Tiger Research: SEC Sets Sights on the $25.9 Billion DeFi Market, Regulatory Target is Not Code

This article is written by Tiger Research. A statement by SEC Commissioner Hester Peirce has placed on-chain treasuries and curators under regulatory scrutiny. If the legal logic is fully applied, the impact will extend beyond treasuries to all DeFi products that make investment decisions on behalf of users—a market with a total value locked of $25.9 billion. Regulation will not target code, but it will precisely target the individuals making decisions behind the code.

Key Takeaways

• If the legal reasoning is broadly applied, the impact will go beyond treasuries and curators to extend to all discretionary products, a market with a total value locked of approximately $25.9 billion.
• The SEC will not target code beyond its jurisdiction. It targets the specific operators who exercise decision-making power over the code.
• Compliance-oriented DeFi teams, including Steakhouse Financial and Maple Finance, have long been preparing for this type of regulatory attention.
• Historical precedents show that only two outcomes withstand the test of time: full registration under existing securities laws, or the creation of new exemption provisions through legislation.
• The SEC Targets Decision-Making Power, Not Code

  On July 22, 2026, SEC Commissioner Hester Peirce released a statement titled 'Headstands and Summervaults,' arguing that the Howey Test (a legal standard established by the Supreme Court in 1946) could be applied to on-chain treasuries and lending strategies under existing securities laws.

  The Howey Test evaluates the economic substance of how funds are raised and managed. It requires no new legislation or rulemaking to apply. It is a fact-based standard that can be continuously applied to new financial instruments regardless of their technological form. On-chain treasuries or decentralized lending strategies, no matter how complex their blockchain architecture, may be deemed investment contracts under securities laws if their structure meets the test's three core criteria. When all three are met, the product is classified as a security.

  This statement does not have direct enforcement power, as it represents the views of a single commissioner. However, it marks the first time the emerging regulatory framework of the SEC's Crypto Task Force has been mapped onto a specific product, already causing concern among relevant market participants. The token MORPHO, of the treasury infrastructure protocol Morpho, fell approximately 5% immediately after the statement's release.

  If this legal reasoning is put into practice, the regulatory target will almost certainly not be the smart contracts driving the treasuries. Instead, it will be the risk curators and DeFi participants who have actual decision-making authority over how assets are allocated. The treasury infrastructure built by Morpho is a technological tool for asset management. Code without a controlling party is not a natural target for regulatory sanctions.

  Why Curators Have Become the Target

  Curators decide how much capital within a treasury is allocated where, and the level of risk to which this capital is exposed. In this sense, they possess genuine decision-making power over depositors' assets. The treasury itself is merely the tool curators use to manage these assets. Most treasuries are deployed as smart contracts without admin keys or upgrade capabilities, meaning even the original deployer cannot halt their operation or alter their logic.

  Financial regulation has historically been predicated on the existence of an identifiable legal entity that can be served with a subpoena, have its assets frozen, or comply with an injunction. Immutable code without a controlling party has no such manager.

  The regulatory consequence is that enforcement attention shifts from code to decision-making power. Earlier cases involving Tornado Cash and Uniswap Labs illustrate this pattern.

  The core issue in the Tornado Cash case was whether immutable code constitutes sanctionable property. The Uniswap Labs case questioned whether a company operating a non-custodial interface was effectively acting as an unregistered broker or exchange. Both cases focused on the legal status of code and the act of operating a service. Neither touched on investment decision-making power as a basis for securities liability.

  This time is different. The key question is no longer who built the protocol, but who chooses which assets a depositor's capital is exposed to, how much is allocated to each market, and how interest rate conditions and collateral parameters are adjusted to influence yields. Suppose a curator selects specific lending markets from a wider pool, withdraws capital when risk rises, and shifts weight towards higher-yield markets. Depositors entrust their capital to that curator because they trust their judgment, not the underlying smart contract. Gains and losses flow directly from the curator's decisions. This professional decision-making model exercised on behalf of depositors is precisely the defining characteristic of an investment contract identified by the Howey Test—'an expectation of profits from the efforts of others.'

  Curators are the party that most explicitly exercises this type of decision-making power within the on-chain treasury ecosystem. This is why they are at the center of the regulatory framework.

  Which Categories Will Be Included in the Scope

  If this legal reasoning is broadly applied, the impact will not stop at risk curators. The SEC's analysis focuses on who is making investment decisions on behalf of users.

