MiCA review explained: ESMA and EBA proposals for CASPs, stablecoins and DeFi

On 20 May 2026 the European Commission opened a public consultation and a more technical targeted consultation on the Markets in Crypto-Assets Regulation (MiCA), which has applied in full since 30 December 2024. Both closed on 31 August 2026. The Commission wants to know whether the framework is still fit for purpose as crypto markets change.

The EBA published its response on 24 September 2026 and ESMA on 30 September 2026. Both are advice to the Commission, not new rules. Nothing changes for firms until the Commission proposes amendments and the European Parliament and the Council adopt them.

For investor protection, ESMA wants stricter marketing rules, including duties for influencers and other third parties who promote crypto-assets; full cost disclosure by CASPs that execute orders, transmit orders or exchange crypto-assets, to stop misleading zero-commission claims; and targeted conduct and disclosure rules for staking, lending and borrowing. For supervision, it asks for explicit national powers to have scam websites removed, a direct ESMA power to require CASPs to freeze crypto-assets suspected of links to market abuse, money laundering or terrorist financing, stronger tools against third-country firms that solicit EU clients without authorisation, and permanent product intervention powers for ESMA.

On scope, ESMA wants a narrow, defined DeFi exemption, a new regulated service for CASPs that give clients access to DeFi protocols, binding ESMA opinions on token classification, and an express ban on CASP services involving stablecoins that do not comply with MiCA. To cut burden, it suggests centralising white paper notifications at ESMA, sparing investment firms that offer crypto services through a MiCA notification a separate licence for transfer services, and aligning CASP capital rules with the investment firm regime (IFR/IFD).

The EBA finds the MiCA rules for issuers of asset-referenced tokens (ARTs) and e-money tokens (EMTs) broadly appropriate. It sees significant to very significant risks in third-country multi-issuer stablecoin schemes and asks the Commission to strengthen the framework for them. It also suggests reviewing reserve requirements, notably the minimum amount of reserves held as deposits; clarifying MiCA's scope and definitions so that tokens are classified consistently; regulating crypto-asset lending, including where CASPs give access to decentralised lending protocols; and reviewing reporting by issuers and CASPs.

For context, the EBA counted 39 EMTs issued under MiCA and no authorised ART as at 1 September 2026.

MiCA's transitional period ended on 1 July 2026, so crypto-asset services provided from Cyprus now require a MiCA authorisation, or a notification where the firm already holds certain other EU financial licences, as an investment firm does. Neither response changes that today, but both point the same way. CASPs that use affiliates, introducers or influencers could face marketing rules closer to MiFID II; those advertising commission-free trading should check how they disclose spreads and other costs; and staking, lending and earn products could face specific disclosure, consent and safeguarding duties. Firms should also check that every stablecoin they support comes from a MiCA-authorised issuer.

Supervision may change too. ESMA notes that CASP supervision was outside this consultation, but asks that the review stay consistent with the Commission's market integration and supervision package of December 2025, which proposes moving the authorisation and supervision of all MiCA-authorised CASPs to ESMA; firms offering crypto-asset services under another licence, such as investment firms using a notification, would generally stay with their national supervisor unless those services become their main activity. That proposal is still before the co-legislators. Compliance teams should follow both files; for background on the Cyprus regime, see our study note on CASP registration and MiCA.