Credit ratings giant S&P Global has agreed to acquire smart contract security firm OpenZeppelin, according to an official announcement, expanding its risk assessment business to the code underpinning tokenized financial products.

OpenZeppelin's code libraries have underpinned more than $37 trillion in value transferred through stablecoins, tokenized funds, and DeFi protocols. Financial terms were not disclosed, and S&P Global said the deal is not expected to materially affect its financial results.

Extending Risk Assessment Onchain

Announced on Thursday, the deal will give S&P Global access to OpenZeppelin's smart contract security tools and technical expertise as banks and asset managers move more financial products onto blockchain networks.

The move extends a business built on rating the creditworthiness of bond issuers into a market where risk lives in code: smart contracts execute automatically and generally cannot be altered once deployed, so weaknesses in their design put user funds directly at stake — making independent security assessments a natural complement to traditional credit ratings.

"As digital assets and tokenized markets continue to mature, OpenZeppelin's technology and expertise complement our smart contract and onchain technology risk assessment capabilities, giving traditional financial institutions and DeFi-native companies alike the confidence to build and transact in this new environment," Yann Le Pallec, President of S&P Global Ratings, said in a statement.

S&P Global says its digital assets strategy centers on "bringing trusted data, benchmarks and transparent risk assessment to markets as they move onchain." The company said OpenZeppelin will help it develop security assessments, benchmarks, and data services covering the technical risks associated with onchain financial products.

About OpenZeppelin

Founded in 2015, OpenZeppelin develops open-source smart contract libraries and provides security assessments and development services. Smart contracts are programs, found on blockchains including Ethereum, Solana, and Cardano, that automatically execute transactions when predetermined conditions are met. Because the libraries are open source, developers can inspect and reuse the code freely, and they have become widely adopted building blocks for projects deploying on Ethereum and other networks — the reach behind the $37 trillion figure.

OpenZeppelin will continue operating under its own name as a separate S&P Global business unit. Co-founder and CEO Demian Brener will remain in charge and report to Le Pallec.

"OpenZeppelin's standards, technology, and expertise already power the infrastructure behind the world's leading stablecoins, tokenized funds, DeFi protocols, and onchain markets," Brener said in a statement. "With S&P Global, that foundation reaches a broader set of organizations entering this market, as well as the blockchain networks and DeFi protocols gaining institutional adoption."

A Broader Digital Assets Push

The acquisition builds on S&P Global's wider expansion into digital assets. S&P Dow Jones Indices previously helped develop the S&P Digital Markets 50 Index, which combines 35 blockchain-related stocks with 15 cryptocurrencies and was designed to gain onchain verifiability through Chainlink.

The deal also comes as institutional interest in tokenized financial products grows. BlackRock recently launched tokenized money market funds on Solana and Ethereum, while banks have explored blockchain networks for tokenized deposits, stablecoin payments, and automated settlement.

The regulatory landscape is shifting as well. The SEC introduced an "innovation exemption" allowing qualifying platforms to trade tokenized U.S. stocks on public blockchains without registering as national securities exchanges, days after the Clarity Act stalled in the Senate.

How quickly S&P Global folds OpenZeppelin's security assessments and benchmarks into its ratings and data products will provide an early read on how traditional risk frameworks translate to onchain markets.