The Efforts of Vaults

July 24, 2026

Last summer I wrote about Commissioner Peirce’s “Enchanting, but Not Magical” statement, the one where she reminded everyone that tokenized securities are still securities. I called it almost obvious, and said the interesting part was the messenger and the timing, not the legal theory. She has now published the sequel, and it moves from the asset to the activity. It is still not magical. But it is a fairly complete map of the places in decentralized finance where someone is quietly in charge, which is awkward for an industry built on the premise that nobody is.

The statement (Headstands and Summervaults) is short. [1] Much of crypto is not subject to the securities laws, but that does not mean none of it is. If you do “headstands, backflips, and other gymnastics” to read the law so it does not reach activities that sit well within the securities perimeter, you are going to fall on your head. Better, she says, to come talk to the staff and find a compliant path. The two activities she singles out are crypto vaults, which use smart contracts to deploy user assets into yield strategies like staking and lending, and onchain lending strategies themselves.

The magic word is “managing”

When reading the statement the recurring word is “managing.” The people Peirce says “may want to analyze whether their activities implicate the federal securities laws” are the ones managing the vault, selecting the yield-generating activities, reallocating assets among them, or choosing who gets to make those calls. On the lending side, it is the people setting interest rates, deciding which assets to accommodate, setting loan-to-value limits, and establishing liquidation thresholds. She is not, in this statement, chasing the token, she is calling out a particular job or role.

That matters because the founding fiction of decentralized finance is that there is no job. It is just code, the code is neutral, and nobody is in charge. Peirce’s statement is a polite, footnoted list of the places someone is. Once you see it that way, the doctrine falls out almost mechanically, because “the efforts of a promoter or third party” has been half of the securities analysis since 1946.

Before the specific statutes, one idea carries the rest. Peirce describes vaults as falling along a spectrum, from allocations “determined solely by immutable smart contracts” to allocations “at the sole discretion of another person or group of persons.” That spectrum is less a taxonomy than a risk gradient: the more human discretion sits between the depositor and the yield, the more securities law you have walked into. Everything that follows is a footnote to it.

The vault as an investment contract

Start where Peirce starts, with Howey. A vault can be a common enterprise in which users contribute assets expecting profit from the managerial efforts of the deployer and the curator. That is an investment contract, full stop, and it does not matter that the “enterprise” is a set of contracts on Base instead of a citrus grove in Florida. Peirce cites United Housing Foundation v. Forman for the point, the case that tells you to weigh economic reality over the label. [2]

Now apply the gradient. A genuinely immutable vault, one that is deployed once, allocates by a fixed rule, and has no one steering it afterward, is at the weak end of Howey. There are no ongoing efforts of others to rely on, which is the same reason a sufficiently mature token can age out of being an investment contract. (Regular readers will recognize the Atkins-era idea that an investment contract can expire; a vault can be born already expired if it is truly autonomous.) A curated vault, where a human or a multisig picks strategies, chases the best yield, and rebalances on Tuesdays, is at the strong end. It is textbook Howey, and the curator is the promoter.

So the design decision is the classification decision. Whether your vault interest is a security is not a fact about crypto. It is a fact about how much discretion you kept. That is the single most important structuring call you will make, and, like the tokenization-model choice I wrote about in the spring, you want to make it on purpose and before you write the contract, not discover it in a Wells notice.

The Investment Company Act is the one to worry about

Everyone in crypto has trained themselves to fight Howey. Fewer are ready for the statute Peirce raises next, the one that ends companies. She notes that a vault holding securities, or allocating assets to investments in securities, “could fall into investment company territory,” and then walks through unit investment trusts, management investment companies, and separately managed accounts.

The Investment Company Act of 1940 sweeps in any issuer that holds itself out as primarily engaged in investing, reinvesting, or trading in securities, or that owns “investment securities” worth more than forty percent of its total assets, excluding cash and government securities. [3] If your vault takes user deposits and puts them into things that are themselves securities, the vault can be an investment company. And being an unregistered investment company is not a disclosure problem you paper over. It is close to unfixable for anything permissionless, because the usual exits are the private-fund exclusions, and those require that you not make a public offering and that you limit yourself to no more than a hundred holders or exclusively to qualified purchasers. A vault that anyone on the internet with a wallet can deposit into satisfies none of that; it has made a public offering to the entire planet.

This is why Peirce’s taxonomy is not academic. She is handing you a menu, and every item is a way to be regulated. Look like a unit investment trust (a fixed, unmanaged basket) and you are one. Look like a management company (active allocation) and you are that. Look like a separately managed account (individualized, non-pooled positions) and you may have dodged the Act entirely. That is the real lifeline in the statement: if each user’s assets are managed individually instead of pooled into a common vehicle, you may not have an investment company at all. You will, however, probably have an investment adviser, which we will get to.

