Ondology Labs: full site text for LLM ingestion. Generated at build time from the prerendered pages. Canonical URLs are given per section. # Blockchain Auditing, Compliance & Forensics in Cyprus | Ondology Labs URL: https://ondologylabs.com/ Description: Cyprus-based blockchain auditing, compliance, and forensics: proof of reserves, transaction reconciliation, AML audits, MiCA readiness, and DAC8 reporting. Lost your crypto? We trace and recover stolen funds with court-ready evidence. Blockchain Auditing, Compliance & Forensics Audit-ready crypto books. MiCA-ready operations. We verify wallet control and balances on-chain, reconcile them to your ledger, and deliver the evidence auditors, CySEC and tax authorities ask for. Full statutory audits with our ICPAC-licensed partner. Talk to us MiCA Compliance What We Do We give digital-asset businesses the same financial assurance traditional companies rely on: independent audits and proof of reserves first, backed by deep blockchain forensics when funds need to be traced. For CASPs supervised by CySEC and for crypto companies across Cyprus and the EU, we also produce the MiCA and DAC8 evidence that supervisors and tax authorities ask for. Crypto Audit Support On-chain evidence, wallet-control verification and working papers for your incumbent auditor, or for audit firms with crypto clients. The engaged auditor keeps the opinion. How audit support works Financial Statement Audits Independent audit opinions on the financial statements of crypto and digital-asset businesses, prepared to recognised accounting and assurance standards. About our statutory audits Proof of Reserves & Solvency On-chain verification that custodied assets genuinely exist and fully back customer liabilities, giving users, investors, and regulators confidence. How our attestations work MiCA Readiness & CASP Compliance Gap assessments against CASP obligations, custody and client-asset segregation verification, and the evidence packs CySEC and other EU supervisors expect to see. See the MiCA readiness service DAC8 & Tax Reporting Scoping, self-certification due diligence and transaction aggregation, so your first DAC8 report, due in Cyprus by 30 June 2027, reconciles to the chain and to the books. Prepare for DAC8 reporting Forensic Tracing & Recovery When fraud or theft occurs, we trace the flow of funds across chains, identify connections to real-world entities, and document findings for legal scrutiny. Explore forensics services Dates That Matter The deadlines Cyprus crypto businesses are working against right now. Each one links to what we prepare for it. 1 Jul 2026 MiCA transition ended Providing crypto-asset services from Cyprus without CySEC authorisation under MiCA is now unauthorised, not transitional. What we prepare Now to mid-2027 CySEC custody inspections On-site inspections and desk reviews of custody CASPs under ESMA's Common Supervisory Action: key management, wallet access controls, transaction monitoring, incident response. What we prepare 1 Jan 2027 DAC8 self-certifications due Tax self-certifications from every user whose account existed before 2026. After two reminders and 60 days, non-responders must be blocked from reportable transactions. What we prepare 30 Jun 2027 First DAC8 report due in Cyprus Covers the 2026 calendar year, aggregated per user and per crypto-asset, and has to reconcile to the chain and to the books. What we prepare Sources for every date are listed on the linked pages. Deadlines outside Cyprus differ within the EU windows; we confirm yours at scoping. Now Live · Ondology App The compliance suite for crypto companies. Step into the same workspace our team uses: watch AI agents map wallets in real time, reconcile activity across exchanges and chains, and turn findings into shareable briefs. Regulatory reporting modules land next, built on the same engine. Preview the Canvas Ask for a demo AI Investigator Live tracing, entity graphs, and narrative-ready evidence, just by chatting with your AI assistant. AI Auditor Agentic reconciliation across exchanges, chains, and ledgers. Compliance Modules DAC8 reporting, safeguarding checks, AML casework, and MiCA readiness. Coming soon. Our Team Meet the experts behind Ondology Labs, bringing together years of experience in blockchain technology, data science, auditing, and forensic investigation. Iraklis Anastasiou Co-Founder & CEO ISO/TC 307 Technical Committee Member Leads Ondology Labs' forensic investigations and audit engagements, supporting law firms and digital asset businesses with transaction tracing and on-chain analysis. 7+ years in cryptocurrency, formerly Senior Data Analyst at Cointelegraph MSc in Blockchain and Digital Currency Panayiotis Kattides Co-Founder & CTO ISO/TC 307 Technical Committee Member Builds the technology behind Ondology Labs, from cross-chain transaction tracing to the firm's AI-assisted audit and investigation tooling. Data scientist and AI/ML professional with 5+ years in cryptocurrency and financial crime detection MSc in Data Science and Analytics Advisors Industry leaders guiding Ondology Labs across Audit, Law, Compliance, and Web3 economics. Joseph Kassapis Assurance & Audit Advisor Veteran assurance expert (CPA, CMA, CIA), financial consultant, and international instructor with over 40 years of experience in technical audit compliance, risk management, and forensic investigations. Christiana Aristidou Business Technology Lawyer CEO of The Hybrid LawTech Firm and Head of the National Blockchain Delegation to ISO/TC 307, with over 27 years of experience in fintech, digital governance, and transnational technology law. Luca Bazzurro Digital Asset Valuation Advisor Token design and valuation expert specializing in the fair value of digital assets, combining on-chain analytics, liquidity and market-structure analysis to assess token economies and protocol treasuries. Arthur Firstov Digital Assets Business Advisor Chief Business Officer at Mercuryo, a recognised voice on regulated crypto payments, with a decade of experience across fintech and digital assets. Brings frontline insight into how funds move between fiat and crypto. Our Partners Who does what on an engagement. Statutory opinions come from an ICPAC-licensed audit office; analytics, tax and training come from specialists we work with in Cyprus and internationally. ICPAC-licensed audit office. Issues the statutory audit opinion on joint engagements. Blockchain analytics and wallet risk data behind our tracing and AML work. Audit, tax and advisory network in Cyprus. Audit, tax, and advisory. Compliance education and CPD training for CASP staff. How each partnership works, and how to verify it: see our partners on the About page . Common Questions Straight answers on auditing, compliance, and what to do when crypto goes missing. What is blockchain auditing, and how is it different from a smart-contract audit? Blockchain auditing is the independent financial and forensic audit of an organisation’s crypto holdings, transactions, and reserves, verifying that the on-chain reality matches the books. It is distinct from a smart-contract (code) audit: we audit the money and the controls, not the source code. Our work covers financial-statement audits, proof of reserves, transaction reconciliation, and AML controls. Crypto audit services in Cyprus Are your audits backed by a licensed firm in Cyprus? Yes. We partner with ICPAC-licensed firms (the Institute of Certified Public Accountants of Cyprus is the body that authorises statutory audit work in Cyprus), so independent audit opinions are issued through licensed partners your investors, board, and regulators can rely on, combined with the on-chain forensic depth most accounting firms don’t have. Statutory crypto company audits How do I know Ondology Labs is legitimate? Check us independently. Ondology Labs is a registered Cyprus company based at Hawaii Tower, Themistokli Dervi 41, Nicosia, with named founders you can verify on