France Proposes Exchange Liability for DeFi Access Under MiCA

French authorities have put forward a set of significant changes to EU crypto rules that would make regulated exchanges responsible for vetting the DeFi protocols they connect customers to, and liable for certain losses when they fail to do so. The joint submission, filed in response to a European Commission consultation on the Markets in Crypto-Assets Regulation (MiCA), marks one of the most concrete attempts yet by an EU member state to extend investor protections into decentralised finance. For compliance officers and finance teams relying on crypto accounting software to track client exposure, the proposal introduces a fresh layer of regulatory risk that demands attention now, even though MiCA amendments remain prospective.

What France Is Proposing and Why It Matters

The submission came from four French bodies acting together: the Treasury, the Financial Markets Authority (AMF), the Banque de France, and the Prudential Supervision and Resolution Authority (ACPR). That four-agency coordination signals this is not a fringe position. It is a considered national stance heading into what will likely be a multi-year revision process for MiCA.

The Core Liability Shift

Today, MiCA explicitly carves out crypto services that are provided in a fully decentralised manner without any intermediary. France wants to close the gap that this carve-out creates in practice. When a regulated crypto-asset service provider (CASP) actively routes a customer into a DeFi protocol, French authorities argue the platform is acting as an intermediary, and should bear responsibility for incidents that occur on that protocol if the platform failed to conduct proper checks.

The proposal sets out a tiered framework. Platforms would be required to vet protocols before offering access, monitor them continuously for vulnerabilities and suspicious activity, and provide enhanced risk disclosures. For protocols that go through a formal certification process, standard due diligence would suffice. For uncertified protocols, platforms could still offer access, but only if they carry out their own rigorous due diligence and disclose the additional risks clearly to clients.

Smart Contract Certification

The French authorities backed the idea of certifying both protocols and smart contracts as part of the revised framework. This is a notable step: smart contract audits already exist as a market practice, but folding certification into a regulatory requirement would give them legal weight. Platforms that skip this step when connecting customers to a protocol could face direct liability for resulting losses.

On non-custodial wallets, the authorities took a more measured approach. They opposed blanket certification requirements for wallet developers, recognising that over-regulating self-custody could be counterproductive. Instead, they backed voluntary certification for more sophisticated wallets that integrate DeFi services directly, a sensible line to draw given the range of products on the market.

Broader MiCA Reforms Backed by France

DeFi liability is the headline, but the French submission covers several other significant proposals that will reshape how exchanges, custodians, and stablecoin issuers operate across the EU.

Shifting Significant CASPs to ESMA Supervision

France backed a transfer of supervisory authority over "significant CASPs" from national regulators to the European Securities and Markets Authority (ESMA). The current MiCA threshold for identifying a significant CASP is set at 15 million average daily active users in the EU. French authorities proposed lowering that threshold and expanding the criteria to include custody assets under management, business risk profiles, and group complexity. In practice, this could bring a larger number of platforms under direct EU-level supervision earlier than the current rules anticipate.

For compliance teams, a shift to ESMA oversight would mean dealing with a single pan-European supervisor rather than a national regulator, which could bring both harmonisation benefits and a more demanding supervisory approach, particularly for AML and reporting obligations.

Stablecoin Framework Gaps

The French submission also flagged gaps in MiCA's treatment of stablecoins. The regulation currently distinguishes between asset-referenced tokens (ARTs) and e-money tokens (EMTs). France proposed revisiting the ART category and, critically, adapting the EMT framework to cover multicurrency stablecoins. This is directly relevant to products that peg their value to a basket of currencies rather than a single fiat currency, a category that the current EMT regime was not designed to handle cleanly.

The proposal follows the EBA's designation of USDC as the EU's first significant e-money token, a development covered in our earlier analysis of EBA designating USDC as the EU's first significant EMT under MiCA. Taken together, these signals suggest the Commission will face pressure to clarify the stablecoin perimeter substantially in any MiCA amendment.

