European Regulators Publish Joint Report on Recent Developments in Cryptoassets and DeFi

In a Joint Report published on January 16, 2025, the European Banking Authority (EBA) and European Securities and Markets Authority (ESMA) set out the findings of their analysis on specific elements covered by Article 142 of the EU’s Markets in Crypto Assets Regulation (MiCAR). The Report constitutes the authorities’ contribution to the production of the European Commission’s report to the European Parliament and Council on recent developments in cryptoassets. The analysis was informed by extensive research on decentralized finance (DeFi) and crypto lending, borrowing, and staking.

The Report first examines the various use cases for DeFi and traces its development from its emergence in 2016 to its rise in 2020.

It is emphasized that this sector remains “marginal” compared to the cryptoasset sector as a whole, i.e., total assets under management in DeFi (“Total Value Locked”) represent just 4% of the total capitalization of the cryptoasset market.

IDENTIFIED RISKS AND REGULATORY IMPLICATIONS

A notable feature of the Report is the analysis of the risks inherent in DeFi. These findings will have resonance with the European Commission, which will have to decide on the appropriateness and feasibility of a suitable framework in accordance with Article 142 of MiCAR.

The European Supervisory Authorities (ESAs) consider that the main risks inherent in DeFi include the following:

• Cybersecurity Risks: The vulnerability of protocols to cyberattacks due to flaws in the code of “smart contracts,” the exploitation of economic mechanisms, or transactional techniques such as Maximum Extractable Value. On this point, it is worth recalling the work carried out jointly by the AMF (the French securities supervisor) and the ACPR (the French banking and insurance supervisor) relating to the certification of smart contracts, to which Morgan Lewis’s Paris team has actively contributed. This also echoes the EU’s DORA Regulation, which entered into force on the same day as the publication of the Report, January 16, 2025.
• AML/CFT Risks: Due to the absence of anti-money laundering and counter-terrorism financing compliance mechanisms, certain illicit actors (cybercriminals, fraudsters, terrorist organizations) could exploit the technical characteristics of DeFi to launder funds of criminal origin or collect cryptoassets destined to finance illicit activities.

ANALYSIS OF CRYPTOASSET LENDING AND STAKING ACTIVITIES

The Report also presents an in-depth analysis of cryptoasset lending and staking activities, distinguishing between the various forms of lending and staking mechanisms, including liquid staking and restaking.

With regard to the risks specific to these activities, the ESAs highlight:

• Investor Protection Risks: A significant proportion of the assets deposited as collateral on these protocols expose users to potential losses in the event of market fluctuations.
• Legal Risks: Absence of a clear legal framework for asset pooling; lack of dispute resolution mechanisms in the event of forced liquidation, piracy, or other unforeseen events; uncertainty as to applicable law; and consequences in the event of project insolvency.
• Market and Operational Risks: Fluctuations in the value of cryptoassets, vulnerability of technological infrastructures, and difficulties associated with decentralized governance.

It is interesting to note the influence of France in this Report, which cites studies conducted by the Banque de France, the EU-based trade crypto association ADAN’s “Web3 and Crypto in France” report, and the work of the AMF/ACPR working group on smart contract certification.

NEXT STEPS

The European Commission will incorporate the conclusions of the Report into its own report to the European Parliament and the Council in accordance with Article 142 of MiCAR. This document should guide the European Union’s regulatory strategy for DeFi and determine the appropriateness of a possible additional framework (MiCAR II).