Author: Tiger Research

Translation: Deep Tide TechFlow

Deep Tide Introduction: A statement from SEC commissioner Hester Peirce has made on-chain vaults and curators a regulatory focus. If legal logic is fully applied, the impact will not only be on vaults but on all DeFi products that make investment decisions for users—this market has a total locked value of up to $25.9 billion. Regulation will not target code but will precisely target the individuals making decisions behind the code.

Key Points

If legal reasoning is widely applied, the scope of impact will go beyond vaults and curators, extending to all discretionary products, with a total locked value of approximately $25.9 billion.

The SEC will not target code outside its jurisdiction. It targets the specific operators who make decisions over the code.

Compliance-focused DeFi teams, including Steakhouse Financial and Maple Finance, have long been preparing for such regulatory attention.

Historical precedents indicate that only two outcomes can withstand the test of time: achieving full registration under existing securities laws or creating new exemption clauses through legislation.

Current measures that market participants can take are, at best, transitional solutions. Only curators with sufficient capital who can establish regulatory compliance infrastructure afterwards can maintain their market position. Resource-constrained small curators will be eliminated.

SEC Targets Decision Rights, Not Code

On July 22, 2026, SEC commissioner Hester Peirce published a statement titled "Headstands and Summervaults," asserting that the Howey test (a legal standard established by the Supreme Court in 1946) can be applied to on-chain vaults and lending strategies according to current securities law.

The Howey test assesses the economic substance of how funds are raised and managed. It can be applied without new legislation or regulatory rulemaking. This is a factual standard that can be continuously applied to new financial instruments, irrespective of technological form. On-chain vaults or decentralized lending strategies may be deemed investment contracts under securities law if their structure satisfies the three core criteria of the test, classifying the product as a security when all three are met.

This statement does not carry direct enforcement power as it only represents the viewpoint of a single commissioner. However, it is the first mapping of the regulatory framework being formed by the SEC's cryptocurrency special working group onto specific products, raising concerns among relevant market participants. The token MORPHO of the vault infrastructure protocol Morpho instantly dropped about 5% following the statement's release.

If this legal reasoning is put into practice, the regulatory targets are unlikely to be the smart contracts driving the vaults. Instead, it will focus on risk curators and those DeFi participants who have actual decision rights over asset allocations. The vault infrastructure built by Morpho is a technical tool for asset management. The code without a controlling party is not a natural target for regulatory sanctions.

Why Curators Are Targeted

Curators decide how much capital within a vault is allocated where and what levels of risk those capital exposures are subject to. In this sense, they have genuine decision rights over the depositors' assets. The vault itself is merely a tool for curators to manage these assets. Most vaults are deployed as smart contracts without administrator keys or upgrade rights, meaning even the original deployers cannot stop their operation or change their logic.

The premise of financial regulation historically is that there exists an identifiable legal entity that can receive subpoenas, have its assets frozen, or comply with injunctions. Immutable code without a controlling party lacks such a manager.

The regulatory implication is that the focus of enforcement has shifted from code to decision rights. Earlier cases involving Tornado Cash and Uniswap Labs illustrate this pattern.

The core of the Tornado Cash case is whether immutable code constitutes sanctionable property. The Uniswap Labs case asks whether a company operating a non-custodial interface effectively acts as an unregistered broker or exchange. Both cases focus on the legal status of the code and the behavior of running the service, without addressing the issue of investment decision rights as the basis for securities liability.

This time is different. The key issue is no longer who built the protocol but who chooses the capital exposures of depositors to which assets, how much capital is allocated in each market, and how interest rate conditions and collateral parameters are adjusted to affect yields. Suppose a curator selects specific lending markets from a broader market, withdraws capital when risks rise, and shifts weight toward higher-yielding markets. Depositors hand over capital to that curator because they trust their judgment, not the underlying smart contract. Gains and losses result directly from the curator's decisions. This mode of professional decision-making on behalf of depositors is precisely the defining feature of an investment contract identified by the Howey test—"the expectation of profits from the efforts of others."

Curators are the most explicit party exercising this decision-making power within the on-chain vault ecosystem. This is why it is at the center of the regulatory framework.

What Categories Will Be Included

If this legal reasoning is widely applied, the scope of influence will not stop at risk curators. The SEC's analysis focuses on who makes investment decisions on behalf of users.

