MiCA Wants to Regulate Vaults. The Problem: There’s No One to Regulate.
Brussels is reopening the MiCA file. In this review cycle, crypto lending and DeFi vaults are back on the table.
The knot is stablecoin yield. MiCA already prohibits paying people simply for holding certain stablecoins. Read too broadly, that principle can become something much larger: no return should ever be associated with a stablecoin.
But a lender in a lending pool is not paid for holding a token. They are paid by borrowers using their capital and bearing its cost. Erase that distinction and lending itself stops making sense: who lends without a return?
That is what this article unpacks: what Brussels is examining, why the regulatory concern is legitimate, and why applying the wrong concepts to DeFi vaults could break the infrastructure regulation is meant to govern.
The Problem Is Not Lending. It’s the Control Point.
MiCA does not currently regulate crypto lending as a general category. Recital 94 leaves it to national law pending an assessment of whether a European framework is necessary and feasible. The official text is more cautious than the clickbait headlines doing the rounds online.
The consultation opened in May 2026 and closed on 30 September did not introduce KYC for DeFi vaults. It raised a harder question: what should happen when a credit market runs in a public smart contract, without a company holding assets or identifying the customer? The consultation
Lending, in one sentence: lenders make assets available for a potential return; borrowers post collateral to access capital without selling the assets they want to keep.
That is the basis of a DeFi Lombard loan: borrow against collateral, keep your exposure, and accept liquidation risk if the collateral falls. Our guide
The joint EBA/ESMA report separates centralised intermediaries from DeFi protocols while examining interfaces, wallets, and platforms. The report is fundamentally about scope, not just risk.
A technical interface is not a financial intermediary.
When it holds no assets, controls no keys, executes no order for the user, and provides neither personalised advice nor discretionary management, it is a control layer. The user signs the smart-contract call from their own wallet.
Erase that line and regulators are no longer regulating a service. They are regulating the tool: the browser, the block explorer, the wallet, then eventually the analytics software.
MiCA does not require a licence to publish every dApp today. But if a future extension did, compliance, KYC, legal teams, reporting, insurance, and redress processes would become the cost of entry. Large incumbents could absorb it. Independent developers could not. That is a market-structure choice, not a neutral form of consumer protection.
Yield Is Not a Bug
Lending capital involves risk. Borrowing capital you do not own has a cost. Yield is not an anomaly; it is the price of credit.
In a lending pool, suppliers provide liquidity. Borrowers post collateral, pay a rate that rises when liquidity is scarce, and can be liquidated if their collateral no longer covers the debt. Interest flows back to the pool after any fees.
That is not the same thing as paying someone simply for holding a stablecoin. MiCA Articles 40 and 50 prevent issuers of ARTs and EMTs — and certain service providers — from offering interest linked to how long a token is held. The goal is to stop stablecoins becoming interest-bearing deposit substitutes. Articles 40 and 50
In a pool, users are not paid because USDC is sitting in a wallet. They are lending capital to borrowers, for a price and with risk. Treating the two as identical confuses money with credit.
A Vault Is Not a Small Bank
The word vault sounds like custody. In DeFi, it usually means a set of rules allocating assets across one or more lending markets.
With a model such as Morpho, the layers need to be kept separate:
“Code is law.”
Collapsing those layers into one label — “DeFi” — is both a reading error and a design error.
Protect Users. Target the Right Thing.
The risks are real: fast liquidations, oracle failures, vulnerable smart contracts, poorly configured vaults, misunderstood leverage, and AML controls that can be bypassed. The EBA is right to ask whether crypto lending and parts of DeFi belong in MiCA’s next review. Its position
When people see “8% yield,” they do not naturally read:
“I am taking smart-contract, market, liquidity, oracle, governance, and counterparty risk.”
They read:
“My money is working.”
The regulator’s job is to stop that simplification from becoming a trap. The question is where that protection belongs.
Regulate Real Power, Not Technical Proximity
The question is not “control or no control.” It is who controls what, and on whose behalf.
MiCA defines specific services: custody, exchange, executing or transmitting orders on behalf of a client, personalised advice, and portfolio management. Its definitions are about control and client relationships, not merely displaying an interface.
A non-custodial interface through which users read a protocol and sign for themselves is not inherently a financial service. The analysis changes when it controls keys, acts for the client, makes personal recommendations, manages a strategy, or promises returns.
We have already seen that category error with m-Wallet. During its App Store review, Apple asked for signed agreements with partners. But m-Wallet holds no assets, controls no keys, and never signs for the user — so there were no partners to declare. A technical interface is not an unfinished bank.
That is also where KYC belongs. It can make sense when a company holds assets or acts for a client. Imposing it on an autonomous smart contract means adding a whitelist, a database, and a new gatekeeper connecting identity, wallet, and onchain wealth. It does not regulate the protocol; it adds an intermediary.
Blocking a front-end does not remove the public contract. It sends users down less visible paths. EBA and ESMA identify interfaces as possible entry points to study, not as automatic CASPs. The report
A protocol is not automatically a financial institution. An interface is not automatically an intermediary.
Deposits Are Also About the Rails
This debate is not only technical. It is also about where your capital sits — and who gets to put it to work.
Banks do not simply lend out a pre-existing pool of deposits. When they issue a loan, they also create the corresponding deposit. But deposits remain strategic: they provide liquidity, funding, and the customer relationship. Bank of England
Self-custody and onchain credit markets move part of that relationship. Users decide where their capital works rather than leaving it automatically inside bank-centred rails.
Making stablecoins non-yielding while making onchain alternatives harder to access can therefore reinforce the existing rails. That does not require a hidden intention. It is a structural effect.
The real question is simple: are we reducing a specific risk, or making every alternative to the banking model harder to use?
What This Changes for You
The 2026 consultation does not itself introduce mandatory KYC for a DeFi vault. But the likely fault lines are easy to see:
| Situation | What may face more oversight | What remains difficult to regulate |
|---|---|---|
| Direct deposit from a self-custody wallet | Fiat on- and off-ramps, commercial access tools | The public smart contract itself |
| Curated vault | Strategy, disclosures, conflicts, curator accountability | Autonomous onchain execution |
| Product offered by a CEX or custodial wallet | KYC, custody, marketing, client protection | Direct interactions outside the product |
| Technical non-custodial interface | Not a CASP on its own; an extension would need a new obligation | Direct contract access from the user’s wallet |
Do not look to work around rules; understand where they apply. Keep protocol, strategy, counterparty, and regulatory risk separate. A vault without KYC is not risk-free. A product with KYC does not become risk-free either.
Do Not Make Netflix Rebuild Blockbuster
Europe can treat DeFi as a blind spot to close, or as a new financial layer whose risks must be made legible and whose responsible actors must be regulated where they actually have power.
The first option feels familiar: identify a company, require a process, close a door. The second is harder. It accepts that an autonomous protocol can exist without a company holding it, while still demanding honest disclosure and accountability where there is real control.
Netflix did not win because video rental stores were useless. It won because the rails changed.
The test should stay simple: who holds the key, who signs, who executes, who decides for the user? If the answer is the user, the interface helping them operate their wallet is not an intermediary. It is a tool.
This article describes an evolving regulatory landscape. It is not legal or investment advice. Check the rules that apply to your situation before making decisions.