Crypto Custody Audit: Proof of Reserves and SAB 122

Holding a crypto asset and holding it for someone else are different audit problems. The first is a valuation and ownership question for the holder. The second is a custody question for the exchange, trust company or platform, and a different question again for the customer whose assets sit there. This guide covers the custody side. For the holder's fair value accounting, see the ASC 350-60 audit guide.

What SAB 122 changed

SEC Staff Accounting Bulletin 121 required entities that safeguarded crypto assets for others to record a liability and a matching asset at fair value. SAB 122 rescinds that guidance by removing Topic 5.FF. It is effective January 30, 2025.

After the rescission, an entity with an obligation to safeguard crypto assets for others decides whether to recognize a liability for the risk of loss. If it does, it applies the recognition and measurement requirements for liabilities arising from contingencies, which under US GAAP is ASC 450-20 and under IFRS is IAS 37. Entities apply the rescission on a fully retrospective basis for annual periods beginning after December 15, 2024, or apply it earlier in an interim or annual period in a filing made after the effective date. The first application needs clear disclosure of the effects of a change in accounting principle. The bulletin also reminds entities to keep disclosing the nature of their safeguarding obligations, citing Regulation S-K Items 101, 105 and 303, ASC 450-20 and ASC 275.

For an audit client that is a custodian, three matters need documentation in the file:

The prior-period balances recorded under SAB 121 and the reversal entry, with the disclosure of the change in principle.
The risk of loss analysis under ASC 450-20: probability and estimability of loss from hacks, key compromise, insider theft or operational error, and the contractual and insurance terms that limit or shift the loss.
The disclosures: description of the custody arrangement, how keys are held, and the loss contingency disclosure.

A custodian that is not an SEC registrant still applies ASC 450-20 to its safeguarding obligation, because the standard, not the bulletin, governs the loss analysis.

Control is the first question

The AICPA's practice aid on accounting for and auditing digital assets, which is nonauthoritative, identifies the level of interaction between an entity and a third-party custodian as an audit challenge, adds a chapter on use of a service organization, and covers whether a SOC report is sufficient for the needs of the audit. Those themes are the right frame for the custody work: who controls the keys, what rights the holder has against the custodian, and what controls the custodian operates.

On control, the auditor asks several questions in sequence:

Who generates, stores and uses the private keys, and where? Hot wallets, warm wallets, cold storage and multi-party computation arrangements each have different control points.
Who can authorize a transfer, and does the custodian have the contractual right to refuse a valid instruction or to pledge or lend the assets?
Are customer assets legally segregated from the custodian's own, and does the agreement say so?
If the custodian fails, what claim does the customer hold?

Key possession alone does not settle ownership. The contract and the legal structure carry the answer, and the auditor reads both. For the holder, if the custodian can use the assets, the position can be a receivable from the custodian rather than a holding of the asset.

Proof of reserves is evidence to evaluate, not an audit

A proof of reserves report is a point-in-time statement, often supported by a cryptographic method, that wallet balances cover customer liabilities. The platform or a third party under agreed procedures prepares it. Treat it as a document that supplies evidence to be evaluated under AU-C 500, not as a substitute for the audit.

Questions to apply to any such report:

Date. It speaks to one moment. Balances move in and out around the date.
Completeness of liabilities. Wallet totals prove assets. The harder question is whether the customer liability list is complete. Reconcile it to the internal ledger and to the platform's own records of deposits and withdrawals.
Ownership of the wallets. A public address shows a balance, not who controls it. The auditor needs evidence of control, such as a signed message from the address at a time of the auditor's choosing, or observed transfers initiated under the auditor's supervision.
Preparer. If a specialist prepared it, apply AU-C 620 to competence, objectivity and the work done.
Scope. A report on one asset or one entity does not cover other assets or affiliates.

Reconciliation, the central test

For a custodian, the control that matters most is the three-way reconciliation: on-chain wallet balances, the platform's internal customer ledger, and the books. Differences are either timing items, such as pending withdrawals, or errors that need investigation.

Worked example (illustrative numbers). At year-end a platform's wallets hold 10,000 units of an asset. The internal ledger shows customer balances of 10,012 units. At an example price of $50,000 a unit, the 12-unit shortfall is $600,000.

Pending withdrawals of 9 units account for part of the gap. The auditor traces them to blockchain confirmations on the first days after year-end. That leaves 3 units, or $150,000.
The remaining 3 units are a fee sweep not yet booked, a customer-balance error or a loss. Each has a different consequence: a fee is revenue, a ledger error is a correction, and a loss feeds the ASC 450-20 analysis and a possible misappropriation inquiry under AU-C 240.

An unexplained difference that the client carries forward for months is a control deficiency to evaluate under the firm's standards for communicating deficiencies.

Service organizations

Many holders rely on a custodian's service organization control report. The auditor reads the scope, the period, the complementary user entity controls, and the exceptions, and decides whether the report speaks to controls over safeguarding and transfer authorization. See SOC 1 reports under AU-C 402. A report that does not cover wallet and key management does not support reliance on them. Where it falls short, direct confirmation and substantive testing take its place.

PBC list

Custody agreements and wallet structure diagram
Key management policy, signer lists and access logs
Wallet inventory with addresses, signing evidence and balances at year-end
Customer ledger by asset and the three-way reconciliation
Withdrawal and deposit logs around year-end
Any proof of reserves report with the preparer's engagement terms
SOC reports and the client's review of complementary user entity controls
Insurance policies and exclusions
ASC 450-20 loss contingency analysis and the SAB 122 transition workpapers
Incident logs, hack and loss history

Red flags

Customer liabilities that cannot be listed in full
Wallets whose control cannot be shown with a signed message or a supervised transfer
A custodian that has the right to use client assets
Reserve reports published for dates picked by the platform
Reconciling differences that persist
Insurance that excludes the main loss scenario

Sources

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Part of CORAA University · Specialized engagements: related guides, calculators and templates.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error

Crypto Custody and Proof of Reserves: Audit Considerations After SAB 122