Why Are Aave, Veda and Kamino Challenging the SEC's DeFi Vault Securities Framework?

Why Are Aave, Veda and Kamino Challenging the SEC's DeFi Vault Securities Framework?

Custom Image
Aave Labs, Kamino Foundation, and Veda Tech Labs are asking the U.S. Securities and Exchange Commission (SEC) to clarify how federal securities laws apply to decentralized lending protocols and non-custodial DeFi vaults. In a legal framework submitted on October 26 and summarized publicly on November 2, 2026, the three organizations argue that supplying assets to decentralized lending markets or borrowing against personal collateral does not automatically constitute a securities transaction.
 
The submission comes amid growing debate over whether yield-generating DeFi products should be regulated like traditional investment funds. At the center of the disagreement is a fundamental question: should regulatory treatment depend on the actual rights and responsibilities established by a protocol, or on the degree of control exercised by individuals managing deposited assets? The SEC's eventual position could influence the development of decentralized lending, yield vaults, and institutional on-chain asset management.

Key Takeaways

  • Aave, Veda, and Kamino submitted a joint legal framework to the SEC seeking clearer treatment of decentralized lending and non-custodial vaults.
  • The organizations argue that ordinary DeFi lending does not automatically constitute a securities transaction, particularly when users interact with transparent, code-governed markets.
  • The Howey and Reves tests are central to the debate, determining whether certain arrangements may qualify as investment contracts or securities-related debt instruments.
  • The proposal distinguishes automated protocol operations from discretionary investment management, particularly when vault curators can independently allocate assets.
  • The SEC has not approved the proposed framework or granted a general exemption to DeFi vaults, leaving individual products subject to fact-specific legal analysis.

Why Are Aave, Veda and Kamino Challenging the SEC's DeFi Vault Securities Framework?

Aave, Veda, and Kamino are seeking regulatory clarity because existing securities laws were largely developed around identifiable issuers, intermediaries, investment managers, and contractual relationships. DeFi protocols distribute some of these functions across smart contracts, governance systems, liquidity providers, and independent developers. The three organizations argue that regulators should examine the actual rights, obligations, and powers established by these arrangements instead of automatically treating yield-generating products as investment contracts.
 
On November 2, Aave Labs published a summary of the legal framework submitted to the SEC's Crypto Task Force and Division of Corporation Finance on October 26. The submission addresses two activities: supplying digital assets to decentralized lending protocols and borrowing against assets users already own. Its central argument is that these activities do not automatically satisfy the requirements of federal securities laws when conducted through the types of decentralized structures described. The organizations also requested engagement with SEC staff to discuss their legal analysis.
 
The proposal is significant because it focuses on the underlying lending infrastructure rather than examining only the yield products built on top of it. A lending protocol establishes the market through which assets are supplied and borrowed, while a vault can allocate deposits across multiple markets according to a particular strategy. The legal treatment of the underlying lending activity may therefore influence how regulators evaluate the vaults that use it. However, the submission represents an industry position, not a binding regulatory interpretation or an SEC determination.

How Do DeFi Lending Protocols and Vaults Differ?

DeFi lending protocols and vaults both allow users to deploy digital assets into on-chain financial activities, but they perform different functions. A lending protocol establishes the rules through which suppliers provide assets and borrowers obtain liquidity. A vault adds another layer by organizing deposits and allocating them according to predefined strategies or authorized management decisions.
 
In a typical decentralized lending market, a user supplies an asset such as USDC or ETH to a smart-contract-based pool. Borrowers obtain liquidity by providing collateral, often at a value greater than the amount borrowed. Interest rates generally respond to market utilization and protocol parameters, while collateral requirements and liquidation mechanisms help manage credit exposure. Suppliers may receive interest based on borrowing demand, but returns are variable and depend on market conditions rather than a guaranteed payment from a conventional investment manager.
 
A DeFi vault can allocate deposited assets across lending markets, liquidity pools, or other strategies. Some vaults rely primarily on automated rules, while others allow curators to select markets, adjust allocation limits, or modify strategies. This distinction is important because the regulatory analysis may depend on whether an individual exercises meaningful discretion over deposited assets or simply performs functions constrained by code and previously authorized rules.

What Legal Arguments Are Aave, Veda and Kamino Presenting to the SEC?

The joint framework applies existing U.S. securities-law principles to decentralized lending and non-custodial vault structures. Its central argument is that regulators should examine the actual transaction and the legal relationships it creates rather than assuming that supplying assets to a protocol is equivalent to purchasing an investment product. Four areas are particularly important: investment contracts, securities-related debt instruments, investment companies, and investment advisers.

