Crypto: you lend (staking) your tokens to a platform. Who protects you, exactly?

You open your crypto platform's app. Somewhere on the screen, there's a friendly little box: let your tokens sleep at our place and earn a return. Two taps of your finger, it's activated, and your tokens go off to work somewhere.

Stupid question: at that exact moment, what are you covered by?

The answer is amusing. The platform itself is covered by a European regulation more than two hundred pages long. What it has just done with your tokens, no.

The big roof protects four shops out of five. The last one gets rained on.

What Europe put in its law, and what is lying around outside

The text is called MiCA, for markets in crypto-assets. It's the European regulation that says who is allowed to sell, hold or exchange crypto for you, and under what conditions. It has applied in full since December 30, 2024, and since July 1, 2026 the screw is completely tightened: a company that offers these services to European clients without a licence is breaking the law, full stop. There are more than 270 of them registered today.

What MiCA specifically regulates is a list of professions. Exchanging, holding on behalf of a client, transmitting an order, advising, transferring. Each one has its obligations, its minimum capital, its checks.

The column on the right is worth billions. It fits in a dotted box.

And in this list, two things that everyone does are missing. Lending, that is, entrusting your tokens to the platform, which will lend them to someone else and pay you back part of what that earns. And staking, which consists of locking up your tokens to help a network validate its operations, in exchange for a share of the rewards distributed by that network.

Neither one nor the other is a regulated service under MiCA. Staking is treated there as a little add-on to custody. Lending, on the other hand, simply does not appear there.

The three things your platform still owes you

Here's the bit that made me open this subject, because it's useful and nobody talks about it.

On June 18, 2026, ESMA, the European financial markets watchdog, published an official response on exactly this question. It has the sweet name Q&A 2883. The reasoning is simple: crypto lending is not a regulated service, all right, but the company offering it to you is licensed under MiCA. So its general obligations continue to apply to everything it does, including what is not on the list.

Two good pieces of news and a hole. In that order, because that's the real order.

First, your agreement must be explicit and specific. ESMA writes that consent buried in the general terms and conditions, without being highlighted, is not enough. Translation: the box already ticked in the middle of forty pages that nobody reads is worth nothing. They have to ask you clearly, for this particular operation, using defined terms.

Secondly, and this one is worth noting: the proceeds from the loan have to come back to you. The ESMA's reasoning fits in one line, you carry the risk, so you get paid. The platform has the right to take fair and proportionate fees that reflect its operating costs. It does not have the right to keep the difference between what the borrower pays and what it gives back to you. If it lends your tokens at eight percent and gives you three, the question is not whether that is nice, it is whether the remaining five points look like operating costs.

Thirdly, and this is the bad one, but it is clear: MiCA's protection for client assets does not apply to tokens committed to a lending program. The obligation to keep your tokens separate from the house's, which saves you if the house goes under, does not cover those you made available. They are out of the vault the moment you clicked. If the borrower returns nothing, if the collateral is no longer worth enough, or if the platform goes bankrupt, you are a creditor like any other.

This is genuinely useful information, and it was written two months ago. Go reread the screen you clicked on.

What is at stake by next Monday

On May 20, 2026, the European Commission opened a targeted consultation on the revision of MiCA. A consultation is a public questionnaire: anyone can respond, from law firms to platforms, including an individual who has an opinion. Responses close on August 31, so next Monday.

One week. After that, others fill in the boxes in your place.

The questionnaire covers four parts, and the fourth is the one that concerns us. It asks, for real:

• Should staking become a fully regulated service, with its own rules, rather than remain an accessory to custody?
• Should lending and borrowing be regulated, and if so what should the framework look like?
• Should platforms that sell NFTs, those tokens that represent a unique object, be regulated?
• Where should markets where people bet on an event be placed, and contracts on the price of a crypto that have no end date?
• And for automated finance, the kind that runs on its own without a company behind it, just with code: should a licensed platform check what the protocols it sends its clients to are worth, and should these programs be certified?

That last question, now. Yesterday I told you here how six bugs chained together in a single transaction created 49 million tokens that did not exist, on a protocol that ran on its own, with no one to notice that 49 million might be quite a lot. Would a certification mechanism have caught that? Honestly, I have no idea. But the question asked by the Commission is not theoretical, it got its live illustration last week.

And concretely, here in Belgium?

Three things, and none of them requires you to be a lawyer.

One: your platform is licensed or it is not. Since July 1, there is no more grey area, no more grace period. It can be checked, it is public, and if you cannot find the information in one minute on the company's website, that is already an answer.

Two: the advertised yield is not a gift, it is the price of a risk, and that risk is yours. As long as lending remains outside the framework, no one will reimburse you because a law requires it. I am not telling you not to do it, it is not my job and it is not the role of this article. I am telling you to know what you are signing, which is not the same thing.

Three: do not confuse being protected with being compliant. The two subjects have nothing to do with each other. What I am talking about here is what happens to your tokens. What you have to declare is another matter, and I had talked about it last April while presenting the tool that calculates the tax on capital gains.

What I think

There is something that bothers me about this whole story, and it is not the hole in the text. A hole in a 2023 law covering a sector that moves every quarter, that is normal, it happens to every law, and Europe is in the process of plugging it, which is exactly what we ask of it.

No, what bothers me is that the most useful answer in this whole business, the one that tells you that the yield from the loan should come back to you and not stay in the platform's pocket, is hidden away in a document numbered 2883 on the website of a European authority. No one has read it. Not an email, not a notification, not a box in the application when you click. While the little button promising you a yield is displayed big and in color.

I'm not asking for the moon. Just that the day someone writes that a client has rights, someone thinks of displaying them next to the button!

Sources

• ESMA, Q&A 2883 on crypto-asset lending, June 18, 2026
• ESMA: the MiCA file
• Maples Group: the European Commission's targeted consultation on the review of MiCA, opened on May 20, 2026, responses until August 31, 2026
• Cryptoasset Lending in the Gaps: MiCA, ESMA Q&A 2883, August 17, 2026