How the AI Buildout Stays Off the Balance Sheet

Meta is building a data centre campus in Richland Parish, Louisiana. It is called Hyperion, it will draw about two gigawatts of power, and the first phase cost roughly $27 billion. Meta announced it, designed it, and operates it, and Meta will be the only tenant it ever has.

Meta did not borrow the $27 billion. The debt does not appear anywhere on Meta’s balance sheet.

That is not a loophole somebody is quietly exploiting. It is a documented, audited, rating-agency-reviewed structure, and some version of it now sits behind most large data centre projects in the United States. Understanding how it works takes about ten minutes and changes how you read every hyperscaler balance sheet.

Why they needed a structure at all

Start with the constraint. In 2023 the largest cloud companies spent roughly 40 cents of every dollar of operating cash flow on capital expenditure. Consensus estimates put that at 94 cents for 2026 and again for 2027.

At 94% there is nothing left over to fund the next campus with. The obvious answer is to borrow, and they did, quadrupling hyperscaler bond issuance. But corporate borrowing carries a cost beyond the coupon. It raises reported leverage, which pressures credit ratings, which raises the cost of every future dollar borrowed. For companies whose entire financing advantage rests on being rated in the double-A band or better, that is expensive.

So the problem became: how do you commit hundreds of billions of dollars without the commitment showing up as debt.

What “off balance sheet” actually means

A balance sheet lists what a company owns and what it owes. What it owes is governed by accounting rules that specify exactly when an obligation has to be recorded as a liability, and those rules are narrower than ordinary intuition about who owes what.

A guarantee only becomes a recorded liability when payment under it is judged probable. A lease only becomes a recorded liability when the lease commences, which for a building under construction can be years away. Debt owed by a company you hold a minority stake in is not your debt at all.

None of that is a trick. It is what the standards say. But it opens a gap between the obligations a company has actually taken on and the obligations that appear in its reported numbers, and the AI buildout has been engineered to sit inside that gap. Technology companies moved more than $120 billion of data centre spending off their balance sheets in about eighteen months. Across the five largest hyperscalers, the obligations sitting in the footnotes are now larger than the debt on the face of the statements.

This matters because almost everything downstream keys off the reported number. Leverage ratios use recorded debt. Credit ratings weight recorded debt. Index inclusion, covenant tests, and the risk models of the pension funds and insurers buying this paper all start from the same place.

There are four structures doing the work. Each is built differently and each fails differently.

1. The minority joint venture

How it is built. The technology company and a private credit fund form a joint venture that will own the campus. The fund takes 80%, the technology company takes 20%. The joint venture borrows the money, builds the facility, and leases it to the technology company as sole tenant.

Consolidation rules require a company to put an entity’s debt on its own books when it is the primary beneficiary of that entity. At 20%, it is not. So the technology company records an equity stake and a lease, and the borrowing stays with the venture.

Beignet Investor LLC is the reference deal. It priced $27.294 billion of senior secured amortising notes in October 2025 at a 6.581% coupon, maturing 2049, rated A+ by S&P, one notch below Meta’s own rating. Blue Owl’s funds hold 80% of the venture, Meta holds 20% through a subsidiary called Iris Crossing LLC, and PIMCO took roughly $18 billion of the paper.

The structure propagated quickly. BlackRock launched $12.3 billion through Sopaipilla Investor LLC in July 2026 for Meta’s El Paso campus, on an identical 80/20 split. Oracle has used the same shape for its Stargate sites: about $13 billion from Blue Owl and JPMorgan into the vehicle owning the OpenAI facility at Abilene, a $38 billion package covering Texas and Wisconsin, and an $18 billion loan for New Mexico. Blackstone and Google agreed a venture with $5 billion of Blackstone equity targeting 500 megawatts.

The gap this opens is visible company by company. Alphabet, Meta, Nvidia and Oracle all carry future lease and purchase commitments well above their recorded balance sheet liabilities. Amazon, which has largely kept its buildout on its own books, is the exception in the other direction.

How it fails. Everything rests on the legal separateness of the venture, and in a distress scenario that is precisely what gets attacked. The claims have established names: recharacterising a “true sale” of assets as a disguised loan, substantively consolidating the vehicle with the parent, veil-piercing and alter ego theories, fraudulent transfer, and equitable subordination of the private lenders’ claims behind everyone else’s.

A plaintiff’s version of the facts writes itself. The parent designed the building, operates it, is the only tenant, and has written a guarantee over its residual value, so the 20% is a formality and the separation is a fiction. The Enron examiner reached that conclusion about several of Enron’s vehicles, though the relevant difference there was that Enron controlled both sides of its transactions. Blue Owl and BlackRock are genuine third parties with their own investors, which is a substantial defence, but it has not been tested against a structure where the minority partner holds this much operational control.

There is also a conflict worth naming. Blue Owl manages vehicles for both Meta and Oracle. If one of those came under stress, the same manager would be making decisions about the other while owing duties to investors in both.

2. The lease that has not started

How it is built. Under lease accounting, the liability is recognised when the lease commences. Signing a fifteen-year lease today on a building that will be delivered in 2028 creates no balance sheet entry at all. It sits in the commitments footnote until the day the keys change hands.

Moody’s measured this across the hyperscalers. Undiscounted future lease payments for leases not yet commenced went from $71 billion at the end of 2022 to $662 billion at the end of 2025, against $202 billion of operating and $105 billion of finance leases already running.

Short initial terms make it worse. A twenty-four-year bond can rest on a lease whose stated initial term is a fraction of that, renewing in increments, which keeps the recognised liability small relative to what the tenant has economically committed to.

How it fails. This one does not fail so much as mature. The obligations convert into recorded liabilities mechanically as buildings are delivered, with no judgement involved on anyone’s part. The timetable is the construction timetable, which means balance sheets absorb them on a schedule that is already largely fixed.

Moody’s has said it will not wait for that. Its position is that reported liabilities may understate likely cash outflows, and that it will make its own probability assessments, applying a quantitative debt adjustment where it believes the recorded lease liability understates what will actually be paid. Once a rating agency adds back what the accounting leaves out, the treatment stops delivering the benefit it was structured to deliver.

3. The guarantee that is not a liability

How it is built. To get an investment-grade rating on a bond secured by one building with one tenant, somebody has to stand behind what the building will be worth. Meta provided the Hyperion venture with a residual value guarantee running sixteen years, triggered if Meta fails to renew a lease, terminates early, or defaults. The guaranteed minimum is sized so that the bonds can be repaid.

The guarantee is worth up to $28 billion. Meta’s 2025 annual report describes it in a footnote and then states that, as of 31 December 2025, RVG payments are not probable and therefore no liability has been recorded.

Both audiences are told the truth. Bondholders are told they effectively have Meta’s credit. Shareholders are told there is no recorded obligation. The accounting standard permits both statements at once, because “probable” is a judgement the issuer makes.

How it fails. On the appraisal. When a residual value guarantee is tested, the fight is never about whether the guarantee exists. It is about what the asset is worth, who performs the valuation, and against what comparables. A purpose-built two-gigawatt campus in rural Louisiana, designed around one tenant’s hardware, may not have a meaningful comparable anywhere. Converting an AI facility to general-purpose cloud use is expensive and slow, so the liquidation value is lowest in exactly the scenario where the guarantee is being called.

The second problem is discretion. The trigger is Meta’s own decision not to renew. Investors would argue that a non-renewal was timed to push losses onto them, and Meta would argue it was an ordinary commercial judgement. That is a good-faith dispute with $28 billion attached and no clean answer written into the documents.

