Three distinct credit-rating models now compete to become the institutional standard for assessing risk in decentralized finance. S&P Global Ratings launched its Vault Risk Assessment (VRA) framework on October 5, 2026, grading on-chain lending vaults on a scale from AAA(v) to CCC(v). Moody's Rat...
"Aave made DeFi more open, programmable, and capital efficient." — Cristina Polizu, Managing Director, S&P Global Ratings
Three distinct credit-rating models now compete to become the institutional standard for assessing risk in decentralized finance. S&P Global Ratings launched its Vault Risk Assessment (VRA) framework on October 5, 2026, grading on-chain lending vaults on a scale from AAA(v) to CCC(v). Moody's Ratings assigned Sky Protocol a B3 issuer rating on October 7 — the first time the agency has rated a stablecoin protocol. And crypto-native firm Agio Ratings published a probability-of-default model for Aave V3's Ethereum Core Market, estimating a 12.23% one-year default probability with expected loss of 0.31%.
These three frameworks arrive at the same problem from different directions. S&P evaluates the vault as a product. Moody's evaluates the protocol as an issuer. Agio evaluates the smart contract as a counterparty. The combined DeFi lending market held approximately $56 billion in total value locked as of October 14, 2026, according to data tracked by DefiLlama, up 55% from July. How — and whether — traditional risk language maps onto permissionless software will determine which pool of capital flows into DeFi next.
The credit-rating industry generated approximately $14 billion in global revenue in 2025, dominated by S&P, Moody's, and Fitch. Until August 2025, none of the three had applied traditional rating methodologies to a DeFi protocol. Within 14 months, two of them have.
The timeline is compressed:
Fitch Ratings has published stablecoin research but has not assigned a formal rating to any DeFi protocol as of mid-October 2026.
S&P's VRA evaluates six dimensions of vault-level risk:
| Risk Dimension | What It Measures | |---|---| | Portfolio Credit Quality | Collateral composition and borrower default probability | | Liquidity Mismatch | Duration gap between vault deposits and outstanding loans | | Curator Risk | Competence and track record of the vault curator | | Blockchain Risk | Underlying chain security, finality guarantees, and uptime | | Protocol Risk | Smart contract design, audit history, upgrade mechanisms | | Vault Security & Governance | Access controls, multisig configuration, governance attack surface |
The scale runs from AAA(v) to CCC(v), with the "(v)" suffix separating these scores from S&P's traditional corporate and sovereign ratings. S&P has not published assessments for any individual vaults. The framework targets a market segment that grew from $1.5 billion in deposits in September 2024 to approximately $10 billion by September 2026 — a 567% increase in two years.
The VRA is explicitly not a credit rating. S&P stated it does not assess yields and does not guarantee against losses. It measures the relative probability of impairment while holding a position in an on-chain vault.
The distinction matters. Credit ratings carry regulatory weight under Basel III, Solvency II, and U.S. insurance capital frameworks. A vault risk assessment, as currently structured, does not.
Moody's took a fundamentally different approach. Rather than grading a DeFi product, the agency evaluated Sky Protocol as an entity — applying counterparty risk methodology to a protocol that has no legal incorporation, no audited financials in the traditional sense, and governance by token holders.
The B3 rating sits six notches below investment grade on Moody's 21-step scale. The agency identified three structural weaknesses:
Moody's did credit the protocol with solid profitability, liquid assets, and limited historical credit losses. The agency set a 2.5% capital ratio as the upgrade threshold and a 0.5% ratio as the downgrade trigger.
Sky's reserves stood at $92 million as of September 17, 2026, against a governance-set target of $150 million. High-quality liquid assets — USDC and tokenized money market funds backed by U.S. Treasuries — totaled approximately $4.92 billion, covering roughly 50% of circulating USDS and DAI, up from 36% in August 2025.
Greg Feibus, Global Head of Capital Markets at Sky Frontier Foundation, stated: "We appreciate the rigor that Moody's brought to its review of Sky Protocol and the independent assessment it has provided."
London-based Agio Ratings, a crypto-native firm, published a probability-of-default model for Aave V3's Ethereum Core Market as of July 1, 2026.
Key metrics:
| Metric | Value | |---|---| | Probability of Default (1-year) | 12.23% | | Loss Given Default | 2.54% of deposits | | Expected Loss | 0.31% |
The methodology differs from both S&P and Moody's in that it is entirely quantitative and on-chain. Agio reconstructed every borrower position using over 6 million on-chain events, replayed them through a protocol replication using scaled-balance accounting, and generated 100,000 daily price paths assembled into 10,000 one-year scenarios. Liquidation logic was applied to calculate resulting bad debt through the protocol's protective waterfall.
