The Day a Rating Agency Bought an Auditor: S&P Global's OpenZeppelin Acquisition and the Rating-ization of Code Risk

A Rating Agency Buys a Smart Contract Auditor

On September 17, 2026, S&P Global (NYSE: SPGI) announced it had entered into an agreement to acquire OpenZeppelin, a blockchain security company. Financial terms were not disclosed, and S&P stated the transaction is not expected to have a material impact on its financial results. Closing remains subject to conditions. OpenZeppelin will continue to operate under its own name as a separate business unit, with CEO Demian Brener continuing to lead it. He will report to Yann Le Pallec, President of S&P Global Ratings — a reporting line that says a great deal about the nature of this deal. Jefferies served as financial advisor to S&P and FT Partners to OpenZeppelin, with Clifford Chance and Cooley acting as respective legal advisors.

The Dual Position OpenZeppelin Occupies

Founded in 2015, the company runs on two pillars. The first is OpenZeppelin Contracts, a reusable smart contract code library that provides standard implementations for token issuance and permission management. According to S&P's announcement, value transferred through this library exceeds $37 trillion (roughly JPY 5,700 trillion at 155 yen to the dollar), and the vast majority of the largest stablecoins and tokenized funds are built on these standards. The second pillar is security audit and secure development services: more than 900 security engagements to date, surfacing over 10,000 vulnerabilities before production. In other words, the company both makes the components the industry builds with and inspects what gets built from them. That dual position is precisely what S&P has acquired. In its own announcement the same day, OpenZeppelin stated that the Contracts libraries will remain open source, free, and publicly maintained on GitHub; that every released version remains open source permanently and cannot be withdrawn by anyone; and that future versions will stay open source. Audits and engineering work continue with the same team.

The Digital Asset Stack S&P Has Been Assembling

This acquisition is not a standalone deal but the final piece of a deliberate accumulation. S&P Global Ratings has offered Stablecoin Stability Assessments since December 2023, scoring peg-maintenance capability on a five-point scale from 1 (very strong) to 5 (weak). In November 2025 it downgraded Tether's USDT from 4 (constrained) to 5 (weak), citing rising exposure to high-risk assets in reserves and persistent disclosure gaps. As of August 2026, six of the eleven stablecoins assessed sat at adequate or above. On the data layer, S&P Dow Jones Indices and crypto data firm Kaiko launched the co-branded S&P Kaiko Digital Asset Indices on September 1, 2026, and on September 14 S&P Global announced it had led a strategic investment in Kaiko. Issuer-level asset assessment, market data, and benchmark indices were all in place; the missing layer was risk assessment of the technology itself. Le Pallec has stated that the digital assets strategy centers on bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain.

What Is New: Code Risk Becomes a Rateable Component

In traditional finance, credit risk, market risk and operational risk each have established assessment methodologies. With tokenized financial products, however, a defect in the smart contract representing a right or asset can produce losses even when the underlying is sound. Until now, this technology-layer risk has been reduced to a binary judgement — does a report from a well-known auditor exist — rather than a measure comparable across products. What S&P purchased is the capability to make this layer assessable. The phrasing in the announcement about creating the next generation of onchain security assessments and benchmarks is telling: the objective is not audit revenue but the generation of assessments and benchmarks. In practice, this means that when institutional investors select tokenized products, the technical risk level of the contract will sit alongside the credit quality of the underlying asset as a criterion for comparison.

The Open Question: The Standard-Setter as Assessor

A structural issue arises at the same time. OpenZeppelin is the provider of the industry-standard library, the performer of audits, and will now, under S&P, participate in generating assessments and benchmarks. Systems built using its own standards will be audited by its own group and assessed by its own group. The conflict-of-interest problem the ratings industry has carried for decades risks being transplanted directly into the onchain technology layer. OpenZeppelin's unusually forceful commitment to the permanence of its open source licensing reads as an attempt to pre-empt this concern. But open source code and independence of the assessment process are separate questions.

[Business Development Insights]

1. Issuers of tokenized products need to shift their preparation from obtaining an audit report to obtaining an assessment. Until now, smart contract safety has been a domain where presenting a report from a recognized auditor sufficed. Once a rating agency productizes technology-risk assessment and benchmarks, institutional selection processes gain the ability to compare products, and the assessment level itself becomes a distribution constraint. For Japanese financial institutions designing tokenized securities or yen stablecoins, treating the audit as a final development stage risks discovering too late that design requirements for a favorable assessment cannot be retrofitted. Assessment criteria need to enter the requirements list at the design stage.
2. Owning a de facto open source standard is difficult to monetize on its own, yet generates value the moment assessment or benchmarking is layered on top. OpenZeppelin gave its library away for a decade and thereby came to occupy a position underpinning more than $37 trillion in value transferred. That position could only be partially monetized through audit services; it becomes an assessment business only in combination with a rating agency. For Japanese companies supplying components or specifications in the blockchain space, prioritizing adoption as a standard over direct monetization — and planning an assessment, certification or benchmarking layer above it — may be the sequence that yields the larger opportunity.
3. Users of these assessments need to verify which layer's independence is actually protected. A structure where the standard-setter, the auditor and the assessor belong to the same group is isomorphic to the issuer-pays problem the ratings industry has long carried. Financial institutions intending to use S&P technology-risk assessments in investment or product selection should establish, before adoption, how information barriers between audit and assessment functions are designed and what mechanism prevents adjustment of assessments for engagements using the group's own library. Because a state with multiple independent assessors is preferable, maintaining relationships with audit and assessment providers outside OpenZeppelin in parallel is the rational procurement stance from a risk management perspective.

[Sources]

S&P Global, "S&P Global Announces Agreement to Acquire OpenZeppelin" (September 17, 2026) https://press.spglobal.com/2026-09-17-S-P-Global-Announces-Agreement-to-Acquire-OpenZeppelin OpenZeppelin, "S&P Global Enters Agreement to Acquire OpenZeppelin" (September 17, 2026) https://www.openzeppelin.com/news/spglobal-enters-agreement-to-acquire-openzeppelin Atarashii Keizai, "S&P Global Agrees to Acquire OpenZeppelin, Strengthening Onchain Finance Risk Assessment" (September 18, 2026) https://www.neweconomy.jp/posts/609024 Atarashii Keizai, "S&P Global Leads Strategic Investment in Crypto Data Firm Kaiko; Series B Totals JPY 17 Billion" (September 2026) https://www.neweconomy.jp/posts/607978 S&P Global Ratings, "More than half of Stablecoin Stability Assessments are adequate or above" (August 4, 2026) https://www.prnewswire.com/news-releases/sp-global-ratings-more-than-half-of-stablecoin-stability-assessments-are-adequate-or-above-302842767.html CoinDesk, "S&P Downgrades Tether's USDT, Citing Falling Bitcoin Prices as Risk" (November 26, 2025) https://www.coindesk.com/policy/2025/11/26/s-and-p-downgrades-tether-s-usdt-citing-falling-bitcoin-prices-as-risk S&P Global Ratings, "Stablecoin Stability Assessment" product page https://www.spglobal.com/ratings/en/products/stablecoin-assessments Atarashii Keizai, "S&P Downgrades USDT to Lowest Assessment, Citing Riskier Reserves and Disclosure Gaps" https://www.neweconomy.jp/posts/521390