PCAOB warns of limitations on crypto proof of reserve reports

The Public Company Accounting Oversight Board issued an advisory Wednesday warning investors to exercise caution when it comes to the so-called “proof of reserve” reports that some cryptocurrency companies have claimed.

The warning comes after a number of auditing firms have already stopped providing this limited form of assurance following the collapse of high-profile crypto companies such as FTX. Several companies have published such audits, including Binance, Crypto.com, Kraken and KuCoin. A few audit firms such as Armanino and Prager Metis offered this type of insurance in the past, at least until their former client FTX collapsed last November. Mazars, which provided proof of reserve audits for Binance, Crypto.com and Kraken, has also reportedly halted such work (see story).

The PCAOB’s newly established Office of the Investor Advocate now warns investors against relying on such reports. “Evidence of reserve reports is inherently limited and clients should exercise extreme caution in relying on them to conclude that there are sufficient assets to cover client liabilities,” it said.

It is aware that some service providers, including PCAOB-registered audit firms, issue proof of reserve reports to certain crypto exchanges and stablecoin issuers. In the reports, they try to calm customers’ concerns about the type of reserve holdings or the security and availability of their digital assets in case some or all of the customers decide to withdraw their assets, for example if there is a run on a crypto exchange or stablecoin issuer.

The Office is concerned that investors and others may rely on evidence of reserve reports, which do not fall under the PCAOB’s oversight authority.

“Importantly, investors should note that PoR engagements are not audits and, accordingly, the related reports do not provide any meaningful assurance to investors or the public,” the notice said. “As a general matter, these PoR reports are intended to provide an asset confirmation for an asset type at a specific point in time, subject to significant limitations based on the procedures performed. For example, the procedures performed will likely not address the crypto entity’s liabilities, rights and obligations to the owners of digital assets, or if the assets are loaned by the crypto-entity to make it appear that they have sufficient collateral or ‘reserves’ beyond the customers’ claims. For this reason, if the assets were loaned by the crypto-entity at the time of the PoR engagement , investors would not know based on the PoR report. Because PoR reports concern digital assets at some point in time, they also provide no assurance as to whether the assets were used, lent, or otherwise became unavailable to customers after the PoR report was issued. Furthermore, PoR- nor report any assurance about the effectiveness of internal control or governance ce for the crypto entity.”

The PCAOB emphasized that back-up engagement evidence is not the same as a true audit or more rigorous, and that it is not performed in accordance with the PCAOB’s auditing standards. There is also a lack of uniformity in the service providers who handle such engagements. Some assignments are performed by accounting firms, while others are performed by non-accountants. Crypto company executives also have discretion over whether the results of proof of reserve reports are made public, including the scope and format of the information provided.

Whether the engagements are intended to provide reasonable assurance, limited assurance or no assurance, they are not subject to PCAOB auditing standards and the engagements are not subject to PCAOB inspections. The reports provide no assurance that the reserves will be sufficient as of the date of the report, in the future, or that the client’s assets will be protected.

For “agreed procedures”, crypto managers, not the proof-of-reserve report provider, determine the procedures to be performed by the third party when performing the assignment. The report contains only some factual findings about the results of the procedures that were performed, and there is no representation as to whether these procedures are adequate. These types of reports do not express an opinion on the adequacy of reserves, the financial stability of the crypto company, or the validity of management’s claims.

“Evidence on reserve reports is inherently limited and clients should exercise extreme caution when relying on them to conclude that there are sufficient assets to meet client obligations,” the alert warned.