This section provides a regulator-grade analysis of audit requirements, proof-of-reserves standards, and reporting obligations for institutional crypto custodians across 20 jurisdictions. It is intended to inform policymakers drafting or updating custody licensing frameworks and should be read alongside the Licensing Frameworks, Key Management, and Capital Requirements sections of this guidance document.
The 20 jurisdictions surveyed span five regions: Americas (United States, Brazil, Canada, Bermuda, Cayman Islands); Asia-Pacific (Australia, Hong Kong, Japan, Singapore, South Korea); Europe (European Union, France, Germany, Switzerland, United Kingdom, Liechtenstein, Luxembourg); and Middle East & Africa (Gibraltar, Bahrain, UAE). The five EU member states surveyed (the EU framework itself, France, Germany, Luxembourg) plus EEA-member Liechtenstein operate under the directly-applicable MiCA audit and reporting architecture.
1. Regulatory Audit Requirements by Jurisdiction
Crypto custodians face a patchwork of audit obligations that vary by jurisdiction, entity type, and the nature of assets under custody. The following surveys the principal audit regimes that apply.
1.1 SOC 1 / SOC 2 Type II (United States — Industry Standard)
Legal basis: There is no single statute mandating SOC reports for crypto custodians. However, the SEC's custody rule (Rule 206(4)-2 under the Investment Advisers Act of 1940) and state trust-company chartering requirements create de facto pressure to obtain them. The SEC's September 30, 2025 no-action letter conditions permitting state trust companies to act as qualified custodians require those custodians to furnish a SOC-1 or equivalent control report. SOC reports are issued under AICPA attestation standards (AT-C Section 320 for SOC 1; AT-C Section 205 for SOC 2).
Scope:
- SOC 1 (SSAE 18 / ISAE 3402): Evaluates controls relevant to user entities' financial reporting — critical for custodians whose clients have audited financial statements that depend on custodian data.
- SOC 2: Evaluates controls against the AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security and Availability are the minimum baseline for any custodian holding crypto assets. Higher-tier custodians are expected to cover Confidentiality and Processing Integrity as well.
Type I vs. Type II:
- Type I assesses control design at a point in time.
- Type II assesses operating effectiveness over a period (typically 6–12 months) and is the standard expected by regulators and institutional clients.
Frequency: Annually, with the reporting period typically aligned to the fiscal year. The 2026 SOC 2 criteria place greater emphasis on business continuity and disaster recovery, requiring custodians to demonstrate recovery within defined Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Who performs: An independent CPA firm. For custodians whose clients include SEC-registered entities, the auditor must be registered with, and subject to inspection by, the PCAOB.
Industry adoption: Major custodians including Coinbase Custody, BitGo, and Crypto.com Custody Trust Company have obtained both SOC 1 Type II and SOC 2 Type II reports. Crypto.com's SOC 2 Type II report was carried out by Deloitte and completed in September 2025.
Source: Crypto.com Custody SOC 1 & SOC 2 Compliance; SOC 2 Compliance Guide 2026
1.2 ISAE 3402 (International Equivalent)
Legal basis: International Standard on Assurance Engagements (ISAE) 3402, "Assurance Reports on Controls at a Service Organization," was developed by the International Auditing and Assurance Standards Board (IAASB) and published by the International Federation of Accountants (IFAC) in 2009. It is the international equivalent of SOC 1 (SSAE 18).
Scope: Provides assurance to a service organization's customers that the organization has adequate internal controls relevant to financial reporting. For crypto custodians, this covers key management, transaction processing, asset segregation, and reconciliation controls.
Type II significance: The ISAE 3402 Type II certification evaluates the effectiveness of a service organization's control systems over a sustained period — not merely their design — making it the preferred standard for institutional due diligence.
Adoption in crypto custody: European and Swiss custodians have increasingly adopted ISAE 3402 Type II. Taurus secured its third consecutive ISAE 3402 Type II certification. SDX Web3 Services received an ISAE 3402 report for custody and staking from EY. Sygnum Bank obtained an ISAE 3402 Type 2 assurance report for its multi-custody platform. The standard is widely accepted as the international equivalent of SOC 1 across the EU and EEA custody centres surveyed here — including Germany, France, Luxembourg and Liechtenstein, where MiCA mandates an annual financial-statement audit but does not prescribe a single control-attestation standard.
Who performs: An independent auditor, typically a Big Four or mid-tier firm with digital asset expertise.
Source: Taurus ISAE 3402 Type II Certification; SDX ISAE 3402 Report; Sygnum ISAE 3402 Type 2
1.3 MiCA Annual Financial Audit Requirements (European Union)
Legal basis: Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA). Title V (covering custody and administration of crypto-assets as a regulated CASP service under Article 63) became applicable from 30 December 2024; the final transitional/grandfathering deadline is 1 July 2026. The European Union requires authorised CASPs to comply with ongoing reporting and audit obligations.
Scope:
- Annual independent audit of financial statements for all authorised CASPs (Article 68); national arrangements may permit supervisor validation as an alternative.
- Daily reconciliation between each client's position register and on-chain balances to verify proper segregation and security of customer assets (Article 75).
- Stablecoin issuers (EMT/ART issuers) must provide frequent transparency reports demonstrating reserves are fully backed by liquid assets.
- Comprehensive documentation of all compliance activities.
Frequency: Annual financial audit at minimum. Ongoing reporting obligations include a client position statement at least once every three months (Article 75(4)), real-time transaction monitoring, prompt incident reporting, and continuous compliance documentation. The final CASP compliance deadline is 1 July 2026.
Who performs: An independent statutory auditor authorised under national implementing legislation, in accordance with EU audit directives.
Specific requirements:
- Segregation proof for customer assets (on-chain separate addresses + per-client register)
- Insurance or equivalent own-funds guarantee verification (Article 67)
- SOC-type / ISAE 3402 control reports for operational controls (market practice; no single standard prescribed)
- MPC/HSM security verification with multi-signature approval workflows
Reporting-format harmonisation: ESMA data standards apply across all CASPs — RTS on order-book records (in force 3 April 2025, JSON/ISO 20022) and the iXBRL white-paper format from 23 December 2025, with a five-year record-retention floor. These standards apply uniformly across the EU member states surveyed here (France, Germany, Luxembourg) and EEA-member Liechtenstein.
Source: MiCA Updated Guide 2026; MiCA Compliance Guide — ChainUp
1.4 SEC Surprise Examination Rule (United States)
Legal basis: Rule 206(4)-2 under the Investment Advisers Act of 1940 (the "Custody Rule"). Applies to SEC-registered investment advisers that have custody of client assets, including digital assets.
Scope: If an investment adviser has custody of client funds or securities (including crypto assets), the adviser must either:
- Undergo an annual surprise examination by an independent public accountant; or
- Use a qualified custodian that provides account statements directly to clients and meets specific conditions.
Surprise examination mechanics:
- The independent public accountant selects the examination date without prior notice to the adviser.
- The accountant verifies the existence of client funds and securities.
- The auditor has 120 days from the surprise date to complete the examination.
- The accountant files Form ADV-E with the SEC after completion.
Qualified custodian requirements for crypto: On September 30, 2025 the SEC issued a no-action letter permitting state-chartered trust companies (e.g., Coinbase Custody, Anchorage Digital, Fidelity Digital Assets) to act as qualified custodians for digital assets, subject to conditions including furnishing a SOC-1 or equivalent control report. On December 19, 2025 the SEC's Crypto Task Force published a Custody Rule Modernization discussion draft, with an NPRM projected (but not yet issued as of June 2026). State-chartered trust banks remain the principal qualified-custodian pathway.
