# Proposal: SAFO as USDe Backing Asset

**URL:** <https://gov.ethenafoundation.com/t/proposal-safo-as-usde-backing-asset/860>\
**Category:** General\
**Tags:** risk-committee\
**Created:** [October 22, 2026, 1:19pm UTC](https://gov.ethenafoundation.com/t/proposal-safo-as-usde-backing-asset/860 "2026-10-22T13:19:52Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlockworksAdvisory](https://yyz1.discourse-cdn.com/flex003/user_avatar/gov.ethenafoundation.com/blockworksadvisory/32/732_2.png) [@BlockworksAdvisory](https://gov.ethenafoundation.com/u/BlockworksAdvisory)\
**Post date:** [October 22, 2026, 1:19pm UTC](https://gov.ethenafoundation.com/t/proposal-safo-as-usde-backing-asset/860/1 "2026-10-22T13:19:52Z")

</div>

Blockworks Advisory concludes that the Spiko Amundi Overnight Swap Fund (SAFO) is eligible as a USDe backing asset, at an allocation of up to $500M through year end 2026 rising to $1bn in 2027. S&P rates the fund AAAf for credit quality and S1+ for volatility, the highest grades on both scales, assigned to the EUR share class on 29 September 2026 on the strength of the sub fund securities basket and its swap with BNP Paribas, which the USD share class used for this allocation shares through its own USD financing leg. The rating rests on a structure that holds its securities in full ownership at the depositary, settles its swap in cash every day and limits the fund exposure in a bank default to one day of market variation. The fund has met $820M of redemptions since its March 2026 launch and its published NAV has shown no drawdown. The allocation is governed by Ethena CDS trigger framework as follows: above 150bps on the swap counterparty five year CDS the position is cut to 5% of USDe backing and above 225bps it exits to zero.

The framework holds up under the 2007 to 2008 crisis. Applied with Ethena holding $1bn to the CDS paths of the five largest United States investment banks, the triggers cut or closed the position months before every failure in that sample. Daily spreads for approved counterparties, the JPMorgan and Citigroup average and Barclays, crossed both triggers in 2008 without a default. In the tightest case, Bear Stearns, the simulation conservatively assumes the second trigger fires only days before the rescue and Ethena exit is gated at the fund worst case pace. Failure three business days after the second trigger then leaves a one day loss of $10.06M and failure five days after leaves $5.66M, covered 6.21 and 11.05 times by the $62.50M gross Reserve Fund, exits cost at most $5.00M in swing pricing. The residual case is a default without prior spread widening, which none of the failures in that sample produced.

## Key takeaways

First, the fund is independently rated at the top of S&P’s scales. S&P assigned AAAf and S1+ to the EUR share class, citing the daily swap unwind and the fund short maturity profile, and assessed its management, organizational structure, risk management, compliance, credit culture and credit research as strong. S&P reviews the fund’s portfolio reports monthly against the rating.

Second, a performing counterparty leaves the fund with no exposure to its basket. Both swap legs settle in cash daily, so the published NAV behaves as a cash instrument. Across 138 observations from 3 March to 18 September 2026, drawdown and the worst one day and three day observations are all zero. Loss can arise only if the counterparty defaults, and the daily reset then limits the fund’s exposure to one day of market variation, calibrated through the 2007 to 2009 crisis at a worst one day move of 9.8%.

Third, the CDS triggers take Ethena allocation out ahead of a counterparty failure on the historical evidence. On the 2007 to 2008 investment bank spread paths, Lehman Brothers and Merrill Lynch crossed both triggers six months before their failure and acquisition, Bear Stearns crossed the first trigger seven months before its rescue, and Credit Suisse crossed them twelve and nine months before its rescue by UBS. Among approved counterparties, the JPMorgan and Citigroup average and Barclays crossed the first trigger in March 2008 and the second in the week of Lehman Brothers failure. At $1bn the largest loss in the stress test, a Bear Stearns failure three days after the second trigger with a gated exit, is $10.06M against a $62.50M gross Reserve Fund.

