Proof of Reserves vs an Audit: What Each Can and Cannot Show

Proof of reserves can provide evidence about specified assets, balances or customer-account calculations. A financial statement audit addresses a broader set of statements under an identified reporting and auditing framework. Neither label should be accepted without reading the actual report, but the two are not interchangeable: demonstrating that assets exist does not, by itself, establish that all obligations have been identified or that customers can withdraw when needed.

The most useful way to compare them is to ask which assertions were tested, against what evidence, at which date and with what limitations. A report becomes misleading when readers use it to answer a question that the engagement did not examine.

Start With the Claim, Not the Badge

An exchange may display several reassuring objects: a list of wallet addresses, a cryptographic commitment to customer balances, a report signed by an accounting firm, and an audit opinion on an affiliated company. These can refer to different entities, different dates and different scopes.

Begin by writing the precise claim you want to evaluate. Are customer assets present? Are they restricted or pledged? Are customer obligations complete? Does the operating company have other debts? Is the reporting entity the same entity that owes the customer money? Can withdrawals be completed in the relevant asset?

A single badge cannot answer all these questions. Even a technically correct calculation may address only a narrow subset. The task is to connect each claim to evidence and leave the unsupported claims visibly unresolved.

The PCAOB Office of the Investor Advocate's advisory on proof-of-reserve reports cautions that these engagements are not equivalent to financial statement audits. The document is a staff investor advisory, not a new rule establishing one universal definition of every reserve-verification product.

Asset Existence Is Only One Assertion

A wallet balance can support the proposition that assets are associated with an address. A demonstration of signing ability can provide evidence of control at a particular point. Neither observation alone determines the economic ownership of the assets or the full set of claims against them.

To see the gap, imagine that an organization shows $100 million in liquid tokens. That total says nothing by itself about whether it owes customers $80 million or $120 million. It also does not reveal whether part of the inventory was financed by a lender, whether assets are pledged, or whether some addresses belong to a different legal entity.

The distinction between control and rights is visible in conventional audit practice. PCAOB Audit Standard 1105 identifies separate financial-statement assertions, including existence, completeness, valuation and rights and obligations. Those categories provide a useful reading framework without turning a reader's checklist into an audit.

This is also why custody technology cannot establish financial health. A sophisticated signing arrangement may reduce unauthorized transfers while saying little about liabilities. The analysis of multisignature custody concerns authorization and recovery; reserve adequacy requires additional evidence.

A Coverage Ratio Can Change When the Denominator Changes

Consider a hypothetical company displaying $100 million of assets against $92 million of customer balances. The headline ratio is approximately 108.7%. An observer looking only at those two numbers could conclude there is a comfortable buffer.

Now suppose the company also owes $20 million to a lender and has no other assets. On those assumptions, total obligations are $112 million. Assets divided by total obligations equal approximately 89.3%, leaving a $12 million shortfall. The assets shown on the dashboard did not change; the question and denominator changed.

This is an educational example, not a finding about any business. It does not determine which claimant has priority or what customers would recover in an insolvency process. Such conclusions depend on legal arrangements and jurisdiction. It simply shows why an asset-only or customer-only ratio cannot resolve all balance-sheet questions.

The opposite qualification matters too: a narrowly scoped reserve report is not automatically false or useless. If it accurately documents an identified asset position, it can be valuable evidence for that assertion. The mistake is expanding a limited finding into a comprehensive solvency conclusion.

What a Customer Inclusion Proof Actually Establishes

Some reserve systems let a customer verify that an account balance is included in a cryptographic commitment. In simplified terms, the customer checks that their record is consistent with a published aggregate rather than receiving a plain promise that their account was counted.

That can reduce one information gap. It does not allow one customer to determine whether every other customer or obligation was included correctly. A proof about membership in a stated dataset is not automatically proof that the dataset is complete.

Suppose a fictional platform reports customer balances totaling $90 million. A customer verifies that their own $2,000 balance is included. If an additional group of obligations totaling $10 million was outside the stated dataset, that customer's successful check would not reveal the omission. The individual verification and the aggregate completeness question are different tasks.

There are further scope questions. Does the system handle negative balances appropriately? Are balances netted across legally distinct entities? Are contingent claims included? Which assets are counted against which liabilities? A sound review asks how the engagement addresses these issues; it does not presume that every implementation has the same weaknesses or protections.

Privacy-preserving techniques can improve what can be demonstrated publicly. They cannot make an undisclosed legal obligation disappear. Their assurance remains tied to the inputs, rules and claims the system actually covers.