LinkedIn, an ISO/TC 307 technical committee membership, and an ICPAC-licensed audit partner (CYAUSE Audit Services) behind our statutory audit work. We never cold-contact victims and we never ask for payment through gift cards or crypto transfers to "unlock" recovered funds. If someone claiming to be us does any of that, it is an impersonator. Verify us independently What should I do if my crypto is stolen in Cyprus? Act fast and contact us immediately. Stolen funds can be moved through mixers or cross-chain bridges within hours, so the earliest hours matter most. We trace the funds on-chain, document the trail, notify exchanges that may be able to freeze assets, and coordinate with law enforcement in Cyprus, Greece, and beyond. The sooner we start, the better the odds of recovery. Crypto asset recovery Do you guarantee crypto recovery? No, and no legitimate firm can. Recovery depends on where the funds went: assets that reach a regulated exchange can often be frozen through legal channels, while funds sitting in a private wallet cannot be seized by anyone without legal process against the holder. We tell you honestly what the trace shows and what your realistic options are. Treat any "guaranteed recovery" promise as a red flag for fraud. Crypto asset recovery Who do you typically work with? We work with crypto exchanges, funds, and digital-asset businesses needing audited, verifiable financials; law firms and prosecutors needing on-chain evidence and expert testimony; banks, fintechs, and CASPs needing AML and compliance assurance; and individuals or businesses that have lost crypto to fraud or theft. All our services See all frequently asked questions Start with a scoping call Tell us about the audit, reserve attestation or MiCA obligation you are working toward. We reply within one business day. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Send Inquiry Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. --- # About Ondology Labs | Blockchain Auditing & Forensics Team URL: https://ondologylabs.com/about Description: Who is behind Ondology Labs: the Nicosia-based founders, advisors, ICPAC-licensed audit partner, and how to independently verify the firm before you engage anyone. About Us About Ondology Labs Ondology Labs is a Cyprus-based blockchain auditing , compliance and forensics firm in Nicosia. We give digital-asset businesses audited, verifiable financials, keep them compliant with MiCA, AML and DAC8 obligations, and trace what moved when funds go missing, serving clients across Cyprus, Greece and the EU. Why we exist Crypto grew up faster than the assurance around it. Companies hold material treasury positions on-chain, exchanges custody customer assets, and regulators now expect the same discipline from digital-asset businesses that they have always expected from banks and funds. Yet most accounting firms cannot read a blockchain, and most blockchain analytics firms have never prepared evidence an auditor or a court would accept. Ondology Labs sits deliberately in that gap. On the assurance side, we verify wallet control cryptographically, read balances directly from the chain, and reconcile on-chain activity to the accounting ledger, which is our crypto audit support service. For statutory audits , the opinion is issued by our ICPAC-licensed audit partner, CYAUSE Audit Services Ltd, while we supply the on-chain evidence inside the engagement. That split matters: you get a real, licensed audit opinion and specialist digital-asset verification in one engagement, without either side stretching beyond what it is qualified to do. On the forensics side, we trace stolen or disputed funds across chains, bridges and swaps, and we document what we find to a standard that holds up in court: documented methodology, chain of custody, honest limits. We say plainly what the evidence shows, what it does not show, and what your realistic options are. We never guarantee recovery, because nobody honestly can. The company Brand Ondology Labs Legal name ONDOLOGY ENTERPRISES I.A. LIMITED, registered in Cyprus Office Hawaii Tower, Themistokli Dervi 41, Office 102, 1066 Nicosia, Cyprus Phone +357 97 689363 Email iraklis@ondologyenterprises.com Our Team Meet the experts behind Ondology Labs, bringing together years of experience in blockchain technology, data science, auditing, and forensic investigation. Iraklis Anastasiou Co-Founder & CEO ISO/TC 307 Technical Committee Member Leads Ondology Labs' forensic investigations and audit engagements, supporting law firms and digital asset businesses with transaction tracing and on-chain analysis. 7+ years in cryptocurrency, formerly Senior Data Analyst at Cointelegraph MSc in Blockchain and Digital Currency Panayiotis Kattides Co-Founder & CTO ISO/TC 307 Technical Committee Member Builds the technology behind Ondology Labs, from cross-chain transaction tracing to the firm's AI-assisted audit and investigation tooling. Data scientist and AI/ML professional with 5+ years in cryptocurrency and financial crime detection MSc in Data Science and Analytics Advisors Industry leaders guiding Ondology Labs across Audit, Law, Compliance, and Web3 economics. Joseph Kassapis Assurance & Audit Advisor Veteran assurance expert (CPA, CMA, CIA), financial consultant, and international instructor with over 40 years of experience in technical audit compliance, risk management, and forensic investigations. Christiana Aristidou Business Technology Lawyer CEO of The Hybrid LawTech Firm and Head of the National Blockchain Delegation to ISO/TC 307, with over 27 years of experience in fintech, digital governance, and transnational technology law. Luca Bazzurro Digital Asset Valuation Advisor Token design and valuation expert specializing in the fair value of digital assets, combining on-chain analytics, liquidity and market-structure analysis to assess token economies and protocol treasuries. Arthur Firstov Digital Assets Business Advisor Chief Business Officer at Mercuryo, a recognised voice on regulated crypto payments, with a decade of experience across fintech and digital assets. Brings frontline insight into how funds move between fiat and crypto. How we work with partners Some of our work legally requires a licence we do not hold, and we are open about that. Statutory audit opinions in Cyprus can only be issued by an audit office licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus. Ours are issued by CYAUSE Audit Services Ltd: they sign the opinion, we deliver the cryptographic wallet-control verification and on-chain evidence behind it. For blockchain intelligence we work with Crystal Intelligence analytics alongside our own tooling. McMillan Woods and CoreTax cover audit, tax and advisory needs beyond digital assets, and Centre 8 Education is our partner for blockchain training. Our Partners Who does what on an engagement. Statutory opinions come from an ICPAC-licensed audit office; analytics, tax and training come from specialists we work with in Cyprus and internationally. ICPAC-licensed audit office. Issues the statutory audit opinion on joint engagements. Blockchain analytics and wallet risk data behind our tracing and AML work. Audit, tax and advisory network in Cyprus. Audit, tax, and advisory. Compliance education and CPD training for CASP staff. How each partnership works, and how to verify it: see our partners on the About page . How to verify we are who we say we are The crypto recovery space is full of scammers, including scammers who impersonate legitimate firms. Do not take our word for anything on this page. Check it: Look up the company at the Cyprus Registrar of Companies (ONDOLOGY ENTERPRISES I.A. LIMITED) via the official portal at efiling.drcor.mcit.gov.cy . Find our office on Google Maps : Hawaii Tower, Themistokli Dervi 41, Nicosia. You are welcome to visit by appointment. Check the founders on LinkedIn: Iraklis Anastasiou and Panayiotis Kattides , and the company page at linkedin.com/company/ondology-labs . Verify our audit partner independently: CYAUSE Audit Services Ltd is listed in ICPAC's public register of licensed firms. Call the number on this site, +357 97 689363, and speak to us before sending anyone anything. What we will never do We never cold-contact theft victims. We never promise or guarantee recovery. We never ask for an upfront percentage-of-recovery fee, gift cards, or a crypto transfer to "unlock" funds. Anyone doing any of that in our name is an impersonator; please report it to us and to the police. What we do Three practice areas, one team. Blockchain Auditing Crypto audit support, statutory audits, proof of reserves, reconciliation. Crypto Compliance MiCA readiness, AML compliance audits, DAC8 and tax reporting. Blockchain Forensics Tracing, investigations, asset recovery, expert witness work. Crypto Audit Support For companies whose auditor cannot test the crypto balances. Talk to us --- # Contact Ondology Labs | Crypto Audit & MiCA Enquiries URL: https://ondologylabs.com/contact Description: Talk to Ondology Labs about a crypto audit, proof of reserves, or MiCA compliance. Reply within one business day. Nicosia office, phone and email. Home / Contact Contact Talk to us about your crypto audit or MiCA compliance Tell us what you hold, who your auditor or supervisor is, and the deadline you are working to. A founder reads every enquiry and replies within one business day. Send your enquiry Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Send Enquiry What happens next 1 We reply within one business day. A founder, not a sales team, reads your message and confirms whether we can help. 2 A 20-minute scoping call. We agree the wallets, exchange accounts, ledgers and reporting framework in scope, and who else should join. 3 A fixed-fee proposal. Written scope, procedures, timetable and price. No retainer and no percentage fees. Reach us directly +357 97 689363 iraklis@ondologyenterprises.com Hawaii Tower, Themistokli Dervi 41 Office 102, 1066 Nicosia, Cyprus Find us on Google Maps Before you engage anyone Statutory opinions are issued by CYAUSE Audit Services, an ICPAC-licensed audit office. ISO/TC 307 blockchain standards committee membership on the team. Registered in Cyprus as ONDOLOGY ENTERPRISES I.A. LIMITED. Verify us at the Registrar of Companies. We only contact you from an ondologyenterprises.com email address or the phone number on this page. Not ready to enquire yet? Read what each engagement involves before you get in touch. Blockchain Auditing Crypto audit support, statutory audits, proof of reserves, reconciliation. Crypto Compliance MiCA readiness, AML compliance audits, DAC8 and tax reporting. Blockchain Forensics Tracing, investigations, asset recovery, expert witness work. Crypto Audit Support For companies whose auditor cannot test the crypto balances. Last reviewed: September 21 , 2026 --- # Blockchain Auditing, Compliance & Forensics Services | Ondology Labs URL: https://ondologylabs.com/services Description: Independent blockchain auditing, crypto compliance, and forensics. Audited, verifiable crypto financials, MiCA and DAC8 readiness, and tracing or recovery when funds go missing. Our Services Three practice areas, one team. We give digital-asset businesses audited, verifiable financials, keep them compliant with the EU rulebook, and, when something goes wrong, trace and recover funds with forensic precision. Blockchain Auditing Prove what you hold Independent financial audits, proof of reserves, and reconciliation for crypto-native businesses. Crypto audit support for your auditor Financial statement audits Proof of reserves & solvency Transaction reconciliation Explore Auditing Crypto Compliance Prove you comply MiCA readiness, AML audits, and DAC8 reporting, built on evidence a supervisor can test. MiCA readiness & CASP compliance AML & compliance audits DAC8 & tax reporting Explore Compliance Blockchain Forensics Trace what moved Investigations, transaction tracing, and crypto recovery with court-ready evidence. Advanced transaction tracing Crypto asset recovery Investigations Expert witness & court support Explore Forensics Which service do you need? Most enquiries we receive fall into one of three situations. Find yours: Your auditor will not sign off on crypto balances, or you need audited financials for a bank, investor, or regulator. You need Auditing. Crypto audit support keeps your existing auditor and adds the on-chain evidence; the full statutory audit runs with our ICPAC-licensed audit partner. Start with Blockchain Auditing MiCA, AML, or DAC8 obligations have landed and you need evidence a supervisor can test, not another policy document. You need Compliance. Gap assessments, custody and segregation verification, AML control testing, and DAC8 reports reconciled to the chain and the books. Start with Crypto Compliance Funds moved and you need to know where they went: a theft, a suspicious counterparty, an insolvent platform, a dispute heading to court. You need Forensics. Transaction tracing, investigations, recovery support, and expert witness work with court-ready documentation. Start with Blockchain Forensics Who we serve CASPs & crypto exchanges Funds & corporate treasuries Law firms & insolvency practitioners Banks, fintechs & audit firms Theft & scam victims Quick Answers What is blockchain auditing, and how is it different from a smart-contract audit? Blockchain auditing is the independent financial and forensic audit of an organisation’s crypto holdings, transactions, and reserves, verifying that the on-chain reality matches the books. It is distinct from a smart-contract (code) audit: we audit the money and the controls, not the source code. Our work covers financial-statement audits, proof of reserves, transaction reconciliation, and AML controls. How much do your services cost? It depends on the engagement. Audit support, proof of reserves, and compliance work are scoped up front and quoted as a fixed fee once we understand the wallets, chains, and volumes involved. Investigations and recovery cases are phased: a scoped initial assessment first, so you know what the evidence shows before committing to more. For theft victims the first conversation is free, and we never charge a percentage-of-recovery fee up front. Anyone demanding an upfront fee to "release" or "recover" your funds is running a second scam. Who do you typically work with? We work with crypto exchanges, funds, and digital-asset businesses needing audited, verifiable financials; law firms and prosecutors needing on-chain evidence and expert testimony; banks, fintechs, and CASPs needing AML and compliance assurance; and individuals or businesses that have lost crypto to fraud or theft. More questions answered on our general FAQ . Related Reading Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the new 8% tax Crypto audits in 2026: Tether, Bitpanda, and the new standard The first 24 hours after your crypto is stolen Not sure where to start? Describe the problem in your own words. We will tell you which engagement fits, or that we are not the right firm for it. Talk to us Last reviewed: September 21 , 2026 --- # Crypto & Blockchain Audit Services in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/auditing Description: Crypto auditors in Cyprus. Audit support for your incumbent auditor, statutory crypto audits with our ICPAC-licensed partner, and proof of reserves. Crypto Auditors in Cyprus Crypto audit services in Cyprus Audits your stakeholders trust. Crypto auditors for exchanges, CASPs, funds and treasuries in Cyprus. Independent financial audits, crypto audit support for incumbent auditors, proof of reserves, and transaction reconciliation across Cyprus and the EU. We make your numbers verifiable, aligned with CySEC and MiCA requirements for crypto-asset service providers. Already have an auditor? Start with crypto audit support . Need to show customers their deposits are backed? That is proof of reserves . Request