Fourth, the fund liquidity supports the exit the ladder requires. It has met $820M of redemptions since launch, all honoured, and the fund offers T+1 redemption for a full position. Neither the gate nor swing pricing has been exercised. Where the gate applies, more than 75% of a position return within five business days and all of it within 21, and swing pricing caps the cost of exit at 0.50% of NAV, $5.00M at $1bn.

## Background

SAFO is a sub-fund of Spiko SICAV, a French UCITS umbrella whose shares are natively tokenized, with the legal share register held onchain by Spiko Finance across eight public networks. Twenty First Capital is the management company, accountable to the regulator for governance, compliance and risk oversight. Amundi manages the portfolio and the swap as delegated investment manager and approves new G-SIB counterparties through its risk committees. CACEIS is depositary and administrator, holding the securities basket in custody, calculating the daily NAV and providing the onchain NAV feed. Spiko Finance handles tokenization, the wallet allowlist and the dealing desk and PwC is a statutory auditor.

The fund holds bonds, equities and money market instruments, and the prospectus states that the assets underlying the swap are held in full ownership by the sub-fund. It swaps the entire performance of that basket for one or more G-SIB counterparties for a financing rate benchmarked to the relevant overnight index plus a margin. Both legs execute cash settlement daily, so the fund carries no exposure to the basket’s performance while the counterparty performs, and the published NAV behaves as a cash instrument. All share classes hold the same securities basket and one swap on it with BNP Paribas, and each currency class has its own financing leg paying that currency’s overnight rate plus a margin, so the USD share class earns SOFR and the EUR class €STR. The prospectus sets SOFR as the legal benchmark for the USD share class. Spiko published product data currently displays the same share class against capitalized EFFR plus 50bps. The prospectus fee table permits a 0.25% management fee plus up to 0.10% in operating expenses, and the published NAV is net of both.

Dealing is daily, with orders clearing before a 12:25pm Paris cutoff at that day’s NAV and settling the next business day in fiat or USDC. On a redemption the fund closes out a commensurate portion of the swap through a sale of underlying assets and settles that day mark to market with the counterparty. The fund has processed $820M of redemptions since launch, all honoured at NAV. Two protective liquidity mechanisms sit above ordinary T+1 dealing, both required of a UCITS fund and both set out in the prospectus, and neither has been exercised. A gate may cap redemptions once net redemptions across all share classes exceed 25% of fund NAV on a dealing day, and it can run for up to 20 dealing days in a rolling three month window. Deferred orders are irrevocable, filled pro rata, and carry no priority over new requests at subsequent NAVs. A swing adjustment of up to 0.50% of NAV can be applied against net redeemers.

The basket was 99.9% large cap United States equities on 18 September 2026, with a concentration index of 4.02%. The mandate permits subordinated and perpetual bonds, covered bonds, and securitization vehicles including asset backed securities, residential mortgage backed securities, collateralized loan obligations and collateralized debt obligations, with ratings down to B- on the S&P and Fitch scales or B3 on the Moody’s scale. The fund’s holdings are published through Spiko’s public API, Ethena can exit at T+1, and absent a counterparty default the swap passes the basket’s full performance to the G-SIB counterparty.

## The failure case sample

Loss can arise only if the counterparty defaults, so it is calibrated on the basket, proxied by a large cap United States equity index consistent with the fund’s 99.9% equity composition. SAFO holds 146 equity lines with a concentration index of 4.02%, an effective count of about 25 names, and its ten largest positions are 55.6% of total net assets. That is more concentrated than a broad index, so a holdings weighted basket is the natural refinement and would raise the estimates. Every figure is a gross loss on the position held at the moment of default over one trading day, the exposure the daily swap reset leaves, and takes no credit for the recourse against the G-SIB that the memorandum describes.

Through the crisis window, the fifth percentile of the one day return distribution sits at −4.3%, the mean of the worst five percent of observations at −5.9%, and the single worst one day observation at −9.8%, on 15 October 2008. The loss figures in this analysis use that worst observation.

The anchor is stable across stress windows. The worst one day observation is 9.8% in the full 2007 to 2009 span, the crisis window and the two months following Lehman Brothers’ failure, and 10.9% in the March 2020 COVID shock.

