Policy
S&P Global Is Buying the Auditor Behind $37 Trillion in Transfers
OpenZeppelin writes the libraries most tokenized finance is built from, and its audits function as the industry's seal of approval. Under the deal announced Wednesday, the company that wants to rate on-chain risk will own the firm that inspects it.
S&P Global has signed an agreement to acquire OpenZeppelin, the smart-contract security firm whose code libraries sit underneath a large fraction of everything built on public blockchains. The deal was announced on September 17. Financial terms were not disclosed, the transaction is subject to customary closing conditions, and FinanceFeeds reports that S&P does not expect it to have a material impact on its financial results.
The size of the cheque is the least interesting thing about it. What S&P has bought is a position: OpenZeppelin is simultaneously the toolmaker, the standard-setter and the inspector for the code that tokenized finance runs on. Founded in 2015 — by Manuel Aráoz and Demian Brener, per FinTech Futures — the company says its Contracts libraries have underpinned more than $37 trillion in value transferred, that it has completed more than 900 security engagements, and that it has caught more than 10,000 vulnerabilities before they reached production.
What the rating agency says it is buying
S&P's framing is that on-chain assets carry a category of risk its existing machinery cannot see. Credit and market analysis were not built to evaluate a faulty access-control modifier. "Our digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move on chain," Yann Le Pallec, president of S&P Global Ratings, said in the announcement, as reported by PYMNTS.
That is a coherent thesis, and on its face an overdue one. If a money-market fund's shares become an ERC-20, the question "is the issuer good for it?" acquires a second half: "and does the contract do what the prospectus says?" Nobody in traditional ratings has been equipped to answer the second half. OpenZeppelin has been answering it, one engagement at a time, for a decade.
The stated structure preserves a good deal. OpenZeppelin keeps its name and operates as a separate business unit inside S&P Global. Brener stays on as chief executive and will report to Le Pallec. And the companies said that existing and future versions of the open-source applications will remain open source, with audits and other security engagements continuing under the same team.
OpenZeppelin, by the numbers it publishes — and the ones on disk
| Measure | Figure |
|---|---|
| Value transferred through its Contracts | $37 trillion+ |
| Security engagements completed | 900+ |
| Vulnerabilities found pre-production | 10,000+ |
| Contracts repository licence | MIT |
| GitHub stars / forks | 27,243 / 12,402 |
| Most recent commit to the library | Sep 18, 2026 |
The shape of the question
Ratings agencies buying analytics firms is ordinary corporate behaviour, and most such deals deserve no more than a paragraph. This one is worth more because of what the acquired firm does for everyone else.
An OpenZeppelin audit is not merely one vendor's opinion. In practice it operates as a passport: protocols announce it, exchanges and integrators look for it, and its absence is treated as a finding in itself. Meanwhile the Contracts library is the default starting point — the ERC-20 you are holding is, statistically, an OpenZeppelin ERC-20. S&P is acquiring an institution that writes the reference implementation, publishes the standard, and grades the homework.
Layer a ratings business on top and the arrangement acquires a shape worth naming out loud. If S&P eventually issues risk assessments of on-chain products, some meaningful share of those products will be built from libraries its subsidiary maintains and blessed by audits its subsidiary performed. A negative finding then travels awkwardly: it is a mark against the rated product and, at one remove, against the parent's own security business.
None of that is an allegation. There is no evidence of anything improper here, and the separation S&P describes — distinct unit, same audit team, same name — is the conventional remedy. But the credit-ratings industry's own history is the reason the question gets asked early rather than late. The structural critique that followed 2008 was never that analysts were dishonest; it was that the incentives were arranged so that nobody had to be.
The licence is the load-bearing commitment
Of the three assurances, one is enforceable by anybody and two are promises.
The Contracts library is MIT-licensed, a fact this desk confirmed directly from the repository rather than the press release. That licence is irrevocable for code already published. If a future owner tried to close the library, relicense it, or make the useful parts conditional on a commercial tier, the community's remedy is immediate and requires nobody's permission: fork the last free commit and carry on. Twelve thousand four hundred forks already exist. The repository was still taking commits on September 18, the day after the announcement.
The commitments about the audit team and the business unit's independence have no such backstop. They are undertakings by a buyer about how it will behave, and they last as long as the buyer wants them to. That is not cynicism about S&P in particular — it is true of every acquisition, and it is why the licence matters more than the reassurance.
Worth watching, then, in roughly this order: whether the open-source libraries keep their current cadence and stay MIT; whether audit reports continue to be published in full and unflattering detail, including for entities S&P rates; and whether any disclosure convention emerges when a rated product is running audited-by-subsidiary code. The last one has no precedent to borrow. Someone will have to invent it.
A decade from library to ratings asset
There is a longer arc here that is easy to miss inside the deal mechanics. OpenZeppelin began as a set of reusable contracts published free so that developers would stop writing their own token logic badly. That act of public-goods engineering is why the libraries ended up everywhere, and why being everywhere eventually became a thing an S&P could buy.
The same property that made the library valuable to the industry — that it is the common foundation nobody has to negotiate for — is exactly the property that makes its ownership newsworthy. Infrastructure is boring right up until someone acquires it.
The Take
Treat this as good news with a condition attached. On-chain products genuinely need risk assessment that can read a contract, and S&P buying the capability is faster and more honest than pretending its existing models already cover it. The condition is disclosure. The moment S&P Global Ratings publishes an assessment touching a protocol its subsidiary audited or whose code its subsidiary wrote, that relationship needs to be stated on the face of the document — not discoverable in a corporate structure chart. Ratings agencies learned this lesson in public once already, at considerable cost to everyone else. The version where they apply it in advance is available, and it is cheap.