Development of Institutional Lending System
Retail DeFi lending (Aave, Compound) built on overcollateralization: want to borrow $100 — lock $150. Institutional lending works differently: hedge fund or market maker with proven reputation wants undercollateralized credit for $10M under trading strategy returning money in 48 hours. Overcollateralization for such participants meaningless — kills returns.
Fundamentally different architecture: identity/KYC layer, credit scoring, legal enforcement framework and portfolio risk management instead of simple health factor.
Key system components
Identity and KYC layer
Institutional credit impossible without borrower verification. On blockchain solved via:
Verifiable Credentials (ERC-7093 / W3C VC standard). Trusted issuer (regulator, compliance provider) issues signed credential confirming KYC/AML status. Contract verifies credential signature without storing personal data on-chain.
Soulbound tokens (ERC-5192 / EIP-4973). Non-transferable NFT as on-chain identifier of accredited borrower. Issued after off-chain KYC. Contract checks SBT presence before allowing loan.
Whitelist with multisig governance. Simplest option — list of allowed addresses, updated via governance multisig. Less privacy-preserving, but simpler to implement.
Goldfinch Protocol uses UID (Unique Identity) — ERC-1155 token issued post-KYC via Persona. Maple Finance applies pool delegate model: specialized participants (Pool Delegates) conduct off-chain borrower due diligence.
Credit scoring and undercollateralized lending
On-chain credit score built on historical data: repayment history, on-chain activity, DeFi collateral history. Protocols like Credora and Clearpool offer off-chain credit assessment with on-chain verification via oracle.
For institutional system credit score determines:
- Maximum loan size (Credit Limit)
- Loan-to-Value ratio (can be >100% for high-grade borrowers)
- Interest rate (prime rate + credit spread)
Contract mechanics:
struct CreditLine {
uint256 creditLimit; // maximum loan
uint256 collateralFactor; // LTV, can be 0 for uncollateralized
uint256 interestRateBps; // rate in basis points
uint256 tenor; // maximum term
bool isActive;
}
mapping(address => CreditLine) public creditLines;
Credit line set by governance or pool delegate via multisig. Borrower can borrow within limit, repay, borrow again — like revolving credit facility.
Interest accrual: terminal and continuous models
For institutional lending with known terms two standard models:
Fixed-term loans. Loan for specific period with fixed rate. Interest accrual: interest = principal * rate * days / 365. Simple calculation, predictable cash flow. Pendle Finance tokenizes fixed income exactly this way.
Revolving credit with variable rate. Like Aave, but no collateral requirement for verified borrowers. Per-second accrual via borrowIndex — global accumulator updated on each operation.
Liquidation in institutional context
Overcollateralized liquidation (like Aave) — not always applicable. Three approaches:
Legal enforcement + on-chain penalty. Default triggers penalty (e.g., forfeit deposit) and transfers debt to off-chain collection. Protocols like Maple and Centrifuge work this way.
Partial collateral + soft liquidation. Borrower provides 20-30% collateral liquidated on default. Remaining debt — via legal channels. USDC or ETH collateral allows on-chain liquidation.
Social slashing via reputation. Default lowers credit score (on-chain), limiting future loan access. Works only if reputation important to borrower in ecosystem.
Portfolio risk management
Pool delegates and tranching
Following Maple Finance pattern: pool divided into Senior and Junior tranches. Junior tranche takes losses first — high risk, high yield. Senior tranche — conservative, priority payouts.
Pool Delegate — specialized participant who:
- Assesses borrower creditworthiness
- Sets loan terms
- Manages defaults
- Takes portion of interest income as fee
Smart contract implements income and loss distribution between tranches. Problem: if pool delegate acts in bad faith or misjudges — junior investors lose. This is counterparty risk specific to institutional DeFi.
Interest rate risk and treasury management
Pool accepts deposits at floating rate, issues loans at fixed. If market rates rise — pool earns less than must pay LPs. Managing this risk — via limiting fixed-rate loan share or using interest rate swaps (Pendle, Voltz).
Concentration risk: if one borrower takes 30% of pool and defaults — pool loses 30%. Borrower limit (max 10-15% of total pool) — standard restriction. Per-borrower exposure caps.
Technical stack and integrations
Solidity 0.8.x, Foundry for development and testing. OpenZeppelin AccessControl for role-based permissions (POOL_DELEGATE_ROLE, BORROWER_ROLE, LIQUIDATOR_ROLE).
Chainlink Price Feeds for collateral value assessment. For KYC — integration with Persona API and Soulbound token issuance. Gnosis Safe on all admin functions with minimum 3/5 multisig.
The Graph subgraph for indexing loans, payments, defaults — data for frontend and monitoring.
Regulatory and compliance considerations
Institutional lending with underwriting — potentially regulated activity in most jurisdictions. Protocol must either work only with accredited investors or have proper pool delegate licenses. This determined at design stage, not after deploy.
We implement technical side. Legal framework — client responsibility.
Development process
Analytics and specification (1 week). Loan types, collateral model, KYC approach, regulatory requirements.
Architecture (3-5 days). Pool architecture, tranching, interest model, credit line mechanics.
Development (6-8 weeks). More complex than standard lending due to identity layer and custom liquidation logic.
Audit (4-6 weeks). Mandatory. Institutional funds require audit as condition.
Timeline estimates
Basic system with whitelist lending and over-collateral — 4-6 weeks. Full institutional platform with tranching, credit scoring oracle and pool delegate mechanics — 2-3 months plus audit.