 ![image](https://canada1.discourse-cdn.com/flex003/uploads/ethena/original/1X/ebe0c1b201d84de85c6081e746e63a80ee1a6b26.png)

Figure 1. Left: distribution of one day returns on a large cap United States equity index through the crisis peak-to-trough window, 9 October 2007 to 9 March 2009 (356 trading days yielding 355 one day returns), with the fifth percentile, raw CVaR5 and worst observation marked. Right: raw CVaR5 across four candidate stress windows with the worst one day observation in each, which is 9.8% in the three crisis windows and 10.9% in the COVID window.

A Generalized Pareto tail fitted to the crisis window places its 99.5th percentile loss and expected shortfall at 8.1% and 9.4%, both below the 9.8% observation, so the anchor is the more severe measure. The estimates take no credit for a rebound after a tail shock, which followed the crisis’s worst days on only half to three-fifths of occasions.

## Allocation and stress test

The allocation is capped at $500M through year end 2026 and rises to $1bn in 2027, 10.3% and 20.6% of the $4.84B of USDe backing outstanding on 19 September 2026. It is governed by the CDS trigger framework, consistent with the treatment of DeFi lending. Because the fund carries no basket exposure while the counterparty performs, the framework task is to have Ethena out before a counterparty fails. At $1bn, Trigger 1 cuts the position by $757.79M to $242.21M and Trigger 2 exits the remainder. The gross Reserve Fund stood at $62.50M on 20 September 2026 and is the measure of loss absorption used below.

| Step at $1bn | Position after | Maximum exit cost |
| --- | --- | --- |
| Trigger 1, CDS above 150bps | $242.21M | $3.79M |
| Trigger 2, CDS above 225bps | $0 | $1.21M |
| Both triggers | $0 | $5.00M |

We stress test the trigger framework on the 2007 to 2008 crisis. Five year CDS spreads of the five largest United States investment banks stood between 16bps and 22bps at the start of 2007 and between 240bps and 737bps on 14 March 2008, the week Bear Stearns was rescued. Lehman Brothers stood at 702bps on 12 September 2008, the last trading day before its bankruptcy. Applying each path to the swap counterparty with Ethena holding $1bn, the ladder cut or closed the position months before every failure. Lehman Brothers and Merrill Lynch crossed both triggers six months before their failure and acquisition. Bear Stearns crossed the first trigger in August 2007, seven months before its rescue, and the simulation takes very conservative view that its second trigger fired only days before the rescue, with Ethena exit queued behind the fund gate at a quarter of the remaining position per day. Failure three business days after the second trigger then leaves $102.18M in the fund and a one day loss of $10.06M, and failure five days after leaves $57.48M and $5.66M, covered 6.21 and 11.05 times by the $62.50M gross Reserve Fund. The simulation starts three business days after the second trigger because in every failure with a dated spread the second trigger fired weeks or months ahead with six months for Lehman Brothers, nine months for Credit Suisse and at least two weeks for AIG, whose spread stood at 375bps two weeks before its rescue. Where the exit settles T+1, as a redemption of $242.21M does on its own at 12.9% of fund NAV, the loss is zero. Morgan Stanley and Goldman Sachs, both approved counterparties, also crossed both triggers and survived, and for such paths the framework cost is the exit charge and the spread forgone while out of the fund.

Daily spreads for approved counterparties show the same sequence at full frequency. The JPMorgan and Citigroup average first exceeded 150bps on 7 March 2008 and 225bps on 16 September 2008, and Barclays on 11 March and 17 September 2008. In the week of Lehman Brothers failure the JPMorgan and Citigroup average rose from 150bps on 12 September to 229bps on 16 September, and Barclays from 133bps to 229bps between 12 and 17 September, so the second trigger can follow the first within days in a systemic shock. The six country bank average, which includes BNP Paribas and Société Générale, exceeded the first trigger on 14 March 2008 and peaked at 220bps in March 2009 without reaching the second. None of these banks defaulted, so on their paths the ladder holds Ethena at $242.21M from March 2008, exits in September 2008 where the second trigger fires, and costs only the exit charge and the spread forgone.

