France Proposes Liability Rules for Crypto Exchanges Enabling DeFi

France has urged the European Union to update its crypto rules under MiCA so that regulated platforms face clearer responsibility when connecting users to decentralized finance (DeFi) services. In proposals submitted as part of a European Commission consultation, French authorities argue that crypto-asset service providers (CASPs) should be accountable for certain incidents affecting clients where they actively facilitate access—or fail to address known security risks.

The call comes as the European Commission reviews whether MiCA still fits the rapidly evolving crypto market, including activities that sit partly outside the law’s original scope, such as DeFi. France’s input—delivered by the Treasury along with the Financial Markets Authority (AMF), the central bank and the Prudential Supervision and Resolution Authority (ACPR)—aims to extend investor protection without changing MiCA’s core approach for fully decentralized services.

Key takeaways

• France wants CASPs to be liable for certain client-impacting DeFi incidents when they actively enable access or ignore known risks.
• Proposed obligations include protocol vetting, ongoing monitoring for vulnerabilities and suspicious activity, and risk disclosures.
• Authorities support certification for protocols and smart contracts, but oppose mandatory blanket certification for all non-custodial wallet developers.
• France also backs shifting oversight of “significant CASPs” to ESMA and lowering MiCA’s “significant” user threshold from 15 million average daily active users.
• France suggests revisiting MiCA’s asset-referenced token (ART) rules and adapting the e-money token (EMT) framework for certain multicurrency stablecoins.

Liability for DeFi access would fall on regulated facilitators

MiCA generally targets regulated intermediaries. One of its carve-outs concerns crypto services provided in a fully decentralized manner without intermediaries. France’s proposals aim to narrow the gap between that exclusion and the reality that many consumers access DeFi through regulated gateways.

In its response to the European Commission’s consultation, France says “CASPs [crypto-asset service providers] should be liable for certain incidents affecting clients where they actively facilitated access.” The practical thrust is to make the duty more concrete for platforms that connect customers to DeFi protocols, rather than treating all DeFi-related activity as purely decentralized and therefore outside MiCA.

French authorities argue that investor safeguards should extend to regulated platforms that “link” customers to DeFi protocols—even if the underlying protocol is decentralized. Under the approach described in the proposals, CASPs would be expected to demonstrate they have handled known security issues and continued to monitor supported systems for emerging threats.

Protocol vetting, monitoring, and certification—at least for some cases

France’s DeFi-related proposal centers on expanding compliance duties for platforms offering access. Authorities suggest requiring CASPs to:

• vet DeFi protocols before offering access,
• monitor protocols for vulnerabilities and suspicious activity,
• support certification of protocols and smart contracts, and
• accept liability for certain incidents that harm clients.

The proposals also describe a risk-based structure. Requirements would apply fully to “significant” CASPs, while smaller providers would face scaled obligations rather than identical standards.

Importantly, France’s plan is not necessarily limited to only “certified” DeFi. Authorities state platforms could still connect customers to uncertified protocols if they conduct their own due diligence and give enhanced risk disclosures. That approach suggests an attempt to preserve flexibility for innovation while ensuring regulated intermediaries do not avoid responsibility simply because the underlying DeFi system lacks formal certification.

How France treats wallets differently from DeFi protocols

France’s proposals also differentiate between DeFi access and wallet development. While it supports certification for protocols and smart contracts, it opposes blanket certification requirements for developers of non-custodial or self-custodial wallets.

Instead, the response favors a more targeted model: voluntary certification for more advanced wallets that integrate DeFi services. This distinction matters because it recognizes that requiring uniform certification across all wallet software could be overly broad, while still leaving a regulatory lever where wallets and interfaces are used as conduits to complex DeFi interactions.

Broader MiCA overhaul: ESMA supervision, a lower user threshold, and stablecoin tweaks

France’s submission goes beyond DeFi. It also backs changes to MiCA’s supervisory design and stablecoin taxonomy—two areas that have become increasingly contentious as EU crypto policy tries to keep pace with market expansion.

First, France supports transferring supervision of “significant CASPs” from national regulators to the European Securities and Markets Authority (ESMA). In addition, authorities propose lowering MiCA’s current threshold for identifying “significant CASPs” in the EU: MiCA currently uses 15 million average daily active users. France suggests reducing that figure and also considering other factors such as custody assets, business risks and group complexity when determining which platforms should fall under ESMA oversight.

Second, France calls for a review of MiCA’s asset-referenced token (ART) category. ARTs are defined in MiCA as tokens intended to maintain a stable value by referencing assets or combinations of assets. The proposals note that no ARTs have been authorized under MiCA so far, and recommend adapting the e-money token (EMT) framework to cover certain multicurrency stablecoins.

That stance signals that France sees an uneven fit between MiCA’s existing stablecoin categories and the products being discussed and built across European markets. Since ART authorizations have not materialized yet, adjusting the framework could be an attempt to unblock compliance paths for stablecoin issuers operating with different reserve structures or reference mechanisms.

What to watch next

France’s response feeds into a broader EU process: the Commission’s consultation is expected to inform a report to EU lawmakers due by June 30, 2027, which could lead to amendments. Investors and builders should watch whether Brussels adopts France’s liability model for CASPs facilitating DeFi access—and whether the EU moves to tighten or redefine supervisory thresholds and stablecoin categories before that deadline.