Wallet Verification

One of the most distinctive aspects of auditing a blockchain business is verifying digital assets. Unlike cash held with a bank or securities held through traditional custodians, crypto-assets exist on distributed ledger networks and are controlled through cryptographic keys rather than physical possession.

Although blockchain technology provides an immutable record of transactions, a statutory audit requires considerably more than confirming wallet balances. Auditors must obtain sufficient and appropriate audit evidence regarding the existence, ownership, rights and obligations, valuation and presentation of digital assets within the financial statements.

For Crypto-Asset Service Providers (CASPs), exchanges, custodians and other blockchain businesses, establishing effective custody arrangements and maintaining comprehensive documentation are essential components of sound financial reporting and corporate governance.

Digital assets can be safeguarded using a variety of custody models.

These commonly include:

Each model presents different operational, governance and audit considerations.

Understanding how assets are safeguarded is one of the first stages of planning a statutory audit.

A common misconception is that a wallet address proves ownership.

In reality, a blockchain address merely records that crypto-assets are associated with that address.

The auditor must determine whether the reporting entity has:

This distinction is particularly important where crypto-assets are held by custodians or on behalf of clients.

Many blockchain businesses operate multiple wallets across different blockchain networks.

Examples include:

Management should maintain a complete wallet register identifying:

A comprehensive wallet inventory greatly assists both internal governance and the statutory audit.

Control of digital assets ultimately depends upon control of private cryptographic keys.

Accordingly, management should establish documented procedures governing:

Weak governance over private keys significantly increases operational and financial reporting risks.

Many organisations use multi-signature (multisig) wallets to strengthen governance.

These arrangements typically require multiple authorised individuals to approve transactions before transfers can be executed.

Benefits include:

Auditors evaluate how these controls operate in practice rather than merely confirming that a multisig wallet exists.

Many Crypto-Asset Service Providers use independent custodians to safeguard digital assets.

Where assets are held by external providers, auditors may consider:

Management remains responsible for maintaining adequate accounting records even where custody has been outsourced.

Public blockchains enable auditors to observe transaction histories and wallet balances.

Blockchain explorers may assist in:

However, blockchain information alone is not sufficient audit evidence.

Auditors also consider contracts, accounting records, custody documentation, management representations and other corroborating evidence.

Regular reconciliations are fundamental to reliable financial reporting.

Management should periodically reconcile:

Differences should be investigated promptly and documented appropriately.

These reconciliations form an important component of both internal controls and statutory audit procedures.

Crypto-Asset Service Providers frequently safeguard assets belonging to clients.

Management should maintain clear records identifying:

Appropriate segregation assists management, auditors and regulators in understanding the entity's rights and obligations.

Following developments within the digital asset industry, many organisations have introduced proof of reserves exercises.

Although proof of reserves may provide information regarding certain digital asset balances at a specific point in time, it is not equivalent to a statutory audit.

A statutory audit encompasses a much broader assessment, including:

Accordingly, proof of reserves should not be regarded as a substitute for an independent statutory audit.

No. Proof of reserves generally focuses on demonstrating certain asset balances. A statutory audit evaluates the financial statements as a whole in accordance with International Standards on Auditing.

Verifying crypto-assets requires more than reviewing blockchain transactions. It demands an understanding of custody models, governance, accounting, internal controls and the principles of International Standards on Auditing.

Our firm provides statutory audit services to Cyprus Crypto-Asset Service Providers and other blockchain businesses, combining expertise in blockchain technology, IFRS and independent assurance. Through a structured, risk-based audit approach, we help organisations demonstrate transparency, strengthen governance and enhance confidence among investors, regulators and other stakeholders.