 ![image](https://canada1.discourse-cdn.com/flex003/uploads/ethena/original/1X/c554784112f826227ed28c801938197f6a14676a.png)

Figure 2. Left: daily five year CDS spreads, 2007 to 2009, for the JPMorgan and Citigroup average, Barclays and a six-country bank average including BNP Paribas and Société Générale, extracted from the Yale Program on Financial Stability chart (sources Bloomberg and IHS Markit), with the Bear Stearns and Lehman Brothers readings reported in Flannery, Houston and Partnoy (2010), against the 150bps and 225bps triggers. Right: one day loss at failure on a $1bn allocation following the Bear Stearns path, by business days between the second trigger and failure, three to ten, with Ethena exit gated at a quarter of the remaining position per day, against the $62.50M gross Reserve Fund.

| 2007 to 2009 path at $1bn | Exposure at failure | Loss at failure |
| --- | --- | --- |
| Lehman Brothers, both triggers six months ahead | $0 | $0 |
| Merrill Lynch, both triggers six months ahead of acquisition | $0 | $0 |
| Bear Stearns, Trigger 2 exit settles T+1 | $0 | $0 |
| Bear Stearns, gated exit, failure three days after Trigger 2 | $102.18M | $10.06M |
| Bear Stearns, gated exit, failure five days after Trigger 2 | $57.48M | $5.66M |
| Morgan Stanley and Goldman Sachs, both triggers, no default | $0 | $0 |
| JPMorgan and Citigroup average, both triggers, no default | $0 | $0 |
| Barclays, both triggers, no default | $0 | $0 |

Daily settlement is what limits a default to one day of exposure. It cancels the basket moves while the counterparty performs and when payment stops the fund closes out the swap and sells the basket, which it owns outright. S&P states that because the swap resets to zero every business day, the fund limits its exposure to one day of market variation in a bank default. The loss figures price that day on whatever position remains in the fund when the default occurs.

The redemption gate is a timing mechanism and does not represent a loss channel. While the counterparty performs the fund carries no basket exposure and the memorandum describes the fund liquidating the basket on a T+1 basis upon a default notice. The gate tests net redemptions of all share classes combined against the sub-fund net assets, which were €1,460M across all classes on 18 September 2026, about $1.64B at the fund own valuation rate. Holding other balances at that level, a $500M subscription would make Ethena 23.4% of fund NAV, inside the 25% threshold at which the gate may apply, and a $1bn subscription 37.9%, so a full exit at $1bn can exceed it. Under the gate more than 75% of a position return within five business days and all of it within 21. A Trigger 1 reduction from $500M to $242.21M is 12.0% of fund NAV and settles T+1. From $1bn the reduction is 28.7% of fund NAV and may be gated, which leaves it complete within weeks of a trigger that historically fired months ahead of failure. Swing pricing caps the cost of exit at 0.50% of NAV, $2.50M at $500M and $5.00M at $1bn.

## Counterparty monitoring

BNP Paribas is the only active swap counterparty, against twelve further G-SIB names Amundi has pre-approved. The swap is entered into by the sub-fund, so counterparty exposure is shared across all SAFO holders and share classes. Ethena cannot isolate its exposure to a single counterparty inside the pooled vehicle even after a second G-SIB is onboarded.

The memorandum sets two hard triggers on BNP Paribas’s five year credit default swap. Above 150bps, SAFO is capped at 5% of USDe backing, or $242.21M against the $4.84B outstanding on 19 September 2026. Above 225bps, the position exits to zero. The indicative observation on 17 September 2026 is 44.64bps, which sits 55.36bps below the recommended 100bps watch level and 105.36bps below the first trigger. The ladder does not constrain the position at that spread. At the agreed caps a Trigger 1 breach requires a reduction of $257.79M from $500M and $757.79M from $1bn. Ethena commits to manage exposure in line with the ladder, to flag any trigger breach to the Risk Committee as it arises and to flag new TRS counterparties as they are added.

| Band | Threshold | Action |
| --- | --- | --- |
| Pre-trigger | Below 100bps | $500M through 2026, $1bn from 2027 |
| Watch (recommended) | 100bps, or +30bps in five days | Freeze new scaling |
| Trigger 1 | 150bps | Cap at 5% of backing; halt new subscriptions |
| Trigger 2 | 225bps | Exit to zero |