  1. The Howey Test: Does DeFi Lending Create an Investment Contract?

Established in the 1946 Supreme Court case SEC v. W.J. Howey Co., the Howey Test examines whether an arrangement involves an investment of money in a common enterprise with a reasonable expectation of profits derived from the essential managerial efforts of others.
 
Aave's argument focuses on the common-enterprise and managerial-efforts elements. In the lending structures described, suppliers make assets available to an open market, while borrowers independently obtain liquidity after providing collateral. Interest is determined through published market rates, and one supplier's return does not necessarily depend on the investment performance of another supplier. The organizations therefore argue that sharing infrastructure and market pricing does not automatically create a common investment enterprise.
 
They also distinguish protocol governance from investment management. DAO participants may establish supported assets, collateral requirements, interest-rate models, and liquidation parameters. According to the framework, these activities maintain the market's operating rules rather than directing individual users' assets or promising investment returns. Nevertheless, the Howey Test requires a fact-specific analysis, and the absence of a centralized manager does not automatically exclude every DeFi arrangement from securities regulation.

  1. The Reves Test: Are Lending Positions Securities Notes?

The Reves Test, established in Reves v. Ernst & Young (1990), helps determine whether certain notes or debt instruments qualify as securities under federal law. This is relevant because supplying and borrowing assets through a DeFi protocol does not necessarily create the same legal relationship as a conventional corporate debt issuance.
 
Aave's framework argues that the lending structures it describes do not involve an entity issuing a note or promising to repay depositors. Instead, suppliers make assets available under market rules, and borrowers obtain liquidity after providing collateral. The protocol itself does not necessarily assume a conventional repayment obligation toward suppliers. The organizations therefore argue that these arrangements should not automatically be classified as securities notes.
 
However, receipt tokens and other instruments issued by vaults may require separate analysis. Their legal characteristics depend on the rights they represent, the obligations attached to them, and the surrounding contractual arrangements. The absence of a conventional promissory note at the lending-protocol level does not automatically resolve the legal status of every instrument built on top of it.

  1. The Investment Company Act: Does a Vault Operate Like an Investment Fund?

The Investment Company Act of 1940 regulates qualifying investment companies, including certain entities that pool investor assets and invest primarily in securities. The relevant question for DeFi vaults is whether a structure constitutes an identifiable investment company or issuer that holds and manages pooled assets on behalf of investors.
 
Aave's position is that a non-custodial vault does not automatically become an investment company simply because multiple users interact with the same smart contract. Its framework emphasizes users' ownership interests and the limitations placed on curators. If no separate entity operates as an investment company or independently manages pooled assets, the traditional investment-company analysis may apply differently.
 
This argument depends heavily on the vault's design. A structure that pools assets under discretionary management, invests in securities, or gives an identifiable operator substantial authority may present different legal questions. The organizations are not claiming that every vault is outside the Investment Company Act; they are asking regulators to evaluate actual ownership, control, and management relationships.

  1. The Investment Advisers Act: When Does a Curator Become an Investment Adviser?

The Investment Advisers Act of 1940 regulates qualifying persons who provide securities investment advice as a business for compensation. This makes curator authority one of the most important issues in the regulatory debate.
 
Aave's framework acknowledges that a curator who receives compensation for making substantive investment decisions involving securities may fall within the statutory definition of an investment adviser. However, it distinguishes those activities from limited administrative operations performed under rules approved by users in advance. A participant who adjusts predefined parameters or carries out authorized functions does not necessarily perform the same role as a discretionary investment manager.
 
The distinction between advisory authority and custody is particularly important. A curator may influence asset allocation without holding private keys or possessing the technical ability to transfer user assets. Aave argues that code-enforced limitations should be considered when evaluating the curator's legal responsibilities. Nevertheless, the absence of direct custody does not automatically remove investment-adviser obligations if the person otherwise satisfies the statutory definition.

How Does Aave's Proposal Differ From the CCI Control Framework?

Aave's submission is part of a wider industry debate over how the SEC should evaluate DeFi vaults. On October 29, 2026, the Crypto Council for Innovation (CCI) published a 238-page report titled Under Control: A Framework for Applying the Federal Securities Laws to Crypto Vaults. Developed through its Vault Coalition, the report includes participation from industry organizations such as Bitwise, Galaxy, and Morpho. Both initiatives seek a fact-specific regulatory approach, but they emphasize different aspects of asset control and investment management.
 