Who performs: Both the surprise examination and any internal control report must be performed by an accountant registered with, and subject to regular inspection by, the PCAOB.
Source: SEC Staff Custody Rule FAQ; SEC Custody Rule 206(4)-2 Explained; CBIZ Guide to Surprise Examinations
1.5 UK CASS Audits (United Kingdom)
Legal basis: The United Kingdom Financial Conduct Authority (FCA) Client Assets Sourcebook (CASS) governs the safeguarding of client assets. The FCA is extending CASS to crypto custody through proposed new chapter CASS 17 (cryptoasset safeguarding), with draft rules published in Consultation Paper CP26/4 (23 January 2026, closed 12 March 2026) and consequential CASS amendments in CP26/8 (6 March 2026, closed 13 April 2026). Crypto "safeguarding" is being brought into the FSMA perimeter, with the full regime live 25 October 2027.
Scope:
- Annual client-asset audit by an appointed auditor producing a Client Assets Report (CMAR), assessing compliance with the Client Assets Sourcebook.
- A designated CASS oversight officer must be appointed.
- Daily reconciliations are mandatory, with discrepancies resolved within one business day.
- The audit covers client money and asset segregation, reconciliation procedures, and operational controls; cold storage and multi-signature protocols must meet the ISO/IEC 27001 information-security standard.
Frequency: Annual CASS-based client asset audit (CMAR), plus daily reconciliations and prudential/capital-adequacy reporting under the bespoke CRYPTOPRU regime (ICARA submissions with annual governing-body sign-off).
Timeline: The Financial Services and Markets Act 2000 (Cryptoassets) Regulations were made by Parliament on 4 February 2026. The FCA application gateway opens 30 September 2026 (closes 28 February 2027); the full regime commences 25 October 2027. The Property (Digital Assets etc) Act 2025 (Royal Assent 2 December 2025) confirms digital assets as a third category of personal property, reinforcing trust-based ring-fencing.
Who performs: An appointed auditor producing the CMAR; no separate SOC attestation mandate is stated.
Source: Linklaters: Crypto meets CASS; Deloitte: CASS in a Crypto World; Hogan Lovells: FCA Consults on Crypto Custody
1.6 Japan FSA Periodic Inspections
Legal basis: Japan's Financial Services Agency (FSA) regulates crypto custody under the Payment Services Act (PSA), which has covered custody-only services since the May 2019 amendment (in force May 2020). A Cabinet bill approved 10 April 2026 proposes migrating crypto regulation from the PSA to the Financial Instruments and Exchange Act (FIEA), effective approximately fiscal 2027 if enacted.
Scope:
- Mandatory annual CPA audit of customer-asset segregation compliance — at least 95% of user crypto must be held in offline (cold) wallets, with hot-wallet exposure (≤5%) backed 100% by the operator's own crypto ("Redemption Guarantee Crypto Assets") in cold wallets.
- Verification that user assets are properly segregated from firm assets (customer fiat held in trust with a trust bank/trust company).
- Ongoing KYC procedures including identity verification, screening, customer due diligence, periodic review, and recordkeeping.
- Mandatory suspicious transaction reporting to JAFIC.
Frequency: Annual external CPA audit plus periodic on-site inspections by the FSA, supplemented by JVCEA (the FSA-certified SRO) compliance audits with sanction power.
Registration requirements: Crypto Asset Exchange Service Providers (CAESPs) must register with the FSA before offering services. The proposed FIEA migration would add independent third-party code audits for token offerings.
Who performs: Certified public accountants for the annual segregation audit; FSA staff for periodic inspections; JVCEA for SRO compliance audits.
Source: Disruption Banking: Japan Crypto Regulation 2025; Global Legal Insights: Japan Blockchain & Cryptocurrency 2026
1.7 Switzerland FINMA Requirements
Legal basis: Switzerland's Financial Market Supervisory Authority (FINMA) published Guidance 01/2026 on the custody of crypto-based assets (January 2026), building on Guidance 03/2025 on disclosure of crypto-based assets in annual financial statements (September 2025). The statutory framework derives from the DLT Act (DEBA Art. 242a–242b).
Scope:
- FINMA operates a dual supervisory model — it relies on approved audit firms (Prüfgesellschaften) for full regulatory audits; banks, FinTech-licence holders and DLT trading facilities undergo a regulatory audit, while SRO members undergo an SRO compliance audit.
- Supervised institutions must ensure crypto-based assets are kept in custody at prudentially supervised institutions in Switzerland or a jurisdiction with equivalent supervision.
- Banks may hold crypto-based assets as segregable custody assets with bankruptcy protection, provided they are held in readiness for customers at all times.
- Crypto-based assets held on a fiduciary basis (custody assets) are no longer reported in the corresponding section of supervisory reporting (FINMA Guidance 03/2025).
Frequency: Annual plus ad hoc for banking and DLT trading facilities; annual for FinTech licensees; SRO-specified cadence for SRO members; ad hoc notifications for security incidents and organisational or custody-infrastructure changes.
Proof of reserves: NO DATA — no proof-of-reserves regime is stated; the disclosure obligation instead runs through annual financial statements under FINMA Guidance 03/2025.
Broader regulatory reform: The Swiss Federal Council opened a FinIA reform consultation on 22 October 2025 (closed 6 February 2026), proposing a new Crypto Institution License; the revised framework is expected to take effect in late 2026 or early 2027, with audits by FINMA-approved firms.
Source: PwC Switzerland: FINMA Crypto Custody Guidance; FINMA Guidance 01/2026; Borel Barbey: FINMA Guidance Analysis
1.8 Singapore MAS Requirements
Legal basis: The Monetary Authority of Singapore (MAS) regulates Digital Payment Token (DPT) service providers under the Payment Services Act (PSA) and the Financial Services and Markets Act (FSMA). The April 2024 amendments brought custody explicitly into PSA scope, and the FSMA Digital Token Service Provider (DTSP) regime took effect 30 June 2025 with no transitional period.
Scope:
- An external auditor attestation covering business activities and AML/CFT compliance is required at licensing, plus an annual statutory audit.
- Books and records of customer asset positions must be maintained; monthly statements of account must be provided to customers (no formal proof-of-reserves attestation is named).
- 90% of customer assets must be stored in offline cold wallets under the PS-G03 Consumer Protection Guidelines.
- Daily reconciliations of customer assets and operationally independent custody functions.
Frequency: Annual statutory audit; periodic compliance review; Regulatory Returns under the revised Notice PSN04 (from 1 January 2025); monthly customer statements; TRM technology-risk reporting.
Who performs: A qualified external auditor for the attestation report; MAS for supervisory inspections.
Source: Bestar: Crypto Auditing in Singapore; Signzy: Singapore Crypto Regulations 2026
1.9 Other Audit Regimes (Brazil, Canada, Hong Kong, South Korea, Australia, Bermuda, Cayman Islands, Gibraltar, Bahrain, UAE, Liechtenstein, Luxembourg)
The remaining surveyed jurisdictions exhibit a spectrum from prescriptive, code-driven audit regimes to principles-based or still-emerging frameworks:
- Brazil (BCB): Independent audits are mandatory to verify asset segregation, governance/risk-management compliance, and the accuracy of financial statements. Industry commentary (Fireblocks) reports a biennial cadence, but this is NOT VERIFIED against the text of Resolution 520. BCB Instruction 701/2026 adds an independent technical certification by an accredited certifier as a gate for custody/intermediation activity, covering asset segregation, proof of reserves, risk management, internal controls, and cryptographic-key redundancy.
