Software is now free. Every codebase is one prompt away from your competitor. What do? Simple, compete on what cannot be generated: distribution, trust, and above all, permission.
It always was. Financial innovation has always been mostly the regulator giving you permission to do something new.
Our corner of the market makes this unusually literal. Deploying an on-chain vault takes one transaction. The contracts are audited, open source, and free. What you cannot deploy is everything around the contract: permission to pool other people's money, a compliance record a regulator can inspect, risk controls that stand apart from the strategy, and the trust of the people wiring the money in.
The assets are arriving faster than the permissions
Real-world assets on public blockchains passed $31 billion in July 2026, across 167 platforms, up more than 400% since the start of 2025. Tokenized US Treasuries alone crossed $10 billion in February and kept going.
Citi's base case is $5.5 trillion tokenized by 2030, more than 150 times what is on-chain today, and still under 4% of the $147 trillion professional asset managers run. The migration has not started yet; the permissions for it are being written now.
So who is catching this flow? Not whoever has the best contracts: the vault stack is audited, open source, and free to fork. The early winners share exactly one asset, and it is not on-chain.
Licensed at both ends, lawless in the middle
Effectively none of the $31 billion reached a blockchain without a license. The treasury funds at the top of the leaderboard are run by BlackRock, Franklin Templeton and WisdomTree under securities wrappers; the private credit book is originated by licensed lenders.
Downstream is distribution, and it is where retail shows up. Coinbase has originated more than $2 billion of on-chain loans through Morpho from inside its licensed app. Kraken's DeFi Earn took $611 million of deposits in its first six months. Retail arriving through open front-ends is a rounding error by comparison: measured across vaults, wallets under $10k are the majority of depositors and about 1% of the capital. Licensed app in front, DeFi in the back — the industry already calls it the DeFi mullet, and it is the distribution model now.
Between the two licensed ends sit the vault curators: roughly $7 billion of deposits, allocated at someone's discretion. The standard structure is a Panama, BVI or Cayman entity, terms that disclaim fiduciary duty, and liability capped at $1,000, sometimes $100. Almost none of that $7 billion sits behind an asset-management license. The largest venue's own terms state that it does "not have any information regarding any users, users' identities, or services beyond what is available or obtainable publicly via the blockchain".
The middle is where the losses live
Last November, a curated strategy called Stream Finance disclosed a $93 million loss that on-chain dashboards could not see. Its yield-bearing dollar token fell 77%, analysts mapped $285 million of exposure across seven networks, and about $1 billion left DeFi yield vaults within a week. Depositors recovered nothing, and there was no one to recover it from: the liability caps worked exactly as written. The only punishment available was withdrawal.
Regulators watched the same event. In July, SEC Commissioner Hester Peirce published a statement aimed squarely at vault curators, titled "Headstands and Summervaults": moving asset management on-chain "does not take those activities outside the scope of the laws the Commission administers", and no amount of "headstands, backflips, and other gymnastics" in reading the law changes that. Discretion over depositors' money is her leading indicator for when securities law applies. In Europe, ESMA has already said that MiCA's decentralisation exemption does not cover a service with an identifiable operator. The UK's regime lands in October 2027, and its decentralisation carve-out will not cover a vault whose founder still makes the trading decisions.
Nobody yet regulates vault curation by name, in any jurisdiction, and nobody knows which regime will end up owning it. What is datable is how close the drafting is: Hong Kong's licensing bill for on-chain asset management reaches its legislature this year, the UK's application gateway opens on 30 September, the EU's MiCA review closes for comment the same day, and the US market-structure bill sits on the Senate calendar for the same month.
The last unlicensed layer
Software being free did not flatten this market; it moved the moat. Upstream is settled: you will not out-license BlackRock. Downstream is settling: you will not out-distribute Coinbase. The last unlicensed layer is the middle one, discretion over pooled deposits. The entry ticket: a license to enter, and an operation that keeps you there. Risk limits set in advance. Controls that do not report to the strategy. Records a regulator can replay. The code is the one part you can copy.
The scramble is already underway, small and mid-sized funds are quietly moving: Avantgarde operates under a Bahamas asset-management license, MEV Capital routes its on-chain strategies through a Luxembourg AIF, and Tesseract took a full MiCA license and launched per-client vaults with 21Shares among the pilots, stating it outright: "Regulated capital demands structural asset segregation, independent parameters, and full onchain auditability." These are not the firms with the best smart contracts. They are the firms that have the paperwork, which, in a market where nothing about the moat can be retrofitted, is the entire trade.
What to do?
If you are building: aim at the new regimes, not around them. A DAO wrapper or an offshore terms-of-service page structures you out of personal liability, not into the market. Start in a vehicle that owes its investors the money: a BVI incubator fund takes 20 invited sophisticated investors, costs about $2,000, and opens in two business days. Build the operating record the real regimes ask for, limits set in advance, risk controls separate from the strategy, records a regulator can replay. Then convert into whichever regime the money you want answers to.
If you are allocating, do one thing today. Open the terms of the vault you are already in and find the liability number.
If it says $1,000, that is not a typo and not a worst case. It is the entire balance sheet behind the promise. On a bad day, you are holding an IOU from an entity that owes you one thousand dollars, against everything you lost.
Right now there is roughly $7 billion sitting in vaults like that. Somewhere inside it is the next Stream Finance. The dashboards can't see it. The terms say nobody has to show it to you.
We rebuilt @BlockHelix exactly for this thesis. The execution risk layer that forces fund compliance. We run our own capital through it and it's our risk infrastructure and audit trail.
Not legal or financial advice.