DeFi regulation in France

Two questions: the provider and the contract

Start by identifying the French entity and the crypto-asset services it provides. MiCA Article 59 provides for CASP authorization and, for specified existing financial entities, the Article 60 route. An eligible notification route depends on the entity and service; it is not an exemption available to every startup.

The AMF's July 2026 update confirms that the French national transition has ended. Historical PSAN status alone is no longer a basis for continuing covered services. Check the current authorization and its service scope rather than relying on an old registration screenshot.

Separately, the ACPR and AMF certification publication explicitly says the working group's report is neither a regulatory proposal nor an official authority position. It does not establish a compulsory French certificate for every DeFi contract.

Document the activity before choosing a route

For a France-based business, make a service inventory before preparing the application. Include each client action, the entity contracting with the client, the asset involved and any third party executing the action. A trading interface, custody service and token offer can involve different responsibilities within the same product.

Recital 22 concerns services that are fully decentralized without an intermediary. A governance token, a multisignature wallet or the absence of custody is one fact in that assessment. Retain the evidence for who can change the system and what the interface operator actually does.

Turn the AMF application into a document checklist

The AMF application page lists an authorization application form, a management-body declaration and a cybersecurity/DORA self-assessment. Download the current files from that page when preparing the dossier. A completed self-assessment is a statement by the applicant; its supporting evidence still needs to be assembled.

1. Describe the services and distribution model. Reconcile the application with the website, client terms and features users can access.
2. Assign responsibility for governance and operational decisions. Show who approves a change and who can act during an incident.
3. Prepare ICT documentation that links business services to contracts, infrastructure and external dependencies.
4. Collect the records supporting the cybersecurity answers, including assessment scope, remediation evidence and exercised recovery procedures.
5. Keep a dated application index so a replacement document can be traced to the question it answers.

MiCA Article 62 specifies the application information. Article 67 treats prudential safeguards separately from a regulator's application fee. Budget capital or insurance arrangements, professional work and technical implementation as distinct items; this guide does not substitute a market estimate for an official French tariff.

Match each security answer to an artifact

The table is a DeFiSec working map for preparing evidence, not an official AMF form. An artifact earns its place when a reviewer can inspect what it covers and what remains outside its scope.

For the register's implementation, Pharos Production explains building and maintaining a DORA Register of Information: connecting contractual arrangements, provider identifiers and supported functions. Use that engineering detail to structure the data behind your application, while keeping the official rules and AMF documents as the requirements baseline.

Delegated Regulation 2025/299 addresses continuity of crypto-asset services, including disruption involving a ledger the provider does not control. The evidence question is how the service responds and communicates when a dependency fails.

Specify what a contract assessment proves

Keep the assessment engagement separate from the provider application. Identify the code version, deployment configuration, roles and dependencies under review. Agree how fixes will be checked and how a later upgrade changes the validity of the assessment.

A report should let the reader reconstruct its scope without interpreting a marketing badge. Record the assessor, method, date, unresolved findings and exclusions. For methodology, continue with the smart contract security standards guide and the MiCA security evidence guide.

Before filing or relying on a provider

Recheck the current AMF documents and the scope of the relevant authorization. An Article 60 notification, a cross-border service notification and a new CASP application are different procedures. Do not reuse an application checklist for another route without checking which information that route requires.

When a contract changes after an audit, preserve the old report and record the change separately. When a provider changes its services, compare the new activity with its permitted scope. Both checks require a current version; neither is answered by the date of a homepage badge.