Where This Sits in the MiCA Review Process

The European Commission launched its MiCA consultation to gather views on activities that fell outside the original regulation's scope when it was drafted, including DeFi, certain wallet types, and cross-border supervision. Member state responses like France's will feed into a formal Commission report, which could then form the basis of legislative proposals to amend MiCA.

That process takes time. MiCA only became fully applicable in December 2024, and any amendment would need to pass through the full EU legislative machinery. Realistically, binding changes are unlikely before 2027 at the earliest. But the direction of travel is clear, and firms that wait for final rules to start adapting their governance and technology infrastructure will find themselves behind the curve.

This is also happening in a broader context of regulators pushing for smarter, more targeted oversight of DeFi. The debate around who should bear responsibility when a protocol is exploited is not unique to France, as explored in our piece on Hyperliquid's argument for regulating deployers rather than the chain itself. France is taking a different angle: instead of targeting deployers, it is targeting the regulated access point.

Accounting and Compliance Implications for B2B Firms

Due Diligence as a Recordable Control

If the French proposal or a version of it finds its way into amended MiCA, every CASP that offers DeFi access will need documented, auditable due diligence processes for each protocol it connects clients to. That means compliance teams will need workflows that capture the protocol assessment, the date it was conducted, who approved it, and what monitoring is in place on an ongoing basis. These records will not just be an internal governance matter. They will be the primary defence against a liability claim when something goes wrong.

From an accounting perspective, the due diligence and monitoring costs associated with DeFi access will need to be recognised and allocated correctly. Firms should also begin considering whether contingent liabilities need to be disclosed in financial statements if they are actively routing clients into protocols where the liability framework is still being defined. Under IFRS, a contingent liability disclosure may be warranted if a possible obligation exists and the probability of an outflow is more than remote.

Impact on Digital Asset Accounting Software Workflows

The proposal has direct implications for how firms configure their digital asset accounting software. If platforms become liable for DeFi incidents, they will need to track client exposure to specific protocols in real time, not just at month-end. That requires software capable of attributing transactions at the protocol level, flagging liquidity pool positions, and recording yield or loss events as they occur. Firms using crypto bookkeeping software that treats DeFi interactions as generic token transfers will find that level of granularity insufficient under a liability-based framework.

AML and Transaction Monitoring

The requirement to monitor DeFi protocols for suspicious activity sits squarely within existing AML obligations but extends them into territory that current monitoring tools often do not cover well. Smart contract interactions, liquidity pool movements, and cross-protocol bridges all generate on-chain data that needs to be parsed and assessed for red flags. Firms will need to review whether their current transaction monitoring systems can ingest and assess this data, and build escalation procedures for when anomalies are detected.

Practical Next Steps for Compliance and Finance Teams

The proposal is not yet law, but the consultation response from four major French financial authorities is a credible signal of where EU rules are heading. Firms should act on that signal now rather than waiting for legislative certainty.

First, map your DeFi exposure. Identify every protocol your platform connects clients to, directly or indirectly, and document what due diligence currently exists for each. Second, review your liability framework. Work with legal counsel to assess whether your current terms and conditions adequately address DeFi risks under a scenario where platform liability is imposed by regulation. Third, assess your monitoring capability. Review whether your transaction monitoring and on-chain analytics tools can track protocol-level activity in real time and flag vulnerabilities or suspicious behaviour. Fourth, engage with the consultation process. The Commission is still gathering views, and firms with significant DeFi exposure should consider whether to submit their own response or contribute through industry bodies.

France's submission is a detailed and technically credible document. It will carry weight in Brussels, particularly given that it represents a coordinated stance from the country's treasury, market regulator, central bank, and prudential supervisor. Firms operating across the EU should treat it as the most concrete indicator yet of how DeFi regulation is likely to develop under a revised MiCA.

Source: Cointelegraph