S&P’s First DeFi Credit Rating: Inside the Sky Protocol Assessment with Andrew O'Neill (S&P Global)

Rating debut: On August 7, S&P Global Ratings issued its first-ever credit rating for a decentralized finance (DeFi) protocol, assigning Sky Protocol — formerly MakerDAO — a B-. The assessment used S&P’s global scale, placing Sky’s risk profile alongside that of traditional lenders worldwide rather than under a bespoke DeFi framework.

• About Sky Protocol: Operating on Ethereum, Sky is a decentralized lending protocol that issues the stablecoin USDS alongside its existing DAI. Users can take out crypto-collateralized loans in USDS or earn yield via a dedicated savings product. Together, USDS and DAI make Sky the fourth-largest stablecoin issuer globally.

A new benchmark for DeFi risk: The B- rating reflects structural challenges — including regulatory uncertainty around DAOs and key-person risk — alongside protocol-specific issues like weak capitalization and depositor concentration. It also notes strengths such as a stable peg history, strong smart contract security, and high onchain transparency. For institutional investors, the rating offers a common language to compare DeFi credit risk with that of more familiar asset classes.

Interview: We sat down with Andrew O’Neill, Managing Director, Analytical Lead on Digital Assets at S&P Global, to discuss how the agency is approaching credit ratings for DeFi, what the Sky Protocol case reveals, and how stablecoins, tokenization, and team expertise fit into S&P Global Rating’s broader digital asset strategy.

______________

S&P’s First Credit Rating for a DeFi Protocol

Andrew, can you start by telling us about your role at S&P and how you became involved in digital assets?

I lead our digital assets analytics team at S&P Global Ratings. I’ve been with the company for 15 years, but my work in crypto began around three to four years ago, becoming a full-time focus just over a year ago.

On our side of the business, there’s a strict separation between commercial functions and analytical work. My team focuses purely on producing insights and credit opinions. We’re not involved in commercial discussions or how S&P monetizes these activities.

Our first structured step into the digital asset space was launching the Stablecoin Stability Assessment framework at the end of 2023, covering projects like DAI and FRAX. Those assessments compare stablecoin issuers to each other, focusing on their ability to maintain a peg.

Sky Protocol was different. They approached us to assign a credit rating on our global scale. That meant comparing their credit profile not just to other stablecoin issuers, but to all rated entities worldwide, including traditional banks, corporates, and sovereigns.

It’s also important to note that Sky is a decentralized lending protocol, so we could frame the key risks — asset quality, liquidity stress, capital adequacy, and governance failures — in ways comparable to a traditional lender.

How S&P Evaluates DeFi Credit Risk

So what’s the difference between a stablecoin stability assessment and a credit rating?

A stability assessment ranks stablecoin issuers against each other on the risk that they may lose their peg.

A credit rating measures the issuer’s overall creditworthiness on S&P’s global scale, assessing the likelihood of default relative to all rated entities — from banks to corporates. In Sky’s case, we defined default as a haircut imposed on holders of USDS, DAI, or related savings tokens.

Many of the core risks are familiar, like capital adequacy, liquidity coverage, and risk management discipline. But DeFi brings its own nuances:

• Technological risk: Assets are custodied in smart contracts. That’s a low-probability but high-severity risk if exploited. We factored in mitigants like a strong security track record, multiple audits, and bug bounty programs.

• Transparency: On-chain data and open governance processes are clear strengths. You can see capital ratios, liquidity positions, and depositor concentration in real time. But transparency doesn’t eliminate the underlying risk. In Sky’s case, it also makes the current weaknesses visible.

• Governance: Sky is in transition under its “Endgame” plan. Today, governance is highly centralized around founder Rune Christensen, creating key-person risk. There is also a risk of strategic disruption from dissident voters, which could lead to a volatile decision-making environment.

No, we felt it was important to benchmark Sky against global peers. That gives market participants a common frame of reference. Creating a one-off scale for a single protocol would be far less meaningful.

We could do this because we were able to:

1. Define a clear default scenario.

2. Identify and measure the risks that could trigger it.

3. Track how those risks might evolve over time in a way comparable to other rated credits.

Some factors are structural and slow-moving. For example, there’s ongoing regulatory uncertainty around DAOs, and it may take several years before clear frameworks emerge. This could ultimately have a positive effect by enabling growth, or a negative one by restricting activity.

Other factors are within Sky’s control. The capital position is currently very weak, and improving it will take time and depend on retained earnings. Depositor concentration is another concern, as large, concentrated positions heighten liquidity risk. On the governance side, decentralizing decision-making and stabilizing internal processes would help reduce both key-person risk and the potential for strategic disruption.

We don’t expect an upgrade in the next 12 months, but progress on these fronts could support one over time. There’s no hard ceiling, but an immediate leap to investment grade is unrealistic.

Beyond Sky: S&P Global Ratings and Digital Assets

How does tokenization fit into your work? Do you rate tokenized assets directly?

Tokenization itself doesn’t change the underlying credit risk: a German government bond on-chain has the same credit profile as one off-chain. But it adds operational and technology risk that we evaluate.

We’ve rated tokenized money market funds and seen crossover with DeFi. For example, Sky invests in tokenized funds like the Janus Henderson AAA CLO product, bringing our traditional and digital asset analyst teams together.

I can’t comment on specific pipeline. But our mission is to support risk-aware innovation, whether that’s DeFi protocols engaging with traditional markets or traditional issuers adopting blockchain rails.

I don’t think it would be as easy as a copy-paste of the Sky methodology. If we’re looking purely at another DeFi lender, there are certainly strong parallels: capital, liquidity, and risk management remain the core pillars. But there are also important nuances across protocols: how they’re structured legally, how governance operates in practice, what their economic activity entails, and what financial obligations they actually have. Those differences make it challenging to produce a single, template framework for rating all DeFi projects today.

We‘re more likely to be able to assign a rating in areas where risk concepts from TradFi map well — such as lending protocols — while other DeFi models may require bespoke approaches before they can be meaningfully placed on our global rating scale.

Our dedicated digital assets analytics team is small — two and a half full-time equivalents — but we work closely with sector analysts across S&P (for example, we worked with our financial institutions team on Sky). For complex DeFi ratings like Sky, we lead more of the analytical lift than we would for, say, tokenizing a traditional fund.