an Audit Looking for Forensics? What We Audit Crypto Audit Support Already have an auditor, or are one? We supply the digital-asset expertise inside the engagement: wallet control verified cryptographically, balances read from the chain, and working papers the audit file can rely on. Your auditor keeps the engagement and the opinion. Learn more Financial Statement Audits The full statutory audit, delivered with our ICPAC-licensed audit partner who issues the opinion while we evidence the chain. For companies that need audited financial statements end to end. Learn more Proof of Reserves & Solvency On-chain attestation that your reserves fully back customer liabilities, with cryptographic verification of wallet ownership. Learn more Transaction Reconciliation We reconcile every on-chain movement against your internal ledger and exchange records, so the books match reality. Learn more Treasury & Wallet Audits Verification of custody arrangements, signing controls, and balances across hot, cold, and multi-sig wallets. AML & Compliance Audits Review of KYC/AML controls, wallet risk exposure, and regulatory readiness against EU and local requirements. Learn more DAC8 & Tax Reporting DAC8 crypto reporting for CASPs and crypto-asset operators in Cyprus and across Europe, plus cost-basis tracking and realised gains/losses for the businesses being reported on. The first reporting year is already running. Learn more Who Needs a Crypto Audit in Cyprus? Every Cyprus company files audited financial statements: the Companies Law requires a statutory audit regardless of size, and that does not stop applying because the assets are on a blockchain. If your company holds crypto, the auditor signing your financial statements must obtain evidence about balances they cannot verify with a bank confirmation letter, which is exactly where most audits of crypto-holding companies stall. Beyond the statutory baseline, three groups face crypto-specific assurance demands. CASPs authorised under MiCA answer to CySEC for the safeguarding of client assets and own-funds requirements, and need evidence rather than assertions. Funds and their administrators need digital-asset positions verified at the reporting date. And exchanges or custodians who want customer trust publish proof of reserves, an attestation that customer liabilities are fully backed on-chain. Support, full audit, or attestation? If you already have an auditor, or you are one, crypto audit support adds the on-chain evidence to the existing engagement; your auditor keeps the opinion. If you need the audit end to end, financial statement audits run with CYAUSE Audit Services, our ICPAC-licensed audit partner, who issues the opinion while we verify wallet control and balances on-chain. If the goal is showing customers their deposits are backed rather than a statutory opinion, proof of reserves is an attestation, not an audit, and we are careful about that distinction. And if the books do not yet agree with the chain, start with transaction reconciliation so there is something auditable to audit. Key facts: crypto and the Cyprus audit As at September 2026 Cyprus companies file audited financial statements under the Companies Law; holding crypto does not exempt a company from the statutory audit. Statutory audit opinions in Cyprus are issued only by ICPAC-licensed audit offices; ours are issued by CYAUSE Audit Services Ltd, with Ondology Labs supplying the on-chain evidence. Cyprus corporate income tax is 15% from 1 January 2026, and gains on crypto disposals are taxed at a flat 8% under Article 20E of the Income Tax Law, so crypto activity now has direct audit and tax-reporting consequences. Proof of reserves is an attestation about on-chain backing at a point in time; it is not a financial statement audit and does not by itself satisfy statutory requirements. How an Audit Works 01 Scope & Data Collection We agree the wallets, exchange accounts, and ledgers in scope and gather the source data. 02 Reconcile On-Chain to Ledger Every transaction is matched against your books to surface gaps, errors, and unexplained flows. 03 Verify Reserves & Controls We confirm balances, custody, and segregation of duties, proving what you hold and how it is secured. 04 Report & Attestation A clear, defensible audit report you can share with stakeholders, investors, and regulators. Auditing FAQ Which auditors in Cyprus can audit a crypto company? Only an ICPAC-licensed audit firm can sign a statutory audit in Cyprus, and the register of licensed firms is public, so any firm you are considering can be checked before you engage it. The practical constraint is narrower than the legal one: plenty of licensed firms can audit a Cyprus company but cannot independently test digital-asset balances, because a wallet has nobody to write to for confirmation. That is why crypto audits in Cyprus are usually delivered as a pairing. We work with CYAUSE Audit Services Ltd, which holds the licence and issues the opinion, while we prove wallet control and read the chain behind it. What does a crypto audit in Cyprus cover? The same four assertions as any audit, tested against evidence that lives on a blockchain rather than at a bank. Existence: the assets are real and readable on-chain at the reporting date. Rights and control: the company can actually move them, proven cryptographically rather than asserted on a schedule. Valuation: holdings are priced from a documented source under the right accounting treatment, usually IAS 38 or IAS 2. Completeness: no wallet, exchange account or custodial position has been left out. On top of that sit reconciliation of on-chain activity to the ledger and, for regulated firms, the safeguarding and prudential evidence a supervisor expects. What is crypto audit support? Specialist help with the digital-asset part of a financial statement audit, provided to whoever is running that audit. A conventional audit programme confirms a bank balance by writing to the bank. A wallet has nobody to write to: its balance is confirmed by proving control of a private key and reading the chain. Crypto audit support means we perform that examination, verifying wallet control, reading balances at the reporting date, reconciling on-chain activity to the ledger, and identifying connected addresses, and we hand the results to the auditor as documented working papers. The auditor keeps the engagement, applies their own judgement to our work, and issues the opinion. What is a proof of reserves audit? A proof of reserves engagement independently verifies that the crypto assets a custodian holds are sufficient to cover what it owes its customers. It has two halves that must both be done: proving control of the reserve wallets on-chain, and establishing the total customer liability from the internal ledger. Only the two together demonstrate solvency. A wallet balance on its own proves nothing about what is owed against it. Does a blockchain company in Cyprus need an audit? In almost all cases, yes, and not because it is good practice. A company registered in Cyprus is required to prepare annual financial statements, have them audited by a licensed audit firm, and file them with the Registrar of Companies alongside its tax return. The obligation attaches to the company, not to what the company does. Running a crypto exchange, a Web3 product, a DAO treasury, or a token issuer does not exempt you from it. What being a blockchain business changes is not whether you are audited but what the audit has to examine: the obligation is ordinary, the evidence is not. That gap is why crypto-native companies in Cyprus routinely struggle to close an audit on time. If you hold a CySEC authorisation as a crypto-asset service provider, the audit sits alongside your supervisory obligations rather than replacing them: your AML framework and client-asset safeguarding are reviewed separately. Exemptions in Cyprus are narrow and change, so we confirm your exact filing position