A credit default swap spread converts into a default probability only under explicit assumption. A standard reduced form model treats the spread as compensation for a constant annual hazard, with the hazard rate equal to the spread divided by one minus an assumed recovery rate. At that observation and the 40% recovery convention applied to senior unsecured financial institution debt, the hazard rate is 0.744% per year. It compounds to a cumulative market implied default probability of 0.74% in one year, 2.21% in three years and 3.65% in five years. Two qualifications bound those figures. First, they are risk neutral probabilities priced off what the market charges for protection, which run above real world default rates for an investment grade name. Second, the constant hazard shortcut also ignores discounting, the two legs and the term structure of the credit curve. As an order of magnitude, the result is consistent with BNP Paribas long term ratings of A+ from S&P, as stated in its 29 September 2026 rating report on the fund, AA from Fitch and A1 from Moody’s.

 ![image](https://canada1.discourse-cdn.com/flex003/uploads/ethena/original/1X/8ce669fa0a5e443835ed3893b9ea16c91d7e18a7.png)

Figure 3. Left: sixty-three day rolling correlation between equity returns and credit widening, proxied by the inverse of a high yield credit fund’s daily return, 2007 to 2010. Right: sixty-three day annualised realised equity volatility against the CBOE VIX, 2007 to 2009, with the crisis peak-to-trough window shaded.

Credit stress and equity stress move together, which times the ladder to the episodes that drive basket losses. Sixty-three day rolling correlation between equity returns and credit widening averaged −0.42 through the 2007 to 2009 window and reached −0.83 at its most negative, with credit widening proxied by the inverse of a United States high yield credit fund’s return in the absence of a licensed BNP Paribas history. Realised equity volatility and the CBOE VIX rose together through the crisis, the VIX peaking at 80.9 on 20 November 2008. Spreads therefore widen alongside equity stress, and while the counterparty performs that equity moves stay with the counterparty and do not reach the NAV.

## Carry and diversification

The fund realised return is the relevant carry. Cumulative return over 138 observations from 3 March to 18 September 2026, a span of 199 calendar days, is 2.14%. SOFR is quoted simple on an actual over 360 basis, and on that basis the fund annualises to 3.87% against a SOFR average of 3.63% over the same dates, a realised spread of 24bps. Compounded conventions raise the spread to as much as 34bps. The regime comparison that follows uses SOFR plus the 24bps realised spread as SAFO carry.

Ethena backing book holds lending and basis trade positions, and staked USDe is a derived yield on those positions. The informative comparison runs SAFO carry against those two assets, each against its own regime driver over the observed history. Basis funding has the longer record, 26 March 2021 to 17 September 2026, 1,359 observations, split at its own median of 6.30%. SOFR moved substantially over that span, so SAFO carry is not constant across the split, averaging 3.39% in the low funding regime and 3.90% in the high. Basis funding is considerably more variable, at 0.87% in the low regime, an excess of −2.52pp against SAFO carry, and 13.85% in the high regime, an excess of +9.95pp. It exceeds SAFO carry on 100% of high funding days and 31% of low funding days.

The lending assets are a balance weighted blend across Aave, Morpho, Kamino and Jupiter Lend, each venue’s stablecoin supply APY weighted by its share of Ethena’s lending allocation. Venue level rate history exists from 9 June 2025 to 17 September 2026, giving 319 observations split at the blend’s median of 3.17%. SAFO carry varies across this split too, 3.89% below the median against 4.34% above it, a move of 0.44pp. The blend moves from 2.59% to 4.07%, or 1.48pp, more than three times as far. The lending assets SAFO carry in both halves, with a mean excess of −1.30pp below the median and −0.27pp at or above it. They never exceed it in the low half and exceed it on 23% of days in the high half. The gap narrows in the high lending regime because the blend own rise outpaces SOFR.

 ![image](https://canada1.discourse-cdn.com/flex003/uploads/ethena/original/1X/c87844d1fb70bd69fce24405dbbcd8c09e94c096.png)  
43  
Figure 4. Asset APY and SAFO’s carry at SOFR plus its realised 24bps spread, each split at the median of that panel’s own regime driver. Left: basis funding, 26 March 2021 to 17 September 2026 (n=1,359). Right: the balance weighted DeFi lending blend, 9 June 2025 to 17 September 2026 (n=319).

