Both documents agree that most lending vaults are not securities. The disagreement lies in whether a vault itself counts as a security when the management reallocates funds on behalf of users.

Written by: Sanqing, Foresight News

On November 2, Aave Labs, Kamino Foundation (the foundation behind the Solana lending protocol Kamino), and vault infrastructure provider Veda Tech Labs publicly released a 16-page legal framework summary, arguing that decentralized lending protocols and non-custodial vaults are not governed by federal securities laws. Prior to this, on October 26, the three parties submitted a more detailed confidential version to the U.S. Securities and Exchange Commission (SEC) crypto task force and the Division of Corporate Finance, requesting a meeting with SEC staff.

Previously, the crypto industry advocacy organization Crypto Council for Innovation (CCI) released a vault report titled "Under Control," approximately 238 pages long, in October. This report was promoted by a vault alliance led by Morpho, Bitwise and Galaxy, with input from the law firm Chapman and Cutler.

The two documents generally agree: in regular over-collateralized lending, depositors are not purchasing securities. The real disagreement lies in whether such vaults are considered securities if there is a management party that decides the flow of funds on behalf of users.

Consensus

Both documents reference centralized lending platforms prosecuted by the SEC in recent years. On platforms like BlockFi and Celsius, users transfer tokens, thereby relinquishing ownership; the platform commingles funds, makes independent decisions about lending and investment directions, and promises to repay principal and interest at a predetermined rate. Whether users can recover their principal depends entirely on the platform's business condition.

In 2022, the SEC determined that BlockFi's interest-bearing accounts constituted securities, leading to a $100 million settlement; after Celsius filed for bankruptcy, a court ruled in favor of the platform’s ownership of deposited assets based on user terms, allowing users to queue as ordinary creditors for repayment.

The mechanism of on-chain lending differs. Users deposit USDC into Aave, with funds remaining in smart contracts, where no entity takes ownership; borrowers must first deposit collateral worth more than the loan amount; if the collateral's value drops below a liquidation threshold, a third party will intervene for liquidation; interest rates are automatically calculated based on a public formula according to pool utilization, and each position is verifiable on-chain. There are no promises of returns, nor can anyone misappropriate funds.

Consequently, both documents conclude that regular over-collateralized lending does not constitute securities.

However, there are slight differences in their arguments regarding the Reves Test:

• The Aave camp believes that deposits do not generate "notes" at all; alternatively, even if treated as notes, they do not constitute securities based on the court's four factors.
• CCI asserts that the vault share tokens should undergo the Howey Test, urging the SEC to confirm that the underlying lending positions belong to "commercial loans" which the court historically does not classify as securities. It also acknowledges that open markets, available to all for deposits without bank regulatory backing, would make the lending positions seem more like securities under the Reves Test, but argues that over-collateralization, automatic liquidation, and on-chain transparency are sufficient to offset this.

The divergences beyond consensus stem from differing entry points: the Aave camp starts from lending protocols, most concerned that adjustments made by DAO will be interpreted as "operating for investors;" in contrast, CCI focuses on how extensive the management’s authority is such that the vault transforms into a fund.

Divergence

Currently in the DeFi lending market, an increasing amount of funds are no longer directly deposited into public pools like Aave, but first enter "vaults" managed by professionals who allocate them across various lending markets. On-chain financial products on Coinbase, Kraken, and Robinhood are all backed by such vaults.

Imagine a scenario: a user deposits 1 million USDC into a vault, and the management reallocates funds among several lending markets on a weekly basis based on interest rates. The regulators need to answer: does this user's action equate to buying a fund? If so, the vault would be categorized as a security, and the underlying entity must register with the SEC, disclose information, and be subject to regulation like a fund company.

The judgment criteria mainly consist of four legal standards:

1. Howey Test (established by the U.S. Supreme Court in 1946): Investing money, entering a common enterprise, and expecting profits solely from the efforts of others constitutes an "investment contract" (security).
2. Reves Test: In the lending context, assesses whether the arrangement constitutes a "note" guaranteed by someone.
3. The Investment Company Act of 1940: Defines whether a vault may be considered a fund.
4. The Investment Advisers Act of 1940: Determines whether the management requires licensing.

CCI's Standards

CCI's argument focuses on the "efforts of others" aspect of the Howey Test, dissecting the issue from both sides: on the management side, whether the authorities are hard-coded; on the user side, whether they can understand the strategy, track fund movements on-chain, be forewarned of changes, and exit timely. The report refines this into 10 verifiable criteria against the code:

1. No party with holding rights (including affiliates) can transfer user assets outside what's permitted by the code;
2. User redemptions do not rely on anyone's cooperation and can be completed at any time or by previously announced cycles;
3. Vault assets are stored separately from the management's own assets or any party with holding rights, with each user’s share recorded on-chain;
4. Key parameters that impact fund direction must either be immutable after deployment or changeable only per the code's prescribed procedures;
5. Any retained modification authority must be time-locked, publicly announced in advance, and provide an exit window for users before going into effect, with adjustments that solely reduce user risk exposure (such as lowering caps, tightening whitelists) as exceptions, but with required disclosures;
6. No one is allowed to autonomously reallocate funds after deposits; execution must adhere strictly to immutable code or predetermined objective parameters;
7. Roles responsible for pausing vault operations, vetoing pending actions, etc., must be independent of management and can only act under predetermined objective conditions, without deciding the direction of funds or influencing returns, while other management duties require multiple authorizations;
8. The code must undergo independent audits before deployment and after major upgrades, with reports made public, allowing continuous on-chain verification of holdings, rights, and pending changes;
9. No party with holding rights can direct funds to platforms where they have undisclosed significant interests;
10. The portion of assets that cannot be verified on-chain must be held by qualified custodians, and this boundary must be disclosed.

CCI believes that a vault meeting all 10 criteria should not be treated as a security. If the management can only select from a limited number of pre-defined markets and any changes are publicly announced in advance, providing an exit period, it resembles operating a transparent machine, which does not classify the vault as a security.

However, in the aforementioned scenario, if the management can change positions anytime without prior disclosure, and the risks across markets vary significantly (for example, some accept only mainstream asset collateral while others accept small cryptocurrencies), the user's profits or losses mainly depend on the management's market choices. At this point, the user effectively hands over money to be managed by others, with returns relying on the management's judgment, akin to a fund.

According to CCI standards, such vaults are likely subject to securities laws, necessitating registration with the SEC as securities or even funds, or seeking exemptions designed by CCI. However, CCI has also left room: if the risks across several markets are similar and the reallocation only impacts minor interest rate spreads, the management's judgment might not meet the Howey Test’s critical "efforts of others," and the vault may not constitute a security.

Aave Camp's Standards

The Aave camp's argument centers around the "common enterprise" of the Howey Test and the Reves Test. They believe that securities laws govern situations where "money is handed over to others to manage with promises of returns." In contrast, the ownership of funds in a vault always remains with the user, who holds shares; while the management can issue allocation directives, they cannot touch the funds, and no one promises principal and interest repayment. Therefore, there is neither a "note" as defined in the Reves Test, nor do users bind into a "common enterprise."

The Aave camp acknowledges that proactive reallocation by the management may satisfy the "efforts of others," but since the Howey Test requires all conditions to concurrently exist, a lack of a "common enterprise" means the vault is not a security. Likewise, without an entity owning the underlying assets and issuing shares, the vault does not qualify as a fund under the Investment Company Act's definition. The document cites an example: even if 80% of the assets in the vault are tokenized stocks, no such issuer can be found.

This conclusion is based on clear design premises: the management can only allocate funds within predetermined boundaries and cannot unilaterally expand their powers immediately; significant modifications to investment strategies and authority control must be approved by an independent party and set with time locks, ensuring users have an opportunity to exit before they take effect.

As for the management themselves, the Investment Advisers Act only governs "providing advice about securities." If the vault lends out stablecoins and the loan positions do not qualify as securities, reallocating does not constitute securities advice; only when the vault comprises tokenized stocks or other securities assets while receiving compensation, might the management be required to register as investment advisers and adhere to performance fee regulations.

It’s easier to understand with an analogy from traditional finance. Suppose you place 1 million yuan in your stock account, authorizing a financial advisor to trade for you.

CCI focuses on the advisor’s powers: if they can move money from stable blue-chip stocks to high-risk small-cap stocks without consulting, your earnings depend heavily on their judgment, which is not fundamentally different from buying into a fund, thus should be regulated as a fund; if they can only reallocate among stocks pre-approved by you and notify you of each adjustment in advance, allowing you to withdraw first, it does not amount to handing your money over to them for management.

The Aave camp focuses on asset ownership: the stocks remain in your name, never commingled with other clients' money, and the advisor has no authority to transfer funds as long as their powers are confined within agreed limits; even with active reallocations, your account does not become a fund; whether the advisor needs licensing is a separate issue.

Based on this, both parties made sharply different requests to the SEC. The Aave camp only seeks SEC confirmation that, under existing law, such lending protocols and vaults are not securities, requiring no exemptions.

CCI, on the other hand, has accepted the reality that some vaults may be viewed as funds and has pre-designed a fallback: mirroring the path of ETFs from applying for exemptions to forming unified rules by 2019, they request the SEC to provide a roadmap for vault exemptions, one condition being to designate a specific company as a "compliance entity," responsible for interfacing with the SEC, fulfilling reporting obligations, and bearing responsibility in case of issues.

