Are Crypto Vaults Securities? The $131 Billion Test Bitwise, Galaxy and Morpho Just Put to the SEC — 10 Questions That Decide It

The $131 Billion Question Nobody in Washington Has Answered

Crypto vaults now hold roughly $131 billion in user deposits, up from about $24 billion in April 2023 — a more than fivefold increase in three years. Yet the United States Securities and Exchange Commission has never clearly said whether these vaults are securities, investment companies, or something else entirely. That silence now covers one of the fastest-growing corners of crypto, and it is starting to matter for ordinary depositors, not just lawyers.

On October 29, 2026, the Crypto Council for Innovation (CCI) tried to break the deadlock. Its Vault Coalition — backed by Bitwise, Galaxy Digital and Morpho, with legal advisers from Chapman and Cutler LLP — submitted a 238-page framework titled "Under Control" to the SEC. The proposal does not ask for a blanket exemption. Instead, it offers a test: judge each vault by who actually controls the money inside it. Vaults run by fixed code with limited human discretion would face one treatment; vaults where operators can pick strategies, move capital or change the rules would face another.

This article explains what crypto vaults are, why $131 billion is now riding on an unanswered legal question, how the proposed 10-question control test works, and what depositors should check before trusting a vault with their funds. It is not legal advice, and the framework is an industry proposal — not SEC rulemaking. But if you hold assets in any vault, lending protocol or yield product, this debate will shape the rules that eventually govern your money.

What Is a Crypto Vault, Exactly?

A crypto vault is a smart contract that takes user deposits and deploys them into predefined strategies: lending, borrowing, liquidity provision or portfolio management. You deposit tokens, receive a vault token or share representing your stake, and the vault's code — sometimes managed by human curators — puts the capital to work. Returns come from interest, trading fees or token incentives, minus fees charged by the operator.

The idea began inside decentralized finance, but it has moved well beyond it. Traditional asset managers now run vault-like products, centralized platforms offer vault strategies to retail users, and the line between a "DeFi vault" and a managed investment fund has blurred beyond recognition. That blurring is precisely the problem. A product that looks like a bank deposit to a user can look like an unregistered investment company to a regulator — and the same vault can look like both at once. For readers new to the underlying technology, our guide to what decentralized finance is and how it works explains the building blocks vaults are built from.

Vaults appeal to users for a simple reason: they automate work most people cannot or will not do themselves. Rebalancing positions, chasing the best lending rate, compounding rewards — a vault does all of it in one deposit. The trade-off is control. When you deposit into a vault, you hand some degree of decision-making to code, to curators, or to both. The CCI framework argues that this degree of control — not the label on the product — should determine how the law treats it.

Why $131 Billion Changes the Stakes

The $131 billion figure, cited from S&P Global data in coverage of the CCI report, measures deposits in vaults as of April 2026. Three years earlier, the figure was about $24 billion. That growth did not happen in a vacuum: it coincided with the rise of liquid staking, tokenized funds and automated yield strategies, and with institutional players entering a space once dominated by anonymous developers.

Scale changes the regulatory calculus in three ways. First, more money means more potential harm if a vault fails, freezes withdrawals or turns out to be mismanaged — the kind of event that forces regulators to act after the fact. Second, institutional participation means vaults now sit inside portfolios held by funds, companies and potentially retirement products, widening the blast radius of any legal surprise. Third, growth without clear rules creates an uneven playing field: careful operators that seek compliance compete against rivals that simply ignore the question.

Bitwise CEO Hunter Horsley, whose firm backed the framework, put the industry's ambition plainly: "Vaults are going to change capital markets." That is either a promise or a warning, depending on whether the rules arrive before or after the next failure. The CCI's bet is that clear, control-based rules will let the legitimate part of the market grow while exposing the parts that depend on unchecked operator discretion.

The Control Framework: Two Sides of One Test

The CCI proposal examines vaults under three existing statutes: the Securities Act of 1933, the Investment Company Act of 1940 and the Investment Advisers Act of 1940. Rather than arguing that vaults fall outside all three, it proposes a two-sided control test that sorts vaults by their actual design.

On the operator side, the framework examines four factors: mandate, execution, governance and disposition. In plain terms, regulators would ask whether the people or entities running the vault can choose the strategy, move capital between strategies, change the protocol's rules, upgrade the contracts, or shift assets beyond approved destinations. A vault where curators, administrators or safety guardians hold those powers looks very different from one where the code is immutable and no human can redirect funds.

On the depositor side, the framework lists six conditions: comprehensibility, verifiability, observability, predictability, notice and actionability. Can depositors understand what the vault does, verify what it holds, observe its positions, predict how it will behave, receive notice before material changes, and act — above all, withdraw — when they want to? A vault that scores well on these conditions gives depositors genuine control even when they delegate day-to-day decisions to code.