  Liquid restaking operators decide which validators or Actively Validated Services (AVS) receive asset allocations. Yield aggregators compare yields and risks across lending and liquidity markets and move capital accordingly. On-chain asset allocation services adjust holdings and weights over time. When a specific team or operator continuously makes decisions about asset selection and reallocation, their function is substantially similar to that of a curator.

  Therefore, the relevant scope is broader than the treasury product category itself. Whether a specific service falls within this scope depends on who, within that service, selects assets, changes allocations, and controls exposure to losses. Aggregating potential exposure across categories by this standard results in a total value locked of approximately $25.9 billion.

  The legal standard is unlikely to be applied uniformly across all these participants. Its intensity will vary depending on the structure of the decision-making power involved.

  The highest risk and most stringent regulatory scrutiny will apply to structures where decision-making power is exercised in an opaque manner that depositors cannot verify on-chain in real-time, such as off-chain delegation and under-collateralized lending.

  Moderate risk applies to standard treasury curators and liquid restaking structures, which exercise allocation decision-making power but where capital flows are transparently recorded on-chain and subject to governance mechanisms like timelocks and guardian roles.

  Lower risk, closest to compliance, applies to immutable protocol deployments without a controlling party, and financial products already registered under securities laws.

  Those best able to accurately assess their own legal risk are the operators themselves. This is why curators and adjacent market participants had already begun developing customized responses, including investor qualification restrictions, third-party compliance arrangements, and formal private placement exemptions, before the commissioner's statement was released.

  Four Design Approaches to Reduce Regulatory Risk

  The countermeasures developed so far do not address the fundamental legal issues. They primarily focus on reducing the probability of regulatory application and limiting the legal liability of the operating entity.

  Two analytical dimensions differentiate these approaches: whether a recognized legal exemption has been obtained, and whether actual asset allocation power has changed. Measured against these criteria, the market's current responses fall into four categories.

  Direct Investor Qualification Screening: Pre-verifying and restricting sales exclusively to qualified investors.

  Establishing Regulated Distribution Channels: Distributing through exchanges or regulated entities that have completed user KYC.

  Collateral-Level Whitelisting: Controlling permitted collateral assets by coordinating with asset issuers.

  Structural Separation of Permissioned Lending and Permissionless Yield Tokens: Splitting institutional lending execution from retail-accessible yield exposure.

  4.1 Investor Qualification Screening: Grove and GLDY

  The most direct way to reduce regulatory risk is to control investor eligibility before accepting any capital.

  Steakhouse Financial launched Grove in June 2025 as an institutional-only on-chain capital allocation channel. Access is limited to institutional RWA investors who have passed pre-screening for eligibility.

  Orca partnered with Streamex Corp (Nasdaq: STEX) in May 2026 to open the GLDY pool exclusively to qualified investors. GLDY is a yield-bearing tokenized security backed by physical gold reserves, explicitly issued under the private placement exemption (Rule 506(c) of Regulation D) of US securities laws. Investor accounts have on-chain transfers initially frozen, unlocked only after passing Streamex's KYC and qualified investor verification.

  Both approaches target institutional and qualified investors, establishing a logical basis for using private placement exemptions rather than full public registration.

  However, investor qualification does not eliminate the product's characterization as an investment contract under the Howey Test. Qualified investor status relates more directly to the distribution pathway than to the fundamental question of whether a security exists. This is a practical risk management approach under the current legal framework, not a fundamental change in legal nature.

  The curator's core function of selecting assets and setting allocation weights within the treasury remains unchanged—a structural limitation that these access controls cannot address.

  4.2 Existing KYC and Compliance Infrastructure: Sentora

  Rather than building its own eligibility framework, Sentora combines existing KYC-based distribution channels with regulated asset issuance infrastructure.

  Kraken's DeFi Earn product is the clearest example. Veda provides the treasury infrastructure; Chaos Labs manages the Balanced and Boosted treasuries; Sentora acts as the risk manager for the Advanced treasury, overseeing capital allocation across on-chain protocols and managing risk and liquidity.

  This arrangement was later adopted more broadly. Coinbase, in conjunction with Morpho and Steakhouse Financial, launched USDC lending through Prime and High Yield treasuries. Binance connected its users to Morpho treasuries managed by Steakhouse and Gauntlet.

  Exchange-level KYC confirms user identity, and the issuer's compliance framework supports reserve and redemption structures. Neither addresses who decides which assets and markets receive how much capital. External compliance infrastructure reduces risk at the asset and distribution levels but cannot absorb the regulatory risk or legal liability of the risk manager making allocation decisions.

