Four French financial authorities have jointly proposed new rules under the European Union's Markets in Crypto-Assets Regulation (MiCA) that would hold cryptocurrency platforms responsible for security failures tied to decentralized finance (DeFi), in a move aimed at strengthening protection for European investors.

The proposals, released together on October 21, 2026 by the French Financial Markets Authority (AMF), the French Treasury, the Banque de France and the ACPR, respond to the European Commission's ongoing review of MiCA. MiCA, which the EU adopted in 2023 and phased in through 2024, is the bloc's first comprehensive framework for crypto-asset markets. The four authorities, which collaborate on EU crypto rules, are seeking to enhance investor protection while fostering innovation and competition in Europe's financial sector. Their joint position has been published on the AMF's official website.

Stricter Security Checks for Crypto Platforms

At present, MiCA does not treat fully decentralized peer-to-peer protocols as subject to its main rules. France is calling instead for stronger requirements on regulated companies that connect customers with DeFi services. These companies, known as crypto-asset service providers (CASPs), are regulated platforms that enable customers to access cryptocurrency services.

Under the proposal, CASPs could be held liable for certain customer losses. This would occur when platforms fail to address known security issues or do not adequately verify protocols before granting users access. In effect, responsibility for DeFi-related losses would rest with a regulated and identifiable entity — a notable shift in a market segment built around peer-to-peer protocols that operate without a single controlling company. France also wants these platforms to audit smart contracts — computer programs that execute actions when specific conditions are fulfilled — before providing access to DeFi services. In addition, platforms would be required to check for technical flaws and track suspicious blockchain activity. Such checks could prove useful in detecting security problems before they result in significant losses.

The proposal also establishes a formal certification system for DeFi protocols and smart contracts. Certification would help indicate whether a protocol meets certain security standards. Platforms still offer uncertified protocols under certain circumstances, but they would be required to put independent security surveillance in place and give stronger warnings about potential hazards.

France Pushes Wider Changes to EU Crypto Rules

The French proposal also draws a distinction between large crypto companies and smaller businesses. The proposed rules would be more stringent for significant CASPs and lighter for smaller companies, an approach that could help smaller firms control compliance expenses while investors remain protected — a tiering consistent with the proportionality principle that underpins much of EU financial regulation. However, the specific requirements would depend on the final regulations that European legislators adopt.

France also aims to defend the developers of standard self-custody wallets. Unlike centralized wallets, these wallets give users the ability to manage their own cryptocurrency without needing to trust a company to store it. Ordinary self-custody wallets would be exempt from automatic certification requirements, while advanced wallets with deeper DeFi features could gain access to voluntary certification programs.

Meanwhile, the European Commission is considering whether changes to MiCA are needed to cover gaps related to DeFi. France's proposals will form part of a broader assessment of cryptocurrency regulation, and the Commission is due to submit a report to EU lawmakers by June 30, 2027. Any resulting amendments would need approval from the European Parliament and the Council of the EU, meaning the final shape and timing of any new rules remain open. The outcome could carry implications for crypto companies across the entire 27-member EU bloc.

Beyond DeFi security, France also aims to reduce the threshold for determining the significance of CASPs; the current threshold is 15 million daily active users (DAUs). French officials also back a move to shift regulatory control of these large firms from national regulators to the European Securities and Markets Authority (ESMA), the EU-level securities regulator — a change that would concentrate oversight of the largest platforms in a single European authority and could lead to more uniform policy across Europe.