The dividing line the framework draws is intuitive: vaults with immutable smart contracts, transparent operations, limited human discretion and permissionless withdrawals would face a different regulatory assessment from vaults where operators retain significant control over investment decisions. The first category resembles infrastructure; the second resembles a managed fund. Treating them identically, the CCI argues, would be as mistaken as treating a highway and a taxi company as the same business because both involve cars.

Two Vaults, Two Verdicts: How the Test Would Work

Consider two hypothetical vaults holding the same asset. Vault A runs on immutable code: its strategy is fixed at deployment, nobody can upgrade the contract or redirect funds, all positions are visible on-chain, and any depositor can withdraw at any time without permission. Vault B is managed by a curator team that can rotate strategies weekly, pause withdrawals during "market stress," upgrade contracts without a vote, and allocate up to 30% of deposits to an affiliated trading desk.

Under the CCI framework, Vault A would likely fall outside securities-law treatment as an investment company, because no identifiable person exercises the kind of managerial control the statutes target. Vault B would likely face the opposite assessment: a curator team making discretionary investment decisions with other people's money is performing the core function securities laws were written to regulate, regardless of whether the rails are blockchain-based.

Feature	Vault A: Code-Run	Vault B: Curator-Run
Who picks the strategy	Fixed code, set at launch	Curator team, changed weekly
Can funds be redirected	No, destinations are hard-coded	Yes, including to affiliates
Contract upgrades	Impossible, contract is immutable	Possible without depositor vote
Withdrawals	Permissionless, any time	Pausable during market stress
Likely treatment under the framework	Outside investment-company treatment	Regulated as a managed product

This distinction echoes SEC Commissioner Hester Peirce's July 22, 2026 statement, "Headstands and Summervaults," in which she cautioned against treating all vaults alike. Peirce's point — that design and discretion matter more than labels — is now the intellectual backbone of the industry's proposal. Whether the full Commission agrees is a separate question, and the framework's supporters know it.

The ETF Playbook: Exemptions First, Rules Later

The CCI does not only propose a test; it proposes a path. Mirroring how the SEC handled crypto exchange-traded funds, the council suggests the agency grant individual exemptions to qualifying vault structures under Section 6(c) of the Investment Company Act, then move toward broader standardized rules once experience accumulates. The ETF precedent matters because it worked: case-by-case exemptions let products launch under supervision while the agency learned how the market behaved.

The framework also draws a parallel with Section 10301 of the proposed CLARITY Act, which would judge non-decentralized protocols by whether identifiable individuals or groups can control or materially change how they function. The same control logic, applied to vaults, would give Congress and the SEC a shared vocabulary — a significant advantage in a debate where both branches have often talked past each other. Readers following that bill can catch up with our explainer on why the Senate blocked America's crypto market-structure bill and what happens next.

The CCI report also recommends changes to the SEC's proposed crypto custody rules and suggests safeguards for vaults seeking favorable treatment: on-chain transparency, overcollateralization, permissionless withdrawals, independent code audits and a designated compliance contact. These are proposals, not requirements adopted by the SEC — a distinction that matters. No vault today can claim SEC approval simply because it follows the framework's suggestions.

What Most People Get Wrong About Vault Regulation

The most common misunderstanding is that the framework, if adopted, would deregulate vaults. It would do the opposite for the riskiest products: by defining what genuine decentralization looks like, it would make it harder for curator-controlled vaults to hide behind DeFi branding. A vault that markets itself as "decentralized" while a three-person team can redirect deposits would fail the control test on its own terms.

A second misunderstanding is that the framework settles the question. It does not. It is a submission responding to the SEC's request for information, published after the agency asked how existing securities laws apply to vaults. The SEC may adopt parts of it, reject it, or let it sit while Congress moves on the CLARITY Act. The framework's value is that it gives regulators a detailed, workable alternative to two unappealing options: banning vaults outright or ignoring them until a crisis forces action.

A third misunderstanding concerns the numbers. The $131 billion figure measures deposits, not safety. Deposits can grow precisely because users underestimate risk — especially when yields look attractive and interfaces hide complexity. Our earlier explainer on how crypto lending vaults work and the systemic risks experts fear covers the failure modes — bad debt, oracle manipulation, correlated liquidations — that no regulatory framework can eliminate, only mitigate.

The 10-Question Checklist: Is Your Vault Actually Under Your Control?

Whether or not the SEC adopts the CCI framework, its control test gives depositors a practical checklist. Before depositing into any vault, ask these ten questions — and be suspicious of any project that cannot answer them clearly:

• Strategy decisions are made by fixed code or by a named team with published rules, and the answer is documented rather than implied.
• Capital movement is restricted to pre-approved destinations, and no party can redirect deposits to affiliated entities without disclosure.
• Contract upgrades require advance notice and, ideally, a depositor vote — not a unilateral admin key.
• Withdrawal access is permissionless at all times, with no pause function controlled by the operator.
• Holdings and positions are fully visible on-chain, in real time, without relying on the operator's dashboard.
• Strategy changes come with advance notice long enough for depositors to exit before they take effect.
• Fee structures are fixed and transparent, including performance fees, curator fees and withdrawal fees.
• Code audits come from independent firms, are publicly available, and cover the exact contracts holding your funds.
• Insurance or overcollateralization buffers exist, and their size and source are disclosed rather than marketed vaguely.
• Legal accountability is clear: a named entity, jurisdiction and compliance contact exist if something goes wrong.

