From LlamaRisk

Abstract

DeFi lending operates outside the scope of current European legislative frameworks, including MiCA and traditional financial regulations, prompting discussions on the need for tailored regulatory approaches. A comprehensive analysis by the EU Commission due by 30 December 2024 should assess the regulatory treatment of decentralized finance and the lending and borrowing of crypto-assets. Despite claims of decentralization, the presence of individuals/entities with significant control within DeFi platforms challenges the objective application of the VASP/CASP definition. To preserve their regulatory exemptions, DeFi lending protocols are advised to implement strategies that ensure genuine decentralization, such as developing diverse user interfaces, establishing robust DAO structures, and maintaining a permissionless design to prevent undue influence by single entities, thereby reinforcing their decentralized ethos and operational integrity.

Intro

In this article, we delve into the intricate relationship between Crypto-Assets Regulation (MiCA) and DeFi Lending protocols, with a keen focus on understanding the regulatory framework's applicability. While our expertise is primarily based on LlamaLend, the publication can be seen as an extension to the primer on Curve Lending. Our objective is also to juxtapose the regulatory mandates traditionally applicable to conventional financial entities against the unique operational paradigms of decentralized lending protocols.

I. MiCA

In April 2023, the European Union took a monumental step forward in the regulation of digital finance with the ratification of the Markets in Crypto-assets Regulation (MiCA). MiCA aims to fortify consumer and investor protection, uphold market integrity, ensure the stability of the financial system, and foster continued innovation within the digital finance sector.

MiCAR delineates its jurisdiction with clarity, asserting its applicability to entities involved in the issuance, public offering, and trading of crypto-assets within the Union, as well as service providers engaged in crypto-asset-related activities. The regulation comprehensively lists the activities and services under its purview, including but not limited to the custody and administration of crypto-assets for clients, operation of crypto-asset trading platforms, exchange of crypto-assets for fiat currencies or other digital assets, execution of crypto-asset orders, and advice and management services pertaining to crypto-asset portfolios.

Conversely, MiCAR specifies certain exclusions within its scope, such as traditional financial instruments, deposits, certain funds not classified as e-money tokens, securitisation positions, insurance and reinsurance contracts, pension products recognized for retirement income purposes, officially sanctioned occupational pension schemes, employer-mandated individual pension products, the pan-European Personal Pension Product, and social security schemes.

At the heart of our examination is the core intent of MiCA, which is structured to regulate the issuance of tokens and the provision of crypto-asset services by centralized entities. This foundational premise suggests that, in theory, DeFi protocols might initially seem to operate beyond the regulatory perimeter established by MiCA. This assumption is supported by the explicit delineations found in Recital 22, which posits that "Where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within the scope of this Regulation".

Furthermore, an important aspect to consider is MiCA's deliberate omission of regulations concerning the lending and borrowing of crypto assets, as highlighted in Recital 94:

This Regulation should not address the lending and borrowing of crypto-assets, including e-money tokens, and therefore should not prejudice applicable national law. The feasibility and necessity of regulating such activities should be further assessed.

Despite these apparent exemptions, the Regulation's silence on the governance structures underpinning DeFi protocols, particularly Decentralized Autonomous Organizations (DAOs), marks a notable gap in the legislative framework. DAOs, which are pivotal in steering the development, operational strategies, and governance of DeFi protocols, exist without being anchored in a traditional legal framework. This absence of a formal legal classification for DAOs necessitates a broader exploration for an apt interpretation of "decentralization".

In this context, the updated guidance from the Financial Action Task Force (FATF) emerges as a crucial reference point. FATF stands as an independent inter-governmental organization, dedicated to forging and advocating for policies aimed at safeguarding the global financial ecosystem from the threats of money laundering and terrorist financing. Their risk-based approach to virtual assets and virtual asset service providers emerges as a critical benchmark, influencing the evolution of tailored, country-specific regulatory frameworks.

Therefore, it is a reasonable presumption that EU authorities might leverage the FATF's criteria as a consultative benchmark when scrutinizing the principles of decentralization. The FATF's guidance offers insights into when a DeFi application might traverse the boundary to be considered a Virtual Asset Service Provider (VASP), thereby falling under the purview of national and international regulatory landscapes, as per the guidance in p.67:

… creators, owners and operators or some other persons who maintain control or sufficient influence in the DeFi arrangements, even if those arrangements seem decentralized, may fall under the FATF definition of a VASP where they are providing or actively facilitating VASP services … there may be control or sufficient influence over assets or over aspects of the service’s protocol, and the existence of an ongoing business relationship between themselves and users, even if this is exercised through a smart contract or in some cases voting protocols

Nations might also consider additional factors, such as the potential for any entity to profit from the service provided, or possess the authority to modify or establish parameters that could reveal the identity of the owner or operator of a DeFi platform. The use of marketing terminology or self-proclamation as a DeFi platform does not serve as a definitive criterion, nor does the particular technology employed play a direct role in determining whether the owner or operator qualifies as a VASP.

Conversely, a DeFi protocol may achieve the hallmark of complete decentralization when it successfully eliminates any singular point of regulatory vulnerability. This entails the absence of any individual or entity wielding substantial control or influence over the protocol's assets or operational facets, or maintaining ongoing interactions with users, whether through off-chain or on-chain mechanisms.

Illustrating the practical application of these principles, we observe strategic actions by leading figures in the DeFi sector, which signify their adept navigation of regulatory challenges through the adoption of decentralization strategies.

II. TradFi Regulations

In the next place, we observe the nuanced interplay between the DeFi domain and established financial regulations, such as the Markets in Financial Instruments Directive II (MiFID 2). It is evident that laws and regulations designed for traditional, centralized financial systems cannot be aligned with the innovative and decentralized nature of DeFi.

A central point of inquiry is whether the operational paradigms of DeFi lending protocols—characterized by the deposition of crypto assets for yield generation or the use of crypto assets as collateral for loans—mirror the functions of traditional credit institutions. This raises a pivotal question: How do the authorities apply existing requirements to these activities? The challenge here is underscored by the definitions and conditions set forth in the Capital Requirements Regulation (CRR), which defines a credit institution as "undertaking the business of which is to take deposits or other repayable funds from the public and to grant credits for its own account". Such entities are enshrined within a rigorous regulatory framework that encompasses the Capital Requirements Directive (CRD) and the CRR, mandating stringent capital and liquidity requirements, alongside provisions for corporate governance to ensure board independence, diversity, and robust risk management strategies.

However, the decentralized mechanics of lending protocols starkly diverge from the characteristics of traditional financial institutions. By virtue of their architecture, DeFi protocols, constituted by smart contracts, lack the legal personhood and the capacity to perform regulated activities in the context of conventional financial regulations.

To substantiate this perspective, we closely examine the structural elements of Curve Lending. Despite its distinctive non-custodial architecture, the insights derived may not universally apply to all DeFi lending protocols. Notable features include:

Moreover, we posit that DeFi lending protocols inherently cannot fulfill the definition of credit institutions. The criteria outlined in the CRD, particularly in Annex I, do not adequately reflect contemporary market developments, leading to potential ambiguities in defining regulated activities. This discrepancy underscores the necessity for a harmonized regulatory approach, particularly in alignment with MiCA, to address the specifics of crypto lending and borrowing activities.

Finally, from the standpoint of the EU’s Crowdfunding Regulation, which provides a bespoke framework for peer-to-peer finance, DeFi lending remains outside its legislative purview. As per Article 2(1)(b) loan means:

an agreement whereby an investor makes available to a project owner an agreed amount of money for an agreed period of time and whereby the project owner assumes an unconditional obligation to repay that amount to the investor, together with the accrued interest, in accordance with the instalment payment schedule.

The definition does not encompass crypto-assets, nor the legislative act has been amended to refer to MiCA. DeFi lending arrangements cannot be regulated under a framework that covers only transactions in fiat currencies.

Key Takeaways

DeFi lending currently operates beyond the regulatory boundaries of both MiCA and traditional financial regulations in Europe. As the lending and borrowing protocols continue to evolve, there is a growing discourse on the necessity for bespoke regulatory frameworks. To address this emerging need, the European Commission is tasked with drafting a comprehensive report by 30 December 2024, containing:

(a) an assessment of the development of decentralised-finance in markets in crypto-assets and of the appropriate regulatory treatment of decentralised crypto-asset systems without an issuer or crypto-asset service provider, including an assessment of the necessity and feasibility of regulating decentralised finance; and (b) an assessment of the necessity and feasibility of regulating lending and borrowing of crypto-assets.

It is frequently observed that DeFi platforms label themselves as decentralized despite the existence of individuals wielding significant control or influence within the arrangement. Regulatory jurisdictions are anticipated to enforce the VASP/CASP definition objectively, without being swayed by such self-descriptions. Consequently, the architectural design of these protocols ought to be strategically developed to convincingly counter the aforementioned criteria. This necessitates a deliberate design approach to ensure genuine decentralization.

For DeFi lending protocols to maintain their regulatory exemption, predicated on the principle of full decentralization, several strategic implementations are advised. These measures are aimed at reinforcing the decentralized ethos while ensuring operational integrity and user engagement: