Internal Controls for Crypto-Asset Service Providers

As the digital asset industry continues to mature, effective internal controls have become a fundamental component of sound corporate governance. For Crypto-Asset Service Providers (CASPs), cryptocurrency exchanges, custodians and other blockchain businesses, internal controls are essential not only for safeguarding assets but also for supporting reliable financial reporting, regulatory compliance and operational resilience.

The introduction of the European Union's Markets in Crypto-Assets Regulation (MiCA) has reinforced the importance of governance, organisational arrangements and prudent risk management within regulated crypto businesses. Directors are expected to establish systems that enable the organisation to identify, manage and monitor the risks associated with digital assets while maintaining accurate financial records and protecting client interests.

From an audit perspective, a well-designed control environment reduces the risk of material misstatement and contributes to a more efficient statutory audit. Conversely, weak governance or inadequate controls often result in increased audit procedures, higher operational risk and greater regulatory scrutiny.

Our firm assists Cyprus CASPs and blockchain businesses by performing statutory audits, evaluating financial reporting controls and providing independent observations that help organisations strengthen their governance frameworks.

Internal controls are the policies, procedures and organisational measures implemented by management to provide reasonable assurance that the organisation achieves its objectives.

These objectives generally include:

Internal controls are not limited to accounting processes. They extend across technology, operations, cybersecurity, compliance and executive oversight.

Blockchain businesses manage assets that can often be transferred rapidly and irrevocably. This creates risks that differ from those encountered in many traditional industries.

For example, organisations may face risks relating to:

Appropriate internal controls help reduce these risks while supporting confidence among investors, clients, regulators and auditors.

An effective control environment begins with governance.

The board of directors and senior management establish the organisational culture and define the expectations for ethical behaviour, accountability and risk management.

Good governance generally includes:

A strong governance framework demonstrates that management is committed to maintaining a controlled operating environment.

Segregation of duties is one of the most effective methods of reducing operational and fraud risk.

No individual should have complete control over an entire transaction from initiation through to recording and approval.

Depending on the size and complexity of the organisation, responsibilities should be appropriately separated between:

Where staffing limitations make complete segregation impractical, compensating controls should be implemented.

For blockchain businesses, digital wallets represent one of the most significant operational risks.

Management should establish clear procedures governing:

Documented governance over wallet administration assists both management and auditors in demonstrating effective control over digital assets.

Access to systems and digital assets should be restricted to authorised personnel based on business responsibilities.

Effective access management typically includes:

Access controls should extend to accounting systems, blockchain platforms, cloud infrastructure and supporting applications.

Accurate financial reporting depends upon timely reconciliation of accounting records to supporting evidence.

Management should establish procedures for reconciling:

Regular reconciliations assist in identifying discrepancies promptly and reduce the risk of material misstatements in the financial statements.

Cybersecurity is a critical component of the internal control environment for blockchain businesses.

Management should implement appropriate measures to protect systems and digital assets against unauthorised access, malware, phishing attacks and other cyber threats.

Typical cybersecurity controls include:

Although cybersecurity extends beyond the scope of a financial statement audit, technology controls relevant to financial reporting may form part of the auditor's assessment.

Many blockchain businesses rely upon external providers for custody, cloud infrastructure, payment services, software development or information technology support.

Management remains responsible for ensuring that outsourced activities are appropriately governed.

This includes:

• due diligence before appointment;
• clearly documented contractual arrangements;
• ongoing performance monitoring;
• review of assurance reports where available;
• assessment of information security practices; and
• contingency planning should the provider become unavailable.

Oversight of outsourced service providers is an important element of operational resilience.

Digital asset businesses should prepare for events that may disrupt normal operations.

Business continuity planning generally includes:

• disaster recovery procedures;
• backup of critical systems;
• recovery testing;
• alternative communication arrangements;
• succession planning for key personnel;
• incident response governance; and
• procedures for restoring operations following significant disruptions.

Operational resilience supports both regulatory expectations and the long-term sustainability of the business.

International Standards on Auditing require auditors to obtain an understanding of the internal controls relevant to the preparation of the financial statements.

Where controls are appropriately designed and effectively implemented, they may reduce the extent of detailed substantive testing required in certain audit areas.

Conversely, significant deficiencies in controls may increase audit risk and require additional audit procedures.

The statutory audit therefore provides management with valuable observations regarding the control environment, while remaining independent and focused on the financial statements.

As blockchain businesses evolve, organisations frequently encounter similar governance challenges.

Examples include:

• undocumented wallet procedures;
• inadequate segregation of duties;
• incomplete reconciliation processes;
• insufficient documentation supporting digital asset balances;
• excessive reliance on manual processes;
• weak access controls;
• inadequate monitoring of outsourced providers;
• inconsistent accounting policies; and
• limited board oversight of technology risks.

Addressing these issues proactively can improve governance and facilitate a smoother audit process.

Yes. Well-documented processes, reliable reconciliations and effective governance generally make the audit process more efficient by reducing the need for extensive follow-up requests and additional testing.

Strong internal controls are essential for maintaining stakeholder confidence, protecting digital assets and supporting reliable financial reporting.

Our firm provides statutory audit services to Cyprus Crypto-Asset Service Providers and blockchain businesses, combining expertise in International Standards on Auditing, financial reporting and digital asset operations. Through a risk-focused audit approach, we help organisations demonstrate robust governance while delivering independent assurance in accordance with the highest professional standards.