SEC targets human managers behind $8.7b DeFi vaults

The SEC’s regulatory scrutiny of DeFi vaults and on-chain lending platforms hinges critically on the degree of human discretion exercised in managing these products. Vaults that rely on discretionary management—such as selecting yield strategies, allocating assets across protocols, or setting lending terms—are more likely to be classified as securities or investment funds under federal law, as emphasized by Commissioner Hester Peirce. This focus on human judgment distinguishes curated vaults, which represent about $8.75 billion across 811 products managed by 110 firms, from fully automated, immutable smart contract-based vaults, shifting the regulatory conversation from code to the actors behind it.

The SEC targets the discretionary actors—risk curators and managers—rather than the immutable smart contract code itself, underscoring that regulatory liability and compliance obligations fall on those exercising entrepreneurial or managerial efforts. Peirce and industry voices like Morpho highlight that when curators have full control over asset allocation, they bear significant legal responsibility and may need to register as investment advisers or managers. This accountability is essential to address the principal-agent problem inherent in investor reliance on human judgment within DeFi vaults.

Commissioner Peirce acknowledges a nuanced spectrum of human involvement in DeFi products, ranging from fully programmatic vaults governed solely by immutable code to those under sole human discretion. This spectrum informs the SEC’s openness to proactive engagement with developers to clarify how existing securities laws apply, fostering a regulatory framework that balances innovation with investor protection. However, the SEC warns that only curators with sufficient capital to adapt to regulatory infrastructure will survive, potentially squeezing out smaller operators who cannot bear the compliance burden.

The degree of human discretion exercised in selecting markets, allocating funds, and adjusting risk parameters is central to determining whether DeFi vaults meet the Howey Test criteria for securities classification. This focus extends beyond vaults to any DeFi service where ongoing discretionary management influences investor returns, encompassing a market valued at approximately $25.9 billion in total value locked. The SEC’s approach reflects a shift from targeting decentralized code to identifying accountable legal entities behind discretionary asset management decisions.

SEC Commissioner Hester Peirce has highlighted the nuanced challenge of classifying crypto vaults and on-chain lending products under traditional securities laws, emphasizing that the degree of human discretion in management—such as asset allocation or setting lending terms—plays a pivotal role in determining whether these products fall under securities or investment company regulations. This discretionary element, rather than the blockchain-based nature of the products themselves, drives regulatory scrutiny, with Peirce noting that vaults can range from fully programmatic smart contracts to those managed by individuals or groups, complicating their classification along a spectrum of regulatory categories.

Applying established legal frameworks like the Howey Test to DeFi vaults underscores the SEC’s focus on economic substance over technological form, where the presence of a common enterprise and expectation of profits from managerial efforts can render these products as investment contracts or securities. This approach places significant compliance burdens on vault operators and managers, who may be required to register as investment advisers or investment companies, thereby imposing federal disclosure and registration requirements that could reshape the $25.9 billion DeFi vault market by favoring well-capitalized discretionary managers able to bear these regulatory costs.

Despite the regulatory uncertainty surrounding the classification of crypto vaults, the SEC has opened a rare channel for industry feedback, with Peirce inviting developers to collaborate proactively rather than attempt evasive maneuvers to circumvent securities laws. This evolving stance reflects a recognition of the hybrid nature of on-chain finance, blending traditional and decentralized elements, and signals a potential pathway for adapting existing rules through notice-and-comment rulemaking and exemptive relief to better accommodate the unique operational mechanics of DeFi products.

Commissioner Hester Peirce has championed a forward-looking and cooperative regulatory stance, urging DeFi developers and projects to engage proactively with the SEC rather than attempting to circumvent securities laws through complex maneuvers. She emphasized that open dialogue is crucial to clarifying how DeFi offerings might be classified under securities laws, encouraging builders to 'come and talk to us, let's figure it out' to develop compliant paths forward.

Reflecting this cooperative spirit, DeFi firms are increasingly adopting multi-faceted compliance strategies that blend proactive collaboration with regulated entities and leverage existing infrastructures such as KYC and regulated asset issuance. Examples include Kraken’s 'DeFi Earn' and Coinbase’s USDC lending products, which partner with DeFi protocols to manage compliance, while projects like Steakhouse Financial’s 'Grove' and Orca’s 'GLDY pool' target qualified institutional investors using Regulation D exemptions to align with SEC frameworks and mitigate regulatory risks.

Innovative compliance models are emerging that balance permissionless user access with regulatory safeguards by separating permissioned lending activities from broader yield opportunities. Maple Finance’s 2024 launch of the 'Syrup' protocol exemplifies this approach by allowing non-KYC users to deposit USDC and receive SyrupUSDC tokens that feed into institutionally compliant lending pools, while Aave Horizon’s shared whitelist management with issuers like Circle and Ripple demonstrates a collaborative compliance model that distributes regulatory responsibilities without compromising the permissionless nature of the protocol.