The European Securities and Markets Authority (ESMA) has proposed new powers to freeze crypto assets tied to criminal activity and to block fraudulent websites, in a formal submission to the European Commission's review of the Markets in Crypto-Assets Regulation (MiCA) dated September 30.

The EU's financial markets regulator said its recommendations aim to simplify the MiCA framework while strengthening investor protection and addressing emerging service models such as decentralised finance (DeFi), staking, lending and borrowing. The submission lands as Brussels assesses whether MiCA remains fit for purpose after the regime began applying in full earlier this year.

Tougher investor protections

ESMA proposed stricter rules on crypto-asset marketing, with particular attention to products promoted by influencers and third parties, and called for greater transparency on costs. It also backed proportionate requirements for staking, lending and borrowing, including disclosure obligations designed to give investors clearer information on costs, risks, rewards, collateral arrangements and potential losses before they commit funds.

The proposals echo the European Banking Authority's separate call to regulate crypto lending within the same MiCA review, signalling coordinated pressure from both EU supervisory authorities to bring yield-bearing crypto services inside the regulatory perimeter.

Stronger supervisory powers

To counter unauthorised services, online fraud and non-compliant stablecoins, ESMA recommended enhancing the EU's capacity to detect, block and deactivate fraudulent websites, and to freeze crypto assets where market abuse or terrorist financing is suspected. The regulator offered a blunt assessment of current practice: existing procedures are so lengthy that freezing requests for suspicious assets often arrive too late, after the funds have disappeared.

ESMA also sought reinforced powers against third-country firms that solicit EU investors without MiCA authorisation, and explicit rules preventing regulated crypto firms from offering services linked to stablecoins that fall short of MiCA requirements. The push responds to concerns among some national regulators about patchy enforcement and regulatory divergence across the bloc — a structural weakness that undermines passporting, since a licence in one member state is only as credible as the weakest national supervisor.

For authorised crypto-asset service providers, the operational consequences would be significant. Firms could face new obligations to act on freeze orders within tighter timeframes and to screen the stablecoins they support against MiCA compliance criteria, adding compliance overhead to listing and treasury functions.

DeFi, classification and tokenised markets

On market structure, ESMA advocated clearer criteria for determining when activities are genuinely decentralised — the question that determines whether DeFi protocols sit outside MiCA's scope entirely. It proposed a new regulated crypto-asset service category for firms that give users access to DeFi protocols, a design that would capture front-end intermediaries rather than the protocols themselves.

ESMA also recommended harmonised rules for classifying crypto-assets, including hybrid tokens that combine features of different MiCA categories, and backed granting ESMA itself the power to issue binding opinions on token classification. Such opinions would reduce the legal uncertainty that currently forces issuers to seek individual national determinations across 27 jurisdictions.

Looking beyond MiCA, the regulator urged a framework for tokenised securities and on-chain settlement to support an integrated European tokenised capital market, extending its earlier coordinated custody review conducted under MiCA.

The European Commission will now weigh ESMA's recommendations alongside other consultation responses, including a public campaign by more than 50,000 Europeans pressing for relaxed stablecoin reward limits. Any legislative amendment to MiCA would follow the ordinary legislative procedure, meaning firms should expect a multi-year window before freeze powers, DeFi service rules or binding classification opinions take effect.