and deadlines with CYAUSE at scoping rather than leaving you to assume them. More questions answered on our general FAQ . Related Reading Crypto audit requirements in Cyprus: who needs one and what it involves How to read a proof of reserves report (and spot a meaningless one) Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the 8% tax Best crypto accounting tools compared: the 2026 benchmark Need your crypto books audited? Tell us what you hold, who your auditor is, and the deadline you are working to. We will propose the right engagement and a timetable that fits it. A scoping call, then a fixed-fee proposal Statutory opinions via our ICPAC-licensed partner Audit support if you already have an auditor Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request an Audit Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # Crypto Audit Support for Auditors (ISA 620) | Ondology Labs URL: https://ondologylabs.com/services/auditing/crypto-audit-support Description: Crypto audit support for audit firms and their clients: wallet ownership verification, on-chain balance evidence and working papers under ISA 620. Home / Services / Blockchain Auditing / Crypto Audit Support Crypto Audit Support Crypto audit support for auditors and their clients Keep your auditor. Add the auditor's expert. Specialist digital-asset audit evidence for engagements that already have an auditor. We handle wallet ownership verification cryptographically, read balances directly from the chain, reconcile on-chain activity to the ledger, and deliver audit evidence for cryptocurrency holdings that the audit file can rely on. For companies whose auditor cannot test the crypto balances, and for audit firms engaging an auditor's expert under ISA 620. Request Audit Support All Auditing Services Two Ways We Support an Audit The engagement stays where it is. We bring the part of it that lives on the chain. For companies with their own auditor You have an auditor you trust, and the relationship works. What the audit is missing is someone who can verify wallet control, read balances from the chain, and reconcile on-chain activity to your ledger. We plug that gap and work alongside your auditor, so the engagement stays theirs and the digital-asset areas stop holding up sign-off. Your auditor keeps the engagement and issues the opinion We evidence the digital-asset balances they cannot test themselves The audit closes on time instead of stalling on crypto questions For audit firms with crypto clients A client holds digital assets and your audit programme has nowhere to send the confirmation letter. We act as your crypto specialist on the engagement: agree the procedures with you, perform the on-chain examination under your instruction, and deliver working papers your file can carry. You keep the client, the methodology, and the opinion. Engagement-level support under your instruction and review Working papers with documented methodology, ready for the file Strict confidentiality, one client or a whole portfolio No auditor yet? If you need the whole statutory audit, opinion included, that is our Financial Statement Audits service, delivered with our ICPAC-licensed audit partner. What We Deliver to the Audit Audit evidence over the digital-asset areas, documented so it can be reviewed, challenged, and re-performed. Wallet control verification Cryptographic proof that the entity controls every reported address, by message signature or a nominal transfer performed on instruction. Hot, cold, multi-signature, and MPC arrangements, plus assets held with custodians. Balances at the reporting date Holdings read directly from the chain at the reporting date, not from a management schedule. Every figure traceable to a block and independently repeatable. On-chain to ledger reconciliation On-chain movement matched to the accounting records, with breaks investigated and explained rather than plugged. Transaction classification Internal transfers separated from genuine economic events across bridges, swaps, and exchange accounts, so disposals, income, and mere movement stop looking identical. Related-party identification Clustering of connected addresses and counterparties that points to related-party transactions the accounting system never recorded. Working papers and methodology Findings delivered as documented working papers: what was tested, how, against which blocks and records, and what could not be verified. Written to be reviewed, challenged, and filed. How We Verify Wallet Control Control of the private key is the assertion that matters. How we test it depends on how the wallet is built, and every test leaves evidence another auditor can re-run. Signed message The wallet signs a message we write, containing the entity name, the date, and a random string, so it cannot have been prepared in advance. Anyone can check the signature against the public address: legacy message signing for older Bitcoin addresses, BIP-322 for newer ones, and EIP-191 for Ethereum-style accounts. Evidence on file: The message, the signature, the verification output, and the block height at the time of signing. Instructed transfer A small transfer to an address we specify, inside a window we set and without advance notice. We use it where a wallet cannot sign messages, or as a second test on the largest balances. Evidence on file: The instruction, the transaction hash, and the time it landed relative to the instruction. Multi-signature and smart-contract wallets We read the signing policy from the chain itself, meaning the owners and the threshold, rather than from a policy document. Then we test control at the threshold: enough signers sign, or the contract validates the signature under EIP-1271. Evidence on file: Owners and threshold as read at the reporting date, plus the signatures that met the threshold. MPC wallets MPC wallets produce ordinary signatures, so the same message or transfer test applies, run through the client’s MPC platform. We also record who can approve a transaction under the platform’s policy, because control is shared by design. Evidence on file: The signature or transaction, and the approval policy exported from the platform. Custodians and exchanges No on-chain test proves a balance held in a custodian’s or an exchange’s omnibus wallet. We obtain a direct confirmation, compare it to statements and read-only API exports, and say plainly that the evidence is a confirmation, not a chain read. Evidence on file: The confirmation, the API export, and the reconciliation between them. Agreed-Upon Procedures on Crypto Balances Not every request needs an audit. A bank asking for proof of funds, an investor, or a counterparty often wants specific facts checked: which addresses an entity controls, what it held at a date, or whether funds moved as described. That is an agreed-upon procedures engagement. Procedures are agreed in advance with whoever commissions the work, and the report lists each procedure and what it found. Findings are facts anyone can check. There is no opinion and no assurance, which is why an AUP can be scoped tightly and delivered quickly. Typical procedures: confirm control of listed addresses, read balances at a stated date and block, trace the source of a specific deposit, and reconcile a schedule to the chain. Where the report must be issued under ISRS 4400 (Revised), an accounting firm issues it and we perform the on-chain procedures as its expert, which the revised standard provides for. How an Engagement Runs Scoped with the audit team, delivered as working papers, supported until the opinion is signed. 01 Scoping A call with you and, where one exists, the audit team. We agree the entities, wallets, exchange accounts, and custodians in scope, the reporting framework, and the timetable. 02 Engagement model We agree who engages us: the auditor, using our work as an auditor's expert, or the company, with our output made available to the auditor. Confidentiality and independence are settled here, in writing. 