- Canada (CSA/CIRO): Custodians of public crypto funds must obtain at least an annual SOC-2 Type II report (12-month coverage of all five Trust Services Criteria) from the custodian's public accountant; fund financial statements are audited by an independent auditor. CIRO Tier 1 and Tier 2 custodians must undergo independent external cybersecurity reviews under the four-tier Digital Asset Custody Framework (effective 3 February 2026).
- Hong Kong (SFC): VATPs must engage an external auditor for financial statements plus an external audit/assessment of custody arrangements, supplemented by regular internal audits; proposed standalone custodians will require mandatory independent third-party assessments. The August 2025 SFC Custody Circular mandates independent third-party assessments of custody arrangements.
- South Korea (FSC/FSS/KISA): ISMS certification from KISA, renewed with ongoing security audits, plus FSS on-site supervision and KoFIU registration-compliance demonstration. No dedicated custody licence exists today; a standalone custody business line is proposed under the second-phase Digital Asset Basic Act.
- Australia (ASIC/AUSTRAC): Currently AUSTRAC compliance reporting plus Corporations Act financial reporting. Periodic auditor review is anticipated under the DAF Act 2026 financial-requirement instruments, but a DAP/TCP-specific attestation standard is NOT VERIFIED (the framework is enacted but commences 9 April 2027, with standards awaiting legislative instruments).
- Bermuda (BMA): The Custody of Client Assets Rules 2025 (r.3) require client-asset controls to be reviewed annually by a qualified person, with a report to the BMA. The Digital Asset Custody Code (§5) requires a board-approved annual IT audit plan; key/seed processes are audited at least every six months and multi-signature arrangements annually, with quarterly transaction-sample audits and access recertification.
- Cayman Islands (CIMA): Audited financial statements may be required on a case-by-case basis depending on nature/size/complexity, with annual accounts available to CIMA on request. Independent third-party security audits of custody/key-management systems are required, plus annual key-compromise protocol testing. Phase Two licensing has been in force since 1 April 2025.
- Gibraltar (GFSC): DLT Providers are supervised on par with banks (periodic returns and inspections), with financial-statement audits under general Gibraltar company/financial-services law. A crypto-specific proof-of-reserves or SOC-style attestation mandate is NOT VERIFIED for Gibraltar; the regime is principles-based (ten regulatory principles), with Principle 5 / Guidance Note 5 governing client-asset protection.
- Bahrain (CBB): Regular financial reporting including audited financial statements and regulatory returns to the CBB, plus CBB inspections. Penetration testing is mandatory twice per year by external independent certified penetration testers (CRA-5.8.13G(e); interval/reporting in CRA-5.8.13I). Sandbox graduates must engage a third-party consultant for independent assessment.
- UAE (VARA/ADGM/DFSA/CMA): Under VARA, wallet-management mechanisms and transfer procedures are subject to audit by an independent third-party auditor, with mandatory periodic proof-of-reserves checks. ADGM requires annual audited financial statements and prudential returns. There is no single uniform crypto attestation standard across the UAE's multiple regulators.
- Liechtenstein (FMA): Under the TVTG (Blockchain Act), TT service providers are subject to a company-law statutory audit with event-driven (ad hoc) supervision rather than continuous prudential supervision; MiCAR-authorised CASPs face an annual external audit with full FMA audit/inspection rights.
- Luxembourg (CSSF): CASPs are subject to an annual statutory audit of financial statements and CSSF supervisory reporting under MiCAR, with EU RTS/ITS reporting; DLT-securities control agents reconcile DLT-security quantities. Luxembourg's distinctive fund-custody/depositary ecosystem layers UCITS/AIFM depositary-audit duties on top of the MiCAR baseline.
Source: Bestar: Crypto Auditing in Singapore; MiCA Updated Guide 2026 — InnReg; TRM Labs: Global Crypto Policy Outlook 2025/26
2. Proof of Reserves
2.1 Definition and Purpose
Proof of Reserves (PoR) is a transparency mechanism that attempts to verify, typically through on-chain attestation, that a crypto custodian or exchange holds sufficient assets to cover customer liabilities. It combines cryptographic proofs with public wallet address ownership verification and periodic third-party audits to provide assurance that customer funds exist and are not being improperly lent or pledged.
2.2 Post-FTX Evolution: From Voluntary to Quasi-Mandatory
The collapse of FTX in November 2022 was the catalyst that transformed PoR from a voluntary marketing exercise into a regulatory expectation. Key developments in this trajectory:
- Pre-FTX (before November 2022): PoR was entirely voluntary, with only a handful of exchanges (notably BitMEX and Kraken) publishing any form of attestation.
- Immediate post-FTX (December 2022): Major exchanges rushed to publish PoR data. Binance commissioned Mazars Group to produce an agreed-upon procedures (AUP) report. However, Mazars suspended all PoR work for crypto clients in December 2022, citing "concerns regarding how these reports are understood by the public."
- 2023–2024: The PCAOB issued warnings that PoR reports are "inherently limited" and that "customers should exercise extreme caution when relying on them." The industry shifted toward more rigorous approaches.
- 2025–2026: PoR has become a de facto compliance requirement in several jurisdictions, but with markedly different legal footing. By 2026, the standard has evolved in leading regimes into "Proof of Solvency" — verifying both reserves and liabilities, often through surprise audits. Under MiCA, stablecoin issuers must provide frequent transparency reports demonstrating reserves are fully backed. The United States GENIUS Act (signed into law 18 July 2025, PL 119-27) requires stablecoin reserve custodians to provide monthly public reserve-composition reports examined by a registered public accounting firm. By contrast, the UAE (VARA) mandates periodic proof-of-reserves checks directly under Rulebook v2.0, with monthly independent audits for stablecoin/ARVA reserves — making it the most prescriptive PoR regime among the 20 surveyed.
Source: Bloomberg Law: Auditors Spurn Crypto After FTX; Mazars Ceases PoR Work — TechCrunch; Sumsub: Crypto Regulation in 2026
2.3 Methodologies
Merkle Tree Proof of Reserves
The foundational PoR methodology uses a Merkle tree (binary hash tree) to provide a cryptographically secure method of verifying assets in a reserve. Each customer's balance is a leaf node; the tree is hashed upward to a single Merkle root. If any balance is altered, the resulting hash changes, propagating upward and changing the root — making the structure tamper-evident. Individual users can verify their inclusion without seeing other users' data.
Limitation: Merkle tree PoR alone does not prove the absence of hidden liabilities, nor does it prevent custodians from briefly borrowing assets for the snapshot.
Zero-Knowledge Proof (zk-SNARK) Enhancement
To address privacy and completeness concerns, exchanges including Binance have implemented zk-SNARK-based PoR systems. Binance's implementation allows users to verify that:
- Each account's total net balance is non-negative.
- All user assets are part of the exchange's claimed total net balance.
- This is done without revealing any individual account information.
The PoRv2 protocol (2025) uses the plonky2 ZK algorithm to create a Merkle tree and a final ZK proof that recursively verifies sum and non-negativity proofs.
Full Attestation
The most rigorous approach involves a complete third-party audit of both on-chain and off-chain assets and liabilities by a PCAOB-registered accounting firm (or equivalent-jurisdiction auditor). This goes beyond cryptographic proof to include verification of fiat reserves, off-chain liabilities, intercompany transfers, and derivative positions.
Key relationship: Proof of Solvency = Proof of Reserves + Proof of Liabilities. PoR alone is necessary but not sufficient for solvency verification.
