Statutory Audit of Cyprus Crypto-Asset Service Providers (CASPs)

Independent Audit Services for MiCA-Authorised Crypto Businesses

The introduction of the European Union's Markets in Crypto-Assets Regulation (MiCA) has established a harmonised regulatory framework for Crypto-Asset Service Providers (CASPs) across the European Union. In Cyprus, authorised CASPs operate under the supervision of the Cyprus Securities and Exchange Commission (CySEC), while continuing to comply with their obligations under Cyprus company law, applicable financial reporting standards and other relevant legislation.

For many CASPs incorporated in Cyprus, a statutory audit forms an essential part of the annual financial reporting process. Beyond meeting legal requirements, an independent audit enhances confidence among shareholders, investors, banking partners, regulators and other stakeholders by providing assurance that the financial statements have been prepared in accordance with the applicable financial reporting framework.

Our firm specialises in the statutory audit of Cyprus CASPs, combining expertise in International Standards on Auditing (ISA), International Financial Reporting Standards (IFRS) and the operational characteristics of blockchain and digital asset businesses.

What is a Crypto-Asset Service Provider (CASP)?

Under MiCA, a Crypto-Asset Service Provider is a legal person authorised to provide one or more regulated crypto-asset services within the European Union.

These services may include:

  • custody and administration of crypto-assets on behalf of clients;

  • operation of a crypto-asset trading platform;

  • exchange of crypto-assets for funds or other crypto-assets;

  • execution of orders relating to crypto-assets;

  • reception and transmission of client orders;

  • placement of crypto-assets;

  • portfolio management;

  • transfer services for crypto-assets; and

  • advice relating to crypto-assets.

While the services differ, all authorised CASPs are expected to maintain appropriate governance arrangements, reliable accounting records, effective internal controls and robust financial reporting processes.

Why a Statutory Audit Matters

A statutory audit is far more than a compliance exercise. It provides independent assurance over the financial statements and strengthens confidence in the integrity of an organisation's financial reporting.

For crypto-asset businesses, the audit also demonstrates that management has implemented appropriate systems to record complex digital asset transactions, safeguard client and corporate assets, and support reliable financial information.

An effective audit contributes to:

  • improved corporate governance;

  • enhanced investor confidence;

  • greater transparency;

  • stronger financial reporting processes;

  • identification of control weaknesses;

  • improved risk management; and

  • increased credibility with banking institutions, business partners and regulators.

Unique Audit Considerations for CASPs

Crypto-asset businesses operate in an environment that differs significantly from traditional financial services. As a result, auditors must design procedures that address risks unique to digital assets and blockchain technology.

Typical audit considerations include:

Digital Asset Ownership

Obtaining sufficient and appropriate audit evidence that the entity controls the crypto-assets recognised in its financial statements.

Wallet Management

Understanding how digital wallets are established, managed and secured, including access controls, authorisation procedures and governance over private keys.

Custody Arrangements

Evaluating whether assets are self-custodied or held through regulated third-party custodians, together with the supporting contractual and operational arrangements.

Transaction Completeness

Assessing whether blockchain transactions have been completely and accurately recorded within the accounting records.

Valuation

Evaluating management's methodology for determining the carrying value of crypto-assets in accordance with the applicable accounting standards.

Revenue Recognition

Understanding revenue generated from trading activities, custody services, commissions, staking, transfers or other crypto-related services to determine whether recognition complies with IFRS.

IT and Cybersecurity Controls

Assessing the effectiveness of technology controls that support financial reporting, including logical access, change management, system security and business continuity.

Our Audit Approach

Every engagement is tailored to the client's business model, risk profile and operational complexity.

Our audit typically includes the following stages.

Planning and Risk Assessment

We develop an understanding of the organisation, its governance structure, regulatory environment, blockchain activities and internal control framework.

Evaluation of Internal Controls

Where appropriate, we assess controls over financial reporting, digital asset custody, transaction processing and information technology.

Substantive Audit Procedures

We perform detailed testing designed to obtain sufficient and appropriate audit evidence supporting the financial statements.

Procedures may include reviewing blockchain transaction records, examining supporting documentation, confirming balances where appropriate and testing accounting entries.

Completion and Reporting

Following completion of our procedures, we communicate significant findings to management and those charged with governance before issuing our independent auditor's report.

Responsibilities of Directors

The responsibility for preparing financial statements rests with the directors of the company.

Directors are responsible for:

  • maintaining adequate accounting records;

  • preparing financial statements in accordance with the applicable financial reporting framework;

  • establishing appropriate internal controls;

  • safeguarding company assets;

  • assessing the entity's ability to continue as a going concern; and

  • providing auditors with access to relevant information and documentation.

An independent audit does not replace these responsibilities but provides assurance over the financial statements prepared by management.

Preparing for a Statutory Audit

Early preparation can significantly improve the efficiency of the audit process.

Management should ensure that:

  • accounting records are complete and up to date;

  • digital asset reconciliations have been performed;

  • wallet inventories are maintained;

  • supporting documentation is readily available;

  • significant contracts have been organised;

  • internal control procedures are documented; and

  • management is available to respond to audit enquiries promptly.

A well-prepared audit reduces disruption and enables the engagement to progress more efficiently.

Why Choose a Specialist Blockchain Auditor?

Although the principles of statutory auditing remain consistent across industries, crypto-asset businesses present specialised accounting, operational and technology risks.

Choosing an auditor with experience in blockchain businesses offers several advantages:

  • understanding of blockchain transaction flows;

  • familiarity with digital asset custody models;

  • knowledge of crypto-related accounting issues;

  • experience with emerging financial reporting practices;

  • appreciation of technology and cybersecurity risks; and

  • practical insight into governance expectations for regulated digital asset businesses.

Sector-specific expertise helps auditors focus on the areas of greatest significance while delivering an efficient and risk-focused audit.

Frequently Asked Questions

Does every Cyprus CASP require a statutory audit?

The statutory audit requirement depends on the entity's legal form and the applicable provisions of Cyprus law and the relevant financial reporting framework. Most Cyprus companies that meet statutory audit requirements must appoint a registered auditor to audit their annual financial statements.

Is a statutory audit the same as a regulatory inspection?

No. A statutory audit is an independent examination of the financial statements in accordance with International Standards on Auditing. Regulatory inspections carried out by competent authorities have different objectives and powers.

Can auditors verify blockchain transactions?

Blockchain records can provide valuable audit evidence regarding transactions. However, auditors must also obtain sufficient appropriate evidence regarding ownership, valuation, completeness, rights and obligations, and presentation in the financial statements.

What documents should management prepare?

Typical documentation includes accounting records, wallet registers, reconciliation schedules, custody agreements, bank confirmations, significant contracts, board minutes and supporting evidence for material transactions.

How can specialist auditors add value?

Auditors with blockchain expertise understand the operational characteristics of crypto-asset businesses and can perform a more efficient, risk-focused audit while maintaining independence and professional scepticism.

Speak with Our Blockchain Audit Team

Whether your organisation is preparing for its first statutory audit or is seeking an auditor with experience in digital assets, our team provides independent assurance services tailored to the needs of Cyprus Crypto-Asset Service Providers and other blockchain businesses.

We work closely with management and those charged with governance to deliver a high-quality audit that meets professional standards while recognising the unique characteristics of the digital asset sector.