SEC Targets $25.9 Billion DeFi Market: Regulatory Target Is Not Code, But Those Making Decisions on Behalf of Users

Author: Tiger Research

Compiled by: TechFlow

TechFlow Editor's Note: A statement by SEC Commissioner Hester Peirce has put on-chain vaults and curators in the regulatory spotlight. If the legal logic is fully applied, not only vaults but all DeFi products making investment decisions on behalf of users will be affected—this market has a total locked value of up to $25.9 billion. Regulation will not target code, but will precisely target the people making decisions behind the code.

Key Points

If the legal reasoning is widely applied, the scope of impact will extend beyond vaults and curators to all discretionary products, with a total locked value of approximately $25.9 billion in this market.

The SEC will not target code outside its jurisdiction. It targets specific operators exercising decision-making power over the code.

Compliance-oriented DeFi teams, including Steakhouse Financial and Maple Finance, have been preparing for this kind of regulatory attention for some time.

Historical precedents show that only two outcomes stand the test of time: completing full registration under existing securities laws, or creating new exemption clauses through legislation.

Countermeasures currently available to market participants are at best transitional solutions. Only well-capitalized curators capable of establishing ex-post compliance infrastructure can maintain their market position. Small curators with insufficient resources will be eliminated.

The SEC is Targeting Decision-Making Power, Not Code

On July 22, 2026, SEC Commissioner Hester Peirce issued a statement titled "Headstands and Summervaults," arguing that the Howey Test (a legal standard established by the Supreme Court in 1946) can be applied to on-chain vaults and lending strategies under existing securities laws.

The Howey Test evaluates the economic substance of how funds are raised and managed. It does not require new legislation or regulatory rulemaking to apply. This is a fact-based standard that can be continuously applied to new financial instruments regardless of technical form. On-chain vaults or decentralized lending strategies, no matter how complex the blockchain architecture, may be deemed investment contracts under securities law if their structure meets the three core criteria of the test. When all three are met, the product is classified as a security.

This statement does not have direct enforcement power because it represents only a single commissioner's view. However, this is the first time the regulatory framework being formed by the SEC Crypto Task Force has been mapped to specific products, sparking concern among relevant market participants. The token MORPHO of vault infrastructure protocol Morpho fell approximately 5% immediately after the statement was released.

If this legal reasoning is put into practice, the regulatory target will almost certainly not be the smart contracts driving the vaults. It will be the risk curators and those DeFi participants who have actual decision-making power over how assets are allocated. The vault infrastructure built by Morpho is a technical tool for asset management. Code without a controlling party is not a natural object of regulatory sanctions.

Why Curators Have Become the Target

Curators decide how much capital in the vault is allocated where, and what risk level these capitals are exposed to. In this sense, they have real decision-making power over depositors' assets. The vault itself is just a tool for curators to manage these assets. Most vaults are deployed as smart contracts without admin keys or upgrade permissions, meaning even the original deployer cannot stop their operation or change their logic.

The premise of financial regulation has always been the existence of an identifiable legal entity capable of receiving subpoenas, having assets frozen, or complying with injunctions. Immutable code without a controlling party has no such manager.

The regulatory consequence is that enforcement attention has shifted from code to decision-making power. Earlier cases involving Tornado Cash and Uniswap Labs illustrate this pattern.

The core of the Tornado Cash case was whether immutable code constitutes sanctionable property. The Uniswap Labs case asked whether a company operating a non-custodial interface substantively acted as an unregistered broker or exchange. Both cases focused on the legal status of code and the conduct of operating services. Neither touched on the issue of investment decision-making power as a basis for securities liability.

This time is different. The key question is no longer who built the protocol, but who chooses which assets depositors' capital is exposed to, how much is allocated to each market, and how to adjust interest rate conditions and collateral parameters to influence yields. Suppose a curator selects specific lending markets from a broader market, withdraws capital when risks rise, and shifts weights to higher-yielding markets. Depositors entrust capital to the curator because they trust their judgment, not the underlying smart contracts. Profits and losses come directly from the curator's decisions. This pattern of professional decision-making exercised on behalf of depositors is exactly the defining characteristic of an investment contract identified by the Howey Test—"expectation of profits from the efforts of others."