Liquidity re-staking operators decide which validators or active validation services (AVS) receive asset allocations. Yield aggregators compare yields and risks across lending and liquidity markets and reallocate capital accordingly. On-chain asset allocation services adjust positions and weights over time. When specific teams or operators continuously make asset selection and reallocation decisions, their functions are substantively similar to curators.

Therefore, the relevant scope is broader than the vault product categories themselves. Whether any specific service falls within this scope depends on who is selecting assets, changing allocations, and controlling loss exposures. Aggregating potential exposures across categories according to this standard results in a total locked value of approximately $25.9 billion.

Legal standards are unlikely to be uniformly applicable across all of these participants. Their intensity will vary based on the structure of the decision rights involved.

The highest risk and most stringent regulatory scrutiny are given to structures in which decision rights are exercised in opaque ways that depositors cannot verify in real time on-chain, such as off-chain delegation and uncollateralized lending.

Medium risk is attributed to standard vault curators and liquidity re-staking structures that exercise allocation decision rights, where capital flow is transparently recorded on-chain and governed by mechanisms such as time locks and custodian roles.

Lower risk and closest to compliance are immutable agreements without controlling parties, and financial products that have registered under securities law.

The one best positioned to evaluate their own legal risks is the operators themselves. This is why curators and adjacent market participants began devising customized responses, including investor qualification restrictions, third-party compliance arrangements, and formal private placement exemptions, even before the commissioner’s statement was released.

Four Design Approaches to Mitigate Regulatory Risk

The measures developed so far do not address the fundamental legal issue. They primarily focus on reducing the likelihood of regulatory applicability and limiting the legal liability of operating entities.

Two analytical dimensions distinguish these approaches: whether a recognized legal exemption has been obtained and whether actual asset allocation authority has changed. By these criteria, the current market responses can be divided into four categories.

Direct investor qualification checks: verifying and restricting sales only to qualified investors in advance.

Establishing regulated distribution channels: distributing through exchanges or regulated entities that have completed user KYC.

Collateral level whitelisting: controlling allowed collateral assets through coordination with asset issuers.

Structural separation of licensed lending and non-licensed yield tokens: splitting institutional lending execution from retail-accessible yield exposures.

4.1 Investor Qualification Check: Grove and GLDY

The most direct way to reduce regulatory risk is to control investor qualifications before accepting any capital.

Steakhouse Financial launched Grove in June 2025 as an on-chain capital allocation channel limited to institutions. Access is restricted to institutional RWA investors filtered through advance qualification.

Orca partnered with Streamex Corp (NASDAQ: STEX) in May 2026 to open the GLDY fund pool solely to qualified investors. GLDY is a yield-bearing tokenized security backed by physical gold reserves, explicitly issued under Rule 506(c) of Regulation D of U.S. securities law (private placement exemption). Investor accounts are initially frozen for on-chain transfers and are unlocked only after passing KYC and qualified investor verification through Streamex.

Both approaches target institutions and qualified investors, establishing a logical basis for using private placement exemptions instead of full public registration.

However, the determination of investor qualifications does not eliminate the product’s qualitative status as an investment contract under the Howey test. The status of being a qualified investor is more directly related to the distribution pathway rather than addressing the fundamental question of whether a security exists. This represents a practical risk management approach under the current legal framework, rather than a fundamental change in legal nature.

The core function of curators selecting assets and setting allocation weights within vaults remains unchanged, which is a structural limitation that these access controls cannot resolve.

4.2 Existing KYC and Compliance Infrastructure: Sentora

Sentora did not build its own qualification framework but combined existing KYC-based distribution channels with regulated asset issuance infrastructure.

Kraken’s DeFi Earn product is the clearest example. Veda provides vault infrastructure; Chaos Labs manages Balanced and Boosted vaults; Sentora acts as the risk manager for Advanced vaults, overseeing capital allocation and managing risks and liquidity across cross-chain protocols.

This arrangement has been more widely adopted. Coinbase combined Morpho and Steakhouse Financial to launch USDC lending through Prime and High Yield vaults. Binance connects its users to Morpho vaults managed by Steakhouse and Gauntlet.

Exchange-level KYC confirms user identities, and the issuer compliance framework supports reserve and redemption structures. Neither involves determining who decides what assets and markets receive how much capital. External compliance infrastructure reduces risks at the asset and distribution layers but cannot absorb the regulatory risks or legal liabilities of the risk managers making allocation decisions.