4. The backstop that may never attach

How it is built. Where the tenant is not investment grade, a hyperscaler can provide a conditional credit enhancement instead of signing a lease itself. TeraWulf, a former bitcoin miner, raised $3.2 billion of high-yield bonds at 7.75%, rated Ba2/BB, to build a facility in upstate New York. Fluidstack leases it on ten-year terms to run GPU clusters. Google agreed to backstop Fluidstack’s lease obligations, stepping in to pay a termination fee or assume the leases if Fluidstack defaults, and took warrants over up to 14% of TeraWulf in return. Google has committed more than $5 billion of these backstops across former miners converting to AI hosting.

The bonds drew roughly $10 billion of orders against a $3.2 billion deal. The Google name is why.

How it fails. By not triggering. The backstop only activates after construction is complete and Fluidstack’s lease commences, so through the entire build phase bondholders carry execution risk with no Google support at all. If construction runs more than 180 days past the target completion date, Fluidstack can terminate the leases outright, and Google’s obligation never attaches.

The offering memorandum itself contemplates a disagreement between TeraWulf and Google over whether the backstop has been triggered, and acknowledges that Google might not honour it. Fitch, rating the deal, described the construction schedule as somewhat aggressive. Equipment lead times in this sector run eight to twenty-four months, and utility interconnection delays can stretch to five years. The protection that sold the bonds is conditioned on the thing most likely to go wrong.

The collateral underneath all of it

Two categories of asset secure this debt, and both have valuation problems that only surface under stress.

The buildings are purpose-built, with specialised cooling, high-density power and layouts designed around GPU racks. If AI compute demand contracts, they have limited alternative use and a depressed liquidation value.

The chips are harder, because nobody agrees what they are worth. CoreWeave depreciates its GPUs over six years. Project finance lawyers and engineers working on these deals generally assume three to four. Some analysts argue two to three. Nvidia and AMD have moved from a two-year release cadence to a one-year one, and rental rates for H100s have fallen roughly 70 to 90% since 2023.

The same hardware can look adequately collateralised on one balance sheet and impaired on another, purely because of which assumption was chosen. CoreWeave’s $7.5 billion GPU-backed facility, led by Blackstone at roughly 11%, began amortising in January 2026 while the collateral behind it was repricing downward. Fluidstack has a $10 billion arrangement and Lambda a $500 million loan on similar terms.

What all four structures assume

Every structure above rests on the same load-bearing assumption: that the tenant keeps paying rent and renews when the term is up. The joint venture’s bond is serviced by lease payments. The residual value guarantee triggers on non-renewal. The backstop only attaches once a lease commences. The not-yet-commenced leases become liabilities on delivery whether the capacity is wanted or not.

So the question that decides all of it is whether these tenants will still want this capacity at the price they committed to. Three pieces of evidence make that less certain than the ratings imply.

The first is the anchor tenant’s own arithmetic. OpenAI, which is the demand behind Oracle’s Stargate vehicles including Abilene, disclosed in November 2025 that it was looking at commitments of roughly $1.4 trillion over eight years against an annualised revenue run rate above $20 billion.

The second is what has happened to the price of the product. On OpenRouter, the largest neutral router of model traffic, Chinese-origin open-weight models went from 4.5% of enterprise token volume in the first half of 2025 to an 11% average over the following twelve months, and to a weekly peak of 46% by mid-2026. They have held at 30% or above every week since February. OpenRouter’s own figures put them at 60 to 90% cheaper than the leading American models. Compute demand is not falling, but the revenue any given unit of it can command is.

The third is that enterprise deployments are not sticking. Sinch surveyed 2,527 senior decision makers across ten countries in January and February 2026 and found that 74% of enterprises with a live AI customer communications agent had rolled it back or shut it down, rising to 81% among those with the most mature governance programmes. Sinch sells communications infrastructure, so read the number with that in mind, but it is consistent with Gartner’s June 2025 finding that half of organisations planning to cut customer service headcount through AI would abandon the plan by 2027, and with Forrester’s 2026 estimate that 55% of employers regretted AI-related layoffs.

