How Are the Existence and Reconciliation of Bitcoin or Crypto Accounts Verified in an Independent Audit?

In an independent audit, the existence and reconciliation of Bitcoin accounts are verified through the following steps:

1. Verifying existence

a) Verifying wallet addresses:

• Control procedures are performed to confirm that the wallet addresses the audited company claims to own actually belong to it.

• The company may be asked to carry out a small transaction using the wallet's private key (for example, sending a nominal amount to another address).

• Using public information on the blockchain, the auditor confirms that the wallet is active and that the address used is the one declared by the company.

b) Third-party confirmations:

• If the company uses a custodian, an independent confirmation is obtained from that custodian.

• The confirmation covers the accuracy of the balances the company holds in the specified accounts.

2. Reconciliation process

a) Verification on the blockchain:

• Because Bitcoin transactions can be traced on the public blockchain, the current balances of the company's wallet addresses are checked using a blockchain explorer.

• The balances and transaction history of the wallet addresses are reviewed and compared with the balances the company reports in its financial statements.

b) Comparison with account statements:

• The auditor answers the question: do the company's accounting records or financial statements agree with the blockchain data?

• The company can match the internal records it keeps in its own system against blockchain data. The auditor also checks whether balances are reported correctly at the end of the reporting period.

3. Valuation and presentation

a) Verifying prices:

• The market price of Bitcoin at the reporting date is verified against reliable sources such as independent price providers (for example, CoinMarketCap or Binance).

• The auditor examines whether the fair value of the Bitcoin balance has been reflected in the financial statements.

b) Presentation and disclosures:

• The auditor assesses whether all disclosures relating to Bitcoin accounts in the company's financial statements are accurate and adequate.

• The auditor checks whether an appropriate framework (for example, IFRS or GAAP) has been used to account for crypto assets.

4. Risk assessment and testing of controls

a) Ownership risk:

• If Bitcoin private keys are lost, the funds cannot be accessed. The company's private-key management policies and security measures are therefore reviewed.

b) Money laundering and compliance:

• Given the risk that Bitcoin accounts may be used for illegal activities, the auditor checks whether the company complies with the required "Know Your Customer (KYC)" and "Anti-Money Laundering (AML)" policies.

c) Control framework:

• The company's internal control processes over Bitcoin transactions (for example, approval mechanisms and transaction monitoring systems) are evaluated.

5. Reporting and communicating findings

Finally, the findings identified during the audit are reported. As a result of the existence verification and reconciliation process:

• Any error, inconsistency or risk identified is reflected in the report.

• The strengths and weaknesses relating to the company's Bitcoin accounts are evaluated.

This process enables the independent auditor to confirm impartially that Bitcoin assets are accurate and properly reflected in the financial statements.