CCI proposes a Two-Sided Control Framework that examines both the authority retained by curators and the practical control available to depositors. On the management side, it evaluates four dimensions: Mandate, Execution, Governance, and Disposition. On the depositor side, it considers whether users can understand, verify, observe, and predict vault operations, receive notice of changes, and take meaningful action, including withdrawing their assets. Its central question is whether smart-contract architecture sufficiently limits discretionary control and reduces investor reliance on human management.
 
Aave, Veda, and Kamino place greater emphasis on the legal relationships created by decentralized lending, including ownership rights, market rules, and the distinction between governance and investment management. They argue that human participation does not automatically create an investment contract or managed investment product. The two approaches are not completely opposed: both recognize that substantial discretionary investment management may trigger regulatory obligations. Their main difference concerns how much weight regulators should assign to post-deposit control compared with the legal nature of the underlying transaction.
Comparison Aave, Veda and Kamino CCI Control Framework
Main focus Legal nature of lending and non-custodial vault transactions Control retained after deposits
Key question Does the arrangement create a regulated investment relationship? Can curators materially influence assets or outcomes?
Human participation Bounded administration does not automatically equal investment management Material discretionary control strengthens the case for regulation
User protection Ownership, transparent rules, and limits on asset direction Verifiability, notice, and actionable withdrawal rights
Regulatory objective Apply existing law to actual legal relationships Match regulatory treatment to control and investor reliance
The distinction matters because a vault can be non-custodial while still involving substantial investment discretion. Similarly, a DAO can govern market parameters without necessarily managing individual users' investments. Regulators may therefore need to assess the responsibilities of curators, developers, governance participants, and protocol operators separately rather than treating an entire DeFi ecosystem as a single legal actor.

What Is the SEC's Position on DeFi Vault Regulation?

The SEC has not endorsed Aave's proposal or adopted a blanket exclusion for decentralized lending and non-custodial vaults. However, the agency's recent policy discussions indicate that crypto vault regulation has become an active area of regulatory consideration. The distinction between a digital asset, an investment contract, and the activities of a person managing assets remains central to the debate.
 
In March 2026, the SEC published an interpretation addressing how federal securities laws apply to certain crypto assets and related transactions. The interpretation highlights an important distinction: whether a digital asset itself is a security is different from whether an arrangement involving that asset constitutes an investment contract. An asset that does not independently qualify as a security may still be involved in a securities offering or transaction if the relevant legal requirements are satisfied. This distinction is particularly important for DeFi products, where the asset, transaction, and protocol may have different legal characteristics.
 
The agency's engagement with the industry also predates the latest submissions. SEC Commissioner Hester Peirce discussed crypto vaults and lending strategies in July 2026, while Chairman Paul Atkins previously highlighted the need for greater clarity around vault-related securities and investment-adviser requirements. CCI's October report and the joint Aave, Veda, and Kamino submission respond to this broader policy discussion. Nevertheless, inviting industry input is not equivalent to adopting a rule, and neither submission establishes a binding regulatory standard.

How Could SEC Regulation Affect the DeFi Industry?

The SEC's eventual approach could influence how lending protocols, vault developers, curators, and institutional participants structure their operations. A clearer distinction between automated financial infrastructure and discretionary investment management could reduce uncertainty for developers while establishing more predictable expectations for products that retain substantial human control.
 
For lending protocols, recognition that ordinary decentralized lending does not automatically constitute a securities transaction could help clarify the obligations associated with transparent, code-governed markets. However, this would not eliminate all compliance requirements. Protocols that support tokenized securities or involve regulated intermediaries may raise different legal questions from those that facilitate collateralized borrowing involving other digital assets.
 
Vault developers may also reconsider curator permissions, withdrawal mechanisms, and smart-contract controls. If regulators place greater emphasis on post-deposit discretion, projects may introduce clearer allocation limits, public timelocks, and more transparent administrative permissions. Institutional investors could also benefit from more consistent legal standards when evaluating custody, governance, and compliance risks. However, regulatory clarity alone cannot guarantee increased capital inflows or remove market and technical risks.

What Risks Remain Even If a DeFi Vault Is Not Classified as a Security?

A DeFi vault falling outside a particular securities-law requirement does not mean that it is risk-free or exempt from every other legal obligation. Securities classification and technical or financial risk are separate issues. Users may still face losses from smart-contract vulnerabilities, market volatility, insufficient liquidity, governance failures, and the actions of third-party service providers.
 