Curators are the party most clearly exercising this kind of decision-making power in the on-chain vault ecosystem. This is why it is at the center of the regulatory framework.

Which Categories Will Be Included

If this legal reasoning is widely applied, the scope of impact will not stop at risk curators. The SEC's analytical focus is on who is making investment decisions on behalf of users.

Liquid restaking operators decide which validators or Active Validation Services (AVS) receive asset allocation. Yield aggregators compare yields and risks in lending and liquidity markets and shift capital accordingly. On-chain asset allocation services adjust holdings and weights over time. When specific teams or operators continuously make decisions on asset selection and reallocation, their function is substantively similar to curators.

Therefore, the relevant scope is broader than the vault product category itself. Whether any specific service falls within this scope depends on who is selecting assets, changing allocations, and controlling loss exposure within that service. Aggregating potential exposure across categories by this standard, the total locked value is approximately $25.9 billion.

Legal standards are unlikely to be applied uniformly across all these participants. Their intensity will vary with the structure of the decision-making power involved.

The highest risk and strictest regulatory scrutiny are for structures where decision-making power is exercised in opaque ways that depositors cannot verify on-chain in real time, such as off-chain delegation and under-collateralized lending.

Medium risk includes standard vault curators and liquid restaking structures, which exercise allocation decision-making power, but capital flows are transparently recorded on-chain and constrained by governance mechanisms such as time locks and guardian roles.

Lower risk and closest to compliance are immutable protocol deployments without controlling parties, and financial products already registered under securities laws.

The operators themselves are best positioned to accurately assess their own legal risks. This is why curators and adjacent market participants had already begun formulating customized countermeasures before the commissioner's statement was released, including investor qualification restrictions, third-party compliance arrangements, and formal private placement exemptions.

Four Design Approaches to Reduce Regulatory Risk

Countermeasures formulated to date have not addressed the fundamental legal issues. They mainly focus on reducing the probability of regulatory application and limiting the legal liability of operating entities.

Two analytical dimensions distinguish these approaches: whether a recognized legal exemption has been obtained, and whether actual asset allocation power has changed. Measured by these standards, current market responses are divided into four categories.

Direct Investor Qualification Review: Verify in advance and restrict sales to accredited investors only.

Establish Regulated Distribution Channels: Distribute through exchanges that have completed user KYC or regulated entities.

Collateral-Level Whitelist: Control allowed collateral assets by coordinating with asset issuers.

Structural Separation of Permissioned Lending and Permissionless Yield Tokens: Split institutional lending execution from retail-accessible yield exposure.

4.1 Investor Qualification Review: Grove and GLDY

The most direct way to reduce regulatory risk is to control investor qualifications before accepting any capital.

Steakhouse Financial launched Grove in June 2025 as an institution-only on-chain capital allocation channel. Access is limited to institutional RWA investors who have passed advance qualification screening.

Orca partnered with Streamex Corp (NASDAQ: STEX) in May 2026 to open the GLDY pool only to accredited investors. GLDY is a yield-bearing tokenized security backed by physical gold reserves, explicitly issued under Rule 506(c) of Regulation D of the U.S. Securities Act (private placement exemption). Investor accounts have on-chain transfers frozen initially and are unlocked only after passing Streamex's KYC and accredited investor verification.

Both methods target institutions and accredited investors, establishing a logical basis for using private placement exemptions rather than full public registration.

However, investor qualification does not eliminate the characterization of the product as an investment contract under the Howey Test. Accredited investor status relates more directly to the distribution path than to the fundamental issue of whether a security exists. This is a practical risk management method under the current legal framework, not a fundamental change in legal nature.