Source: Hacken: Proof of Reserves Explained; Binance: zk-SNARKs in PoR; Osec: PoRv2 ZK-Based Proof of Reserves
2.4 Controversies and Limitations
The Mazars/Binance episode (December 2022): Mazars produced an agreed-upon procedures report for Binance's Bitcoin reserves, finding they were "fully collateralised." Days later, Mazars suspended all crypto PoR work. The reports were AUP engagements — explicitly not audits and not assurance opinions. This distinction was widely misunderstood by the public.
FTX's audit failures: FTX's US and international entities were audited by Armanino LLP and Prager Metis LLP respectively, both of which issued unqualified (clean) opinions in 2020 and 2021. These audits failed to detect the commingling of customer funds with Alameda Research. The SEC subsequently sanctioned Prager Metis.
Point-in-time snapshot limitation: PoR reports capture a single moment, creating a vulnerability where assets can be temporarily borrowed to inflate reserves during the attestation window. This is why regulators have moved toward surprise examinations and continuous monitoring.
Liability verification gap: Most PoR methodologies verify assets but not liabilities. A custodian can appear solvent while having massive off-chain obligations that exceed its reserves.
Source: CNBC: Mazars Suspends Crypto Work; DeSilva Law: FTX's Auditors and Proof of Reserves
2.5 Regulatory Status by Jurisdiction
Across the 20 surveyed jurisdictions, a formal proof-of-reserves attestation mandate is the exception rather than the rule. Only 2 of 20 prescribe an explicit, recurring third-party PoR attestation for crypto custodians/issuers (the United States via the GENIUS Act for stablecoin reserve custodians, and the UAE/VARA for custodians and stablecoin/ARVA issuers). Most jurisdictions instead rely on segregation, reconciliation, per-client position records, and "in-effect possession" requirements to achieve the same assurance objective. Several explicitly have no stated PoR regime (Switzerland, France, Germany — "NO DATA") or leave the question NOT VERIFIED (Liechtenstein, Gibraltar, Australia).
| Jurisdiction | Region | PoR Status | Details |
|---|---|---|---|
| United States | Americas | Quasi-mandatory for stablecoins | GENIUS Act requires monthly reserve-composition reports examined by registered accounting firms for stablecoin reserve custodians. No general federal mandate for exchange/custodian PoR. |
| Brazil | Americas | Industry-reported (NOT VERIFIED) | Instruction 701/2026 certification assesses proof of reserves; industry commentary (Fireblocks) reports monthly public PoR, NOT VERIFIED against official text; BCB declined to mandate a single PoR technical standard. |
| Canada | Americas | Not mandated | No explicit PoR mandate; custodian records must reflect the fund as beneficial owner, with reconciliation/record-keeping. |
| Bermuda | Americas | Statutory basis | DABA s.18(3) requires maintaining "a sufficient amount of each type of digital asset" — a statutory basis for proof-of-reserves; Custody Code §2.6 requires accurate accounting records. |
| Cayman Islands | Americas | Not mandated (reconciliation) | No explicit PoR mandate; reconciliation/record-keeping of each client's positions required. |
| Australia | Asia-Pacific | NOT VERIFIED | Not specified; s 912BE asset-holding standards to require reconciliation/reporting (detail NOT VERIFIED; instruments not yet made). |
| Hong Kong | Asia-Pacific | Daily monitoring (not formal PoR) | Daily monitoring of total client VA value; not a formal proof-of-reserves attestation; ASPIRe Initiative 9 straight-through reporting/surveillance. |
| Japan | Asia-Pacific | In-effect possession | CAESP must in effect hold the segregated/backing assets (individual customer position records); no separate PoR attestation named. |
| Singapore | Asia-Pacific | Not mandated (records + statements) | Books/records of customer positions maintained; monthly customer statements; no PoR attestation named. |
| South Korea | Asia-Pacific | In-effect possession | VASP must "in effect possess" entrusted VA types/quantities at all times; reserve/insurance status disclosed; no formal PoR attestation named. |
| European Union | Europe | Reconciliation (no named PoR) | Not a named statutory PoR regime; daily reconciliation between client position registers and on-chain balances required. |
| France | Europe | NO DATA | No proof-of-reserves regime stated in the source. |
| Germany | Europe | NO DATA | No proof-of-reserves regime stated; internal controls/audits verify segregation. |
| Switzerland | Europe | NO DATA | No proof-of-reserves regime stated; custody-asset disclosure runs via annual financial statements (FINMA Guidance 03/2025). |
| United Kingdom | Europe | Sub-custodian PoR audit only | Sub-custodians may be subject to independent audit verification of PoR methodology; no general PoR mandate for the primary custodian. |
| Liechtenstein | Europe | NOT VERIFIED | No explicit PoR mandate stated; custody-position records per client (MiCAR Art. 75). |
| Luxembourg | Europe | Not mandated (statements) | No explicit PoR mandate; periodic client statements at least quarterly (MiCAR Art. 75(4)). |
| Gibraltar | Middle East & Africa | NOT VERIFIED | No crypto-specific PoR mandate located; reconciliation under Principle 5 sufficient to identify each client's entitlement. |
| Bahrain | Middle East & Africa | Not mandated (1:1 holding) | No explicit PoR mandate; 1:1 holding requirement (CRA-8.1.5) and segregation underpin client-asset integrity. |
| UAE | Middle East & Africa | Mandatory periodic PoR | VARA mandates periodic proof-of-reserves checks (Rulebook v2.0); monthly independent audits for ARVAs and fiat-backed stablecoins (1:1 backing). |
2.6 PCAOB and AICPA Guidance on Digital Asset Audits
PCAOB
The PCAOB published a staff Spotlight report in June 2023, "Inspection Observations Related to Public Company Audits Involving Crypto Assets," based on 2021–2022 inspection findings. Key observations:
- Crypto assets present unique audit risks requiring appropriate risk assessment and audit response.
- Deficiencies were found in auditors' responses to risks of material misstatement, integrated audits of internal controls, audit evidence sufficiency, and auditor independence.
- Good practices included the use of specialists and staffing experienced personnel on audit teams.
- The PCAOB warned that PoR reports are inherently limited and should not be conflated with audit opinions.
In late 2025, the PCAOB amended AS 1105, Audit Evidence, effective for audits of fiscal years beginning on or after December 15, 2025, introducing a principle-based, risk-scalable framework for evaluating the reliability of electronic information — directly relevant to blockchain-based audit evidence.
The PCAOB also postponed the effective date of its new quality control standard, QC 1000, by one year to December 2026 due to implementation complexity.
Source: PCAOB: Auditors Must Respond to Unique Risks of Crypto Assets; Journal of Accountancy: SEC-PCAOB Conference 2025
AICPA
The AICPA has issued and iteratively updated its "Accounting for and Auditing of Digital Assets" Practice Aid, which provides practical guidance for auditors:
- January 2025 update: Aligned with FASB ASU 2023-08 (Subtopic 350-60), which classifies crypto assets as intangible assets with indefinite lives, measured at fair value with gains/losses flowing through net income (effective December 15, 2024).
- September 2025 update: Added a new chapter on auditing crypto lending and borrowing transactions, with sample audit procedures from both lender and borrower perspectives.
- The Practice Aid covers risk assessment, internal controls, valuation, existence verification, completeness, and presentation/disclosure for digital assets.
The FASB added two additional crypto asset projects to its technical agenda in late 2025: one addressing transfers of crypto assets and another addressing stablecoins as potential cash equivalents.
Source: AICPA: Digital Assets Practice Aid Update; Journal of Accountancy: Digital Assets Practice Aid
3. Regulatory Reporting
3.1 IRS Form 1099-DA (United States)
Legal basis: Final regulations under 26 USC § 6045, published by the IRS and Treasury Department, require brokers to report digital asset transactions on the new Form 1099-DA, "Digital Asset Proceeds From Broker Transactions."
