Institutional DeFi: live examples, access and controls

Institutional DeFi is the use of public onchain lending markets, tokenised funds and vaults by banks, asset managers, exchanges and treasuries, with identity checks, custody and mandate limits added around the open protocols, and several deployments now run into the billions.

Institutional DeFi means regulated firms using public blockchain protocols for lending, collateral, settlement and yield, under the same controls they apply to any other venue. The protocols are mostly the open ones retail users know, such as Aave and Morpho, while the institutional layer adds allow-listed participants, qualified custody, policy limits on what an operator can do, and reporting a fund administrator can reconcile. Coinbase had about $1.4 billion in bitcoin-backed loans outstanding through Morpho on 22 September 2026, and BlackRock's tokenised liquidity fund held $2.24 billion across nine networks two days later.

Banks have moved from pilots to public chains as well. J.P. Morgan's deposit token runs on Base, and Société Générale's crypto subsidiary lists its euro and dollar stablecoins on Morpho and Uniswap. Institutions reach these markets directly, through a qualified custodian or through a curated vault, and each route rests on controls a risk committee can check.

How is institutional DeFi different from retail DeFi?

The protocols are often identical, and the difference sits in who can participate and how. Chainlink's education hub, updated in May 2026, frames the split along four axes: access, security, compliance and asset types. The comparison here keeps those four and adds how each one is enforced in a live deployment.

A common design mixes the two: the collateral side is permissioned while the liquidity side stays open. Aave Horizon, for example, restricts who can post tokenised securities as collateral, while its documentation says stablecoins can be supplied "by any participant in a fully permissionless manner". That split lets institutions borrow from a deep pool of lenders without the securities themselves leaving their transfer rules behind.

Which institutions use DeFi today?

The clearest proof that institutional DeFi is live comes from programmes with public, checkable sizes. Every figure below was read on 24 September 2026 from the source linked in the row.

BUIDL's holder count is the tell for how institutional these products are. A $2.24 billion fund with 107 holders is a wholesale instrument, and much of its onchain activity is as collateral: Deribit and Crypto.com began accepting it for trading margin in 2025 (Cointelegraph), and Binance added it as off-exchange collateral that November. Coinbase sits at the other end, a listed company using an open lending protocol as the engine behind a consumer product. Its users see a loan in the Coinbase app, while the collateral and the USDC sit in Morpho markets anyone can inspect.

Tokenised private credit has followed the same path. Apollo's ACRED fund, tokenised by Securitize, has been deposited as collateral on Morpho to borrow USDC and buy more of the fund since April 2025 (CoinDesk). That is a looped position in a regulated fund, run on a public lending market, with the fund's own transfer restrictions still attached to every token.

How do institutions access DeFi?

Institutions reach DeFi by one of three routes, and they differ mainly in who holds the keys and who carries the operational work.

The routes also stack. A Kraken Institutional client allocates from its custody account into a vault built on Upshift, and the receipt token comes back into the client's segregated account. The qualified-custody mechanics are laid out in qualified custodians for onchain yield, and the vault itself is explained in what is an onchain vault.

What controls do institutions need before using DeFi?

A risk committee approves an onchain allocation when every control it relies on is either enforced in code or independently checkable. The list below pairs each common control with where it's enforced, since a control described only in a policy document carries less weight than one the contract applies.

• Participant allow-lists: only verified addresses can hold a token or supply collateral. Enforced in the token contract (BUIDL, ACRED) or the market (Aave Horizon's collateral side).
• Mandate limits: which chains, protocols, tokens and contract functions capital may touch. Enforced by a policy engine that rejects out-of-policy transactions before they execute; the design is covered in how traditional asset managers are controlling risk in DeFi.
• No external transfers: the operator can move funds only between the vault, its subaccount and approved strategy contracts. Enforced by the vault contract.
• Key security: no single stolen key can move funds. Enforced by MPC signing for operational keys and a multisig as contract owner; the trade-offs are compared in how onchain yield vaults are secured.
• Segregation: a sole-depositor or whitelisted vault keeps one client's position and losses separate from other depositors. Structures are compared in segregated vs co-mingled vault accounts.
• Independent reporting: NAV and allocations reconciled by a third party. Upshift's vaults report through Securitize Fund Services.

These controls narrow what can go wrong without removing market, credit or smart contract risk, and no onchain yield is guaranteed. Always make sure to do your own research and be aware of the above and any other risks before depositing.

Where Upshift fits

Upshift is the vault layer in the third route: institutions and platforms launch custom, permissioned vaults with a policy engine that restricts activity at the chain, protocol, token and function level, and access can run from inside custody, as with Kraken Institutional. Its parent, August Digital, runs an onchain prime brokerage with more than $7 billion in monthly volume and over $800 million in loans originated, which lets a single vault combine DeFi venues with CeFi credit. The contracts have been through 10 smart contract audits by 6 independent firms, and the platform runs more than 50 vaults across more than 30 chains.

How US regulation applies to DeFi

US rules for DeFi have come mostly through laws aimed at specific activities and instruments rather than through a single framework for the protocols themselves. Tokenised funds sit under existing securities law, lenders and banks keep their usual obligations and supervisors, and each institution's counsel decides how those rules apply to a given use.

Two federal actions in 2025 shaped the picture. H.J.Res.25, signed on 10 April 2025, repealed an IRS regulation that would have treated DeFi front ends as tax-reporting brokers. The GENIUS Act then created a federal framework for payment stablecoins, including a bar on issuers paying yield to holders, covered in how the GENIUS Act and CLARITY Act reshape stablecoin yield. Market-structure legislation covering digital asset trading has been debated in Congress but hadn't become law as of September 2026.

Frequently asked questions

What is institutional DeFi?

The use of public blockchain lending markets, tokenised funds and vaults by regulated firms, with allow-listed participants, qualified custody, mandate limits and third-party reporting added around the open protocols.

What is an example of institutional DeFi?

Coinbase's bitcoin-backed loans run through Morpho markets, with about $1.4 billion outstanding on 22 September 2026. Aave Horizon, where qualified institutions borrow stablecoins against tokenised RWAs, is another.

Are banks using DeFi?

Some are. J.P. Morgan's JPMD deposit token runs on Base, and Société Générale-FORGE listed its EURCV and USDCV stablecoins for lending on Morpho and trading on Uniswap in September 2025.

How do institutions access DeFi without leaving custody?

The custodian holds the receipt token for a vault position in the client's segregated account, while the vault deploys the assets under a policy engine. Kraken Institutional clients use this route through Upshift.

What is a permissioned DeFi pool?

A lending market or vault where only verified addresses can take part on one or both sides. Aave Horizon permissions the collateral side and leaves stablecoin supply open.

Is institutional DeFi safe?

The controls reduce operational and counterparty risk, though smart contract, market and credit risk remain. Upshift has no smart contract insurance, so mandates that require cover need to source it separately.

Keep reading

• How Kraken Institutional clients access onchain yield from within custody. The custody-to-vault route in practice.
• How companies earn yield on idle treasury cash. Six options compared, onchain vaults included.
• Tokenized treasuries. The fund tokens institutions post as collateral.