A vault that answers most of these questions well resembles the framework's code-run archetype. A vault that dodges them — vague strategy descriptions, pausable withdrawals, unaudited contracts, anonymous curators — is exactly the kind of product the framework would push toward full regulation. If you cannot verify the answers yourself, consider whether the yield is worth the opacity. For most savers, keeping assets in a wallet they control remains the baseline: see our comparison of hot versus cold wallets for beginners before choosing between self-custody and any vault product.

What Happens Next: Three Paths for the $131 Billion Market

The first path is SEC action through exemptions. If the agency follows the ETF playbook, qualifying vaults could receive individual Section 6(c) exemptions within months, creating a compliant lane that rewards transparent designs. Watch for the first exemption order: its conditions would become the de facto standard for every vault that follows.

The second path is congressional action through the CLARITY Act or a successor bill. A control-based test written into statute would be more durable than exemptions but slower to arrive, and the bill's recent Senate troubles show how uncertain that route remains. The third path is inaction — the status quo — in which vaults keep growing without clear rules until a major failure forces emergency enforcement. That path is the worst for everyone except operators profiting from ambiguity.

Meanwhile, vault users face a quieter risk: the framework debate itself can create false confidence. Marketing teams will soon describe products as "CCI-aligned" or "control-tested" even though no official test exists. Treat such claims as advertising, not approval, until the SEC itself speaks. The same skepticism applies to yield figures: a vault advertising double-digit returns while holding assets in strategies you cannot inspect is selling you its risk management, not its returns.

There is also a competitive subplot worth watching. Morpho, one of the framework's backers, operates one of the largest vault ecosystems in DeFi, while Bitwise and Galaxy bring traditional asset-management weight. Their alliance signals that the vault debate is no longer a DeFi-versus-Wall-Street fight — it is a negotiation over who writes the rules for a hybrid market. Smaller vault projects that cannot afford compliance teams may find the eventual rules favor incumbents, a dynamic regulators should weigh carefully.

FAQs

Are crypto vaults securities today?

There is no blanket answer. The SEC has not issued a rule declaring all vaults securities or all vaults non-securities. Treatment depends on each vault's design — who controls the assets, how much discretion managers exercise, and what rights depositors hold. The CCI framework proposes making that case-by-case analysis explicit through a control test.

What does the CCI control framework actually propose?

It proposes judging vaults by operator control (mandate, execution, governance, disposition) and depositor control (comprehensibility, verifiability, observability, predictability, notice, actionability). Vaults with immutable code and permissionless withdrawals would face different treatment from vaults where operators retain significant investment discretion.

Does the framework mean vaults are now approved by the SEC?

No. The framework is a 238-page industry submission responding to the SEC's request for information. It is a recommendation, not rulemaking, and no vault gains regulatory approval by following it. Any claim of SEC approval based on the framework alone should be treated as marketing.

How big is the crypto vault market?

Vault deposits reached roughly $131 billion in April 2026 according to S&P Global data cited in coverage of the report, up from about $24 billion in April 2023. The figure measures deposits, not the safety or quality of the vaults holding them.

What should I check before depositing into a vault?

Work through the 10-question checklist above: who controls strategy and capital movement, whether withdrawals can be paused, whether holdings are verifiable on-chain, whether audits are independent and public, and whether a named entity is accountable. If a vault cannot answer clearly, treat that as information — and consider self-custody or a simpler product instead. Staking products carry their own version of this trade-off, explained in our guide to how crypto staking works and how rewards are earned.

When will the rules actually change?

There is no timetable. The SEC could issue individual exemptions, Congress could legislate a control test through the CLARITY Act or a successor, or neither could act until a crisis forces the issue. The realistic expectation is months of debate, not weeks — and depositors should not wait for regulators to do their due diligence for them.

Conclusion

The $131 billion sitting in crypto vaults grew up in a legal gray zone, and gray zones do not last forever. The CCI framework — backed by Bitwise, Galaxy and Morpho — offers Washington a credible way out: stop arguing about labels and start measuring control. Vaults that genuinely run on immutable code with transparent operations and permissionless withdrawals would earn lighter treatment; vaults where managers quietly call the shots would face the regulation their design already implies.

That bargain, if adopted, would be good news for careful operators and careful depositors alike — and bad news for products that depend on the ambiguity. But adoption is not guaranteed, and until the SEC or Congress acts, the burden stays where it has always been: on you. Use the control test, demand clear answers, and remember that in vaults, as everywhere in crypto, the most important yield is the one you still have when the music stops.

Sources: coverage of the CCI framework from CryptoNews, CryptoTimes and Hokanews.