Covered entities: Operators of custodial digital asset trading platforms, certain digital asset hosted wallet providers, digital asset kiosks, and certain processors of digital asset payments (PDAPs).
Timeline:
- 2025 transactions (reported in early 2026): Brokers must report gross proceeds only. Basis reporting is not required for 2025 transactions.
- 2026 transactions onward: Brokers must report both gross proceeds and adjusted basis for "covered" digital assets (those acquired and held in the same broker account).
- Filing deadline: February 17, 2026 for 2025 transactions (many exchanges received extensions to mid-March 2026).
- Transition relief: The IRS will not impose penalties for 2025 reporting (filed in 2026) if brokers make a good-faith effort to file correctly and on time. Some brokers may issue Forms 1099-DA up to one year late (i.e., February 2027) under transition relief.
Reporting content: Digital asset type, gross proceeds, acquisition date and cost basis (from 2026), transaction date, and broker information.
Custodian impact: Crypto custodians serving as qualified custodians for investment advisers will need systems to track cost-basis information for each client position and provide accurate 1099-DA reporting. This intersects with the SEC custody rule requirements — see the United States jurisdiction profile.
Source: IRS: Instructions for Form 1099-DA (2025); IRS: Final Regulations on Digital Asset Reporting; Koinly: Form 1099-DA Guide; The Tax Adviser: Navigating 1099-DA
3.2 DAC8 — EU Crypto Tax Reporting Directive
Legal basis: Directive (EU) 2024/XXX amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8), adopted by the EU Council. Implements the OECD's Crypto-Asset Reporting Framework (CARF) within the EU.
Effective date: January 1, 2026. EU member states were required to transpose DAC8 into national law by December 31, 2025. In Germany, DAC8 real-time transaction reporting to tax authorities became effective 1 January 2026.
Scope: DAC8 applies to all Reporting Crypto-Asset Service Providers (RCASPs), including:
- EU-headquartered exchanges and custodians.
- Any global platform serving EU residents (e.g., Binance, Coinbase, Kraken must comply).
- Coverage includes a broad scope of crypto-assets building on MiCA definitions, plus decentralised crypto-assets, stablecoins, e-money tokens, and certain NFTs.
EEA reach: As an EEA member that took MiCAR into the EEA Agreement, Liechtenstein applies the equivalent EU tax-transparency architecture; Luxembourg (via the Law of 6 February 2025 designating the CSSF) transposes DAC8 into national law for its CASPs.
Reporting obligations:
- RCASPs must implement customer due diligence procedures to identify reportable users and their tax residency.
- Annual reporting to national tax authorities of the RCASP's member state.
- Information on non-resident investors is exchanged with tax authorities of the investor's country of residence.
- First reporting year: 2026.
- First information exchange between member states: By September 30, 2027 (covering 2026 data).
Compliance deadline for systems: All CASPs must ensure reporting systems, customer due diligence procedures, and internal controls are operational by July 1, 2026.
Penalties: Member states may implement penalties including potential asset seizure for non-compliance.
Source: European Commission: DAC8; Yahoo Finance: DAC8 Takes Effect January 2026; CoinDesk: EU DAC8 Takes Effect
3.3 CARF — OECD Crypto-Asset Reporting Framework
Legal basis: Developed by the OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, approved by the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (BEPS).
Scope: CARF requires Reporting Crypto-Asset Service Providers to report information on crypto-asset transactions facilitated for Reportable Users. It operates in parallel with the expanded Common Reporting Standard (CRS 2.0).
Implementation status:
- As of December 4, 2025, 48 jurisdictions have committed to implement CARF for the 2026 reporting period.
- Major committed jurisdictions include all EU member states (via DAC8), the United Kingdom, Japan, South Korea, Australia, Canada, and Singapore.
- Switzerland approved the CARF legal framework (Federal Assembly, September 2025) but decided in November 2025 not to activate CARF reporting with any partner jurisdiction for now, delaying implementation to 2027.
- The United States has signalled support but has its own parallel reporting framework via Form 1099-DA.
Timeline:
- January 1, 2026: Start of the first reporting period. Service providers begin collecting mandated data.
- 2027: First actual exchange of information between jurisdictions, covering the 2026 calendar year.
Relationship to DAC8: For EU member states, DAC8 is the legal vehicle for transposing CARF into EU law. Non-EU jurisdictions implement CARF through domestic legislation and bilateral/multilateral exchange agreements.
Source: OECD: CARF Monitoring and Implementation Update 2025; OECD: Jurisdictions Committed to CARF; RSM: DAC8 and CARF Reporting Challenges
3.4 Reporting Frequency Summary by Jurisdiction
| Jurisdiction | Region | Reporting Type | Frequency | Content |
|---|---|---|---|---|
| US — IRS 1099-DA | Americas | Tax reporting | Annual (transactions from 2025 onward) | Gross proceeds; basis from 2026 |
| US — SEC/Custody | Americas | Custody compliance | Annual surprise exam + ongoing | Asset verification, Form ADV-E |
| US — GENIUS Act | Americas | Stablecoin reserves | Monthly | Reserve composition, CEO/CFO certification |
| Brazil — BCB SPSAV | Americas | Custody/financial reporting | Periodic + cross-border (from May 2026) | Segregation, governance; RFB crypto transaction reporting |
| Canada — CSA/CIRO | Americas | Fund/custody compliance | Annual SOC-2 + FRFI quarterly | SOC-2 Type II; FRFI capital/liquidity capturing crypto exposures |
| Bermuda — BMA | Americas | Prudential return | Annual + ad hoc (cyber events) | Annual prudential return; client-asset controls review; audit logs ≥5 yrs |
| Cayman Islands — CIMA | Americas | Custody/VATP reporting | Ongoing + annual | Risk reporting, material-change notification; market-abuse reporting immediate |
| Australia — ASIC/AUSTRAC | Asia-Pacific | Compliance reporting | AUSTRAC regular; DAP/TCP NOT VERIFIED | AUSTRAC compliance; Corporations Act financials |
| Hong Kong — SFC | Asia-Pacific | Financial/custody returns | Monthly financial returns; annual returns | WINGS-LIC returns; daily compensation/insurance threshold monitoring |
| Japan — PSA/FSA | Asia-Pacific | Custody compliance | Annual CPA audit + periodic inspection | Asset segregation, cold storage, AML/KYC; net-asset/capital reports |
| Singapore — PSA/FSMA | Asia-Pacific | Custody compliance | Annual audit + daily reconciliation | Asset segregation, cold storage, AML/CFT; PSN04 returns; monthly customer statements |
| South Korea — VAUPA/SFIA | Asia-Pacific | Custody/AML compliance | Ongoing + periodic ISMS renewal | Material-info, listing/delisting, fees, reserve/insurance status disclosure |
| EU — MiCA | Europe | CASP compliance | Ongoing + annual audit | Transaction volumes, incidents, financial statements; quarterly client statements |
| EU — DAC8/CARF | Europe | Tax reporting | Annual (first year 2026) | User transactions, tax residency |
| France — AMF/ACPR | Europe | Supervisory/prudential | Ongoing; no fixed cadence stated | Prudential reporting, incident notification; DORA ICT reporting from 2025 |
| Germany — BaFin | Europe | Financial/supervisory | Annual audit + quarterly pen-test | Audited financials; DAC8 real-time tax reporting from 1 Jan 2026 |
| Switzerland — FINMA | Europe | Prudential reporting | Annual + ad hoc | Financial statements, custody segregation, risk controls |
| UK — CASS 17/CRYPTOPRU | Europe | Client asset compliance | Annual CASS audit (CMAR) + daily recon | Segregation, reconciliation, controls; ICARA annual sign-off |
| Liechtenstein — FMA | Europe | TVTG ad hoc / MiCAR periodic | Event-driven (TVTG) / periodic + ad hoc (MiCAR) | Statutory audit; DORA incident reporting for CASPs |
| Luxembourg — CSSF | Europe | CASP/supervisory reporting | Annual audit + ≥quarterly client statements | MiCAR ongoing reporting; DORA; AML/CFT to CRF |
| Gibraltar — GFSC | Middle East & Africa | Periodic supervisory returns | Ongoing (returns + inspections) | Periodic returns; reconciliation under Principle 5 |
| Bahrain — CBB | Middle East & Africa | Custody compliance | Periodic + twice-yearly pen-test | Audited financials, regulatory returns; periodic management reports |
| UAE — VARA/ADGM | Middle East & Africa | Custody/PoR reporting | Periodic PoR; ADGM annual audited + monthly stablecoin audits | PoR, audited statements, prudential returns |
4. Comparative Table: Audit & Reporting Requirements Across Jurisdictions
Given the 20-jurisdiction scope, the comparative matrix below is organised by region. "—" denotes that the source matrix records no specific quantitative mandate ("NO DATA" / "NOT VERIFIED" / risk-based at the regulator's discretion).