Agio redefines "default" in DeFi: rather than a missed payment, default occurs when the liquidation mechanism fails. As the firm stated in its assessment: "Over-collateralisation converts credit risk into a dependency on the liquidation mechanism, and that mechanism can fail while every line of code executes exactly as written."
The firm identified two primary failure modes:
Agio combines more than 1,000 on-chain and off-chain variables per entity to produce daily probability-of-default scores. It also rates centralized exchanges and custodians, and launched liquidity provider ratings in June 2026.
| Dimension | S&P VRA | Moody's Issuer Rating | Agio PD Model | |---|---|---|---| | Unit of analysis | Vault (product) | Protocol (entity) | Smart contract market | | Scale | AAA(v) – CCC(v) | Aaa – C (21 steps) | Probability % + basis points | | Regulatory weight | None (not a credit rating) | Yes (NRSRO-recognized) | None | | Data sources | On-chain + off-chain qualitative | On-chain + governance + financials | On-chain events exclusively | | First assessment | Framework only (no scores published) | Sky Protocol B3, Oct 7 2026 | Aave V3 Core, Jul 1 2026 | | Update frequency | TBD | Event-driven | Daily | | Audience | DeFi vault depositors | Fixed-income investors, regulators | Institutional allocators, insurers |
Below the traditional rating agencies, a parallel scoring ecosystem operates entirely on-chain. At least seven platforms now generate borrower-level credit scores from blockchain transaction history:
These platforms serve a different function than S&P, Moody's, or Agio. They evaluate individual borrowers rather than protocols or vaults. They underpin a nascent market for undercollateralized DeFi lending, which remains small relative to the $56 billion overcollateralized market.
The distinction is material: traditional rating agencies assess systemic and product-level risk for institutional gatekeepers. On-chain scoring assesses individual creditworthiness for protocol-level access control.
The GENIUS Act takes effect on January 18, 2027, restricting U.S. users to Payment Stablecoin Issuer (PPSI)-compliant stablecoins. Under the Act, credit ratings shift from analytical exercises to regulatory gatekeepers.
Sky Protocol has introduced a proxy-upgradeable USDS stablecoin that includes a freeze function — a centralized mechanism that enables compliance with potential enforcement orders. The protocol's pursuit of investment-grade ratings is tied directly to this regulatory trajectory: a higher rating from Moody's or S&P could influence whether institutional counterparties treat USDS as an eligible payment stablecoin.
The capital ratio threshold matters here. At 0.9%, Sky's current ratio falls below the 2.5% Moody's identified as necessary for an upgrade. The protocol must roughly triple its equity base — from $90 million to approximately $250 million — to move toward investment grade, assuming managed assets remain stable at $10 billion.
Institutional DeFi adoption among hedge funds has grown from 10% to 47% over four years, according to industry surveys. Pension funds, insurance companies, and sovereign wealth funds remain largely absent. The legal enforceability of smart contracts and regulatory ambiguity around digital assets continue to constrain these allocators.
The three rating frameworks address different segments of this institutional pipeline:
Aave's institutional arm, Horizon, provides permissioned credit markets for regulated counterparties interacting with tokenized assets. The protocol crossed $1 trillion in cumulative loans processed in March 2026 and held $19.2 billion in TVL as of September 2026, according to S&P Global Ratings.
For context, Aave's Ethereum Core Market carries a 12.23% probability of default per Agio's model, but an expected loss of only 0.31% — suggesting that the protocol's protective waterfall (Umbrella insurance, protocol treasury, and DAO governance reserves) absorbs most potential bad debt. Whether that waterfall holds under correlated stress remains the open question.
The arrival of traditional credit-rating infrastructure in DeFi marks a structural shift in how risk is communicated between permissionless protocols and regulated capital. S&P, Moody's, and Agio Ratings each address a different layer of the risk stack — product, entity, and mechanism. None yet provides the comprehensive, continuously updated, on-chain-verified assessment that institutional mandates ultimately require.
The market is not waiting for convergence. DeFi lending deposits grew from $1.5 billion to $56 billion in two years. Rating agencies entered after the growth, not before it. The question is whether their frameworks — built for quarterly earnings calls and board-approved capital structures — can keep pace with protocols that upgrade through governance votes and settle through automated liquidation.
Sky Protocol's 0.9% capital ratio, expressed in Moody's language, makes DeFi's risk profile legible to fixed-income investors for the first time. Whether that legibility accelerates institutional adoption or merely quantifies reasons for caution depends on what happens to those reserves over the next 12 months.