SAFO carry exceeds the lending assets in every regime cut, and lending is the larger claim on the book. As of 30 July 2026, DeFi lending across those four venues accounts for $1.40B and institutional lending for a further $386M, a combined 47.5% of the $3.77B book.

Adding SAFO does not diversify away from that lending exposure. SAFO failure case is an equity basket crash paired with a G-SIB default. Onchain lending stress arrives through a different trigger with a stablecoin depeg, an oracle failure, or a collateral price crash driving liquidation cascade and the two are not independent in a systematic tail. A crisis severe enough to push BNP Paribas toward its credit trigger is a plausible co-mover with a broad digital asset selloff, which is precisely when utilisation and liquidation risk across the four venues are elevated. This is a conservative mechanism argument since DeFi lending has no history through a crisis of 2008 scale. Therefore, we recommend treating SAFO and the lending assets as exposed to a shared systematic tail when sizing the combined book.

## Risk considerations

Counterparty concentration. BNP Paribas is the only active counterparty and the swap sits at fund level, so exposure is pooled across all SAFO holders. S&P states that its fund credit rating is largely determined by BNP Paribas’s creditworthiness as the sole swap counterparty. Until a second counterparty is active and a per name allocation mechanism exists, the credit ladder monitors a single point of counterparty risk and cannot manage one bank exposure independently of another. We recommend specifying how the trigger levels apply across more than one counterparty. A dedicated share class or side vehicle is the precondition for per-name control.

Basket composition discretion. The mandate permits a shift out of the current all equity basket into subordinated and perpetual bonds, covered bonds and securitization vehicles down to a B-/B3 rating floor. Every severity figure here is calibrated to the current large cap equity book and would need to be re-estimated if composition changed materially.

Redemption at size. The fund has honoured $820M of redemptions since launch and offers T+1 redemption for a full position. The prospectus gate remains available to the management company, so a full exit at $1bn, about 38% of fund NAV, can take up to 21 business days.

Default without spread warning. The trigger framework protects against a counterparty whose spread widens before failure, as every failure in the 2007 to 2008 sample did. A default arriving while spreads sit below 150bps would expose the full position to the one day move, $98.45M at $1bn on the crisis calibration. The memorandum places the practical enforcement range at one to three days, depending on the speed of enforcing the default, and a second day raises the worst observation from 9.84% to 13.36%. The underlying ISDA documentation, which governs that timeline, is an open diligence item.

Rating scope. S&P assigned AAAf and S1+ to the EUR share class on 29 September 2026 and reviews the fund monthly. The allocation is made in the USD share class, which shares the sub-fund securities basket and its swap with BNP Paribas with the EUR class through a separate USD financing leg. The prospectus keeps the sub-fund accounting in euros, classes the USD share class as unhedged and states that in a counterparty default the sub-fund becomes exposed to the portfolio securities and to currency risk, so a USD holder loss in a default could include a currency effect alongside the one day basket move.

## Conclusions

SAFO clears eligibility as a USDe backing asset, rated AAAf and S1+ by S&P, at an allocation of $500M through year end 2026 rising to $1bn in 2027 under the CDS trigger framework: above 150bps the position is cut to 5% of USDe backing, $242.21M on 19 September 2026 backing, and above 225bps it exits to zero. We recommend reviewing the cap once a second G-SIB counterparty is active.

The fund only route to a loss is a counterparty default and the daily reset limits that to one day of market variation. Tested against the 2007 to 2008 crisis at $1bn, the trigger framework cut or closed the position months before every failure on the spread paths of the five largest United States investment banks, and daily spreads for approved counterparties, the JPMorgan and Citigroup average and Barclays, crossed both triggers without a default. In the tightest case, Bear Stearns with a gated exit, failure three and five days after the second trigger leaves losses of $10.06M and $5.66M, covered 6.21 and 11.05 times by the $62.50M gross Reserve Fund, and exits cost at most $5.00M in swing pricing. The fund has honoured $820M of redemptions since launch and has never exercised its gate.