4.1 Americas
| Dimension | US | Brazil | Canada | Bermuda | Cayman Islands |
|---|---|---|---|---|---|
| Primary audit standard | SOC 1/2 Type II + SEC surprise exam | Independent segregation audit + Instr. 701/2026 certification | SOC-2 Type II (fund custodians) | Annual qualified-person client-asset review (Custody Rules 2025) | Case-by-case audited financials + third-party security audit |
| International equivalent | SSAE 18 (SOC 1) | National financial-institution standards | SOC-2 Type II | Annual IT audit plan; FIPS 140-2 HSMs recommended | Independent third-party security audit |
| PoR requirement | Mandatory for stablecoins (GENIUS Act) | Industry-reported monthly (NOT VERIFIED) | Not mandated (reconciliation) | Statutory basis (DABA s.18(3)) | Not mandated (reconciliation) |
| Cold storage mandate | No federal mandate (industry practice) | Not specified | ≥80% with third-party custodians (dealer self-custody ≤20%) | Risk-based hot/cold split (no fixed %) | Cold storage expected (no fixed %) |
| Tax reporting framework | 1099-DA (from 2025) | RFB crypto transaction reporting | CARF (from 2026) | — (no crypto-specific tax-reporting figure) | — |
| Financial audit frequency | Annual | Independent (biennial industry-reported, NOT VERIFIED) | Annual | Annual + 6-monthly key/seed audit | Case-by-case / annual on request |
| Surprise examination | Yes (SEC custody rule) | Not specified | Not specified (compliance reviews) | Quarterly transaction-sample audits | Not specified |
| Incident reporting | Required (various) | SAR to COAF within 24h | Required | Cyber events reported to BMA | Market abuse reported to CIMA immediately |
| Accounting standard | ASC 350-60 (FASB ASU 2023-08) | Financial-institution accounting standards | IFRS | IFRS / Bermuda company law | IFRS |
4.2 Asia-Pacific
| Dimension | Australia | Hong Kong | Japan | Singapore | South Korea |
|---|---|---|---|---|---|
| Primary audit standard | Periodic auditor review (anticipated; NOT VERIFIED) | External auditor + independent custody assessment | Annual CPA segregation audit + FSA inspection | MAS external auditor attestation | KISA ISMS certification + FSS inspection |
| International equivalent | — (standards await instruments) | SFC-licensed-corporation requirements | National standards (CPA audit) | Qualified external auditor attestation | ISMS certification |
| PoR requirement | NOT VERIFIED | Daily monitoring (not formal PoR) | In-effect possession | Records + monthly statements | In-effect possession |
| Cold storage mandate | No fixed % mandated | 98% cold (VATP 2023; moving to dynamic) | ≥95% offline | ≥90% offline | ≥80% offline |
| Tax reporting framework | CARF (from 2026) | National tax reporting | National tax reporting | CARF (from 2026) | National tax reporting |
| Financial audit frequency | AUSTRAC/Corporations Act now | Annual | Annual | Annual | Periodic ISMS renewal |
| Surprise examination | NOT VERIFIED | Independent third-party assessments | FSA discretionary on-site | MAS discretionary | FSS on-site inspections |
| Incident reporting | Required | Required | Prompt incident reporting | TRM technology-risk reporting | Required |
| Accounting standard | AAS / IFRS | HKFRS / IFRS | JGAAP | SFRS(I) / IFRS | K-IFRS |
4.3 Europe
| Dimension | EU (MiCA) | France | Germany | Switzerland | UK | Liechtenstein | Luxembourg |
|---|---|---|---|---|---|---|---|
| Primary audit standard | Statutory audit (Art. 68) | AMF/ACPR supervision + internal audit | Annual BaFin-filed audit | FINMA approved-audit-firm regulatory audit | CASS audit (CMAR, draft CASS 17) | TVTG statutory / MiCAR annual external audit | Annual statutory audit (CSSF) |
| International equivalent | ISAE 3402 widely used | ISAE 3402 accepted | ISAE 3402 / SOC 2 Type II / ISO 27001 expected | ISAE 3402 widely used | No separate SOC mandate; ISO/IEC 27001 | ISAE 3402 accepted | ISAE 3402 accepted |
| PoR requirement | Reconciliation (no named PoR) | NO DATA | NO DATA | NO DATA | Sub-custodian PoR audit only | NOT VERIFIED | Not mandated (quarterly statements) |
| Cold storage mandate | Best-practice (no codified ratio) | No data (no ratio prescribed) | ~95% (secondary-source/market expectation) | No prescribed ratio (market practice) | No fixed % (risk-based, ISO 27001) | NOT VERIFIED (no statutory ratio) | Not prescribed (market practice) |
| Tax reporting framework | DAC8/CARF (from 2026) | DAC8/CARF (from 2026) | DAC8 real-time (from 1 Jan 2026) | CARF approved; activation delayed to 2027 | CARF (from 2026) | EEA DAC8-equivalent | DAC8/CARF (from 2026) |
| Financial audit frequency | Annual | Annual | Annual | Annual + ad hoc | Annual | Statutory / annual (MiCAR) | Annual |
| Surprise examination | Not specified | AMF/ACPR on-site | Quarterly pen-test; on-demand reports | FINMA via approved audit firms | Not specified | Event-driven (TVTG) | Not specified |
| Incident reporting | Prompt (MiCA/DORA) | DORA ICT reporting (from 2025) | DORA ICT incident notification | Ad hoc to FINMA | Required (operational resilience) | DORA (MiCAR entities) | DORA ICT incident reporting |
| Accounting standard | IFRS (varies by member state) | IFRS / French GAAP | IFRS / German GAAP | Swiss GAAP / IFRS | IFRS / UK GAAP | IFRS | Lux GAAP / IFRS |
4.4 Middle East & Africa
| Dimension | Gibraltar | Bahrain | UAE |
|---|---|---|---|
| Primary audit standard | Financial-statement audit (general law) | Audited financials + regulatory returns (CBB) | VARA third-party wallet/transfer audit; ADGM annual audited financials |
| International equivalent | No crypto-specific attestation (NOT VERIFIED) | No separate crypto attestation standard | No single uniform crypto attestation across regulators |
| PoR requirement | NOT VERIFIED | Not mandated (1:1 holding CRA-8.1.5) | Mandatory periodic PoR (VARA); monthly stablecoin/ARVA audits |
| Cold storage mandate | No fixed % (qualitative) | 95% per asset (CRA-8.1.9) | No fixed % (risk-based methodology) |
| Tax reporting framework | — (no crypto-specific tax framework cited) | — | — |
| Financial audit frequency | Periodic returns + financial-statement audit | Regular + twice-yearly pen-test | VARA periodic + ADGM annual |
| Surprise examination | GFSC inspections | CBB inspections + twice-yearly pen-test | VARA third-party audit; ADGM prudential returns |
| Incident reporting | Required (Principle 9 resilience) | Mandatory incident reporting | Required |
| Accounting standard | IFRS / Gibraltar company law | IFRS | IFRS |
5. What Works and What Does Not
What Works
-
SOC 2 Type II / ISAE 3402 Type II as the institutional baseline. The SOC 2 framework (US, Canada) and its international equivalent ISAE 3402 (EU, Switzerland, Liechtenstein, Luxembourg, and the broader European custody market), despite not being designed specifically for crypto, provide a structured and well-understood assurance mechanism. The requirement for Type II (operating effectiveness over time) rather than Type I (point-in-time design) adds genuine substance. Canada's NI 81-102 requirement for a 12-month all-five-criteria SOC-2 Type II is a notably rigorous codification.