Smart-contract risk is one of the most direct concerns. A vulnerability in a vault, lending protocol, or external integration can expose deposited assets to unauthorized transactions or unexpected behavior. Oracle failures can also produce inaccurate collateral valuations, potentially triggering liquidations or allowing borrowers to access liquidity under incorrect conditions. These risks remain relevant regardless of whether a product is considered a security.
 
Users should also examine the authority of curators, governance participants, and administrators. A vault may be described as non-custodial while still allowing authorized participants to change allocation parameters or pause withdrawals under specified conditions. Before depositing assets, users should understand withdrawal rules, allocation strategies, emergency permissions, and the risks associated with underlying lending markets.

What Should Investors and DeFi Developers Watch Next?

The next stage of the debate will depend on whether the SEC engages with the two industry proposals and how its staff interprets existing securities laws in relation to different vault structures. Aave, Kamino, and Veda have requested discussions with SEC staff, while CCI has submitted a broader analysis covering the Securities Act, Investment Company Act, and Investment Advisers Act. Any subsequent staff guidance, public statement, or formal rulemaking could help clarify which product features are most relevant to regulatory treatment.
 
For developers, the most important issues include curator authority, code-enforced restrictions, receipt-token rights, and whether users can withdraw assets before material strategy changes take effect. For investors, attention should remain on disclosures concerning asset ownership, withdrawal rights, administrative permissions, and the legal status of underlying instruments. These factors help distinguish automated lending infrastructure from arrangements that depend on ongoing investment decisions by identifiable managers.
 
The SEC's response may also influence whether the industry moves toward standardized vault documentation and more clearly defined compliance responsibilities. However, no confirmed deadline for a final decision on the joint submission has been established. The most meaningful development will be whether the regulator provides guidance that can be applied consistently without treating all smart-contract-based financial activities as legally identical.

Conclusion

Aave Labs, Kamino Foundation, and Veda Tech Labs are asking the SEC to clarify how existing securities laws apply to decentralized lending protocols and non-custodial vaults. Their October 26 submission, publicly summarized on November 2, argues that supplying assets to open lending markets or borrowing against personal collateral does not automatically create an investment contract or securities transaction. The framework emphasizes user ownership, transparent protocol rules, limited asset-control powers, and the distinction between market governance and discretionary investment management.
 
The proposal also arrives alongside CCI's broader Control Framework, which places greater emphasis on post-deposit control and investor reliance. Together, these submissions highlight an important question for the cryptocurrency industry: should regulatory treatment depend primarily on the legal relationships created by a transaction, or on the practical control that managers retain over deposited assets? The SEC has not adopted either framework, and individual products will continue to require fact-specific legal analysis. Its eventual approach could nevertheless influence the development of DeFi lending, yield vaults, and institutional on-chain financial services.

FAQs

What is a DeFi vault?

A DeFi vault is a smart-contract-based system that accepts digital-asset deposits and deploys them according to predefined rules or an authorized strategy. Depending on its design, a vault may allocate assets to lending markets, liquidity pools, or other on-chain activities to generate variable returns.

Why did Aave, Veda and Kamino submit a framework to the SEC?

The three organizations want clearer guidance on whether decentralized lending transactions and non-custodial vault activities fall under federal securities laws. They argue that regulators should consider asset ownership, contractual relationships, smart-contract rules, and the actual authority retained by third parties.

What is the Howey Test in cryptocurrency regulation?

The Howey Test is a U.S. Supreme Court legal standard used to determine whether an arrangement constitutes an investment contract. It examines whether there is an investment of money in a common enterprise with a reasonable expectation of profits derived from the essential managerial efforts of others.

Does a non-custodial DeFi vault automatically avoid SEC regulation?

No. Non-custodial design does not automatically exclude a vault from securities laws. Its legal treatment depends on the assets involved, the rights granted to users, the powers retained by curators, and whether the arrangement satisfies relevant statutory requirements.

What is the difference between Aave's proposal and CCI's Control Framework?

Aave, Veda, and Kamino emphasize the legal nature of decentralized lending transactions, user ownership, and the distinction between governance and investment management. CCI focuses on the control retained by curators after deposits and whether users can understand, verify, observe, and exit their positions.
 
Disclaimer: This general market information, possibly from third-party, commercial, or sponsored sources, is provided for reference and educational purposes only and does not constitute financial or investment advice, an offer, solicitation, or guarantee. We disclaim liability for its accuracy, completeness, reliability, and any resulting losses. Investments/trading are risky; past performance doesn’t guarantee future results. Users should research, judge prudently, and take full responsibility. For further details, please consult KuCoin’s Terms of Use and Risk Disclosure.