DeFi Lending for Treasury Teams: A CFO Control Guide

What Is DeFi Lending From a CFO's Control Perspective?

DeFi lending, from a finance-function view, is a non-custodial money-market position: you supply an asset to a smart contract and hold a receipt token, not a claim on an institution. Category TVL was $50.11B in September 2026 (DeFiLlama Lending, September 2026). RheoFi treats control as question one.

The Receipt Token in Plain Terms

Supply an asset and you get an rToken, an on-chain balance for your share of one pool. RheoFi's rTokens do not rebase: unit count stays fixed while redemption value rises, so you reconcile a rate, not a quantity. Ownership evidence is a wallet and a contract address, which pulls key custody into scope.

---

DeFi Lending vs Bank Deposits and Money Market Funds: Which Control Model?

Choose the non-custodial model when your evidence requirement is a verifiable on-chain balance, and a deposit or fund when you need a custodian statement and a recall path. 72% of finance leaders call a digital-asset offering competitive necessity (Ripple Digital Asset Survey, March 2026). RheoFi serves the first model.

Control Model Comparison

The Two Rows That Decide It

Freeze-or-reverse and audit evidence settle it. Irreversibility removes the recall path, so control moves upstream into signing and whitelisting. The offset is evidence an auditor can verify at any block.

---

Why Does DeFi Lending Reach the CFO's Desk in 2026?

Digital assets have entered mainstream treasury plumbing, so the question now arrives as an agenda item. A platform processing 13 trillion dollars of annual payments volume now carries native XRP accounts (CoinDesk, April 2026), against a $50.11B lending category (DeFiLlama, September 2026). RheoFi argues finance should own this.

Demand Signals From Finance Leaders

Among more than 1,000 finance leaders surveyed across banks, asset managers, fintechs and corporates, 74% said stablecoins improve cash-flow efficiency and release trapped working capital (Ripple survey, cash-flow finding, March 2026). The pull is working-capital engineering.

Where RheoFi Runs Today

RheoFi's testnet markets run on the XRPL EVM Sidechain, live since June 2025 (Ripple Insights, June 2025).

---

How Does a Non-Custodial Lending Position Flow Through Your Books?

Your books see an asset you still own, not a receivable from a custodian: supplied units mint a receipt token whose redemption value climbs as borrowers pay. A published representative testnet curve bends at 80% utilization (whitepaper v1.0 Jump Rate parameters, 2025). RheoFi fixes unit counts, so reconciliation follows one rate.

The Period-End Reconciliation

At each close capture the receipt-token balance, the exchange rate at that block, and the redemption value. Period income is the change in redemption value, net of supplies and withdrawals. Mechanics live in the supply walkthrough and the borrow guide.

Collateralization Is a Separate Decision

Hold a receipt token for yield alone and you stay outside the liquidation surface. Pledge it as collateral and you have opted into a borrowing position. Two policy clauses, not one.

---

Which Components Belong in a Treasury DeFi Control Framework?

Nine components carry it: permitted instrument, counterparty, key custody, segregation of duties, wallet register, position cap, parameter monitoring, evidence pack, reporting cadence. Collateral factors sit under a hard 95% ceiling in protocol code, typically 40% to 90% (whitepaper v1.0 Comptroller bounds, 2025). RheoFi publishes those bounds for policy reuse.

Nine Components to Document

1. Permitted-instrument clause. Name and bound the position.
2. Counterparty section. What replaces a custodian: code, governance roles, oracles.
3. Key custody. Multi-signature signing, documented quorum, tested recovery.
4. Segregation of duties. Separate who proposes, signs and reconciles.
5. Wallet register. One list of addresses, signers, approvals.
6. Position cap. An aggregate limit and a per-pool limit.
7. Parameter monitoring. Track governance changes to collateral factors, caps, oracles, reserves and pauses, starting from the five risk layers.
8. Evidence pack. A standing folder: addresses, balances, rates, reviews.
9. Reporting cadence. A fixed line in the audit-committee report.

---

Build the Control Layer Before the Allocation

RheoFi runs an isolated-pool money market on XRPL EVM, so a treasury caps exposure per pool rather than across a shared book.

Review the published pool parameters and run your control workflow on testnet.

Protocol code inherits 15 security engagements; a RheoFi-specific mainnet audit is planned.

Launch App → | Read the Docs →

---

How Do You Get a DeFi Lending Allocation Approved in 8 Steps?

Approval runs as a governance workflow ending in a board-accepted policy and a testnet pilot, not a wallet connection. 74% of corporates plan to work with partners offering the digital-asset solutions they want (Ripple survey, partnering finding, March 2026). RheoFi's position: control workflow first, sizing second.

