DeFi, protocols and staking
A protocol only falls outside the MiCA Regulation if its decentralisation is real. An interface operated by a company, an admin key or a vault run by a curator is enough to create a regulated service, or even an investment fund. ORWL Avocats qualifies these structures, secures their governance and their contracts, and advises protocols, staking providers and CASPs that integrate DeFi.
Does a decentralised protocol fall outside MiCA?
The MiCA Regulation leaves outside its scope services provided in a fully decentralised manner, without any intermediary (Recital 22). The wording is narrow. Partial decentralisation is not enough: every link in the chain controlled by an identifiable person may amount to a crypto-asset service.
Regulators look at how the protocol actually works. The ACPR (Autorité de contrôle prudentiel et de résolution, the French Prudential Supervision and Resolution Authority) showed this in its April 2023 discussion paper, which prefers to speak of “disintermediated” rather than “decentralised” finance. The points of attention are always the same:
- admin keys and the power to pause or amend the smart contracts;
- governance: who proposes, who votes and who executes the DAO’s decisions;
- the interface: a company that operates and promotes it often provides a service distinct from the protocol;
- fees: their collection by an identifiable entity points to a commercial activity;
- oracles and bridges, which reintroduce intermediaries.
The MiCA Regulation is not the only text at stake. A token or a vault share may be a financial instrument, which MiCA excludes from its scope and which falls under financial markets law. ESMA’s guidelines on the qualification of crypto-assets as financial instruments set out the analytical framework. The firm also advises on qualifying a token under MiCA.
Finally, the European Commission is to assess DeFi and crypto-asset lending with a view to possible regulation. A protocol being structured today should anticipate that work.
A single project may fall under several regimes: run the tree for each service and each token.
Staking, liquid staking and restaking: which regime?
Staking means locking up crypto-assets to take part in the validation of a proof-of-stake blockchain in exchange for a reward. The MiCA Regulation does not list it among crypto-asset services. The regime therefore depends on what surrounds the operation.
Staking on own account is not regulated. Staking on behalf of third parties becomes regulated where it comes with a service listed by MiCA:
- custody, where the operator holds the staked assets, the rewards or the keys giving access to them;
- exchange, where it converts the rewards into other crypto-assets or into euros;
- portfolio management, where it decides for its clients how to allocate between validators or protocols.
A validator operator that receives a delegation without holding the assets or the keys may remain outside CASP authorisation. It has to demonstrate this through its flows, its contracts and its communications: a badly drafted yield promise, or an exchange service added later on, is enough to change the qualification. Rewards created automatically by the blockchain for validating transactions also fall outside the offer-to-the-public obligations of the MiCA Regulation.
Liquid staking adds a token representing the staked assets and their rewards. That token can be traded, used as collateral or reinvested in other protocols. It is in principle a crypto-asset subject to MiCA, with the questions of offer to the public and admission to trading that come with it. Restaking reuses those staked assets to secure other services: yields and penalty risks (slashing) add up, and user disclosure becomes central.
One risk specific to French law long weighed on these offers: the regime for intermédiaires en biens divers (intermediaries in miscellaneous assets). Since 1 July 2026, the French Monetary and Financial Code (CMF) has excluded from that regime proposals relating to crypto-assets (Article L. 551-1). The risk remains for offers relating to physical goods carrying a yield, such as the sale of nodes or of validation hardware that the buyer does not operate.
Vaults and liquid staking tokens: the requalification risks
A vault pools deposits from several users and allocates them according to a strategy, often set by a manager or a curator. Depositors receive shares representing their rights over the basket of assets. This pattern brings the vault close to an investment fund.
Two requalification risks arise, which the firm analyses case by case with its clients:
- collective management: a scheme that raises capital from a number of investors in order to invest it in accordance with a defined policy, for their benefit, meets the definition of an alternative investment fund (AIF);
- financial instrument: a share or a token carrying a right to a yield generated by someone else’s management, or rights comparable to those of a security, may fall under financial markets law rather than under MiCA.
