S&P Global Ratings has introduced a Vault Risk Assessment (VRA) framework for on-chain digital asset lending vaults, a sector that has grown from about $1.5 billion in deposits in September 2024 to roughly $10 billion by September 2026. Announced on Oct. 4, the framework is designed as a forward-looking, relative opinion on the risk that an investor’s position in a lending vault could become impaired.
The VRA uses letter-grade symbols with a “(v)” suffix, with AAA(v) representing the lowest relative risk. S&P stressed that this is not a traditional credit rating, does not measure expected yield, and does not guarantee a vault’s credit quality. It will assess six risk areas: portfolio credit quality, liquidity mismatch, curator risk, blockchain risk, protocol risk, and vault security and governance.
Portfolio credit quality examines eligible assets and lending markets, while liquidity analysis considers whether a vault could face difficulty meeting withdrawals. Protocol and blockchain assessments cover risks tied to underlying systems. Curator risk focuses on entities or people allocating deposited assets, and security and governance look at how the vault is controlled and how its technical structure affects investors. The methodology can apply to permissioned and permissionless structures, including lending against crypto assets and tokenized real-world asset collateral, though direct exposures to tokenized bonds or funds may fall outside VRA scope.
No individual vault received a VRA at launch. S&P said the first assessments will be published later and did not identify which vaults are under review. S&P Global Ratings President Yann Le Pallec said demand for independent risk assessments has grown as more financial activity moves on-chain. James Wiemken, head of Global Ratings Services, cited vault complexity and varying disclosure standards.
The launch follows S&P’s broader expansion into crypto risk, including stablecoin stability assessments brought on-chain through Chainlink in 2025, a B- issuer credit rating affirmation for Sky Protocol on Oct. 1, and an agreement to acquire smart-contract security firm OpenZeppelin.