The core function of curators selecting assets and setting allocation weights within the vault remains unchanged, which is exactly the structural limitation that these access controls cannot resolve.

4.2 Existing KYC and Compliance Infrastructure: Sentora

Sentora did not build its own qualification framework but combined existing KYC-based distribution channels with regulated asset issuance infrastructure.

Kraken's DeFi Earn product is the clearest example. Veda provides vault infrastructure; Chaos Labs manages Balanced and Boosted vaults; Sentora serves as the risk manager for Advanced vaults, overseeing capital allocation across on-chain protocols and managing risk and liquidity.

This arrangement was later adopted more widely. Coinbase combined Morpho and Steakhouse Financial to launch USDC lending through Prime and High Yield vaults. Binance connected its users to Morpho vaults managed by Steakhouse and Gauntlet.

Exchange-level KYC confirms user identity, and issuer compliance frameworks support reserve and redemption structures. Neither involves who decides which assets and markets receive how much capital. External compliance infrastructure reduces risk at the asset and distribution levels but cannot absorb the regulatory risk or legal liability of risk managers making allocation decisions.

Figure: Sentora's structure leveraging existing KYC and compliance infrastructure—users enter via CeFi exchanges (Coinbase/Kraken/Binance), managed by risk curators such as Steakhouse/Sentora/Gauntlet, and finally deployed to lending pools such as Morpho. Source: Tiger Research

4.3 Asset-Level Whitelist: Aave Horizon

Aave launched Aave Horizon in August 2025, an institutional RWA lending market. The product is structurally separated from the core protocol and designed according to specifications required for institutional asset management.

Aave Horizon's unique design choice is to share control of allowed collateral with asset issuers, rather than restricting user access directly at the distribution stage. The whitelist of tokenized collateral assets is managed by the issuers themselves: Circle, Ripple, Superstate, and Centrifuge (including Janus Henderson products). The protocol itself remains permissionless for any wallet holding whitelisted assets.

The core of control is not who accesses the market, but which assets qualify. Risk parameters follow LlamaRisk's recommendations, and collateral valuation is supported by NAV data verified in real time by Chainlink. Aave Horizon is built on existing Aave lending infrastructure rather than building a new chain or independent protocol.

Sharing verification responsibility with asset issuers does not eliminate Aave Horizon's legal and operational responsibility for its risk parameter decisions.

Figure: Aave Horizon Pool Operating Structure—RWAs such as tokenized treasuries, stocks, and private credit enter the shared stablecoin pool as collateral, whitelist managed by issuers, LlamaRisk responsible for risk parameters, Chainlink NAV provides price data. Source: Tiger Research

4.4 Structural Separation of Permissioned Lending and Permissionless Yield: Maple Finance

In April 2024, Maple Finance converted its entire platform to a whitelist structure. All loans are now fully over-collateralized, and Maple Direct (its internal credit team) directly conducts borrower due diligence, continuous monitoring, and margin calls. Access is limited to approved institutional borrowers and lenders.

The most notable aspect of Maple's design is the separation between permissioned lending operations and permissionless yield access. In 2024, Maple launched the Syrup protocol, where retail users can deposit USDC and receive SyrupUSDC without KYC. These deposits flow into the same institutional lending pool that Maple Direct has managed with its qualified borrowers. The lending itself operates under strict institutional compliance. The yield rights generated from lending are packaged into permissionless tokens open to any user.

This structure repositions regulatory risk rather than eliminating it. Maple Direct's due diligence and management discretion (including borrower selection, collateral terms, and margin calls) remain unchanged. The arrangement of passing institutional lending returns to SyrupUSDC holders creates new questions about whether the token constitutes an investment contract under the Howey Test, as well as separate distribution liability.

The structural separation of permissioned lending and permissionless yield is a deliberate repositioning of where regulatory scrutiny lands. It does not change the legal liability of the entity managing capital or the fundamental nature of the product.

