Standard & Poor's launches risk review of crypto lending vaults

Standard & Poor's Global Ratings launches a risk assessment framework for online lending vaults

In September 2026, the amount of deposits in this field reached US$10 billion. In this context, S&P Global Ratings launched the "Vault Risk Assessment"(VRA) framework on October 4 to assess possible impairment risks in blockchain-based digital asset lending vaults.

Overview of core points

The framework focuses on reviewing six risk areas, including portfolio quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and security and governance. Although AAA(v) represents the lowest risk level, S & P emphasizes that VRA is not a traditional credit rating.

Data shows that the size of deposits in such vaults has increased significantly from US$1.5 billion two years ago to approximately US$10 billion in September 2026. Standard & Poor's said that the initial treasury assessment results will be announced later, and the ratings of specific individual treasury will not be involved in the first batch of releases.

Framework Design and Evaluation Dimensions

Standard & Poor's Global Ratings describes the framework as a forward-looking assessment designed to measure the likelihood of impairment of investors 'positions in digital asset lending vaults. The system uses familiar letter symbols and appends the suffix "(v)", where AAA(v) represents the lowest risk level within the framework. S & P specifically noted that the assessment is not a credit rating in the traditional sense, does not measure expected returns, and does not guarantee the credit quality of the pool.

VRA mainly looks at the following six aspects:

• Portfolio credit quality: 审查金库可使用的资产及借贷市场情况。
• 流动性错配：分析当资产无法快速转换或回收时，金库是否面临满足提款需求的困难。
• 策展人风险：聚焦于负责决定存入资产如何分配的个人或实体。金库可能完全通过智能合约运行，也可能允许人类管理者对部分策略拥有自由裁量权。标普指出，智能合约可以持有 pooled funds（集合资金）并执行由策展人设定的分配限制。
• 区块链风险：涵盖金库运营所依赖的基础系统相关风险。
• 协议风险：评估底层借贷协议的技术风险。
• 安全与治理：分析金库的控制方式及其技术结构对投资者的影响，同时考虑从借贷协议和区块链继承的风险。

AAA(v)并不意味着绝对安全

标普刻意将新量表与其传统信用评级区分开来。VRA仅代表标普对投资者金库头寸发生减值的相对可能性的观点，并不像标准信用评级那样评估借款人或发行人履行财务义务的能力。

此外，收益率不在评估范围内。无论金库支付的回报高低，都不会因此获得特定的VRA分数。该评估集中关注底层资产、流动性、管理、协议及技术基础设施周围的风险。

Applicability of tokenized collateral

S & P's methodology distinguishes between providing loans with tokenized assets and directly investing in certain tokenized securities. Treasury providing loans with tokenized physical assets (RWAs) as collateral is within the scope of the VRA framework. However, direct exposure to assets such as tokenized bonds or funds may exceed the scope of the VRA and be assessed by other criteria.

This framework applies equally to both permission-based and non-permission-based lending structures. Standard & Poor's reviews the types of assets the treasury is allowed to use, not just positions at a specific point in time. Direct allocation limits written into smart contracts are also part of the analysis, with the methodology giving greater weight to hard technical limits because they can limit the amount of capital that enters a particular lending market without relying solely on subsequent decisions by the curator.

If the treasury relies heavily on markets with few providers or difficult to sell, liquidity conditions may change the assessment. According to S & P's methodology, if transfers are restricted to approved participants only, tokenizing physical assets may impose additional restrictions.

S & P's expansion in cryptocurrency risk

The treasury framework is one of a series of initiatives taken by S & P to enter digital asset analysis globally. Previously, Standard & Poor's created a stablecoin stability assessment and gave Sky Protocol a B-issuer credit rating. In addition, Standard & Poor's announced in September that it agreed to acquire smart contract security company OpenZeppelin, which has completed more than 900 security assessments and shifted the value of its software support more than $37 trillion. Prior to this, S & P also led strategic financing for crypto market data company Kaiko.

The first specific evaluation report will be released soon

When the system was launched on October 4, no individual lending treasury received a VRA rating. Standard & Poor's said the first treasury risk assessments would be released in future announcements, but did not specify which treasury were being reviewed or provide a release date. Standard & Poor's likens lending vaults to managed investment vehicles because they are the vehicles that pool investor deposits and deploy funds in accordance with established strategies. Depositors usually receive share tokens that represent their proportionate interest in treasury assets and accrued returns.

As more financial activities migrate to blockchain networks, the need for "independent risk assessments" is growing. Yann Le Pallec, president of global ratings at S & P, and James Wiemken, head of global ratings services, both emphasized the importance of treasury complexity and differences in disclosure standards to the launch of the new framework. The first batch of individual VRAs will be announced separately after the framework is released, and the specific list has not yet been determined.