The $15 billion onchain vault sector faces a regulatory fork. Two competing industry coalitions submitted opposing frameworks to the U.S. Securities and Exchange Commission in late October and early November 2026, disagreeing on whether human-managed DeFi vaults constitute securities offerings. T...
"When a community sets a market's rules in public and gives users time to leave before anything changes, that is running a marketplace, not managing anyone's money." — Linda Jeng, Chief Legal and Policy Officer, Aave Labs
The $15 billion onchain vault sector faces a regulatory fork. Two competing industry coalitions submitted opposing frameworks to the U.S. Securities and Exchange Commission in late October and early November 2026, disagreeing on whether human-managed DeFi vaults constitute securities offerings. The Crypto Council for Innovation, backed by Bitwise, Galaxy Digital, and Morpho, filed a 238-page report on October 29 arguing that regulatory intensity should scale with the degree of operator control over user assets. Aave Labs, Veda Tech Labs, and the Kamino Foundation countered on November 3 that even actively managed vaults fall outside securities law if users retain ownership rights and no issuer-investor relationship exists.
The dispute centers on ERC-4626 and ERC-7540 vault infrastructure that now underpins more than 1,300 tracked stablecoin vaults and approximately $15 billion in total value locked. Morpho alone holds $11.2 billion in TVL across its curated lending markets, with three risk curators — Sentora ($1.85 billion), Steakhouse Finance ($1.63 billion), and Gauntlet ($1.5 billion) — managing 75% of the curation layer's $6.5 billion in assets. The outcome of this regulatory debate will determine whether these curators need to register as investment advisers, whether vaults must comply with investment company rules, and whether the vault sector's projected growth to $64 billion by year-end faces structural constraints.
The current dispute did not emerge in isolation. The SEC has been signaling increased scrutiny of DeFi vault structures throughout 2026:
The Crypto Council for Innovation's 238-page submission, co-authored with Bitwise, Galaxy Digital, and Morpho, proposes a graduated regulatory model tied to operator discretion. The framework identifies three categories of vaults:
Lending vaults that accept deposits and allocate them to borrowers based on predefined parameters. Investment portfolio vaults that manage diversified asset allocations. Trading strategy vaults that execute more complex strategies including leverage and derivatives.
The CCI argues that the degree of human operator involvement in three specific decision areas — investment choices, lending terms, and fund movements — should determine the applicable regulatory regime. A vault that operates on fixed, immutable rules with no human discretion presents a weaker case for securities classification than one where a human curator actively reallocates capital across markets.
For vaults that do meet the threshold of securities regulation, the CCI recommends the SEC initially adopt the ETF regulatory model, granting individual exemptions before establishing broader rules. The submission also calls for clarity on when vault operators must register as investment advisers and how custody rules apply to smart-contract-based asset management.
Morpho's involvement in the CCI coalition is notable given that the protocol holds $11.2 billion in TVL and relies on a curator model where third-party risk managers set allocation parameters. Morpho's Vaults V2 system provides curators with granular controls including absolute and relative exposure caps, timelocks ranging from zero to three weeks, and fee caps of 50% on performance and 5% on assets under management.
Aave Labs, Veda Tech Labs, and the Kamino Foundation take a fundamentally different position. Their submission argues that the presence of human management does not automatically create a securities relationship. The determining factor, they contend, is whether users retain direct ownership rights over deposited assets or whether they have invested capital in a separate enterprise managed by others.
Linda Jeng, Aave's Chief Legal and Policy Officer, framed the distinction as marketplace versus money management: protocols that set rules publicly and give users time to exit before changes take effect are operating marketplaces, not managing investments. The implication is that even curated vaults — where humans actively select lending markets or adjust risk parameters — should remain outside securities regulation if the protocol structure preserves user ownership.
TuongVy Le, Veda's General Counsel, added a second argument: "Immutability shouldn't be the dividing line for what gets regulated." This challenges the CCI framework's implicit logic that more human involvement equals more regulation. Le's position suggests that tying regulatory classification to upgrade capability would penalize protocols that maintain the ability to patch security vulnerabilities or adjust parameters.
Aave's formal October 20 comment letter on Regulation Crypto Assets made five specific requests: clarity on whether assets tied to investment contracts can be used in non-custodial DeFi protocols; function-based regulation for intermediary status; objective criteria beyond Form TR filings; a 60-day safe harbor grace period after Form TR filing; and confirmation that ongoing protocol development does not indefinitely extend original investment contracts.