Qualification depends on the structure: who sets the strategy, who can change it, how the yield is calculated, what rights the shares carry. A vault whose strategy is hard-coded and which has no identifiable manager is not treated in the same way as a vault run by a paid curator. The firm also advises on the tokenisation of real-world assets, which are often placed in such vaults.
| Model | What tips the balance | Requalification risk | Expected deliverables |
|---|---|---|---|
| Protocol and front-end interface | Admin keys, upgrades controlled by a team, fees collected by an entity, interface operated by a company | Low where decentralisation is real and documented; high as soon as one person controls a link in the chain | Qualification memorandum, risk mapping, terms of use for the interface, governance documentation |
| Non-custodial wallet | Key recovery by the publisher, co-signing, exchange or yield built into the application | Low where the user alone keeps control of the funds; custody otherwise | Analysis of the flows and of the keys, terms of use, contracts with integrated partners, remediation plan |
| Vault | Pooled deposits, strategy chosen by a manager or a curator, shares issued to depositors | High: portfolio management, investment fund or financial instrument depending on the structure | Qualification memorandum, legal opinion, user disclosure documentation, smart contract audit |
| Delegated staking, without custody of the assets | Delegation without transfer of the assets, rewards withdrawn by the user, no built-in exchange | Low where the operator keeps neither the assets nor the keys | Legal opinion, service agreement, review of marketing communications |
| Staking offered by a platform that holds the assets | Assets and rewards held by the platform, conversion of the rewards, yield promise | High: custody, exchange and, where applicable, portfolio management | CASP authorisation file, custody policy, risk disclosure to clients |
| Liquid staking | Token representing the staked assets and the rewards, pooling in a smart contract, selection of the validators | Case by case: crypto-asset subject to MiCA, financial instrument or fund unit depending on the rights attached to the token | Token qualification memorandum, legal opinion, crypto-asset white paper where an offer to the public requires one |
| Restaking | Reuse of the staked assets to secure other services, yields and penalty risks adding up | Case by case, with the same questions as liquid staking and a higher risk for users | Qualification memorandum, risk mapping, user disclosure |
Wallets: where does custody begin?
The MiCA Regulation defines custody as the safekeeping or control, on behalf of clients, of crypto-assets or of the means of access to those assets. It excludes providers of non-custodial wallets, whether hardware or software (Recital 83). The boundary comes down to a simple question: can the publisher move the user’s funds?
Recent architectures blur that boundary:
- shared-key (MPC) solutions, where the publisher holds a key share or can reconstitute access;
- smart accounts, where the publisher retains a power of recovery, of freezing or of signature;
- wallets that build in an exchange, a yield or a card, provided directly or through partners.
Each type of wallet calls for an analysis based on the flows and on the contractual terms. The firm identifies the risks, confirms that the solution is compliant or sets out a remediation plan to get there: changes to the key architecture, rewriting of the terms of use, contracts with authorised partners. The firm also advises wallets that touch on payment services and the ACPR, and the NFT marketplaces connected to them.
CASPs: integrating a DeFi or staking product
A crypto-asset service provider (CASP) may offer its clients access to a DeFi protocol or to staking. It is then providing an unregulated product within a regulated offering, which calls for a dedicated analysis.
That analysis covers:
- the qualification of the product and of the services the CASP provides in order to give access to it;
- custody: a CASP may not use its clients’ crypto-assets for its own account, and has to frame their deposit into a smart contract;
- financial and technical risks: failure of the protocol, penalties, loss of liquidity;
- client disclosure on those risks and on the CASP’s remuneration;
- AML/CFT compliance of the flows, screening of addresses and compliance with asset-freezing measures.
In practice, the AMF may ask for a regulatory analysis and an AML/CFT analysis of the product before launch. The firm drafts them and incorporates them into the compliance framework of the authorised CASP.
How we work
The engagement depends on the need. A full engagement runs through six stages.
The firm also handles the taxation of staking rewards and of DeFi income, for the project as well as for its users (Tax).
Why work with ORWL Avocats?
Since it was founded in 2018, the firm has advised DeFi protocols, blockchain services, publishers of non-custodial wallets, vault providers, technical service providers and CASPs that integrate DeFi products. It contributed to the ACPR’s consultation on decentralised finance and takes part in the work of ADAN (Association pour le développement des actifs numériques, the French digital-asset industry association). The firm is ranked by Chambers FinTech and Leaders League.
A lawyer brings what a consultant cannot: a legal qualification of each service and each token, legal professional privilege over the architecture and the flows of the project, and liability for the advice given. A legal opinion carries the firm’s signature before partners and regulators.
A partner leads every matter, from the initial analysis through to the discussions with the regulator.
The Regulatory practice of ORWL Avocats
ORWL Avocats is recognised for its work with crypto and Web3 projects, from qualifying a protocol to obtaining CASP authorisation from the AMF. The firm also advises token issuers and payment institutions throughout their regulatory procedures.
