Does DeFi Lending Count as a Security? Aave and Morpho Camps Deliver Two Different Answers

Written by Sanqing, Foresight News

On November 2, Aave Labs, Kamino Foundation (the foundation behind the Solana lending protocol Kamino) and vault infrastructure provider Veda Tech Labs published a 16-page legal framework summary, arguing that decentralized lending protocols and non-custodial vaults are not subject to federal securities law. Before that, on October 26, the three parties had already submitted a more detailed confidential version to the U.S. Securities and Exchange Commission's (SEC) Crypto Task Force and Division of Corporation Finance, and requested a meeting with SEC staff.

Earlier, the crypto industry advocacy group Crypto Council for Innovation (CCI) published a roughly 238-page vault report, "Under Control," in October. The report was driven by a vault coalition led by Morpho, Bitwise and Galaxy, and written by law firm Chapman and Cutler.

The two documents point in the same broad direction: in ordinary overcollateralized lending, depositors are not buying securities. The real disagreement is whether a vault still counts as a security when a manager decides where the funds go on the user's behalf.

Consensus

Both documents take as their reference point the centralized lending platforms the SEC pursued over the past few years. At platforms such as BlockFi and Celsius, users surrendered ownership the moment they transferred tokens; the platform commingled the funds, decided lending and investment directions itself, and promised to repay principal plus interest at an agreed rate. Whether users could get their principal back depended entirely on the platform's business condition.

In 2022, the SEC determined that BlockFi's interest-bearing accounts were securities, and the company paid $100 million to the SEC and multiple states to settle; after Celsius went bankrupt, a court ruled, based on the user terms, that the platform owned the deposited assets, leaving users to line up as ordinary creditors.

On-chain lending works differently. When a user deposits USDC into Aave, the funds stay inside a smart contract, and no company takes ownership; borrowers must first deposit collateral worth more than the loan, and once the collateral's value falls below the liquidation line, third parties step in to liquidate; interest rates are calculated automatically by a public formula based on pool utilization, and every position can be verified on-chain. No one promises a return, and no one can misappropriate the funds.

On this basis, both documents conclude that ordinary overcollateralized lending is not a security.

However, the two sides' arguments under the Reves Test differ slightly:

• The Aave camp argues that deposits do not create a "note" at all; and even if they were treated as notes, they would not be a security when measured against the court's four factors.
• CCI instead puts vault share tokens through the Howey Test, and asks the SEC only to confirm that the underlying lending positions are "commercial loans," which courts have historically not treated as securities. It also acknowledges that, under the Reves Test, the facts that anyone can deposit in an open market and that there is no bank regulatory backstop would make lending positions look more like securities, but holds that overcollateralization, automatic liquidation and on-chain transparency are enough to offset this.

Beyond the consensus, the divergence stems from different starting points: the Aave camp starts from lending protocols and worries most that DAO parameter adjustments will be treated as "running things on investors' behalf," when in its view this is merely maintaining market rules; CCI starts from vaults and wants to define how far a manager's authority can go before the vault becomes a fund.

The divergence

In today's DeFi lending market, more and more capital no longer goes directly into public pools like Aave, but first enters "vaults," where professional managers allocate it across lending markets. The on-chain yield products on Coinbase, Kraken and Robinhood all sit on top of such vaults.

Consider a scenario: a user deposits $1 million in USDC into a vault, and the manager moves the funds among several lending markets each week depending on interest rates. Regulators need to answer: is this user effectively buying a fund? If so, the vault is a security, and the entity behind it must register with the SEC, disclose information and accept supervision like a fund company.

Four main legal standards guide the judgment:

1. Howey Test (established by the U.S. Supreme Court in 1946): an investment of money in a common enterprise with an expectation of profit derived from the efforts of others constitutes an "investment contract" (a security).
2. Reves Test: in the lending context, whether the arrangement constitutes a "note" issued by someone who promises to repay.
3. Investment Company Act of 1940: defines whether a vault would be treated as a fund.
4. Investment Advisers Act of 1940: defines whether the manager needs a license.