The Eight-Step Approval Path

1. Problem statement. One page: which balances sit idle, and why.
2. Policy amendment. Define instrument, permitted protocols, aggregate and per-pool caps.
3. Counterparty analysis. Document code, governance roles, oracles, backstop.
4. Loss tolerance. Agree what the board absorbs, then derive the caps.
5. Control matrix. Signers, approvers, reconcilers, and their evidence.
6. Legal and audit brief. Send the draft policy and analysis early.
7. Testnet pilot. Execute supply through withdrawal across one full period-end close, keeping every artifact.
8. Board approval. Present policy, caps, matrix and pilot evidence.

---

Risk and Security: What Should a CFO Quantify and Cap?

Quantify two numbers and cap both: the loss the entity can absorb, and the share of treasury exposed to one pool. DeFi protocol losses reached $680M in 2025, up from $534 million in 2024 (Immunefi DeFi loss data, April 2026). RheoFi's isolated pools bound the blast radius.

Sizing the Loss Number

Against the $50.11B lending category, DeFi-wide $680M is a crude upper bound near 1.4%, and Immunefi traces the 2025 rise to a handful of large events. Industry-wide theft totals run higher because they count exchange compromises (Chainalysis, December 2025). Grade each pool with the risk scorecard.

Ask for the Report, Not the Firm Name

Diligence turns up two records. Whitepaper v1.0 discloses 15 inherited engagements across six firms, covering the isolated-pool core, risk fund, comptroller and liquidations. The live security and audits page lists four firms with dated scopes, Certik May 2025 through OpenZeppelin November 2025, every View Report link a placeholder with no file behind it. The records do not reconcile: OpenZeppelin appears on the page but not among the whitepaper's six, and no file backs either list. The whitepaper records a RheoFi-specific mainnet audit as planned, not done.

Liquidity and Backstop

Withdrawal depends on pool liquidity, so a high-utilization pool can delay an exit when nothing has failed. Reserves sit per pool in the Risk Fund, so one auction never consumes another pool's; see depositor protection and the shortfall reference.

---

How Does the Regulatory and Compliance Framework Apply to Treasury DeFi?

Two regimes shape the paperwork: US accounting guidance for SEC filers, and MiCA in the EU. Regulation (EU) 2023/1114 applies from 30 December 2024, with Titles III and IV from 30 June 2024 (EUR-Lex MiCA Article 149, 2023), across a $50.11B lending category as of September 2026. RheoFi's position: classification gets settled with your auditor.

What SAB 122 Did, and What It Did Not Do

Staff Accounting Bulletin 121 put a safeguarding liability under Topic 5.FF on entities holding crypto for platform users (SEC Staff Accounting Bulletin 121, March 2022). Bulletin 122 rescinded it on January 30, 2025, pointing entities to ASC 450-20 or IAS 37 (SEC Staff Accounting Bulletin 122, January 2025). A treasury supplying its own assets was never inside Topic 5.FF, so neither bulletin books your position.

The Question to Put to Your Auditor

Owned crypto sits under Subtopic 350-60, effective for fiscal years beginning after December 15, 2024, at fair value through net income. Its scope covers only assets that "do not provide the asset holder with enforceable rights to or claims on underlying goods, services, or other assets" (FASB ASU 2023-08, December 2023). A receipt token is a claim on what you supplied, so ask whether it sits outside that scope.

MiCA and the Governance Expectation

MiCA Recital 22 excludes services provided in a fully decentralised manner without any intermediary, a narrow condition, not a carve-out; perimeter analysis sits in how MiCA applies to European institutions. Financial Stability Board recommendations of 17 July 2023 expect clear lines of responsibility (FSB high-level recommendations, July 2023), and its February 2023 review warns the degree of decentralisation varies broadly (FSB DeFi review, February 2023). BIS says the same of governance power (BIS Quarterly Review, December 2021).

The Evidence Pack, as a Checklist

• Contract addresses, from deployed markets.
• Receipt-token balance and exchange rate at period end, with block height.
• Security review lineage, with report files where published, from the audit history.
• Oracle configuration, naming the sources that value collateral.
• Governance role register of admin and timelock roles.
• Transaction hashes for every supply, withdrawal and parameter change.

---

Conclusion: Is a DeFi Lending Allocation Defensible to Your Board?

Defensible, yes, once the finance function owns the controls and sizes the position against a loss number the board accepted. Sector losses fell roughly 80% from the $2.62B peak of 2022 to $534 million in 2024, then rebounded to $680M in 2025 (Immunefi six-year loss series, April 2026). RheoFi's honest answer is diligence and a pilot.

What to Do Next

Contracts run on testnet; mainnet remains subject to further audits and governance approvals. A CFO can still finish most of the work now: the policy amendment, the counterparty analysis, and a testnet pilot that produces evidence. Start with the protocol FAQ, then brief legal.