-
Surprise examinations and prescriptive audit cadences. The element of surprise (the SEC model) removes the ability of custodians to prepare for a specific audit window, addressing the fundamental point-in-time snapshot problem. The 120-day completion window and PCAOB oversight add rigour. Bermuda's six-monthly key/seed audits and quarterly transaction-sample audits, and Bahrain's mandatory twice-yearly independent penetration testing, push the same principle into prescriptive, recurring control testing.
-
Zero-knowledge proof-enhanced PoR. The evolution from simple Merkle tree PoR to zk-SNARK-based systems represents a genuine technical improvement. These systems allow users to verify their inclusion and confirm non-negative balances without compromising other users' privacy, while making it computationally infeasible to fabricate proofs.
-
CARF as a global standard. With 48 jurisdictions committed to implementation for the 2026 reporting period, CARF provides the first truly global framework for crypto tax reporting. Its alignment with CRS 2.0 creates operational synergies for multinational custodians, and DAC8 gives the EU/EEA members (EU, France, Germany, Luxembourg, Liechtenstein) a uniform legal vehicle.
-
Mandatory recurring reserve attestation (GENIUS Act and VARA models). Monthly reserve attestation by registered accounting firms, with CEO/CFO certification (US GENIUS Act for stablecoin reserve custodians), and VARA's mandatory periodic proof-of-reserves with monthly stablecoin/ARVA audits, represent significant improvements over annual or ad hoc PoR snapshots — particularly where reserve composition directly affects systemic risk. These are the only two regimes among the 20 with an explicit recurring third-party PoR/reserve attestation mandate.
-
Statutory in-substance reserve duties. Where no formal PoR attestation is mandated, several regimes achieve the underlying assurance objective through statutory "hold the assets" duties — Bermuda's DABA s.18(3) ("a sufficient amount of each type"), Japan's and South Korea's "in-effect possession" obligations, and Bahrain's 1:1 holding (CRA-8.1.5). These are arguably more robust than a point-in-time PoR snapshot because they are continuous obligations.
What Does Not Work
-
Agreed-upon procedures (AUP) reports presented as audits. The Mazars/Binance episode demonstrated that AUP reports — which carry no assurance opinion — can be misunderstood by the public and media as providing audit-level assurance. Regulators should prohibit the use of PoR reports that are not clearly labelled and distinguished from audit opinions.
-
Point-in-time PoR snapshots without liability verification. PoR that verifies only asset holdings at a single moment is fundamentally insufficient. FTX demonstrated that massive hidden liabilities can exist alongside apparently adequate reserves. Proof of Solvency (reserves + liabilities) should be the minimum standard.
-
Fragmented and "NO DATA / NOT VERIFIED" PoR landscape. Only 2 of 20 jurisdictions (US for stablecoins, UAE) prescribe an explicit recurring third-party PoR attestation; three (Switzerland, France, Germany) have no stated PoR regime at all, and three more (Liechtenstein, Gibraltar, Australia) leave it unverified. The mismatch between US 1099-DA timelines (2025 start, transition relief through 2027), EU DAC8 (2026 start, first exchange 2027), Switzerland's deferral of CARF activation to 2027, and varying CARF implementation dates creates compliance-arbitrage opportunities and complicates cross-border oversight.
-
Lack of crypto-specific audit standards. Despite PCAOB and AICPA guidance, there is no dedicated auditing standard for digital assets. Auditors must adapt general-purpose standards (AS 1105, AT-C sections, ISAE 3402) to crypto-specific risks. Most jurisdictions surveyed (including the UAE across its multiple regulators, and Gibraltar, Bahrain, Liechtenstein and Luxembourg) record "no separate crypto attestation standard." This leads to inconsistent audit quality, as the PCAOB's 2023 inspection findings confirmed.
-
Inconsistent cold-storage floors. Quantitative cold-storage mandates exist in only a minority of jurisdictions — Hong Kong (98% under the 2023 VATP guidelines, now shifting to dynamic ratios), Japan and Bahrain (95%), Singapore (90%), and Canada/South Korea (≥80%). The majority (US, Brazil, Bermuda, Cayman, Australia, EU, France, Germany, Switzerland, UK, Liechtenstein, Luxembourg, Gibraltar, UAE) leave the hot/cold split to firm discretion or risk-based methodology. The absence of a quantitative floor in most regimes creates vulnerability, particularly for custodians that prioritise transaction speed over security.
6. Recommended Framework for Policymakers
Based on the comparative analysis above and lessons from failures (particularly FTX), we recommend the following framework for jurisdictions designing or updating audit and reporting standards for crypto custody:
Tier 1: Minimum Standards (All Licensed Custodians)
- Annual SOC 2 Type II or ISAE 3402 Type II report covering at minimum Security and Availability, performed by a PCAOB-registered or equivalent-jurisdiction auditor.
- Quarterly Proof of Solvency (not merely Proof of Reserves) using cryptographic verification (Merkle tree + zk-proof) of both assets and liabilities, attested by an independent auditor.
- Annual surprise examination of client assets by an independent auditor, following the SEC Rule 206(4)-2 model.
- Daily internal reconciliation of on-chain holdings against client liability records, with automated exception reporting (already the EU MiCA, Singapore and UK baseline).
- Mandatory cold storage threshold of at least 90% of client assets, consistent with Singapore, Japan and Bahrain models.
- Annual financial audit by an independent statutory auditor, with crypto-specific disclosures per FASB ASU 2023-08 or IFRS equivalents.
- Tax information reporting consistent with CARF/DAC8 timelines and IRS 1099-DA requirements.
Tier 2: Enhanced Standards (Systemically Important Custodians)
For custodians exceeding defined asset thresholds (we suggest $1 billion AUC), additional requirements:
- Monthly reserve attestation with CEO/CFO certification, following the GENIUS Act and VARA models.
- SOC 2 Type II report expanded to cover all five Trust Services Criteria (adding Confidentiality, Processing Integrity, and Privacy), consistent with Canada's NI 81-102 requirement.
- Real-time or near-real-time on-chain reserve monitoring accessible to regulators.
- Mandatory penetration testing at least annually by an independent security firm, with results reported to the regulator (Bahrain's twice-yearly cadence and Germany's quarterly model are stronger reference points).
- Cross-border information sharing under CARF multilateral agreements.