Figure: Sentora's structure using existing KYC and compliance infrastructure—users enter through CeFi exchanges (Coinbase/Kraken/Binance), managed by risk curators like Steakhouse/Sentora/Gauntlet, ultimately deployed into lending pools like Morpho. Source: Tiger Research

4.3 Asset Level Whitelisting: Aave Horizon

Aave launched Aave Horizon in August 2025 as an institutional RWA lending market. The product is structurally separate from the core protocol and is designed according to specifications required by institutional asset management.

Aave Horizon’s unique design choice is to share control over permitted collateral with asset issuers rather than directly restricting user access at the distribution stage. The whitelist of tokenized collateral assets is managed by the issuers themselves: Circle, Ripple, Superstate, and Centrifuge (including Janus Henderson products). The protocol itself remains permissionless for any wallet holding whitelisted assets.

The core of control is not who accesses the market but which assets are qualified. Risk parameters follow LlamaRisk’s recommendations, with collateral valuations supported by real-time NAV data verified by Chainlink. Aave Horizon builds upon existing Aave lending infrastructure rather than creating a new chain or independent protocol.

Sharing verification responsibilities with asset issuers does not eliminate Aave Horizon's legislative and operational liabilities for its risk parameter decisions.

Figure: Aave Horizon Pool operation structure—tokenized government bonds, equities, privately placed credit, and other RWAs serve as collateral entering the shared stablecoin pool, with whitelists managed by issuers, risk parameters handled by LlamaRisk, and Chainlink NAV providing price data. Source: Tiger Research

4.4 Structural Separation of Licensed Lending and Non-Licensed Yield Tokens: Maple Finance

In April 2024, Maple Finance converted its entire platform to a whitelisting structure. All loans are now fully over-collateralized, and Maple Direct (its internal credit team) directly conducts borrower due diligence, ongoing monitoring, and margin calls. Access is limited to approved institutional borrowers and lenders.

The most notable aspect of Maple’s design is the separation between licensed lending operations and non-licensed yield access. In 2024, Maple launched the Syrup protocol, allowing retail users to deposit USDC and receive SyrupUSDC without KYC. These deposits flow into the same institutional lending pool managed by Maple Direct's qualified borrowers. The lending itself operates under stringent institutional compliance. The yield rights generated from lending are packaged into a non-licensed token, open to any user.

This structure repositions regulatory risk rather than eliminating it. Maple Direct’s discretion in due diligence and management (including borrower selection, collateral terms, and margin calls) remains unchanged. The arrangements that pass institutional borrowing returns to SyrupUSDC holders create new questions regarding whether that token constitutes an investment contract under the Howey test and separate distribution responsibilities.

The structural separation of licensed lending and non-licensed yield tokens is a deliberate repositioning of regulatory scrutiny. It does not change the legal liabilities of the entities managing capital or the fundamental nature of the product.

Figure: Maple’s structural separation of licensed lending and non-licensed yield tokens—retail users deposit USDC through Syrup to receive SyrupUSDC, while Maple Direct conducts due diligence, monitoring, and margin calls for institutional borrowers. Source: Tiger Research

The aforementioned cases involve different regulatory touchpoints but share common limitations. They form operational defense structures aimed at managing regulatory risks by separating investors, assets, and distribution channels. They are not definitive solutions for eliminating legal risks.

According to the two analytical dimensions introduced earlier:

One approach has obtained a clear legal exemption: the Orca/GLDY structure, directly applicable under Rule 506(c) of Regulation D.

The remaining methods manage and limit regulatory risks: Grove, Sentora, Aave Horizon, and Maple Finance, through a combination of institutional qualification restrictions, third-party compliance infrastructure, and collateral whitelists.

Limiting distribution and filtering qualifications do not resolve the potential legal liabilities associated with curators’ or protocols’ discretionary asset selection and allocation decisions.

5. What History Shows as Effective

The future of the on-chain asset management market will not be determined by the superficial appearance of the code but by the established institutional frameworks that govern the scope of discretion, disclosure transparency, and allocation of legal liability.

The measures examined earlier reduce immediate regulatory risk and provide space to use existing private placement exemptions. They do not address the fundamental questions of the standards governing curators' allocation decisions and who bears responsibility when losses occur.