03 On-chain examination Wallet control verified cryptographically, balances read from the chain at the reporting date, activity reconciled to the ledger, and connected addresses identified. 04 Working papers delivered The auditor receives documented procedures, evidence, and findings, including an explicit list of anything we could not verify. Nothing is asserted that cannot be re-performed. 05 Support through review We stay available for audit queries, partner and EQR review questions, and regulator follow-ups until the opinion is signed. Where Our Role Starts and Stops Audit support has clean edges, and stating them up front is what makes the auditor's reliance on our work defensible. We do Produce audit evidence over wallets, balances, and on-chain flows Verify wallet control cryptographically, never from screenshots Document every procedure so the file shows what was tested and how Answer audit, partner review, and regulator queries until sign-off We do not Issue the audit opinion; that stays with the engaged audit firm Replace the auditor's judgement or responsibility for the audit Prepare the books we are evidencing; reconciliation is kept separate Assert anything we could not verify; it is reported as unverified If your records are not reconciled yet, start with transaction reconciliation . If you need the full statutory audit rather than support inside one, see financial statement audits . Crypto Audit Support FAQ What is crypto audit support? Specialist help with the digital-asset part of a financial statement audit, provided to whoever is running that audit. A conventional audit programme confirms a bank balance by writing to the bank. A wallet has nobody to write to: its balance is confirmed by proving control of a private key and reading the chain. Crypto audit support means we perform that examination, verifying wallet control, reading balances at the reporting date, reconciling on-chain activity to the ledger, and identifying connected addresses, and we hand the results to the auditor as documented working papers. The auditor keeps the engagement, applies their own judgement to our work, and issues the opinion. We already have an auditor we trust. Do we have to switch? No, and this service exists precisely so you do not have to. Your auditor keeps the engagement, the relationship, and the opinion. We are brought in for the digital-asset areas only: the wallet verification, on-chain balances, and reconciliation work that a generalist audit team cannot perform itself. Most companies that come to us are not unhappy with their auditor. They are stuck, because the audit cannot close until someone evidences the crypto balances, and nobody on the engagement can. How do you work with the incumbent auditor? Under one of two models, agreed at scoping. Either the audit firm engages us directly and uses our work as an auditor's expert under ISA 620, which gives them the most direct control over our procedures, or the company engages us and our output is made available to the auditor as evidence they evaluate under ISA 500. Both are ordinary, well-understood arrangements. In either case the auditor decides what to rely on and remains responsible for the opinion; our job is to make that reliance defensible by documenting exactly what we tested and how. We are an audit firm. What do you actually give us? Working papers you can put on the file. For each area: the procedures performed, the wallets and accounts covered, the blocks and records tested against, the results, and an explicit list of anything we could not verify. Wallet control is evidenced by cryptographic signature or a nominal transfer performed on instruction, never by accepting a screenshot. Balances are read from the chain and are independently re-performable by anyone who wants to check. You review the work, challenge it where you need to, and decide what it supports. Can our firm use you across several clients? Yes. Some firms bring us in for a single awkward engagement; others use us as their standing digital-asset specialists across a portfolio. Each engagement is scoped and priced on its own, information is never shared between clients, and we are comfortable operating quietly in the background of your client relationship. We do not compete for the audit: we are not the signing firm on your engagement and we do not want to be. Does your work satisfy audit standards? Our work is built to be relied on under them. Auditing standards let an auditor use the work of an expert, but they require the auditor to evaluate the expert's competence, objectivity, and methods. So we document all three: who did the work and their qualifications, the basis of our independence from the audited entity, and a methodology section that sets out each procedure in enough detail to be re-performed. The standards judgement always remains the auditor's, which is exactly how it should be. Do you need access to our systems or private keys? Never private keys, and we will not accept them if offered. Control of a wallet is proven by the holder signing a message we specify, or moving a nominal amount on our instruction, both of which demonstrate key control without disclosing anything. Beyond that we work from read-only material: address lists, exchange account exports, custody statements, and ledger extracts. Chain data itself is public; we read it directly rather than asking anyone for it. What does the on-chain examination cover? Wallet control for every reported address, balances at the reporting date read directly from the chain, reconciliation of on-chain movement to the accounting ledger, separation of internal transfers from genuine economic events across bridges and swaps, and clustering of connected addresses that indicate related-party transactions. We cover the major chains and the usual custody arrangements: hot and cold wallets, multi-signature, MPC, and third-party custodians. Anything that cannot be verified is reported as unverified rather than assumed. Do you only work with audits in Cyprus? No. The chain is the same from anywhere, and this work is performed remotely against public data and the records you provide, so we support audits under any jurisdiction's statutory framework. We are based in Cyprus and know the Cyprus and wider EU reporting environment first-hand, which helps where the engagement is local, but audit firms and companies elsewhere engage us on the same basis. When should we bring you in? At planning, not at the deadline. Involving us early means the wallet list is agreed before fieldwork, control verification is scheduled rather than improvised, and reconciliation gaps surface while there is still time to fix them. We do take engagements that are already stuck at year-end, and unsticking them is common work for us, but the same audit costs less and closes faster when the digital-asset scope is set at the start. Our records are a mess. Can you fix them and then support the audit? The fixing is a separate engagement, and keeping it separate protects the audit. If your on-chain activity has never been reconciled to your books, start with our transaction reconciliation service, which gets the records audit-ready. Where we act as the auditor's expert on evidence, we are careful about independence: the roles of preparing records and evidencing them are kept distinct, and we agree the boundaries with the auditor in writing at scoping. How is this different from your financial statement audit service? By who signs the opinion. Our financial statement audit service is the whole engagement: a statutory audit delivered together with CYAUSE Audit Services Ltd, our ICPAC-licensed audit partner, who issues the opinion while we evidence the chain. Crypto audit support is for every other arrangement: you already have an auditor, or you are the auditor, and what is needed is the digital-asset expertise inside an engagement that belongs to someone else. If you do not yet have an