European regulators are drawing a map around DeFi loans, and the path they pick could change how millions of people borrow crypto through apps like MetaMask. On September 24, the European Banking Authority (EBA) formally asked the European Commission to study new rules for companies that connect everyday customers to decentralized lending — and the Commission’s consultation window slams shut on September 30 at 11:59 p.m. Central European Summer Time.
By David Chen | September 26, 2026
The Hook: A Deadline That Could Redefine DeFi Loans in Europe
DeFi lending — short for decentralized finance lending — lets people earn interest on their crypto or borrow against it using software called protocols, without a bank in the middle. The catch is that many people don’t reach these protocols directly. They get there through an app or a website built by a company. The EBA, Europe’s banking watchdog, wants to know whether those companies should face bank-like duties.
In its September 24 response to the European Commission’s review of the MiCA regulation — the EU’s rulebook for crypto firms — the EBA called for a cost-benefit analysis of possible new duties for intermediated borrowing and lending. MiCA already regulates crypto-asset service providers, known as CASPs. What it does not yet cover is the gray zone where a company’s app funnels a customer into a loan that actually runs on a decentralized protocol.
According to CryptoSlate, the EBA’s move was prompted by consumer risks, and the regulator itself changed no lending rule. It is a request to assess legislation — but it lands days before the Commission’s targeted consultation on the MiCA review closes on September 30, making the coming week a real decision point for the future of DeFi loans in Europe.
On-Chain Evidence: How an App Becomes a Doorway to DeFi
The EBA’s document maps the different ways a regular investor can end up in a DeFi loan. MetaMask’s own lending guide describes in-app access to Aave stablecoin pools, with mobile steps for depositing tokens. Aave’s access guide says users can reach the protocol through its own interface, through other applications, or by interacting with the smart contract — the self-executing code that runs the loan — directly.
Those routes matter because each one puts a different company between you and your money. The EBA identified two possible changes for lawmakers to weigh:
- New CASP service category — adding “intermediating crypto borrowing and lending” to MiCA’s official list of regulated services.
- Access-facilitation rules — requirements for CASPs that give clients access to DeFi lending through an interface or a product offering exposure to DeFi.
The Core Conflict: Consumer Protection vs. Decentralization
The EBA’s response describes real consumer harms behind its proposals: incomplete information about fees, yields, or changes to collateral requirements; leverage that can amplify losses; and risks from commingling of funds, outages, hacks, and poor recordkeeping. It also flags the absence of creditworthiness checks and possible over-indebtedness — the same worries regulators have about payday lending.
The suggested safeguards read like a bank rulebook transplanted onto crypto rails. Suitability tests could assess whether a customer should take part at all. Leverage caps and fuller disclosures could address borrowing risks. For DeFi access specifically, the EBA suggested extra warnings that activity through a truly decentralized protocol may lack regulatory safeguards, and it floated certification of lending protocols for resilience to cyberattacks.
There is even a proposal to prohibit CASPs from intermediating loans that involve tokens meeting MiCA’s definition of an asset-referenced or e-money token when the issuer lacks the required authorization — a quiet squeeze on unlicensed stablecoins in European lending markets.
The tension is obvious. Impose the checks at the app’s front door, and regulators protect retail users without rewriting the code underneath. Push too hard, and European users may simply bypass regulated interfaces entirely — going straight to the smart contract, where no warning screen or suitability test can follow them. The EBA itself notes that direct smart-contract use remains unresolved.
Market Implications: What This Means for Your Portfolio
If you lend or borrow through an app in the EU, expect the fine print to grow. Depending on how lawmakers define “facilitating access,” an app could face checks or mandatory warnings at its entry point while the protocol keeps executing loans on-chain. That could mean suitability questions before you deposit, caps on how much you can borrow, and clearer disclosures about what happens if collateral requirements change overnight.
For DeFi projects themselves, the direction of travel is double-edged. Certification requirements could become a quality signal that attracts cautious institutional money — or a compliance moat that only well-funded teams can afford. The Commission says it may accompany its MiCA report with a legislative proposal if warranted, so the September 30 deadline is the start of a process, not the end of one.
The Verdict
Nothing in the EBA’s response is an enacted rule — all six of its proposed DeFi lending safeguards are ideas for analysis. But the regulator has put the EU’s crypto lobby on notice: the app layer is now in scope. For regular investors, the practical takeaway is simple. If you use an interface to reach DeFi loans, the protections around that doorway may soon grow. If you go straight to the protocol, you remain, as today, on your own.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
the EBA asking for a study is step one of about ten. the sept 30 consultation closing at 11:59pm CEST is doing a lot of heavy lifting making this feel more urgent than it is
sept 30 deadline and they still havent defined what facilitating access even means. half the frontends will just geo-block the eu again and call it compliance
geo-blocking is already the default playbook lol. took me a vpn and three wallets just to farm one testnet drop last year
facilitating access has been undefined since mica dropped and every regulator uses it differently. meanwhile metamask already dips into country lists whenever a wallet connects
The new CASP service category makes sense on paper. Someone has to be answerable when a mobile app routes retail deposits into Aave pools with two taps.
Answerable to whom though. The smart contract keeps executing loans whether the app shows suitability questions or not. You can regulate the doorway all you want, the vault still runs on-chain.
True, but try explaining that distinction when the frontend showed a wrong liquidation price. The EBA paper reads like it wants someone answerable at the doorway, and the contract keeps running regardless.
the funny part is the consultation asks for a cost benefit analysis of frontend rules, as if the cost of geo-blocking europe out of defi is zero. that number should be fun to read
sept 30 deadline on a miCA consultation and the EBA wants a cost benefit analysis of frontend apps. that is basically how they got custody rules through, one consultation at a time
The MetaMask angle is interesting. If the app connecting you to Aave counts as a service provider under MiCA, half the wallets in Europe suddenly need a CASP license. That is a much bigger deal than the headline suggests.
if metamask needs a casp license, every frontend dev in the eu becomes a regulated entity overnight. compliance wall is putting it mildly
if metamask counts as a service provider under mica, every wallet frontend in europe needs a casp license overnight. that is a compliance wall most dev teams cannot climb
@Katarzyna exactly. people keep saying ‘the protocol is decentralized so nothing changes’ but the EBA document is clearly aimed at the doorway, not the pool. regulate the UI and the protocol becomes invisible to normal users
got liquidated on an aave position through a frontend app in may. took 3 days to even figure out who was responsible. nobody. that is the gap they are talking about
the nobody is responsible gap is exactly what frontend regulation tries to close. took you 3 days to find no answer, a casp category at least gives you someone to email
11:59pm CEST cutoff is such a classic move. most people submitting feedback will be doing it from work on tuesday. anyway EBA asking for a study is not a rule yet, calm down everyone
calm down is the right read. its a study request attached to a consultation, not final rule text. the comments treat every EBA paper like regulation day
calm down was also the mood during the tfr consultations and we still ended up with travel rule nonsense. these study requests are how it starts
calm down is the right read honestly. its a study request attached to a consultation, not a draft standard. the metaMask CASP question is where it gets spicy tho
a 23:59 cest cutoff on a tuesday is designed for consultants with prepared templates. watched the custody consultation play out the same way, a dozen polished industry submissions and a handful from everyone else