Historical records are consistent on one point: mere access restrictions have not resulted in enduring institutionalization.

In closed-end funds of the 1920s and 1930s, "blind pool" structures were widely abused, with managers not disclosing their investment objectives. The 1940 Investment Company Act addressed this issue not by limiting access but by institutionalizing the asset management function itself.

In 2008, when the SEC determined that LendingClub's peer-to-peer loan notes were securities, the company halted new registrations and restructured into SEC-registered note issuers linked to its loans, eventually going public in 2014.

In 2012, demands within the crowdfunding industry to lower fundraising restrictions led to the creation of the JOBS Act and crowdfunding regulatory framework.

What these three cases have in common is that they did not stop at restricting investor access. They established the legal nature of products, the obligations of operating entities, the required scope of disclosure, and loss allocation. Sustainable growth of new financial instruments requires market participants to be able to anticipate their rights and legal liabilities in advance.

The on-chain vault and DeFi markets face the same institutionalization challenges. Available paths include:

Complete registration under existing securities laws.

Private placement exemptions for qualified investors.

Design of immutable agreements that completely eliminate discretion.

New regulatory exemptions for on-chain finance, similar to the proposals made to the SEC by Ava Labs and the Solana Policy Institute.

Regardless of the chosen path, the core task remains the same: to establish who makes investment decisions, what disclosures are needed, and where liability lies when results are adverse.

6. Compliance Costs as a New Barrier to Entry

The ultimate factor determining the competitive position of the on-chain asset management market is the ability to structurally absorb compliance costs and demonstrate legal accountability.

As regulators cannot directly control code, the framework holding human actors legally accountable for the discretion they exercise will become clearer. Regardless of how effectively a company positions itself during the transition period, formal registration or a clear exemption framework will eventually require each operator to demonstrate the legal foundations of their management structure and the boundaries of liability. At that point, compliance obligations (including KYC infrastructure, legal reviews, on-chain asset valuations, customized institutional contracts, and loss absorption structures) will no longer be just administrative expenses. They will become independent cost items requiring continuous capital investment.

Internalizing these compliance costs will drive significant reordering in the curator market. Large curators with capital, operational scale, and established institutional relationships will effectively absorb compliance costs and reinforce their market positions. Small curators lacking capital to build independent infrastructures will face the choice of bearing disproportionate costs or integrating into larger regulated protocols or distribution channels.

The true value of the grace period gained through transitional strategies will be determined by what is established during that time. Those who utilize this time to design formal registration pathways, identify feasible exemptions, and proactively establish clear accountability structures will find that regulatory requirements become competitive advantages rather than obstacles. For those who procrastinate, the continually rising compliance costs will erode profitability and ultimately hinder market participation.

Gain insights into the Asian Web3 market with Tiger Research. Join over 23,000 pioneers for exclusive market insights.

🐯 More from Tiger Research

On-Chain Risk Curators: $147 Trillion vs. $7 Billion Market Gap

Korean Institutional Cryptocurrency: Landscape in 2026

DeFi Lending Is Modularizing: Risk Management Wars Between Morpho, Euler, and Aave

Still in 1990: Crypto Cards: $1.5 Billion Monthly, but Not Yet Infrastructure

Transformation of the Crypto Market: From Narrative to PMF

This report is compiled based on materials deemed reliable. However, we do not explicitly or implicitly guarantee the accuracy, completeness, and applicability of the information. We are not liable for any losses arising from the use of this report or its contents. The conclusions and recommendations in this report are based on the information available at the time of compilation and are subject to change without notice. All items, estimates, forecasts, objectives, opinions, and views expressed in this report may differ or contradict those of others or other organizations and can change without notice.

This document is for reference only and should not be considered legal, business, investment, or tax advice. Any references to securities or digital assets are for illustrative purposes only and do not constitute an offer or provide investment advisory services. This material is not directed at investors or potential investors.

Terms of Use

Tiger Research permits the reasonable use of its reports. "Reasonable use" is a principle that broadly allows the use of specific content for public interest purposes, as long as it does not harm the commercial value of the material. If usage complies with reasonable use purposes, the report can be utilized without prior permission. However, when citing Tiger Research reports, it is required to 1) explicitly credit "Tiger Research" as the source and 2) include the Tiger Research branding. Restructuring and republishing materials requires separate negotiation. Unauthorized use of the report may lead to legal action.