CCI's criteria

CCI's argument focuses on the "efforts of others" prong of the Howey Test, breaking the question down from both sides: on the manager's side, whether authority is hard-coded in the code; on the user's side, whether users can understand the strategy, trace where the funds go on-chain, learn of changes in advance and exit in time. The report distills this into 10 conditions that can be checked against the code one by one:

1. No party with authority (including its affiliates) may move user assets anywhere other than where the code permits;
2. User redemption does not depend on anyone's cooperation, and users can redeem at any time or on a pre-announced cycle;
3. Vault assets are held separately from the own assets of the manager or any other party with authority, and each user's share is recorded on-chain;
4. Key parameters affecting where funds go are either immutable after deployment or can only be changed through a procedure defined in the code;
5. Retained modification authority must be subject to a time lock and advance public notice, and must give users an exit window before it takes effect; adjustments that only narrow user risk exposure (such as lowering caps or shrinking whitelists) may be exempted, but must be disclosed;
6. After deposit, no one may allocate funds at their own discretion; execution may only follow immutable code or preset objective parameters;
7. Roles responsible for protective functions — pausing the vault, vetoing pending operations, and the like — must be independent of the manager and may act only on preset objective conditions, cannot decide where funds go or affect yield, and other management functions must require multi-party authorization;
8. The code must be independently audited before deployment and after major upgrades, with reports made public, and positions, permissions and pending changes must be continuously verifiable on-chain;
9. No party with authority may direct funds to a platform in which it has an undisclosed material interest;
10. Assets that cannot be verified on-chain must be held by a qualified custodian, and this boundary must be disclosed.

CCI holds that a vault fully satisfying these 10 conditions should not be treated as a security. If the manager can only choose among a few markets preset in the code, and any change is announced in advance with time left to exit, it is more like operating a transparent machine, and such a vault is not a security.

But in the scenario above, if the manager can rebalance at will without public notice, and the risks of the markets differ enormously (for example, some accept only major assets as collateral while others accept small-cap tokens), the user's gains and losses depend mainly on the manager's market choices. At that point the user is in substance handing the money to someone else to manage, with returns dependent on the manager's judgment — no different from a fund.

By CCI's criteria, such vaults would likely be subject to securities law: either register with the SEC under the requirements for securities or even funds, or apply for the exemption CCI has designed. But CCI leaves some room: if the markets have similar risk and rebalancing only shifts a tiny spread, the manager's judgment may not rise to the "efforts of others" that is key to the Howey Test, and the vault may not constitute a security.

The Aave camp's criteria

The Aave camp's argument focuses on the "common enterprise" prong of the Howey Test and on the Reves Test. In their view, securities law governs "giving money to someone else to run with a promise of return." In a vault, ownership of the funds always remains with the user, who holds by shares; the manager can issue rebalancing instructions but cannot touch the funds, and no one promises principal or interest. So there is neither a "note" under the Reves Test, nor a "common enterprise" binding users together.

The Aave camp acknowledges that active rebalancing by a manager may satisfy "efforts of others," but the Howey Test requires all conditions to hold at the same time; since there is no "common enterprise," a vault is not a security. Likewise, because there is no entity that owns the underlying assets and issues shares to the public, a vault does not qualify as a fund as defined by the Investment Company Act. The document gives an example: even if 80% of a vault's assets were tokenized stocks, no such issuer could be found.

This conclusion rests on explicit design premises: the manager can only allocate funds within preset ranges and cannot unilaterally expand its authority immediately; major changes to investable strategies and permission controls must be approved by an independent party and subject to a time lock, ensuring users have a chance to exit before they take effect.

As for the manager itself, the Investment Advisers Act only governs "advice about securities." If the vault lends stablecoins and the lending positions are not securities, rebalancing does not constitute securities advice; only when a vault allocates securities assets such as tokenized stocks and charges a fee might the manager need to register as an investment adviser and comply with existing rules such as performance fees.

A traditional-finance example makes this easier to follow. Suppose you keep 1 million yuan in your own stock account and authorize a financial adviser to buy and sell on your behalf.

CCI looks at the adviser's authority: if he can move your money from stable blue chips into high-risk small caps without telling you, how much you earn basically depends on his judgment, which is essentially the same as buying a fund and should be regulated as one; if he can only rebalance among a handful of stocks you approved in advance, with notice each time and a chance for you to pull out first, then you are not really handing him the money to run.

The Aave camp looks at who owns the money: the stocks remain registered in your own name, are not commingled with other clients' money, and the adviser has no power to transfer the funds away; as long as his authority stays within the agreed scope, your account does not become a fund even if he rebalances actively. Whether the adviser himself needs a license is a separate question.

On this basis, the two sides made very different requests to the SEC. The Aave camp asks only that the SEC confirm that, under current law, such lending protocols and vaults were never securities and need no exemption at all.

CCI accepts the reality that some vaults may be treated as funds and has designed an exit in advance: drawing on the path of ETFs, from case-by-case exemptive applications to a unified rule in 2019, it asks the SEC to provide an exemption roadmap for vaults, one condition of which is designating a specific company as the "compliant entity," responsible for dealing with the SEC, fulfilling reporting obligations and bearing responsibility when problems arise.

The cost

In the simplest scenario, the two sides agree: a lending market with hard-coded parameters that no one can change is not a security. The disagreement centers on the "middle ground" where the manager or governance retains some modification authority — and that is exactly where the vast majority of vaults and lending protocols sit today.