Read the Report as a Contract About Evidence

Terms such as verification, attestation and audit can appear together in marketing material. The signed document should identify what was performed. Read the subject matter, criteria, reporting entity, period or snapshot date, procedures, conclusion, qualifications and intended users.

The table describes questions to ask, not a hierarchy in which every engagement bearing a particular name has identical coverage. Standards, jurisdictions and engagement terms differ. A report should be evaluated on what it says and who is responsible for it.

The SEC's investor bulletin on alternatives to financial statement audits explains why reserve and valuation reports should not be treated as substitutes for a complete audit of financial statements. Its discussion concerns the U.S. regulatory context; it should not be read as a claim that every crypto business worldwide is subject to the same filing obligations.

The Date Is Part of the Finding

A correct snapshot can become outdated. Assets move, liabilities change, counterparties fail and business arrangements evolve. Compare the observation date with the publication date and with the date on which the reader intends to rely on the report.

For example, a reserve position measured on the final day of a month does not establish the minimum reserve position during that month. A daily wallet dashboard offers a different kind of timeliness, but it may still leave the liabilities or legal restrictions unknown. Combining two datasets helps only if their timing and definitions are aligned.

A useful reporting system therefore explains the reconciliation process. How does token issuance change obligations? How are redemptions reflected? How are transfers between disclosed addresses distinguished from inflows from outside the business? Without those relationships, frequent updates can create an impression of precision while the most important variable remains missing.

Avoid adding several reserve dashboards together without checking whether they describe overlapping assets. A parent company, custodian and token issuer could each report a view of the same inventory for different purposes. Three published totals would then be three descriptions, not three independent pools of resources. An effective comparison identifies which balances are distinct and which claims compete for, or pass through to, the same backing.

For stablecoins, these questions connect directly to the operation of reserves and redemption. A balance-sheet observation and a working redemption route are complementary evidence; neither should silently stand in for the other.

An Audit Is Not a Withdrawal Guarantee

A financial statement audit has a defined entity, reporting period and framework. It is not a promise that the business cannot fail afterward. It is also not automatically an opinion on every customer agreement, software component or affiliate associated with the brand.

An audited group may contain subsidiaries with different obligations. A report covering one entity does not establish that a customer's claim is against that entity. A clean historical opinion does not guarantee that funds will be accessible during an operational interruption or sudden run.

Similarly, a smart-contract audit concerns a different subject. Reviewing code for specified vulnerabilities does not audit the issuer's financial statements. A business can have audited code and weak reserves, or audited financial statements and a software vulnerability. Treating the word audit as a universal safety certificate removes the very scope information that makes the report useful.

The distinction between eventual backing and immediate accessibility is developed in our stablecoin depeg framework. Even adequate asset value can coexist with a payment-timing problem.

Build an Evidence File Before Making a Comparison

An effective comparison begins with the actual reports, not screenshots of a seal. Record the reporting entity, provider, standard, covered assets, covered obligations, measurement date and conclusion. Add links to the original documents and note whether later statements change the interpretation.

Next, match the report to the service being used. Identify the entity in the account agreement and the asset in which withdrawals are owed. If a platform promises a quantity of tokens, a dollar-equivalent reserve figure can obscure token-price and liquidity mismatches. If it promises dollars, a volatile token inventory may create a different mismatch.

Finally, identify the unanswered question that matters most. For one use case it may be completeness of obligations. For another it may be encumbrances or the ability to deliver the required asset. A longer list of documents is not necessarily better evidence if all of them address the same narrow assertion.

Choosing hot or cold self-custody changes this analysis by changing the service relationship. It does not remove the need to assess the backing of any issuer-dependent token held in the wallet. Key control and asset quality remain separate layers.

What Would Improve the Assessment?

The most useful improvement is evidence that closes a specific gap: a clearly defined liabilities scope, independent confirmation of restrictions, consistent entity coverage, reconciliation between reporting dates, or a report whose stated conclusion matches the marketing claim.

Evidence can also weaken a favorable assessment. Examples include unexplained changes in reporting entities, withdrawal of previously available documents, mismatched measurement dates or a description of an engagement that is broader than the signed report. None of these observations alone proves wrongdoing. Each identifies a question that deserves resolution before the report is treated as sufficient.

The broader crypto due-diligence framework connects these reporting questions to governance, control and cash flows. Reserve evidence is strongest when it is one clearly understood part of that analysis, with its limitations visible rather than hidden behind a reassuring label.