One honest limit, since I am not trying to scare anyone off the facts. The ’40 Act bites when the box contains securities. A vault that only stakes ether or only lends a stablecoin is deploying assets that are, under current staff views, generally not securities, and it has a much easier time with this particular statute. It still has a Howey problem, and an adviser problem if someone is curating it. None of this is regulation-free, but which asset sits in the box decides which statute you are fighting, and how hard.

Onchain lending and Reves

For lending, Peirce reaches for Reves v. Ernst & Young, and it is the citation to sit with. A note is presumed to be a security. It escapes only if it looks like one of a short list of everyday commercial instruments the Supreme Court blessed: consumer financing, home mortgages, short-term notes secured by a lien on a small business, character loans, notes secured by accounts receivable, notes formalizing ordinary open-account debts. To decide, courts run the four-factor “family resemblance” test: the motivations of the buyer and seller, the plan of distribution, the reasonable expectations of the investing public, and whether some other risk-reducing factor (like another regulatory scheme) makes the securities laws unnecessary. [4]

First, get the direction right, because people invert it. In a lending pool the security is not the loan to the borrower. It is the instrument the depositor gets in return for supplying capital, the interest-bearing claim on the pool. The depositor is the investor, the protocol is the issuer, and the borrowers drawing on the pool are a separate commercial layer downstream. When Peirce says onchain loans can “bear the hallmarks of notes that are securities,” the note she means is the yield position, the thing marketed to you with an APY next to it.

Now run the factors on a typical deposit-for-yield product, and it fails all four. Motivation: the depositor wants return, the protocol wants capital to lend, so both sides are in it for investment, not to buy a refrigerator. Distribution: it is offered to the entire public and the positions trade freely. Expectations: the front end literally says “earn.” Risk-reducing factor: there is no FDIC, no comprehensive alternative regulator, nothing standing between the depositor and a bad day. All four point toward a security.

Which brings us to the headstand Peirce is warning about, the one I hear most often: “our loans are overcollateralized, so they are safe, so they are not securities.” Overcollateralization is a credit feature, not a securities exemption. The Reves risk-reducing factor is about whether another regime has already made investors safe enough that securities law is redundant, the way federal deposit insurance does for a bank account. A pile of volatile collateral backstopped by an automated liquidation engine is not that. It is a nice feature right up until a fast drawdown and a congested chain turn “automated liquidation” into “the collateral did not sell,” which is how a lot of DeFi failures actually unfold. Overcollateralization reduces credit risk. It does not take the instrument out of the family.

Every door has a statute behind it

There is one more overlay Peirce names almost in passing, and it is the one that catches the people who thought they had escaped. If you avoid investment-company status by running separately managed accounts, or if you are the curator selecting strategies for a fee, you start to look like an investment adviser: someone who, for compensation, is in the business of advising others as to the value of securities or the advisability of investing in them. [5] Discretionary curation of a securities portfolio for a cut of the yield is, functionally, discretionary asset management. The Advisers Act does not care that your discretion is expressed in a config file.

Put the three together and you get the real shape of the statement. The pooled, securities-holding, curated vault is potentially an unregistered investment company, an investment contract, and a vehicle run by an unregistered adviser. Strip out the pooling and you may lose the ’40 Act but keep the adviser. Strip out the discretion and you weaken Howey, but you have also built a different, dumber product. Every version trades one statute for another. The only real choice is which one you take on deliberately.

Where the frontier is

Peirce ends on two sentences that are easy to skim and should not be. Any analysis, she says, “requires respect for the limits Congress set on our jurisdiction and an unwavering commitment to protecting developers’ free speech rights.” That is not boilerplate; it is the boundary line of the whole fight.

The truly immutable, unowned, autonomous protocol, published as code and then left alone, is where two arguments converge and are at their strongest at the same time. It is where the Howey case is weakest, because there are no ongoing efforts of others to rely on, and it is where the First Amendment argument is strongest, because what the developer did was publish speech and walk away. The actively curated vault is where both arguments collapse together, because now there is an ongoing enterprise and an identifiable person running it. The free-speech line and the Howey line, it turns out, are drawn in the same place. That is why the autonomy-versus-curation gradient is not a compliance detail but the core of the case, and the unsettled part, still being fought over in the developer-liability cases moving through the courts. Peirce is signaling which side of that line she thinks the code lives on, and which side the curator lives on.

