The European Union is reconsidering whether crypto lending and borrowing should fall within the scope of the Markets in Crypto-Assets Regulation (MiCA), potentially bringing decentralized lending protocols and onchain vaults into a regulatory framework that was not originally designed for them.
The European Commission launched a targeted consultation on May 20, 2026, seeking industry feedback on areas left outside the initial MiCA framework, including DeFi, crypto lending and borrowing. The consultation could eventually reshape how Europe approaches decentralized credit markets.
The difficult question is not simply whether lending should be regulated. It is who should be regulated when lending activity is distributed across smart contracts, automated systems and multiple participants rather than a conventional financial institution.
DeFi Vaults Complicate the Regulatory Picture
Onchain lending vaults can direct significant amounts of capital into credit markets while operating very differently from traditional lenders.
Under EU law, there is no specific legal category called a “vault.” Regulators would therefore need to examine what a vault actually does rather than rely on its terminology or technical architecture.
That creates a fundamental challenge.
A conventional lender typically has a clearly identifiable company responsible for originating loans, managing risk and interacting with customers. A decentralized vault can divide those responsibilities among smart contracts, governance participants and specialized roles.
As a result, determining who is actually providing a financial service can become considerably more complicated.
Morpho Shows Why Identifying the Provider Is Difficult
Morpho’s Vault V2 architecture illustrates the problem.
The system separates responsibilities among several participants, including an owner, curator, allocator and sentinel. The curator can establish investment strategies and risk parameters, while the allocator manages capital deployment and the sentinel provides additional risk controls.
That structure does not automatically mean any participant is operating a regulated lending business under MiCA.
But it demonstrates why applying traditional regulatory concepts to DeFi can be difficult. Control and responsibility may be distributed rather than concentrated in a single organization.
Legal analysts have similarly warned against treating every DeFi lending structure as one uniform category.
Some vaults primarily facilitate lending, while others may perform functions closer to asset management or trading. Applying one regulatory classification to all of them could therefore capture fundamentally different economic activities under the same rules.
Decentralization May Not Be Enough
MiCA currently excludes crypto-asset services provided in a “fully decentralized manner,” although the regulation can still apply when only parts of an activity are decentralized.
That might suggest decentralization as a potential dividing line between regulated and unregulated activity.
However, the concept itself is difficult to define.
Decentralization is not necessarily a fixed state. Control can gradually move from founders and core teams toward broader communities as protocols mature.
Using decentralization as the primary regulatory test could therefore create an unintended advantage for established protocols that have had more time to distribute control.
A newer protocol with a similar economic function could potentially face greater regulatory exposure simply because it has not yet reached the same degree of decentralization.
The Focus Could Shift Toward Control
One alternative is to examine the actual structure of a protocol and determine who exercises meaningful control.
Factors could include whether there is an identifiable operator or manager, whether users hold a direct contractual or coded claim on pooled assets, and whether participants can exit before material changes to the system take effect.
Such a structural approach could provide regulators with a more precise way to distinguish genuinely decentralized systems from businesses that simply use decentralized technology.
If the EU ultimately decides that lending and borrowing should become regulated crypto-asset services, another option would be to explicitly add those activities to MiCA rather than broadly expanding the definition of a crypto-asset service provider.
That distinction could prove important.
DeFi Lending Is Not Traditional Lending
Curve Finance founder Michael Egorov has argued that decentralized lending should not simply inherit the same regulatory requirements as conventional financial institutions.
Traditional lenders rely on centralized intermediaries, contractual relationships and institutional risk-management systems. DeFi protocols can instead use transparent smart contracts, automated collateral management and publicly verifiable transactions.
That does not eliminate risk. It changes its nature.
DeFi may require fewer traditional safeguards in certain areas while needing entirely different protections around smart-contract failures, oracle manipulation, governance attacks, liquidity shocks and automated liquidation mechanisms.
A regulatory framework designed exclusively around traditional finance could therefore impose requirements that some decentralized protocols cannot realistically satisfy without fundamentally changing their architecture.
Brussels Faces a Difficult Balancing Act
The European Commission’s consultation runs until September 30, giving policymakers and industry participants an opportunity to influence how the regulatory perimeter develops.
The outcome could determine whether DeFi lending vaults remain largely outside MiCA or become subject to a new regulatory regime.
But the central challenge for Brussels goes beyond deciding whether DeFi lending should be regulated.
The real challenge is designing rules that distinguish between different types of onchain lending, different levels of decentralization and different forms of human control.
A conventional lender has a company, management team and identifiable responsibilities.
A DeFi vault may have none of those things.
That difference makes regulation considerably harder. If Europe creates rules based on labels rather than economic function and actual control, it risks treating fundamentally different systems as though they were identical.
The next phase of MiCA may therefore become less about defining what DeFi is and more about determining when decentralized infrastructure becomes a regulated financial service.
