Today Veda, Kamino, and Aave Labs are publishing a public summary of a legal framework for decentralized lending protocols and non-custodial vaults. On October 26, the three organizations submitted a detailed, confidential version to the SEC's Crypto Task Force and Division of Corporation Finance and asked to meet with staff. The public version is here.
The paper answers the following question:
Do the federal securities laws apply when a user supplies an asset to a decentralized lending protocol, or borrows against its own collateral?
For the protocols the paper describes, the answer is no. The paper explains why, step by step, and explains at each step which facts the answer depends on.
Start with the decentralized lending protocol layer. Most of the regulatory conversation about DeFi has been about products built on top of lending protocols, including vaults. Aave Labs wanted the analysis to start one layer down, with the protocol itself, which is the “base layer” for vaults. If the base layer were treated as a securities issuer, every vault would inherit securities law obligations. The paper therefore takes lending protocols as they actually operate today: open markets, governed by their own communities, with real governance powers over markets in place.
No lender, no loan, no promise. Securities laws are built around a promise. A company takes your money and promises you a return, and the law makes that company disclose, register, and answer for their promise. A decentralized lending protocol has no such promise anywhere in it. A user makes its own assets available to a market and keeps control of its position throughout. Another user draws assets once the protocol values collateral it has posted from its own assets. Neither owes the other, or anyone else, anything, and no company stands in between or takes anyone’s assets. There are no legal relationships created by protocol use. The paper does not describe these transactions as loans; it explains why they are not debt at all. The securities laws protect investors by regulating the people who make promises to them. Where no one makes a promise and no one holds another person’s assets, users are protected instead by open rules, public code, and the ability to leave at any time.
Governance is administration, not management. This is the point that matters most for Aave and for protocols governed by a DAO. Tokenholders list assets, adopt interest-rate models, and set collateral and liquidation parameters. That is what a market's rulebook does. The DAO selects nothing on a supplier's behalf, directs no one's assets, and cannot touch what users have supplied. Changes take effect only after public notice and a timelock, so users can leave before a change applies to them. If governance stopped acting tomorrow, the markets would keep running under the then existing rules. The paper asks the SEC to recognize that public, time-locked governance of market rules is administration of a market, not the promises relied upon by investors, and that a protocol does not have to be frozen in place, or stripped of its community, to stay outside the securities laws. The alternative, in which the more open and accountable a market's governance is the more exposed it becomes, would be the wrong result for users and for the law.
Common enterprise, answered rather than conceded. Every version of the Howey test requires a common enterprise, and the SEC’s 2026 Interpretation confirms this element must be separately satisfied rather than assumed. The paper meets the question directly. A supplier to a lending protocol finances no one and nothing. Borrowers draw against liquidity provided for their own purposes. Interest is credited at a published rate per unit, so no supplier's return depends on any other supplier. Suppliers share infrastructure and a price. They do not share the fortunes of an enterprise. The recent decision in Aguilar v. Baton Corp. applies the same reasoning to a shared smart contract, and supports that there is no common enterprise under the circumstances of the protocols.
The transaction, not the token. Some protocols issue a receipt token when a user supplies an asset. Others record the position in their own accounting without issuing a token. The user's rights are identical either way. The paper asks the SEC to classify the transaction and treat any token as evidence of it, so that two identical positions are not treated differently merely because one includes a token.
A vault holds your assets; it does not own them. Many users reach lending markets through non-custodial vaults, which deploy deposited assets either under a strategy fixed in code or under a curator with code-limited authority. The paper reaches the same answer for them, by a different route. In vault transactions, no one promises to repay anyone, so there is no note. Users keep ownership of their share of the vault’s assets, and a curator cannot take or redirect them, so holding positions together is administration, not a shared enterprise. A user would be in the same position running the same strategy from its own wallet. Where a curator does exercise discretion, it is within a mandate users accepted in advance, with notice and a timelock before any change is effective against a user’s assets. No fund stands between users and their assets, so the vault is not an investment company. A curator paid to make investment decisions about securities may be an investment adviser, but it does not have custody, because the code does not let it take the users’ assets.
No exemption requested. The paper does not ask for a safe harbor, an exemptive program, a set of conditions, or a compliance entity to stand in for the market. It applies existing law as it stands today and asks the SEC to confirm what that law already provides. It is candid about the harder questions, especially actively curated vaults and performance-based fees, and it answers them rather than asking for relief from the law.
The public summary is written in general terms so that any protocol or vault with the same features can apply it. Aave Labs and its co-authors invite feedback and engagement from protocols, vault builders, DAOs, and everyone else building onchain finance.
The paper does not claim the SEC agrees with it. Aave Labs looks forward to the conversation.
This post and the paper are provided for information and do not constitute legal advice. The conclusions depend on the design features the paper describes.