Costs

In the simplest scenarios, both parties reach the same conclusion: a lending market where parameters are hard-coded and unalterable is not a security. Disagreements center on the "gray area" where management or governing parties retain partial modification authority, and currently, the vast majority of vaults and lending protocols fall precisely within this gray area.

Aave itself is a prime example. Aave's interest rate models, collateral ratios, and liquidation thresholds are adjusted through DAO voting, with a public notice and time locks set before modifications. Against CCI's 10 standards, as long as there is a time lock and users can exit before changes take effect, Aave would still meet the conditions to be exempt from being treated as a security.

However, the underlying logic of CCI’s framework is "the less room for artificial changes after deposit, the less like a security it becomes." If the SEC follows this line of reasoning, protocols with more active governance will be easier to classify as "managed by someone for investors," thus falling under securities law jurisdiction. Therefore, the Aave camp has specifically requested the SEC to clarify: whether protocols can be upgraded and whether ongoing governance exists should not be criteria for determining securities.

Each proposal carries its own costs:

• CCI's proposal: The checklist is specific, verifiable line by line, proactively delineating regulated situations, which is friendlier for institutions eager to clarify compliance boundaries; the cost is that the scope exempt from regulation is narrower, making it harder for products with broader management allocation permissions to meet the criteria.
• Aave's proposal: Expands the range that is not subject to securities laws; the cost is that it must convince the SEC to accept the broad judgment that "active management does not equal securities." If this is not adopted, the documents only state that management must comply with existing investment adviser rules, without providing a compliance path for vaults determined to be securities or funds.

Business

The methods of delineation in both documents are directly related to the business of the signing institutions. As of the time of writing, according to DefiLlama data, Aave's total value locked (TVL) is approximately $16.2 billion, with outstanding loans around $11.72 billion; Morpho is about $11.09 billion and $5.78 billion, respectively; Kamino is about $1.26 billion and $820 million, respectively.

Most of Aave's deposits still remain in the V3 public liquidity pool, with rules uniformly established by the DAO, and there is no management choosing markets for users; their greatest concern is that DAO adjustments to parameters will be interpreted as "operating for investors." In corporate business, Aave's permission-based market Horizon allows qualified institutions to borrow stablecoins against tokenized government bonds, with approximately $294 million in deposits as of now, peaking at about $638 million in mid-January of this year.

However, V4 has introduced management: the first external management entity, Sentora, went live in October, allowing it to set collateral, risk parameters, and interest rates independently, with significant risk changes requiring a 48-hour time lock. According to the Aave Pro page, deposits in V4 have exceeded $1.7 billion. Aave will face the challenge of whether external management constitutes investment advising in the future.

On the other hand, Morpho's business is built directly upon management: it only provides lending markets, leaving market selection and exposure decisions to management, with vaults distributing to exchanges and fintech companies. According to Morpho's disclosure on October 29, assets managed by the management have grown from zero to over $11 billion in two years; Coinbase and Robinhood have both surpassed $500 million in deposits for financial products based on the Morpho vault by September.

Among the three leading institutions in CCI, Bitwise and Galaxy are also management entities on Morpho. For them, a checklist stating "which conditions exempt it from being a security," even if leading to more constraints, is more practical than a broader scope whose adoption by the SEC is uncertain.

Kamino's positioning is intriguing. Its V2 structure similarly separates the market level and the vault level, with management entities like Steakhouse, Re7 Labs, and MEV Capital dynamically reallocating across multiple markets, almost identical to Morpho’s model.

According to CCI's checklist, such vaults require individual reviews; per Aave camp standards, as long as assets belong to users and permissions are constrained within preset bounds and time locks, it is not a security, but Kamino chose the latter.

Veda’s situation is similar. It provides multi-protocol vaults for products like Kraken DeFi Earn, with deposits exceeding $600 million, also needing to adjust according to market demands, making it hard to meet CCI’s "no autonomous fund allocation post-deposit" criteria.

However, the two camps are not distinctly separate. Sentora manages over $1 billion in assets on Morpho while providing risk management for the Veda vault and is also Aave V4’s first external management party; Galaxy operates vaults on both Morpho and Kamino. Regardless of which pathway the SEC adopts, these management entities will be affected.

Overall, both documents do not display differences on regular on-chain over-collateralized lending; the primary controversy revolves around vaults where the management reallocates for users, which is the mainstream model underpinning on-chain financial products and institutional business. CCI opts for a verifiable checklist trading off certainty at the cost of requiring more products to comply; the Aave camp focuses only on asset ownership, broadening the scope, but whether it can persuade the SEC remains uncertain.

SEC Commissioner Hester Peirce described vaults as a spectrum in a statement on July 22: one end is fully governed by code, and the other is entirely determined by others. Both documents address the same question: at what point along this spectrum does a vault transform into a security. Aave Labs, Kamino, and Veda have requested meetings with SEC personnel; as of the time of writing, the SEC has not publicly responded.