On October 4th, S& P Global Ratings launched the Vault Risk Assessment (VRA) framework, which is used to assess the relative risks of on-chain lending vaults. The company stated that this framework is designed to measure the prospective risks that investors' positions in digital asset lending vaults may suffer from damage. S&P noted that the deposit size of such vaults has grown from $1.5 billion in September 2024 to approximately $10 billion two years later.

This system uses familiar letter rating symbols, with the suffix “(v)” added afterwards. AAA (v) represents the lowest risk level under this framework. S&P emphasizes that this assessment is not a traditional credit rating; it does not measure expected returns, nor does it guarantee the credit quality of any particular vault.

S&P to review six types of vault risks

Vault Risk Assessment focuses on six aspects: portfolio credit quality, liquidity mismatch, custodian risk, blockchain risk, protocol risk, as well as treasury security and governance. S&P indicates that the combination of these factors is intended to demonstrate how different sources of risk affect investors' positions.

The portfolio credit quality examines the assets available to the vault as well as the lending market. Liquidity analysis focuses on whether the vault will face difficulties in meeting redemption demands when assets cannot be liquidated or recovered quickly enough. The protocol and blockchain assessments cover the risks related to the underlying systems upon which the vault's operations depend.

The risks associated with trustees focus on the individuals or entities responsible for deciding how to allocate the deposited assets. The vault can be operated entirely through smart contracts, or it can allow human managers to have discretion over certain strategies. S&P indicates that smart contracts can hold pooled funds and enforce the allocation restrictions set by the trustees.

Security and governance is the last area of analysis. S&P's methodology examines how vaults are controlled and how their technical structure may affect investors, while also considering risks that arise from lending protocols and blockchain.

This framework is suitable for lending vaults that invest digital assets in the blockchain lending market, and can also cover loan markets that use encrypted assets or tokenized real-world assets as collateral.

AAA (v) does not mean that the vault is absolutely secure.

S&P deliberately distinguishes this new system from its traditional credit ratings.

VRA represents S&P's view on the relative likelihood of investors' treasury positions being damaged. It does not assess whether borrowers or issuers will fulfill their financial obligations in the same manner as standard credit ratings.

The “v” suffix is used to indicate that the assessment is related to the vault. AAA (v) is located at the lowest risk end of this system, but S&P states that even a higher assessment should not be construed as a guarantee against losses.

Earnings are also not within the scope of this framework. Regardless of whether a particular vault pays a higher or lower return, VRA will not provide a rating based on the level of earnings. This assessment focuses on the risks surrounding the underlying assets, liquidity, management, protocol, and technical infrastructure.

S& P Global Ratings President Yann Le Pallec stated that as more financial activities migrate to blockchain networks, the demand for “independent risk assessment” is growing. Global Ratings Services Head James Wiemken mentioned the complexity of vaults and their “various information disclosure standards” when explaining the new framework.

Tokenized collateral can be included, but there are differences when directly holding RWA.

S&P’s methodology draws a distinction between lending based on tokenized assets and direct investment in certain tokenized securities.

Treasuries that issue loans using tokenized real-world assets as collateral can be incorporated into the VRA framework. The methodology published by S&P indicates that assets that are directly exposed to tokenized bonds or funds may not fall within the scope of VRA, and will instead be evaluated according to other criteria.

The same framework applies to both licensed and license-exempt lending structures. S&P examines which assets are allowed to be used by the vault, not just the holdings that are visible at a given point in time.

Configuration restrictions written directly into smart contracts will also become part of the analysis. This methodology assigns greater weight to rigid technical limitations, as they can restrict the flow of funds into a particular lending market, without relying entirely on the decisions made by custodians afterward.

If a vault relies heavily on markets with fewer suppliers, or on assets that are difficult to sell, liquidity may affect the assessment. According to S&P's methodology, if the transfer of tokenized real-world assets is limited to approved participants, there may be additional restrictions as well.

Therefore, when there are changes in eligible assets, liquidity conditions, smart contract controls, or other aspects of the treasury risk profile, VRA may also change accordingly. In the event of significant progress, S&P may re-evaluate the current assessment.

S&P has been expanding its crypto risk business.

The treasury framework is another initiative by S& P Global to enter the digital asset analysis sector.

S& P Global Ratings has previously created Stablecoin Stability Assessments to assess the ability of stablecoins to maintain their target values. S&P's stablecoin risk scoring will be integrated onto the blockchain via Chainlink in 2025, enabling DeFi applications to access these assessments through blockchain infrastructure.

Thereafter, the company expanded its operations to lending protocols as well. On October 1st, S&P confirmed the issuer credit rating of Sky Protocol as B-, with a stable outlook. The reasons included its capital position, liquidity, concentration of governance, and the increased complexity brought about by the new lending strategy.

The security sector has also become one of its areas of investment. In September, S& P Global announced that it had agreed to acquire the smart contract security company OpenZeppelin, although the transaction still needs to meet the delivery conditions. The company stated that OpenZeppelin has completed over 900 security services, and the cumulative value of contracts supported by its software has exceeded 37 trillion US dollars.

crypto.news previously reported that S& P Global intended to acquire OpenZeppelin, and also planned to continue operating this company as an independent business unit. The transaction amount was not disclosed.

Three days ago, S& P Global also led a strategic investment in the crypto market data company Kaiko. As reported by crypto.news, this investment expanded the scale of Kaiko's Series B financing to $110 million, with participation from several banks, exchanges, and financial institutions.

The first batch of vault assessments will be announced later.

On October 4th, when the system was launched, no single lending treasury obtained VRA.

The company stated that the first batch of Vault Risk Assessments will be announced in a future announcement, but they did not specify which vaults are being reviewed, nor did they provide a release time.

S&P's publication materials compare lending vaults with managed investment vehicles, as both gather investors' deposits and deploy funds according to established strategies. Depositors typically receive share tokens that represent their proportional interest in the vault's assets and accumulated earnings.

Treasury strategies can be automatically executed through smart contracts or managed discretionarily by humans. S&P indicates that as of September 2026, the amount of funds held in such structures amounted to 10 billion US dollars, which is higher than the 1.5 billion US dollars in September 2024.

The rating agency stated that the first batch of individual VRA will be announced separately after the framework is released. At present, it has not yet named the vaults that will undergo the initial assessment.