Tier 3: Stablecoin-Specific Standards
For custodians that issue or safeguard stablecoins:
- Monthly public disclosure of reserve composition on the issuer's website.
- One-to-one reserve backing verified monthly by a registered public accounting firm (GENIUS Act / VARA / CMA models).
- Permitted reserve assets restricted to high-quality liquid assets (e.g., US Treasuries, central bank deposits), consistent with the GENIUS Act framework and Capital Requirements guidance.
7. Decision Matrix: Selecting an Audit and Reporting Framework
This decision matrix is designed for regulators determining which audit and reporting requirements to impose based on the nature of the custodian.
| Factor | Small Custodian (<$100M AUC) | Medium Custodian ($100M–$1B AUC) | Large / Systemic Custodian (>$1B AUC) | Stablecoin Issuer |
|---|---|---|---|---|
| Financial audit | Annual | Annual | Annual + semi-annual review | Annual + monthly attestation |
| SOC/ISAE report | SOC 2 Type I acceptable in year 1; Type II thereafter | SOC 2 / ISAE 3402 Type II (Security + Availability) | SOC 2 / ISAE 3402 Type II (all 5 criteria) | SOC 2 / ISAE 3402 Type II (all 5 criteria) |
| Proof of Reserves/Solvency | Quarterly PoR | Quarterly PoS (reserves + liabilities) | Monthly PoS + real-time monitoring | Monthly public PoR + reserve composition |
| Surprise examination | Annual | Annual | Semi-annual | Annual |
| Cold storage minimum | 90% | 90% | 95% | N/A (reserves in TradFi assets) |
| Tax reporting | CARF/1099-DA annual | CARF/1099-DA annual | CARF/1099-DA annual + quarterly summary to regulator | CARF/1099-DA annual |
| Incident reporting | Within 72 hours | Within 24 hours | Immediate (within 4 hours) | Within 24 hours |
| Penetration testing | Recommended | Annual | Semi-annual | Annual |
| Reconciliation | Daily | Daily | Real-time | Daily |
| Auditor qualification | Licensed CPA | PCAOB-registered or equivalent | PCAOB-registered Big Four or equivalent | PCAOB-registered |
| Regulatory reporting | Annual | Quarterly | Monthly | Monthly |
How to Use This Matrix
- Classify the custodian by assets under custody (AUC) and whether it issues stablecoins.
- Apply the corresponding column as the minimum standard set.
- Layer on jurisdiction-specific requirements from Section 1 above (e.g., CASS audit for the UK, FSA/CPA segregation audit for Japan, BMA six-monthly key audits for Bermuda, Bahrain's twice-yearly penetration testing, VARA periodic PoR for the UAE).
- Cross-reference with Licensing Frameworks for entity-type requirements and Key Management for technical control standards that underpin audit scope.
- Review periodically — the PCAOB's amended AS 1105 (effective December 2025) and FASB's pending crypto projects will require updates to audit procedures.
For international frameworks from IOSCO and the Basel Committee, regulators should additionally consider the prudential treatment of crypto-asset exposures and the interplay between audit requirements and capital adequacy — see the Capital Requirements section.
Verification Notes
The audit, proof-of-reserves, and reporting facts in this document mirror the canonical per-jurisdiction t7 fields (and associated t3 cold-storage data) of the crypto-custody fact matrix, which covers all 20 jurisdictions across five regions (Americas, Asia-Pacific, Europe, Middle East & Africa, plus the international frameworks layer). The "X of N" aggregates in Sections 2.5 and 5 are derived from the matrix for N=20. Where the matrix records "NO DATA" or "NOT VERIFIED" (e.g., the absence of a stated proof-of-reserves regime in Switzerland, France and Germany; unverified PoR/attestation positions in Liechtenstein, Gibraltar and Australia), those gaps are reflected honestly rather than filled. The five jurisdictions added in this refresh — Liechtenstein, Luxembourg, Gibraltar, Bermuda and Cayman Islands — are integrated into every table, list and prose bucket alongside the original fifteen. The underlying primary-source positions were verified during the original domain research and the 2026-06-04 refresh; the following sources informed the cross-country audit/reporting synthesis.
Audit Standards
- Crypto.com Custody SOC 1 & SOC 2 Compliance — SOC 1/2 Type II completion September 2025
- SOC 2 Compliance Guide 2026 — Fraxtional — 2026 SOC 2 criteria updates
- Taurus ISAE 3402 Type II — Third consecutive certification
- SDX Web3 ISAE 3402 from EY — EY-issued ISAE 3402 report
- Sygnum ISAE 3402 Type 2 — Multi-custody platform assurance
- PwC Switzerland: Crypto Custody Risks and Controls — Auditor perspective on custody controls
PCAOB and AICPA
- PCAOB: Auditors Must Respond to Unique Risks of Crypto Assets — June 2023 Spotlight report
- PCAOB 2023 Inspection Priorities — Crypto inspection focus
- Journal of Accountancy: SEC-PCAOB Conference 2025 — AS 1105 amendment, QC 1000 delay
- AICPA: Crypto Lending Audit Guidance — September 2025 Practice Aid update
- AICPA: Digital Assets Practice Aid (Significantly Updated) — January 2025 update
Proof of Reserves
- Bloomberg Law: Auditors Spurn Crypto After FTX — Post-FTX audit industry reaction
- TechCrunch: Mazars Ceases PoR Work — Mazars withdrawal
- CNBC: Mazars Suspends Crypto Work — Public perception concerns
- Binance: zk-SNARKs in PoR System — zk-SNARK implementation
- Hacken: Proof of Reserves Explained — PoR methodology overview
- Osec: PoRv2 ZK-Based Proof of Reserves — PoRv2 plonky2 algorithm
US Reporting
- IRS: Instructions for Form 1099-DA (2025) — Official IRS instructions
- IRS: Final Regulations on Digital Asset Reporting — Final regulations
- Koinly: Form 1099-DA Guide — Timeline and transition relief
- The Tax Adviser: Navigating 1099-DA — Compliance analysis
- Latham & Watkins: GENIUS Act — GENIUS Act requirements
- Richmond Fed: Stablecoins and GENIUS Act — Reserve requirements
EU/International Reporting
- European Commission: DAC8 — Official DAC8 page
- CoinDesk: EU DAC8 Takes Effect — January 2026 implementation
- RSM: DAC8 and CARF Reporting Challenges — Implementation challenges
- OECD: CARF Implementation Update 2025 — 48 jurisdictions committed
- OECD: Jurisdictions Committed to CARF — Commitment list
Jurisdiction-Specific
- SEC Staff Custody Rule FAQ — Surprise examination mechanics
- Linklaters: Crypto Meets CASS — UK CASS 17 / CRYPTOPRU
- Deloitte: CASS in a Crypto World — UK audit requirements
- Disruption Banking: Japan Crypto Regulation 2025 — Japan FSA / CPA audit requirements
- PwC Switzerland: FINMA Crypto Custody Guidance — Switzerland FINMA guidance
- FINMA Guidance 01/2026 — Custody of crypto-based assets
- Bestar: Crypto Auditing in Singapore — MAS requirements
- MiCA Updated Guide 2026 — InnReg — MiCA CASP obligations (EU, France, Germany, Luxembourg, Liechtenstein)
Regulatory Outlook
- Sumsub: Crypto Regulation in 2026 — Global regulatory overview
- TRM Labs: Global Crypto Policy Outlook 2025/26 — Policy trends across the 20 jurisdictions
- Kroll: Crypto Comes of Age in 2025 — US regulatory evolution
- The Block: 2026 Crypto Regulation Outlook — Forward-looking analysis