Figure: Maple's separation structure of permissioned lending and permissionless yield tokens—retail users deposit USDC via Syrup to receive SyrupUSDC, Maple Direct conducts due diligence, monitoring, and margin calls on institutional borrowers. Source: Tiger Research

The above cases involve different regulatory touchpoints but share common limitations. They are operational defense structures aimed at managing regulatory risk by separating investors, assets, and distribution channels. They are not final solutions to eliminate legal risk.

According to the two analytical dimensions introduced earlier:

One method obtained a clear legal exemption: the Orca/GLDY structure, directly applying Rule 506(c) of Regulation D.

The remaining methods manage and limit regulatory risk: Grove, Sentora, Aave Horizon, and Maple Finance, through a combination of institutional qualification restrictions, third-party compliance infrastructure, and collateral whitelists.

Restricting distribution and screening qualifications does not resolve the potential legal liability attached to discretionary asset selection and allocation decisions by curators or protocols.

5. What History Shows Works

The future of the on-chain asset management market will not be determined by the surface appearance of code, but by established institutional frameworks that manage the scope of discretion, disclosure transparency, and allocation of legal liability.

The measures examined above reduce immediate regulatory risk and provide room to use existing private placement exemptions. They do not answer fundamental questions such as standards for managing curator allocation decisions and who bears responsibility when losses occur.

The historical record is consistent on one point: access restrictions alone have not produced lasting institutionalization.

In closed-end funds of the 1920s and 1930s, "blind pool" structures were widely abused, with managers not disclosing their investment objectives. The Investment Company Act of 1940 solved this problem not by restricting access, but by institutionalizing the asset management function itself.

In 2008, when the SEC determined that LendingClub's peer-to-peer loan notes were securities, the company suspended new registrations and restructured into an SEC-registered note issuer linked to its loans, eventually going public in 2014.

In 2012, the crowdfunding industry's demand for reduced financing restrictions led to the creation of the JOBS Act and crowdfunding regulations.

The commonality among these three cases is that they did not stop at restricting investor access. They established the legal nature of products, obligations of operating entities, required disclosure scope, and loss allocation. Sustainable growth of new financial instruments requires market participants to be able to predict their rights and legal liabilities in advance.

On-chain vaults and DeFi markets face the same institutionalization challenges. Available paths include:

Full registration under existing securities laws.

Private placement exemptions for accredited investors.

Immutable protocol design that completely eliminates discretion.

New regulatory exemptions for on-chain finance, such as proposals submitted by Ava Labs and Solana Policy Institute to the SEC.

Whichever path is chosen, the core task is the same: establish who makes investment decisions, what disclosures are required, and where liability lies when results are unfavorable.

6. Compliance Costs as a New Barrier to Entry

The factor ultimately determining competitive position in the on-chain asset management market is the ability to structurally absorb compliance costs and demonstrate legal accountability.

Because regulators cannot directly control code, frameworks holding human actors legally liable for the discretion they exercise will only become clearer. No matter how effectively a company positions itself during the transition period, formal registration or clear exemption frameworks will ultimately require every operator to demonstrate the legal basis and liability boundaries of its management structure. At that time, compliance obligations (including KYC infrastructure, legal review, on-chain asset valuation, customized institutional contracts, and loss absorption structures) will no longer be administrative expenses. They will become independent cost items requiring continuous capital investment.

The internalization of these compliance costs will drive a significant reorder of the curator market. Large curators with capital, operational scale, and established institutional relationships will be able to effectively spread compliance costs and consolidate their market position. Small curators lacking capital to build independent infrastructure will face a choice between bearing disproportionate costs and accepting integration into larger regulated protocols or distribution channels.

The true value of the grace period gained by transition strategies will be determined by what is established during this period. Those who use this time to design formal registration paths, identify viable exemptions, and establish clear liability structures in advance will find regulatory requirements becoming a competitive advantage rather than an obstacle. For those who delay, rising compliance costs will erode profitability and ultimately prevent market participation.