auditor and need the full audit, the financial statement audit page is the right place to start. How do auditors verify crypto wallet ownership? By testing control of the private key, not by reading a screenshot. The two accepted methods are a signed message, where the wallet signs an auditor-supplied string that anyone can verify against the public address, and a nominal transfer made on the auditor's instruction at an unannounced moment. Both prove the entity can move the funds, which is the assertion that matters. A wallet address supplied on a management schedule proves nothing on its own, because anyone can copy an address they do not control. For custodial holdings the equivalent is a direct confirmation from the custodian, subject to the usual limits on third-party confirmations. What audit evidence is acceptable for cryptocurrency holdings? Evidence that is independent of management assertion and reproducible by the audit file. In practice that means proof of wallet control by signature or instructed transfer, balances read directly from the chain at the reporting date rather than from an exported spreadsheet, a reconciliation of on-chain activity to the ledger with breaks investigated rather than netted, independent confirmations for custodial and exchange-held balances, and pricing taken from a documented source with a stated methodology. We deliver each of these as working papers with the queries, block heights, and timestamps recorded so another auditor can re-run them. What are agreed-upon procedures for crypto, and when are they enough? An agreed-upon procedures engagement checks specific facts rather than giving an opinion on a whole set of accounts. A bank, investor, or counterparty agrees a list of procedures, for example confirming that an entity controls certain addresses and held stated balances at a date, and the report sets out each procedure and its findings. It is enough when the recipient needs those facts, not assurance on financial statements. Under ISRS 4400 (Revised) the report is issued by the practitioner, usually an accounting firm, and the standard provides for using an expert, which is how we perform the on-chain procedures. How do you verify control of a multisig or MPC wallet? For a multi-signature or smart-contract wallet we read the owners and the threshold from the chain at the reporting date, then test control at the threshold: enough signers sign our message, or the contract validates the signature under EIP-1271. MPC wallets produce ordinary signatures, so the usual signed-message or instructed-transfer test applies, run through the MPC platform, and we record the approval policy because control is shared by design. In both cases the file shows who can actually move the funds, not just that someone can. How do you verify crypto held on an exchange or with a custodian? Differently, and we say so in the working papers. Assets in a custodian's or an exchange's omnibus wallet cannot be tied to one client by reading the chain, so the evidence is a direct confirmation from the custodian, compared with account statements and read-only API exports and reconciled to the ledger. That is the same standard of evidence as a bank confirmation, with the same limits, and the file labels it as a confirmation rather than an on-chain verification. Can our audit firm engage you as an auditor's expert under ISA 620? Yes, and it is the most common way we work with audit firms. Under ISA 620 the engagement team may use an expert in a field other than accounting or auditing to obtain sufficient appropriate audit evidence, while remaining solely responsible for the opinion. We provide the competence, capability and objectivity evidence your file needs, agree scope and the nature of our work in writing, and deliver findings in a form your team can evaluate and reference. You keep the engagement, the client relationship and the opinion. More questions answered on our general FAQ . Sources The regulations, guidance and registers this page relies on. Check them directly. IAASB : ISA 620, Using the Work of an Auditor’s Expert The standard under which an engaged auditor relies on our on-chain work while keeping responsibility for the opinion. IAASB : ISA 500 series, Audit Evidence Relevance and reliability of information used as audit evidence, including management-engaged evidence. IAASB : ISRS 4400 (Revised), Agreed-Upon Procedures Engagements The standard for agreed-upon procedures, including the use of a practitioner’s expert. Added 2026-10-13. IFRS Interpretations Committee : Agenda decision: Holdings of Cryptocurrencies (June 2019) Why most crypto holdings are intangible assets under IAS 38, or inventory under IAS 2 for brokers and traders. ICPAC : Institute of Certified Public Accountants of Cyprus Licensing body of CYAUSE Audit Services Ltd, the partner that issues statutory opinions. Related Reading Your auditor will not sign off on the crypto balances How auditors verify crypto wallet ownership (ISA 500, 505 and 620) How to read a proof of reserves report The MiCA transition window closes in July 2026 DAC8 and EU crypto tax transparency Is crypto holding up an audit? Tell us who the auditor is, the reporting framework, and the wallet and exchange footprint. We will propose the engagement model, the procedures, and a timetable that fits the audit's own. A scoping call with you and the audit team Working papers the audit file can carry Confidential, whether one engagement or a portfolio Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request Audit Support Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Proof of Reserves Audit & Attestation | Ondology Labs URL: https://ondologylabs.com/services/auditing/proof-of-reserves Description: Proof of reserves audits and attestations for exchanges, custodians and stablecoin issuers in Cyprus and the EU, verifying wallet control and liabilities. Home / Services / Blockchain Auditing / Proof of Reserves Proof of Reserves in Cyprus Proof of reserves audits and attestations in Cyprus and the EU Prove your reserves back every customer balance. Independent proof of reserves attestations for exchanges, custodians, and funds, and reserve of assets work for ART and EMT issuers under MiCA, across Cyprus and the EU. We verify cryptographic control of your wallets, establish what you owe customers, and publish an attestation your users and supervisors can actually rely on. Request an Attestation All Auditing Services Reserves Alone Prove Nothing A wallet balance is only half the equation. Solvency is a comparison, and an attestation that shows one side without the other is marketing rather than assurance. The assets you hold Every reserve address proven under your control by cryptographic signature or a nominal transfer on our instruction, not simply named to us. Balances are read directly from the chain at an agreed snapshot, across hot, cold, multi-signature, and MPC custody. The liabilities you owe The full customer balance ledger, tested for completeness and committed to a Merkle tree so any individual customer can verify their own inclusion. This is the half that is routinely skipped, and the half that makes the ratio meaningful. Who Needs Proof of Reserves Anyone holding crypto that ultimately belongs to someone else, and increasingly anyone who has to satisfy a supervisor, counterparty, or acquirer that it is really there. Exchanges & trading platforms Demonstrate to customers and regulators that deposits are fully backed, and turn a recurring attestation into a competitive claim you can actually substantiate. Custodians & wallet providers Evidence segregation of client assets and the integrity of custody controls across hot, cold, multi-signature, and MPC arrangements. Stablecoin & token issuers Attest that circulating supply is backed by reserves held as stated, on the frequent cadence holders and MiCA-conscious counterparties expect. Funds & treasuries Give investors, boards, and administrators independent verification of holdings and net asset value at period end. CASPs authorised in Cyprus Support CySEC supervision and MiCA client-asset safeguarding obligations with documented, repeatable evidence rather than management assertion. Businesses holding crypto on balance sheet Verify treasury holdings for auditors, lenders, insurers, and acquirers who will not take a block explorer screenshot as evidence. How the Engagement Works Methodology fixed before testing starts, so the result cannot be shaped after the fact. 01 Scope & methodology We agree which entities, wallets, custodians, and customer liabilities are in scope, and fix the methodology and snapshot timing in writing before any testing begins. 