S&P Global Ratings launched a Vault Risk Assessment on 4 October, a framework for judging the risk of onchain lending vaults. The move brings a 150-year-old credit institution into one of the fastest-growing corners of decentralised finance. Deposits in these vaults reached about US$10 billion by September 2026, up from roughly US$1.5 billion two years earlier.
The Vault Risk Assessment is a methodology, not a verdict. No vault has received a score yet.
What the Vault Risk Assessment actually is
The assessment is a forward-looking opinion on the risk of impairment to an investor’s position in a lending vault. S&P scores six factors: portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance.
S&P expresses the result on a letter scale with a ‘v’ suffix, where AAA(v) is the lowest risk. Two distinctions matter. The assessment is not a credit rating, and it does not address a vault’s ability to repay obligations in full. Nor does it comment on yield. That separation is deliberate: S&P is grading relative risk between vaults, not certifying them.
For now, the company has published the analytical approach and a FAQ. Initial assessments will follow in later announcements.
What a vault is
A lending vault is a smart contract that pools deposits and allocates them to blockchain-based lending markets, collateralised by crypto or tokenised real-world assets. It works much like a managed fixed income fund. Depositors hold share tokens representing a claim on the pool.
The model separates infrastructure from risk management. A “curator” decides which markets a vault can use, which collateral is eligible, and how much capital each market can take. That role is increasingly professionalised, and concentrated. Across the sector, a handful of curators — Steakhouse Financial, Sentora and Gauntlet among them — control the large majority of capital.
Why a ratings giant is moving in
S&P has spent two years assembling an onchain risk franchise. It launched Stablecoin Stability Assessments in December 2023. In August 2025 it issued the first credit rating of a DeFi protocol, assigning Sky Protocol a ‘B-‘ with a stable outlook. In February 2026 it rated its first bitcoin-backed structured finance transaction.
The pace quickened this year. S&P and Kaiko tokenised the iBoxx U.S. Treasuries Index in March, launched a co-branded digital asset index suite in September, and S&P Global led a US$110 million funding round in Kaiko. Days later, it agreed to acquire OpenZeppelin, the smart-contract security standard, to cover the code layer.
The vault assessment is the next piece. It extends S&P’s machinery from the issuer to the pooled structure, at a moment when mainstream firms — Bitwise, Apollo and JPMorgan among them — are moving into vaults.
The caveats worth keeping
Three things temper the announcement. First, adoption is voluntary; no protocol is obliged to seek an assessment, so a vault without a VRA is not necessarily risky, and one with a high score is not guaranteed safe.
Second, the market figure is soft. S&P cites US$10 billion, but vaults.fyi mapped US$11.29 billion in August and a DeFiLlama study put it at US$7.18 billion. The three count vaults and protocols differently, so the range — not a single number — is the honest picture.
Third, the risks are real and recent. In March 2026, an attacker minted 80 million unbacked tokens that generated bad debt across vaults on Morpho, Euler and Fluid. In October 2025, a thin oracle feed sent USDe to about US$0.65 on Binance. A methodology does not remove either risk; it only makes it legible.
What to watch
The next signals are concrete. Which vaults S&P assesses first, and whether curators and protocols adopt the label voluntarily. Whether the framework stays a transparency tool or becomes a gate that institutional allocators require. And whether the vault market keeps growing even as the wider DeFi lending pool shrinks — the divergence that has made this niche worth grading in the first place.
S&P is not the first to notice onchain lending. It is trying to be the first to standardise how it is judged.
Editor’s Note
Sources: S&P Global Ratings’ release of 4–5 October 2026; S&P’s “Analytical Approach: Vault Risk Assessments” and “FAQ: Vault Risk Assessments”; S&P’s prior digital-asset announcements (Stablecoin Stability Assessments, the Sky Protocol rating, the Kaiko investment, the OpenZeppelin agreement); market data from vaults.fyi, DeFiLlama and Talos; and reporting by CoinDesk, Cointelegraph and CryptoSlate. The US$10 billion vault figure and the six-factor framework are as stated by S&P; independent estimates differ and are cited. S&P Global is listed on the New York Stock Exchange under ticker SPGI. This article is not investment advice.