The European Securities and Markets Authority has called for changes to the European Union's crypto-asset rulebook, pressing for stronger investor protection, closed regulatory gaps and clearer rules for emerging services including decentralized finance.

ESMA set out its position on October 1, 2026, in a intervention that puts the EU's top securities regulator at the center of the bloc's next phase of crypto policy. The regulator's recommendations target the framework that has governed crypto-asset markets across the 27-member bloc since the Markets in Crypto-Assets Regulation took effect.

The call for reform arrives at a moment of institutional strain. EU policymakers have spent the past year assessing how the existing rules perform against market innovation, and ESMA's intervention signals that the regulator considers the current framework insufficient on at least three fronts: investor protection, unresolved regulatory gaps, and services such as DeFi that the original rules did not fully anticipate.

What does ESMA want changed?

The regulator's agenda, as reported by Law360 on October 1, centers on three objectives:

• Stronger investor protection, sharpening the safeguards that apply to retail participants in crypto markets
• Closing regulatory gaps, addressing areas where the current rules leave exposures unmonitored
• Clearer rules for emerging services, including decentralized finance, which existing authorization frameworks struggle to capture

Each objective carries operational weight. For crypto-asset service providers already authorized in the EU, tighter investor-protection standards could mean revised disclosure obligations, suitability requirements and conflict-of-interest controls. For firms building DeFi protocols, the prospect of a dedicated rulebook would end the current ambiguity over whether decentralized services fall inside or outside the authorized perimeter.

Why does DeFi drive the timing?

Decentralized finance is the least settled element of the EU regime. The Markets in Crypto-Assets Regulation was designed around identifiable issuers and authorized intermediaries, a structure that maps poorly onto protocols operating without a central operator. ESMA's decision to name DeFi explicitly in its call for reform indicates the regulator now treats the sector as a policy priority rather than a peripheral concern.

The business consequences cut in two directions. Incumbent, fully authorized platforms face higher compliance costs if investor-protection rules tighten. DeFi developers face the more consequential question: a formal EU framework could either legitimize their operations across the single market or impose structural requirements that conflict with decentralized governance models.

What happens next?

ESMA's recommendations feed into the EU's legislative machinery. Any amendment to the bloc's crypto-asset rules requires the European Commission to propose a revision, followed by negotiation between the European Parliament and the Council of the EU. That process typically runs 12 to 18 months from proposal to adoption, meaning any ESMA-backed changes would realistically take effect years after the current framework.

For market participants, the immediate implication is procedural: firms structuring DeFi products or operating near the boundaries of the existing perimeter should track the Commission's response to ESMA's call. The regulator has now put its institutional weight behind reform — the question is whether Brussels moves in this legislative cycle or defers the DeFi question once again.