S&P Global is buying a smart-contract auditor to start rating the code behind stablecoins

S&P Global, the credit-ratings and financial-data company best known for rating corporate and sovereign debt, announced on September 17, 2026 that it has agreed to acquire OpenZeppelin, a provider of smart-contract security standards and audits. The deal is designed to extend S&P Global’s risk-assessment franchise beyond traditional credit analysis into the technical code that underpins stablecoins, tokenized funds and other decentralized-finance instruments — a category of risk that has nothing to do with an issuer’s balance sheet and everything to do with whether its software has exploitable bugs.

That distinction is the point of the acquisition. A traditional S&P credit rating assesses whether a bond issuer can repay its debt. A smart contract carries a different kind of risk entirely: whether its code has been audited rigorously enough to prevent hacks, exploits or bugs that can drain funds regardless of the issuer’s financial health. As stablecoins and tokenized funds have grown large enough to matter to institutional investors, demand has grown for a trusted third party to assess that code-level risk the way S&P has long assessed default risk — and buying an established auditor is a faster path to that credibility than building the expertise internally.

Under the deal, OpenZeppelin will continue operating under its own name as a distinct business unit rather than being folded into S&P Global’s existing ratings operation, with CEO Demian Brener reporting to Yann Le Pallec, president of S&P Global Ratings. Keeping the brand and leadership separate suggests S&P Global sees OpenZeppelin’s existing reputation within the crypto and DeFi developer community as valuable in its own right, not merely as a technical capability to absorb.

S&P Global has not disclosed financial terms, and the transaction is still subject to customary closing conditions, so the deal is not yet final. If it closes as announced, it would mark one of the clearest signals yet that a legacy credit-rating institution sees onchain financial infrastructure — stablecoins in particular, following the GENIUS Act’s passage — as a permanent enough part of the financial system to warrant its own dedicated ratings and risk-assessment practice, rather than a niche the company can ignore.