The tax gremlin

I cannot let a yield product go by without asking what any of this means for tax, the question the hackathon crowd would rather skip. If the depositor’s position is a note, the yield is interest, which means original-issue-discount timing under §§ 1272 through 1275 and, if the issuer is U.S. and the holder is offshore, a withholding obligation on U.S.-source interest that somebody is supposed to satisfy against an anonymous wallet, which nobody has figured out how to do. If the vault is instead a pooled, equity-flavored vehicle, it may be a partnership for tax purposes, which means K-1s to pseudonymous addresses and § 704(b) allocations, or it is a grantor trust that passes items straight through. And the securities answer and the tax answer need not agree: an instrument can be a Reves note for securities law and equity for tax, or a non-security for securities law and plain debt for tax. Layer in that staking rewards earned inside the vault raise the dominion-and-control timing question from Rev. Rul. 2023-14, and you have a compliance surface much larger than “is it a security.” None of this is advice; all of it is why you call your tax person before you deploy. [6]

Don’t mistake a thaw for spring

I want to give Peirce full credit, because the tone here is the constructive kind. “Come talk to us, you may not even be in scope, and if you are we will help you find a path” is a real change from the years when the path was a subpoena. But temper the read the same way I told you to in the spring. This is a single Commissioner’s statement. It is not a rule, not a safe harbor, and not a no-action letter. It says “facts and circumstances” four different ways, which means the compliant path is bespoke, lawyered, and expensive, and it will stay that way until the Commission does the durable thing and writes the exemption or the rule that Peirce herself gestures at when she asks whether the rulebook should be modified for vaults and onchain lending. A warm speech is an invitation, not a framework.

Here is the order of operations I would hand anyone deploying or curating one of these things:

1. Locate the discretion. Map every point where a human or a multisig chooses a strategy, a rate, a threshold, or a counterparty. That map is your Howey exposure, and the shorter it is, the better your story.
2. Look in the box. If the vault holds or routes to securities, assume the Investment Company Act is live, and confirm you can fit a private-fund exclusion before you open deposits to the public. A permissionless vault usually cannot.
3. Get the note direction right. In a lending product, the depositor’s yield position is the instrument to test under Reves, not the borrower’s loan. Run all four factors honestly and assume you fail them.
4. Retire the overcollateralization defense. It reduces credit risk; it does not exempt the instrument. Do not build your legal position on it.
5. Ask whether you are the adviser. If you curate a securities portfolio for compensation, you probably are, especially in a separately-managed-account design that dodges the ’40 Act.
6. Decide immutable-versus-curated deliberately. It sets your securities exposure and your free-speech posture at the same time. Pick one and build all the way to it, because the middle is the worst of both.
7. Take the meeting, keep your expectations sober. The invitation to engage is real and worth using. It is not a substitute for the rule that has not been written yet.

Peirce is right that the promise here is large, and right that it only gets realized if we grapple with it now instead of pretending it isn’t there. The vault has no more power to transform the underlying activity than the token had to transform the underlying asset. Same enchantment, one year later, one layer deeper. The gymnastics are available to anyone who wants them; Peirce has already said where they land.

[1] Commissioner Hester M. Peirce, Headstands and Summervaults: A Statement on Crypto Vaults and Lending Strategies (July 22, 2026). The predecessor she builds on is Commissioner Hester M. Peirce, Enchanting, but Not Magical: A Statement on the Tokenization of Securities (July 9, 2025).

[2] SEC v. W.J. Howey Co., 328 U.S. 293 (1946); United Housing Found., Inc. v. Forman, 421 U.S. 837, 852 (1975) (economic reality over form; profits derived from the managerial efforts of others).

[3] Investment Company Act of 1940 § 3(a)(1)(A), (C) (the primary-business and forty-percent tests; “investment securities” excludes government securities and cash items). The private-fund exits are §§ 3(c)(1) (no public offering; not more than 100 beneficial owners) and 3(c)(7) (no public offering; solely qualified purchasers). Company types appear in § 4 (unit investment trust, § 4(2); management company, § 4(3)).

[4] Reves v. Ernst & Young, 494 U.S. 56, 64-67 (1990) (a note is presumed a security; the four-factor family-resemblance test and the enumerated categories of non-security notes).

[5] Investment Advisers Act of 1940 § 202(a)(11) (a person who, for compensation, is engaged in the business of advising others as to the value of securities or the advisability of investing in, purchasing, or selling securities).

[6] On the tax seams: original issue discount, §§ 1272-1275; withholding on U.S.-source FDAP interest, §§ 871, 881, 1441; entity classification (partnership vs. grantor trust) under the check-the-box regime; and the timing of staking rewards under Rev. Rul. 2023-14.

Written by David Lopez Kurtz