  

  Figure: Sentora's structure leveraging existing KYC and compliance infrastructure – Users enter via CeFi exchanges (Coinbase/Kraken/Binance), are managed by risk curators like Steakhouse/Sentora/Gauntlet, and are ultimately deployed to lending pools like Morpho. Source: Tiger Research

  4.3 Asset-Level Whitelisting: Aave Horizon

  Aave launched Aave Horizon in August 2025, an institutional RWA lending market. The product is structurally separated from the core protocol and designed to the specifications required for institutional asset management.

  Aave Horizon's unique design choice is to share control over allowed collateral with asset issuers, rather than restricting user access directly at the distribution stage. The whitelist for tokenized collateral assets is managed by the issuers themselves: Circle, Ripple, Superstate, and Centrifuge (including Janus Henderson products). The protocol itself remains permissionless for any wallet holding whitelisted assets.

  The core control is not who accesses the market, but which assets are eligible. Risk parameters follow recommendations from LlamaRisk, and collateral valuations are supported by on-chain NAV data verified in real-time by Chainlink. Aave Horizon is built on top of the existing Aave lending infrastructure, rather than constructing a new chain or independent protocol.

  Sharing verification responsibility with asset issuers does not eliminate Aave Horizon's legal and operational responsibility for its risk parameter decisions.

  

  Figure: Aave Horizon Pool operational structure – Tokenized RWA such as treasury bills, stocks, and private credit enter a shared stablecoin pool as collateral, with issuers managing the whitelist, LlamaRisk responsible for risk parameters, and Chainlink NAV providing price data. Source: Tiger Research

  4.4 Structural Separation of Permissioned Lending and Permissionless Yields: Maple Finance

  In April 2024, Maple Finance converted its entire platform to a whitelist structure. All loans are now fully over-collateralized, and Maple Direct (its internal credit team) directly performs borrower due diligence, ongoing monitoring, and margin calls. Access is restricted to approved institutional borrowers and lenders.

  The most notable aspect of Maple's design is the separation between the permissioned lending operation and permissionless yield access. In 2024, Maple launched the Syrup protocol, allowing retail users to deposit USDC and receive SyrupUSDC without KYC. These deposits flow into the same institutional lending pools already managed by Maple Direct and its qualified borrowers. Lending itself operates under strict institutional compliance. The yield rights generated from lending are packaged into permissionless tokens accessible to any user.

  This structure repositions regulatory risk rather than eliminating it. Maple Direct's due diligence and management discretion (including borrower selection, collateral terms, and margin calls) remain unchanged. The arrangement where institutional lending returns are passed to SyrupUSDC holders creates new questions about whether that token constitutes an investment contract under the Howey Test, and separate distribution liabilities.

  The structural separation of permissioned lending and permissionless yields is a deliberate repositioning of where regulatory scrutiny falls. It does not change the legal liability of the entity managing the capital or the fundamental nature of the product.

  

  Figure: Maple's separation structure of permissioned lending and permissionless yield tokens – Retail users deposit USDC via Syrup to receive SyrupUSDC, while Maple Direct performs due diligence, monitoring, and margin calls on institutional borrowers. Source: Tiger Research

  The above cases involve different regulatory touchpoints but share a common limitation. They are operational defense structures designed to manage regulatory risk by separating investors, assets, and distribution channels. They are not final solutions for eliminating legal risk.

  According to the two analytical dimensions introduced earlier:

  One approach obtained a clear legal exemption: the Orca/GLDY structure, directly applying Regulation D Rule 506(c).

  The remaining approaches manage and limit regulatory risk: Grove, Sentora, Aave Horizon, and Maple Finance, through a combination of institutional eligibility restrictions, third-party compliance infrastructure, and collateral whitelisting.

  Restricting distribution and screening eligibility does not resolve the potential legal liability attached to the discretionary asset selection and allocation decisions made by the curator or protocol.

  5. History Shows What Works

  The future of the on-chain asset management market will not be determined by the superficial appearance of code, but by the institutional frameworks established to manage the scope of discretion, transparency of disclosure, and allocation of legal liability.

  The measures examined above reduce immediate regulatory risk and provide space for using existing private placement exemptions. They do not answer the fundamental questions of the standards governing curators' allocation decisions and who bears responsibility when losses occur.

  The historical record is consistent on one point: access restrictions alone have not produced lasting institutionalization.

  In the closed-end funds of the 1920s and 1930s, the 'blind pool' structure was widely abused, with managers failing to disclose their investment objectives. The Investment Company Act of 1940 addressed this not by restricting access, but by institutionalizing the asset management function itself.

  In 2008, when the SEC determined that LendingClub's peer-to-peer loan notes were securities, the company suspended new registrations and re