S&P Global launches risk assessments for crypto lending vaults
S&P Global Ratings adds a risk framework for onchain lending vaults
S&P Global Ratings has announced a new framework for judging the risk of digital asset lending vaults, the onchain products that pool investor money and lend it out to earn a return. The credit rating agency said deposits in these vaults reached about $10 billion in September, up from $1.5 billion two years earlier.
The announcement, published on Monday, covers what S&P calls a Vault Risk Assessment. It looks at how exposed an individual vault could be to losses for the people who deposit into it.
A lending vault works like a shared pot. Depositors lock in their money together, the pot is deployed through a set strategy run by computer code or by a human manager, and each depositor receives a token that represents their share of the pot and its returns.
The key numbers
- About $10 billion in deposits sat in digital asset lending vaults in September, according to S&P Global.
- That compares with about $1.5 billion two years earlier.
- The framework checks six risk categories, not one.
- The assessments are not credit ratings, and they do not judge the returns a vault pays.
Six risk areas the framework checks
Each vault is examined in six areas, according to S&P's announcement:
- Portfolio credit quality risk — the quality of the loans the vault money is tied up in.
- Liquidity mismatch risk — the risk that money cannot be returned to depositors when they ask for it.
- Curator risk — the risk tied to the person or team managing the vault's strategy.
- Blockchain risk — the risk tied to the underlying network the vault runs on.
- Protocol risk — the risk tied to the smart contract or lending protocol in use.
- Vault security and governance risk — the risk tied to who can change settings or move funds.
One weak spot is enough to cap the score
S&P Global Ratings analyst Lisa Schroeer told Cointelegraph that the framework was not built to treat any one of the six categories as more dangerous than the others.
“A material weakness in any factor can constrain the overall VRA,” Schroeer said. “A strong score in one factor does not offset a material weakness in another.” She said the approach reflects a sector where “there are many points of risk/failure that can break.”
On the purpose of the work, she said: “The assessment aims to provide more transparency on the risks so that any entity can make more informed decisions when deciding how to allocate capital to DeFi vaults.” DeFi, short for decentralized finance, means financial services that run on blockchain networks rather than through a traditional company.
Who is building these vaults
Vaults have grown over the past year as exchanges, wallets and DeFi platforms launched products that package lending and other return-seeking strategies.
In February, Wallet in Telegram introduced self-custodial BTC, ETH and USDT vaults, meaning customers keep control of the assets themselves. The product used infrastructure from Morpho, TAC and Re7. Kraken followed in May with a Bitcoin yield vault powered by Veda and curated by Sentora, drawing $30 million from 4,000 wallets in its first 10 hours.
The model has since spread to tokenized securities, which are traditional investments issued on a blockchain. In September, Kraken launched yield vaults for tokenized versions of Nvidia, the SPDR S&P 500 and Invesco QQQ ETFs, with Sentora managing strategies that lend the assets through DeFi markets.
Losses have already hit one vault
The growth has come with losses. In August, the lending protocol Term Finance lost an estimated $8.5 million after an attacker exploited the governance control of its Meta Vaults. Governance control refers to who has authority to change a system's settings or decisions.
US regulators have not settled how to treat vaults
Crypto vaults remain in a regulatory gray area in the United States. In July, Securities and Exchange Commission Commissioner Hester Peirce said some vaults and onchain lending products could fall under federal securities laws depending on how they are built and run.
Peirce said vaults that involve discretionary decisions over asset allocation, yield strategies, lending terms or liquidation thresholds could trigger securities, investment company or investment adviser requirements.
What is confirmed and what is not
Confirmed: S&P Global Ratings announced the Vault Risk Assessment framework, it covers six risk categories, it is not a credit rating, and deposits in the sector hit about $10 billion in September.
Not yet known: S&P said it plans to publish its first Vault Risk Assessments in future announcements, but it did not name any vault that will be assessed first. So no individual vault has a published assessment yet, and the source material does not set a date for the first results.
Why this matters
Sector growth of this speed has happened without a shared way to compare how risky one vault is against another. S&P says its framework is meant to make those risks more visible so that investors and institutions can compare products on more than the return they advertise. The company also notes the limits: the assessments look at loss risk, not yields, and one weak area can hold back the overall result.
What happens next
S&P Global Ratings says the first Vault Risk Assessments will be revealed in announcements to come. Until then, the framework is a method without published results, and which vaults appear first is unknown.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.