect how the underlying positions are measured and classified on the balance sheet.
Stablecoin-collateralised lending and asset-referenced tokens
The EBA's specific reference to restricting lending involving asset-referenced tokens and e-money tokens adds a layer relevant to stablecoin accounting. Where USDC, EURC, or other MiCA-authorised stablecoins serve as collateral in a lending arrangement, the accounting treatment of that collateral, whether it remains on the lender's balance sheet, is pledged, or is rehypothecated, needs to be clearly documented. For US-GAAP reporters, ASC 350-60's fair-value-through-net-income framework for crypto assets means that any collateral held will be marked to market each period, and credit exposure on the loan must be assessed under ASC 326's current expected credit loss model. For IFRS reporters, IFRS 9's expected credit loss model applies to the receivable side.
Disclosure and segment reporting
If lending becomes a named, regulated service under MiCA, it also becomes a reportable segment for many CASPs under IFRS 8 or an operating segment under US GAAP's ASC 280. That means revenue, expenses, and assets attributable to the lending book may need to be disclosed separately in financial statements, increasing the granularity of information available to investors and regulators alike. Auditors should anticipate this when planning engagements for CASP clients with active lending operations.
What Happens Next
The EBA's recommendations are input to the Commission's review, not law. The Commission will assess the responses to its targeted consultation, weigh the cost-benefit analysis the EBA has requested, and decide whether to table an amending regulation or handle the issues through delegated acts and technical standards. Given the EBA's explicit call for a cost-benefit analysis first, there is a procedural step before any legislative proposal. That analysis takes time, and EU legislative cycles, especially those touching a regulation as significant as MiCA, typically run over months to years. However, the direction of travel is clear: the EU's institutional infrastructure views unregulated crypto lending as a gap that needs closing, and the political appetite for MiCA expansion appears strong across both the EBA and the ECB.
Firms serving EU-regulated CASPs should treat this as a yellow warning, not a green light to wait. The gap analysis, product audit, and control framework design work should begin now, before any proposal creates a rushed compliance scramble.
Frequently Asked Questions
Does MiCA currently regulate crypto lending?
Not directly. MiCA's current text covers a defined list of crypto-asset services, including custody, exchange, and transfer. Crypto borrowing and lending is not explicitly named as a regulated service, which is precisely the gap the EBA is recommending the Commission close through a legislative amendment.
Which firms would be affected by the proposed DeFi access rules?
Any CASP that gives clients access to DeFi lending protocols, whether through a trading interface, a wallet product, or an AI-assisted yield tool, would be in scope under the EBA's proposals. The EBA is targeting the regulated intermediary, not the protocol itself, though the certification regime could indirectly affect which protocols CASPs are permitted to use.
What does the proposed suitability test mean in practice?
It would require the CASP to assess whether a client has sufficient knowledge and experience to understand the risks of crypto lending before granting access. This is modelled on MiFID II's appropriateness test for complex products. Firms would need documented processes for collecting and retaining that client information.
How should accounting teams treat crypto loans under current IFRS standards?
Under current IFRS, the treatment depends on whether the risks and rewards of the lent asset genuinely transfer. If they do, the lender derecognises the asset and recognises a receivable, which is then subject to the expected credit loss model under IFRS 9. If not, the position may be treated as a secured borrowing. Legal analysis of the lending agreement is essential to determine the correct accounting treatment.
When could these rules take effect?
The EBA's recommendations are input to the European Commission's MiCA review, not binding law. The Commission must first commission or review a cost-benefit analysis, then decide whether to table an amending regulation. EU legislative procedures mean any new rules are unlikely to apply before 2028 at the earliest, but the preparatory compliance work should start well in advance of any formal proposal.
Source: Cointelegraph