Kamino, which holds $2.4 billion in TVL on Solana, and Veda, which operates yield optimization vaults, both face direct consequences from any SEC determination that managed vaults constitute securities.
The vault sector has grown into a substantial segment of DeFi infrastructure. Data from DeFiLlama and Lagoon Finance as of Q3 2026:
| Metric | Value | |--------|-------| | Total ERC-4626/ERC-7540 vault TVL | $15B+ | | Tracked stablecoin vaults | 1,300+ | | USDC vaults alone | $3B | | Morpho TVL | $11.2B | | Pendle TVL (11 chains) | $3.5B | | Kamino TVL (Solana) | $2.4B | | Risk curation layer TVL | $6.5B |
The curation model has concentrated capital among a small number of risk managers. Three curators — Sentora, Steakhouse Finance, and Gauntlet — control 75% of the $6.5 billion curation layer. This concentration raises a separate regulatory question: if three entities direct the majority of capital allocation, the "decentralized marketplace" argument becomes harder to sustain.
DeFi TVL broadly declined from approximately $115 billion in January 2026 to $70 billion at mid-year before recovering to $93.9 billion by September. The vault sector has grown against this backdrop, suggesting capital migration from direct protocol interaction to curated yield products.
Projected vault AUM by end of 2026, per Lagoon Finance estimates: $64 billion base case, $85 billion bull case, $41.6 billion bear case.
The SEC has not issued a formal rule on vault classification, but Commissioner Peirce's July statement and the Regulation Crypto Assets proposal establish the agency's analytical framework.
Peirce's "Headstands and Summervaults" statement identified specific triggers for securities analysis. Vaults that involve discretionary asset allocation, set lending terms, establish loan-to-value ratios, or manage liquidation thresholds may implicate the Howey test's "efforts of others" prong. She noted that onchain loans may bear the "hallmarks of notes that are securities." However, Peirce did not declare all vaults to be securities, stating that classification depends on specific facts and circumstances.
Regulation Crypto Assets, proposed August 18, offers a potential path forward. The investment contract safe harbor (Rule 400) allows an investment contract to cease existing when the issuer completes its promised "essential managerial efforts" and files Form TR. This mechanism could theoretically apply to vault structures that begin with centralized management and progressively decentralize — but the rule's applicability to perpetually managed vaults remains ambiguous.
The SEC's November 2 FAQ update on decentralized governance adds another variable. By clarifying criteria for identifying a "central party" in token governance arrangements, the staff implicitly addressed the control question at the heart of the vault debate.
SEC Chairman Paul Atkins described Regulation Crypto Assets as "the most historic step yet to modernize federal securities regulations for crypto assets." Whether that modernization extends to vaults managed by risk curators will depend on how the agency processes the competing submissions.
The regulatory outcome carries material consequences for vault operators, curators, and users.
Registration costs: If vault curators must register as investment advisers, compliance overhead including legal, audit, and reporting requirements could price out smaller curators. The three dominant curators managing $6.5 billion might absorb these costs; the long tail of hundreds of smaller vault operators likely cannot.
Investment company rules: Classifying vaults as investment companies would impose diversification requirements, leverage limits, and board governance mandates designed for mutual funds — structures fundamentally incompatible with smart-contract-based capital allocation.
User access: Investment company classification could restrict vault access to accredited investors under existing exemptions, reducing the retail participation that currently characterizes DeFi lending markets.
Protocol design: If immutability becomes a factor in securities analysis, as the CCI framework implies, protocol developers face a perverse incentive to make vaults less upgradeable — potentially sacrificing security for regulatory clarity.
Market consolidation: Compliance requirements would accelerate the concentration already visible in the curation layer, favoring well-capitalized entities over decentralized alternatives.
The DeFi vault industry faces a classification problem with no precedent in securities law. The Investment Company Act of 1940 and the Howey test were designed for centralized intermediaries and passive investors — not for smart-contract systems where users retain asset custody while third-party curators set risk parameters. Both the CCI and Aave coalitions acknowledge that some vaults may warrant oversight; they disagree on where to draw the line.
The SEC's next steps — whether through formal rulemaking, no-action letters, or enforcement — will set the terms for a vault market projected to reach $64 billion by year-end. The agency has the competing frameworks, the comment letters, and the staff analysis. What it has not yet produced is a rule that accounts for the vault model's hybrid structure: decentralized custody, centralized curation, automated execution. Until that rule arrives, the $15 billion vault sector operates in regulatory ambiguity, and the two coalitions that filed competing visions of its future will wait for the SEC to choose between them — or reject both.