Malta's financial regulator is asking the industry for input on a proposed legal framework for decentralized autonomous organizations (DAOs), aiming to slot these entities into the European Union's Markets in Crypto-Assets (MiCA) regulation. The move comes as the regulator argues that many DeFi projects claiming to be fully decentralized actually aren't — and need clearer rules.
What the proposal covers
The Malta Financial Services Authority (MFSA) published a consultation document this week that sketches out how DAOs could be legally recognized and supervised under MiCA. The framework would apply to DAOs that issue governance tokens, manage lending protocols, or run other DeFi services. The regulator's core argument: if a DAO isn't truly decentralized — meaning a small group or a foundation still calls the shots — it shouldn't get a pass on traditional oversight.
That's a direct shot at many projects that label themselves 'fully decentralized' to dodge licensing requirements. The MFSA's document doesn't name names, but it says the gap between claimed and actual decentralization is a major vulnerability for the whole crypto ecosystem.
Why Malta is acting now
Malta has been a hub for blockchain firms since its 'Blockchain Island' push back in 2018, but the EU's MiCA regulation, which came into full force this year, forces all member states to harmonize crypto rules. Local regulators can add their own layers, and the MFSA sees DAOs as a gap that needs filling before MiCA implementation creates confusion.
The timing also reflects growing pressure from within DeFi. Several large DAOs have faced legal uncertainty about liability, voting rights, and tax treatment. Without a framework, courts in different EU countries could reach conflicting conclusions. Malta wants to offer a template.
The regulator's decentralization test
The consultation paper floats a set of criteria to determine if a DAO is genuinely decentralized. Factors include how concentrated governance token ownership is, whether a core team can override votes, and how much control the founders retain over smart contract upgrades. Projects that fail the test would likely have to register as a regular legal entity — with all the reporting and compliance that entails.
The MFSA is careful to say it doesn't want to stifle innovation. But the tone of the document is skeptical. 'Many DeFi projects are not fully decentralized,' it says flatly — a line that's likely to ruffle feathers in the community.
What happens next
The consultation is open until mid-August 2026, giving firms and legal experts two months to submit comments. After that, the MFSA plans to publish a final framework that could serve as a model for other EU nations. No draft legislation has been released yet; the regulator wants feedback first.
For DAO operators based in Malta or targeting EU users, the clock is ticking. If the framework moves forward, they'll have to decide whether to restructure their governance or accept a more traditional legal wrapper.
