What auditors ask for on crypto balances, and how to be ready

Existence, ownership, completeness and valuation each need different evidence for crypto. Here is what regulators flag and what to prepare.

2026-10-17 · 7 min read

Crypto balances fail audits for predictable reasons: the company cannot show it controls the keys, cannot prove the list of addresses is complete, or cannot support the prices used. Knowing what your auditor has to obtain lets you build the evidence during the year instead of scrambling at year end.

Why crypto is different

The PCAOB's 2023 staff Spotlight on audits involving crypto assets is the clearest public statement of what goes wrong [1]. Inspectors found audits where the auditor did not obtain enough evidence over existence, valuation, and rights and obligations of crypto held at year end [1]. The staff point to features that break normal audit habits: pseudonymous addresses, no central bank to send a confirmation to, the chance that several people or a related party hold the same private key, and the risk that management overrides key controls [1]. The Spotlight reflects staff views, not a Board rule, but it describes how PCAOB standards apply and audit firms treat it seriously [1].

Private companies are audited under AICPA standards. The AICPA's practice aid on accounting for and auditing of digital assets covers similar ground and gained a chapter on auditing crypto lending and borrowing in September 2025 [2].

Assertion by assertion

Ownership: access is not enough

The PCAOB staff make a point many teams miss: showing the auditor you can access the keys for an address may not prove you have sole ownership, because access does not necessarily mean ownership [1]. Someone else, including a related party or a custodian, might hold the same key [1]. So auditors may need to test controls over how keys are generated and kept, including segregation of duties in key management [1].

A common supporting test is a signed message. On Ethereum-style chains, EIP-191 defines a signing format with a fixed prefix that cannot be mistaken for a valid transaction, so a key holder can sign an auditor's chosen text without moving funds [4]. For Bitcoin, BIP-322 defines a generic signed message format, including a proof-of-funds variant, that works across modern address types [5]. A signature proves someone with the key signed; it does not prove nobody else has the key. Pair it with control evidence.

Custodians and exchanges

Where a third party holds your crypto, the auditor will look at the custody terms, including side arrangements and whether your assets sit in addresses mixed with other customers' assets [1]. Commingled wallets raise the risk that balances are allocated to the wrong entity [1]. Confirmations from custodians may help, but the auditor has to judge whether the respondent is reliable and objective, and apply more scepticism where a custodian holds a material amount of the company's assets [1].

If a custodian is part of your financial reporting system, expect a request for its SOC 1 report, the AICPA examination of controls at a service organisation that are relevant to user entities' financial reporting [3][1]. Read the report yourself: check the period covered, the exceptions, and the controls you are expected to run on your side.

Completeness and data reliability

Inspectors flagged audits that did not test whether information downloaded from self-custodied wallets, external data providers and third-party pricing feeds was relevant and reliable [1]. Block explorers and similar tools are acceptable sources only if the auditor evaluates whether they extract and display ledger data accurately and completely [1]. The auditor will also consider whether the company omitted addresses or exchange accounts, by accident or on purpose [1].

For your side, that means one controlled register of every address and account, with who approved adding it, and a reconciliation that ties ledger balances to the books for each one.

Valuation

Under US GAAP, crypto within ASU 2023-08 is measured at fair value through net income [6]. When third-party prices are significant, the auditor must judge whether the company used them appropriately and whether they are reliable [1]. Document which source you use, the timestamp convention, and why the source reflects the market you would actually trade in.

Fraud and related parties

Pseudonymity makes related parties harder to spot, and auditors are told to watch for unusual patterns: spikes in activity with public addresses, large fiat-to-crypto conversions without a clear purpose, related-party flows across many addresses, and use of mixing services [1]. Expect questions about the business purpose of any large or unusual transfer.

What to do

• Maintain a wallet and account register with owners, signers, approval dates and purpose.
• Keep key management documentation: generation ceremonies, storage, signer changes and segregation of duties.
• Be ready to sign auditor-chosen messages from each material address, using EIP-191 or BIP-322 formats.
• Collect custody agreements, custodian statements and SOC 1 reports, and review them before the auditor does.
• Write down your pricing source and cut-off time, and keep the raw price data for year end.
• Explain large or unusual transfers in writing as they happen, not months later.

This is general information; your auditor will tailor procedures to your risks.

Sources

1. Spotlight: Inspection Observations Related to Public Company Audits Involving Crypto Assets (June 2023) (PCAOB)
2. New digital assets practice aid addresses auditing of lending, borrowing (Journal of Accountancy (AICPA & CIMA))
3. SOC 1 - SOC for Service Organizations: ICFR (AICPA & CIMA)
4. ERC-191: Signed Data Standard (Ethereum Improvement Proposals)
5. BIP-322: Generic Signed Message Format (Bitcoin BIPs (GitHub))
6. Accounting for Crypto Assets: Feedback and Standard-Setting Updates (ASAF, October 2026, Agenda Paper 7B) (FASB staff via IFRS Foundation)

General information for finance teams, current as of publication. Not legal, tax or accounting advice.

All Newsroom explainers