Aave itself is a typical example. Aave's interest rate models, collateral ratios and liquidation lines are all adjusted by DAO votes, with public notice and a time lock before changes. Measured against CCI's 10 criteria, as long as there is a time lock and users can exit before it takes effect, Aave still meets the conditions for being spared treatment as a security.

But the underlying logic of the CCI framework is that "the less room for human changes after deposit, the less it looks like a security." If the SEC reasons along these lines, the more active a protocol's governance, the more easily it is deemed that "someone is running things on investors' behalf," and thus the more likely it falls under securities law. For this reason, the Aave camp specifically asks the SEC to make clear that whether a protocol is upgradeable and whether ongoing governance exists should not be grounds for finding a security.

Each approach has its costs:

• The CCI approach: a concrete checklist that can be verified item by item, proactively delineating the regulated cases, and friendlier to institutions eager to know the compliance boundary; the cost is a narrower safe harbor, and the more rebalancing authority a manager has, the harder the product is to qualify.
• The Aave approach: draws a broader carve-out from securities law; the cost is that it must persuade the SEC to accept the broad proposition that "active management does not equal a security." If that is not adopted, the document only states that managers must follow existing investment adviser rules, and leaves no compliance path for vaults that are found to be securities or funds.

The business

The two documents draw their lines differently, and that is directly tied to the signatories' businesses. As of publication, according to DefiLlama, Aave's total value locked (TVL) is about $16.20 billion with about $11.72 billion in outstanding borrows; Morpho about $11.09 billion and $5.78 billion; Kamino about $1.26 billion and $820 million.

Most of Aave's deposits remain in the public V3 pools, with rules set uniformly by the DAO and no manager picking markets for users; its biggest fear is that DAO parameter adjustments will be treated as "running things on investors' behalf." On the institutional side, Aave's permissioned market Horizon lets qualified institutions pledge tokenized Treasuries and other assets to borrow stablecoins; according to DefiLlama, deposits currently stand at about $294 million, down from a peak of about $638 million in mid-January this year.

But V4 is already bringing in managers: the first external manager, Sentora, went live in October, able to set collateral, risk parameters and interest rate curves itself, with risk-increasing changes subject to a 48-hour time lock. According to the Aave Pro page, V4 deposits have exceeded $1.7 billion. Going forward, Aave will likewise have to face the question of whether external managers constitute investment advisers.

Morpho's business, by contrast, is built directly on managers: it only provides lending markets, leaving market selection and exposure setting to managers, whose vaults then distribute to exchanges and fintech companies. According to Morpho's October 29 disclosure, assets run by managers grew from zero to more than $11 billion in two years; the yield products built on Morpho vaults at Coinbase and Robinhood each surpassed $500 million in deposits in September.

Among CCI's three lead institutions, Bitwise and Galaxy are both managers on Morpho. For them, a checklist that spells out "meet these conditions and you are not a security," even if it means more constraints, is more practical than a broader claim whose adoption by the SEC is uncertain.

Kamino's alignment is intriguing. Its V2 is likewise split into a market layer and a vault layer, with managers such as Steakhouse, Re7 Labs and MEV Capital dynamically rebalancing across multiple markets — a model almost identical to Morpho's.

Under CCI's checklist, such vaults would need to be reviewed one by one; under the Aave camp's standard, as long as the assets belong to users and authority is bounded by preset ranges and time locks, it is not a security — yet Kamino chose the latter.

Veda is in a similar position. It provides multi-protocol vaults for products such as Kraken DeFi Earn, with deposits already above $600 million, and likewise needs to rebalance with the market, making it hard to satisfy CCI's condition that there be no discretionary allocation after deposit.

But the two camps are not cleanly separated. Sentora manages more than $1 billion on Morpho, provides risk management for Veda vaults, and is Aave V4's first external manager; Galaxy operates vaults on both Morpho and Kamino. Whichever line the SEC adopts, these managers will be affected.

Overall, the two documents do not disagree on ordinary on-chain overcollateralized lending; the dispute is mainly about vaults where a manager rebalances on users' behalf, which is precisely the mainstream model behind exchanges' on-chain yield products and institutional business. CCI trades a verifiable checklist for certainty, at the cost of more products having to comply; the Aave camp looks only at asset ownership, a broader scope, but whether it can persuade the SEC remains uncertain.

SEC Commissioner Hester Peirce, in a July 22 statement, described vaults as a spectrum: at one end, allocation is entirely determined by code; at the other, entirely at the discretion of others. Both documents answer the same question: how far along that spectrum can a vault go before it becomes a security? Aave Labs, Kamino and Veda have requested a meeting with SEC staff; as of publication, the SEC has not publicly responded.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps