France Wants Exchanges Liable for DeFi Losses. MiCA's Clock Is the Real Story.

I spent a morning with a French consultation paper and a coffee that went cold. Not a flex. It's just what happens when a regulator quietly moves the line between a wallet and an exchange.

The proposal is short on drama and long on consequence. Authorities in Paris want crypto exchanges that offer customers access to DeFi protocols to run checks on those protocols, and to carry liability when customers lose money in certain scenarios. Same app. New legal exposure.

Here's what matters: this isn't a French problem. It's a template.

What Paris Is Actually Asking

Strip the language down and the ask is simple. If your app puts a button in front of a user that deposits into a lending pool, you're no longer a neutral pipe. You're a distributor. And distributors get sued when the product misbehaves.

That framing changes the diligence list entirely. An exchange would need to look at audit history going back multiple versions. Upgradeability and who holds the admin keys. Oracle design, because a stale feed is how people get liquidated at the wrong price. Governance concentration, because a handful of wallets can vote to change risk parameters overnight. Bridge dependencies, because most of the ugly losses in DeFi trace back to a bridge, not the lending market.

Tokens are static. A listing decision is a snapshot. You review the contract, you review float and market structure, you sign off, you revisit quarterly. Protocols aren't static. A governance vote on Tuesday can move collateral factors and liquidation thresholds by Wednesday. The risk profile you underwrote last month isn't the one facing the user today.

So ask the obvious question. Can you underwrite a product that rewrites its own terms while the customer is holding it?

The diligence itself isn't cheap either. A serious audit of one protocol version typically runs well into six figures, and it has to be redone after material upgrades. Stack that across the dozens of pools a mid-size exchange surfaces and you're funding a small research desk. Notably, most exchanges already have that desk. They just don't call it a liability function yet.

France isn't starting from zero. The country ran its own digital asset registration regime under PACTE back in 2019, years before MiCA existed, which means the AMF has more operational muscle memory than almost any other national regulator in the bloc. When Paris writes a rule, Brussels tends to read it.

The timing isn't random. MiCA has applied in full since December 30, 2024, and the grandfathering window most member states used runs out on July 1, 2026. That's when every exchange serving French users needs a license, and every regulator needs a rulebook covering the things MiCA left vague. DeFi access sits right at the top of that list.

Why This Leaks Past France

Passporting is the whole point of the EU framework. A license from one regulator buys access to the entire bloc. Which means whatever liability standard France writes becomes the price of admission to roughly 450 million consumers. That's not a national rule. That's a market-access condition.

What the street is missing: exchanges have three moves here, and none of them are free. They can geofence DeFi access for EU users and lose the volume. They can build walled gardens, curated pools with permissioned assets and vetted governance, which is safer and far less interesting. Or they can price the liability in, raise fees on the DeFi tab, and treat the loss reserve as a cost of distribution.

Watch who benefits. Compliance vendors get a new line item. Custodians and qualified custody venues get a moat. Insurance desks finally get a product nobody can argue with. Permissioned pool builders get a customer base they couldn't buy two years ago.

The numbers tell the story. DeFi total value locked sits somewhere around $120 billion depending on how you count, and a meaningful share of retail entry into it runs through a short list of exchange apps. Cut that pipe and you don't kill the category. You shrink it, concentrate it, and push the remaining activity into venues that look an awful lot like banks with a governance token bolted on.

From a risk perspective, that's the trade nobody's pricing. The rule is aimed at protecting users. The likely outcome is fewer users, in more controlled venues, with better paperwork. Whether that's a win depends on whether you think the losses were the problem or the access was.

My Honest Read

Two takes, both of which will annoy people.

First: liability without control is a tax on distribution, and markets route around taxes. An exchange can't pause a protocol. It can't force a governance vote. It can't stop a bridge exploit at 3am on a Sunday. Handing it the bill for something it can't operate doesn't make users safer, it makes the front-end more conservative and the whole thing more centralized. Frankly, that's the feature for some regulators and the bug for everyone else.

Second: this is smarter than the last five years of DeFi policy. Regulators spent years trying to classify code. Code doesn't take meetings. So they've moved to the choke point that does, the exchange app that sits between a user's bank account and a liquidity pool. That's a coherent strategy, whether I like it or not.

If you're a user in France with DeFi exposure through a centralized venue, expect one of two things before July 2026. A warning screen with a checkbox that shifts the risk back onto you, or a route that quietly stops loading. The checkbox is the more likely outcome, and the checkbox is the tell.

If you're building, get your governance documentation and upgrade history in order now. Not because a regulator asked. Because the diligence questionnaire is coming and the teams that answer it in a week will keep their distribution while everyone else loses it.

The exchanges that come out of this clean won't be the ones with the best lawyers. They'll be the ones that treated protocol diligence as a product function two years before anyone made them.

And the ones that treated it as a footnote will find out what liability actually costs.