S&P Global Ratings launched the Vault Risk Assessment on Oct. 4 in Singapore, the first letter-grade framework built for the curator-run lending vaults that channel most passive capital into decentralized finance.

The assessment runs from AAA(v) to D(v), with no plus or minus modifiers. A weak curator score limits how high a vault can be graded, and no assessment has been issued yet.

Digital asset lending vaults held $10 billion in deposits as of September 2026, up from $1.5 billion in September 2024, according to S&P. DefiLlama's Risk Curators category carries $10.04 billion across 93 curators, led by Steakhouse Financial and Sentora at $2.51 billion each and Gauntlet at $1.65 billion.

How does the scoring work?

The analytical approach runs in four steps across six risk factors: portfolio credit quality, liquidity mismatch, curator, blockchain, protocol, and vault security and governance. Each factor receives a score from 1 (lowest risk) to 6.

Step one produces a preliminary score from the credit quality of the assets and lending markets a vault can reach. Step two adds the curator assessment and a liquidity mismatch score. Step three folds in blockchain, protocol, and governance and security scores. Step four converts the result into a letter grade.

The intermediate score "cannot be more than two points better than the worse of the curator assessment or liquidity mismatch assessment," and step three caps the result at the worst of the three operational and security scores.

Why does the curator matter most?

S&P grades a vault on what its mandate permits it to hold, rather than on the assets sitting inside it on a given day. A portfolio may migrate toward its riskier eligible collateral, the report says, which makes a broad mandate a cost even when a vault is parked in conservative collateral.

The curator evaluation covers management and organization, risk management and compliance, and investment culture and research, each rated strong, adequate, or constrained. James Wiemken, executive managing director and head of global ratings services at S&P, said in the release:

"Digital asset vaults represent a significant evolution in onchain finance, offering new avenues for pooled investment and capital efficiency. However, the inherent complexities and varying disclosure standards in this nascent market create a clear need for a standardized, independent risk perspective."

What stays outside the framework?

The scope covers lending vaults investing in markets backed by crypto or real-world-asset collateral, permissioned or permissionless. Vaults that accept deposits and buy tokenized funds or bonds fall outside, per S&P's FAQ, and would be handled under fund credit quality rating criteria.

Which incidents shaped the conversation?

The vault market has produced the operational record S&P now rates against. Morpho blamed an AI marketing tool in September for a deleted post calling its own curator business model broken. Sentora's Morpho vaults saw sharp outflows on Oct. 1 amid a MetaMask staking incident. Morpho co-founder Paul Frambot's proposal to split vaults into noncustodial and discretionary categories drew pushback from Aave founder Stani Kulechov. SEC Commissioner Hester Peirce said in July that active management of a vault can trigger securities laws.

Aave holds $19.59 billion in total value locked and Morpho Blue $11.46 billion, per DefiLlama.

Where is S&P headed next?

The vault product follows a cluster of digital-asset moves. S&P Global agreed in September to acquire smart-contract auditor OpenZeppelin, and earlier the same month led a funding extension in market data firm Kaiko that brought that round to $110 million. The agency also cites stablecoin stability assessments, its credit rating of Sky Protocol, and a structured finance rating backed by bitcoin for Ledn.

A Vault Risk Assessment is not a credit rating and does not comment on yield. S&P will publish initial assessments through future announcements, leaving the next market-structure data point clear: which of the 93 curators volunteers first, and whether Peirce's securities-law reading forces restructuring of active mandates before any letter grade lands.