How risk tiers work
Tiers A, B, C and D come from fixed rules applied to public, sourced facts; nobody types them in. A: meets every criterion. B: fails none, but does not meet them all, or a new incident awaits review. C: fails at least one. D: an incident may affect deposits right now; it lifts when the incident ends. Each tier is shown with the number of criteria met (for example B 4/5) to tell apart subjects in the same tier. A product’s tier is the worse of the coin and the venue.
Criteria by kind
Exchanges (CEX): counterparty risk
Tier A: meets all
- Publishes a monthly proof of reserves (Merkle)
- Holds at least one licence from a major regulator (an anti-money-laundering registration does not count)
- Operating for 5 full calendar years after the founding year (only the year is known, so it counts from the end of that year)
- Publicly discloses a user protection fund
- Has never left users with uncompensated losses
Tier C: failing one is enough
- No proof of reserves published. Audited financial statements showing customer assets held in full and segregated count as equivalent evidence: not C, but not A either (not frequent, not verifiable by users)
- Users suffered uncompensated losses in the last 3 years
DeFi protocols: smart-contract risk
Tier A: meets all
- Live for 3 years or more
- Audited by at least 2 firms
- Runs a bug bounty programme
- TVL of $1,000,000,000 or more
- No uncompensated losses in the last 5 years
Tier C: failing one is enough
- Live for under 12 months, or no public audit
- TVL below $100,000,000
- Uncompensated losses in the last 2 years
Stablecoins: does your money hold its peg
Tier A: meets all
- Reserves attested monthly by an independent firm, or collateral public on the blockchain
- Reserves are cash, bank deposits and short-term Treasury bills
- The issuer holds a licence from a major regulator (an anti-money-laundering registration does not count)
- Operating for 3 years or more
- Not below 0.97 in the peg currency (USD, EUR…) for more than 24 hours in the last 3 years
Tier C: failing one is enough
- No reserve attestation published
- Launched less than 12 months ago
Other coins (BTC, ETH…): asset quality, not price
Tier A: meets all
- Network live for 5 years or more
- Market cap in the top 10
- No organisation controls the supply or can freeze funds
- No network halt in the last 2 years
Tier C: failing one is enough
- No failing criterion of their own: other coins are tier A or B, or D while the network is halted. Legal action against the coin is disclosed but does not change the tier
Tier D: an incident right now (all kinds)
- Exchanges: withdrawals halted or restricted, sanctions, or enforcement against the entity holding customers’ money
- DeFi protocols: markets paused, unresolved bad debt, a governance attack
- Stablecoins: currently below 0.97 in the peg currency (USD, EUR…) and not recovered, redemptions halted, or enforcement against the issuer
- Other coins: the network is halted, or holders cannot move or redeem the coin
When the incident ends, the tier is worked out again from the criteria above. Tier D products are never suggested.
The "Rate spike" label (not a risk tier)
Very high rates rarely last: they are usually cut within days, or only apply to small amounts, new users or a limited quota. A product meeting either condition carries the label:
- Very high rate: the highest published rate is 50% a year or more.
- Rate just jumped: the rate rose in the past 7 days, the current rate is still at least 2 times what it was before that rise, and it is 15% a year or more.
The label changes no risk tier. A labelled product is never picked as a suggestion, and the full table lists it after the products open to everyone. A change caused by YieldCompanion changing how a rate is computed does not count as a jump.
Notes
- An incident that only hit an isolated market (for example a market set up by a third party on Morpho) is listed but not counted against the core product. Losses under $1,000,000 are listed but not scored; losses of unknown size are scored (conservatively).
- Regional notes (no licence in one country, leaving a market, an investigation without a finding) and the asset’s own risk (synthetic stablecoin, unsecured lending…) are always shown but never change the tier.
- TVL and the incident list of DeFi protocols update automatically every day from DefiLlama. A new incident is marked "awaiting review" and keeps the protocol at tier B at best until an admin confirms it.
- Exchange profiles are reviewed by hand periodically and after major events. The review date is shown on each profile.
- Stablecoins: a depeg of unknown duration counts as longer than 24 hours (conservatively). Only licences granted by major regulators (EU MiCA, New York NYDFS, US federal OCC, Singapore MAS, Hong Kong HKMA…) count; in-principle approvals, registrations and other state licences do not. Being slightly off the peg (above 0.97 in the peg currency (USD, EUR…)) only caps the coin at tier B.
- A coin’s tier does not include price risk. Interest on BTC, ETH… is paid in the coin itself, so its USD value can drop sharply even while the interest keeps coming. The ability of USDT and USDC to freeze wallets is disclosed but not penalised, since regulators require it.
- Third-party ratings are shown for reference but not scored: S&P Global’s Stablecoin Stability Assessment (1 very strong to 5 weak) and the CoinDesk Data Exchange Benchmark grade for exchanges (AA to F). Each line gives the edition and the source.
- Enforcement actions and settlements with regulators (for example Binance with the US Department of Justice in 2023) are disclosed on the profile but do not change the tier: the tier measures the risk to depositors’ money, and customers did not lose funds in those cases. When enforcement threatens depositors’ money (frozen assets, withdrawals halted), the exchange moves to tier D.
- No venue pays to be rated or ranked higher. Even tier A does not mean risk-free: assets deposited on an exchange or in DeFi can be lost, and a tier only reflects public information as of the review date.
Methodology changes
2 Oct 2026
- YieldCompanion starts with the rules above. Every later change is recorded here, with its date.