The industry itself has already priced in some of this doubt. OpenAI’s 27 October 2025 letter to the Office of Science and Technology Policy asked the administration to deploy grants, cost-sharing agreements, loans or loan guarantees to expand industrial base capacity for AI infrastructure and grid components. Days later its CFO said publicly that the federal government could provide the backstop that allows data centre financing to happen, then retracted it. Sam Altman said the following day that OpenAI does not have or want government guarantees for its data centres. The White House AI czar said there would be no federal bailout for AI. Senator Warren’s January 2026 letter documents the distance between the letter and the denial.

None of this establishes that AI demand collapses. It establishes that the lease payments underwriting these bonds come from tenants whose own unit economics are still unsettled, and that the residual value assumptions were set when a token was worth considerably more than it is now.

Where the risk actually sits

These structures move risk rather than removing it, so it is worth following where it goes.

Private credit funds originate most data centre debt, principally Blackstone, Blue Owl, Apollo, PIMCO and BlackRock. Their outstanding loans to AI-related companies went from close to zero to over $200 billion in a few years, and Morgan Stanley’s map of how the rest of the buildout gets funded assigns $800 billion to private credit, the single largest line in it.

Those funds are themselves financed by banks. A Federal Reserve Board study found that up to a quarter of bank lending to non-bank financial institutions now goes to private credit firms, against roughly 1% in 2013. The Chicago Fed found banks’ direct exposure to AI-adjacent industries averages 0.8% of assets, then noted that banks most likely hold further exposure through their lending to non-banks, which is to say through the funds originating this debt.

Beyond the banks, major life insurers hold close to $1 trillion in private credit. New York and Pennsylvania state pension plans have invested in Blue Owl’s $7 billion digital infrastructure fund, the same fund behind Beignet and several Oracle financings. And an August 2025 executive order directed federal agencies to loosen the rules so that ordinary 401(k) holders can hold alternative assets including private credit.

Each link in that chain marks the same underlying asset on a different basis and a different schedule.

What happens from here

The first cases are already filed. CoreWeave was sued in New Jersey on 12 January 2026 over its disclosure of construction delays, and Oracle bondholders sued in New York two days later over the offering documents for its $18 billion issuance. Four senators wrote to the Treasury Secretary that month asking regulators to examine the sector’s reliance on opaque debt markets. And Moody’s, which paid $864 million to the Justice Department over its pre-crisis ratings, is now the party warning that current accounting lets tens of billions of potential liability go unrecorded.

The case for not reading too much into that is genuinely strong. Nothing here is concealed: every figure in this piece came from a filing, a rating report or a court document, and the auditors and rating agencies saw the numbers before anyone else. The sponsors are real third parties deploying their own investors’ capital, which is the fact most likely to defeat a consolidation claim in court. And the anchor credits are exceptional. Meta carries a double-A rating, the other three run debt-to-equity between roughly 0.18x and 0.51x, and PIMCO’s data puts A-rated-and-higher hyperscalers at 0.04x net debt to EBITDA, the lowest of any sector in US investment grade, against BBB hyperscalers at 4.24x. Most of the alarm attaches to one issuer rather than the group.

What none of that addresses is the specific way these structures break. Consolidation claims, appraisal disputes, backstops that fail to trigger and collateral shortfalls are not cured by the tenant being creditworthy. They get litigated between the tenant and the parties who lent against it, and a creditworthy tenant is a well-resourced opponent rather than a guarantee of payment.

So watch three things. The first Moody’s debt adjustment, because once an agency adds an unrecorded lease back into a leverage calculation, the treatment stops delivering what it cost to obtain. The first residual value appraisal, because nobody has yet had to price a purpose-built AI campus into a soft market, and whatever number comes out becomes the comparable for everything after it. And the first construction loan that cannot refinance: data centre mini-perms run two to five years and must roll into the ABS or CMBS markets on demonstrated tenant cash flows, and a number of them were underwritten on booked-but-not-billing terms, meaning the revenue backing them need never have arrived.

None of this requires the AI trade to fail. It requires a building to be late, or a chip to be worth less than assumed, or a tenant to decline a renewal, and these structures were designed for a world in which those things do not happen at the same time.