02 Prove wallet control You demonstrate control of every reserve address cryptographically: a signed challenge message or a nominal transfer on our instruction. Unproven addresses are excluded. 03 Establish customer liabilities We extract the full customer balance ledger, test the controls around it for completeness, and build a Merkle tree so individual customers can verify their own inclusion. 04 Compare, test & investigate Reserves are measured against liabilities asset by asset. Any shortfall, unexplained movement, or third-party exposure is investigated rather than netted away. 05 Attestation report You receive a report stating the reserve ratio, the methodology, the Merkle root, and the limitations, written to be published, not just filed. What It Does and Doesn't Prove We state the limits in the report itself. An attestation that overclaims damages the business it was meant to reassure. It does prove You controlled specific wallets holding specific balances at the snapshot Those balances covered the customer liabilities recorded in your ledger Individual customers can verify their own balance was counted The methodology was fixed in advance and applied by an independent firm It does not prove Anything about your position before or after the snapshot moment That no liabilities exist outside the ledger we were given Overall financial health, which needs a full financial statement audit That assets deployed with third parties carry no counterparty risk We reduce snapshot risk with unannounced timing, control testing over the liability ledger, and a recurring cadence. We recommend pairing attestations with a financial statement audit . Proof of Reserves, MiCA and CySEC MiCA never uses the phrase "proof of reserves", but it creates the obligations that make one the practical form of evidence. Crypto-asset service providers must segregate and safeguard client assets; asset-referenced and e-money token issuers face specific reserve, custody, and reporting requirements. Custody providers must also give each client a statement of position at least once every three months ( MiCA Article 75 ). That statement shows clients their own balances; proof of reserves shows all of them are backed. For a CASP authorised in Cyprus under CySEC supervision, a recurring attestation is a direct way to show client assets are held as claimed, documented, repeatable, and independent of management assertion. Read our note on the MiCA transition window Proof of Reserves FAQ What is a proof of reserves audit? A proof of reserves engagement independently verifies that the crypto assets a custodian holds are sufficient to cover what it owes its customers. It has two halves that must both be done: proving control of the reserve wallets on-chain, and establishing the total customer liability from the internal ledger. Only the two together demonstrate solvency. A wallet balance on its own proves nothing about what is owed against it. Is proof of reserves the same as a financial statement audit? No, and the distinction matters. A proof of reserves engagement is a targeted attestation about assets and customer liabilities at a point in time. A financial statement audit is a much broader opinion covering the whole entity: revenue, expenses, going concern, related parties, and off-balance-sheet obligations. Proof of reserves is faster and more frequent; a full audit is deeper. Most crypto businesses eventually need both, and we provide each. How do you prove we actually control our wallets? Through cryptographic proof rather than assertion. We have you sign a challenge message with the private keys controlling each reserve address, or move a nominal amount on our instruction, so that control is demonstrated rather than claimed. Addresses you merely name to us, including ones you might have borrowed sight of, do not count as reserves. What is proof of liabilities, and why does it matter more than the reserves? Proof of liabilities is the other half of proof of reserves: establishing the total a custodian owes its customers, from the internal ledger, completely and at the same moment as the reserves are measured. It matters more because it is where reports go wrong. Wallet balances are easy to show; a ledger that leaves out some customers, or nets negative balances against positive ones, makes any reserve look sufficient. We test the ledger's completeness and its controls, then publish a Merkle root so each customer can check their own balance was counted. How are customer balances verified without exposing customer data? With a Merkle tree. Each customer balance is hashed into a tree whose root we publish alongside the attestation. Any customer can then check that their own balance was included in the total we verified, using a proof unique to them, without seeing anyone else's data. We test the tree construction ourselves rather than taking the output on trust, because a Merkle proof is only as good as the completeness of the leaves fed into it. What are the real limitations we should disclose? Proof of reserves is a snapshot. It shows the position at a moment, and it cannot by itself rule out assets borrowed shortly before that moment and returned after, nor liabilities kept outside the ledger we were given. We mitigate this with unannounced timing, control testing over the liability ledger, and recurring attestations rather than a single one, and we state the residual limitations plainly in the report, because an attestation that overclaims is worse than none. How often should we publish proof of reserves? Quarterly is the emerging norm for exchanges and custodians, and monthly is increasingly expected of stablecoin issuers. A single one-off attestation has limited assurance value. The credibility comes from an unbroken series, published on a schedule you commit to in advance and keep to even in a bad quarter. Does MiCA require proof of reserves? MiCA does not use the phrase "proof of reserves", but it imposes obligations that proof of reserves is the practical way to evidence: crypto-asset service providers must segregate and safeguard client assets, and asset-referenced and e-money token issuers face specific reserve, custody, and reporting requirements. Custody providers must also give each client a statement of position at least once every three months under Article 75, which shows clients their own balances; proof of reserves shows that all of those balances, taken together, are actually backed. For a CASP authorised in Cyprus under CySEC supervision, a recurring reserves attestation is a direct way to demonstrate that client assets are held as claimed. Which chains and assets can you attest to? Bitcoin, Ethereum and the major EVM chains, and the other principal networks, together with the stablecoins and tokens issued on them. We handle multi-signature and MPC custody arrangements, and assets held with third-party custodians or deployed into staking and lending, though the latter carry counterparty risk we identify separately rather than counting at face value. How long does an engagement take? For a first engagement, typically a few weeks from scoping to report, with most of that spent establishing the liability side and testing the controls around it. Once the methodology is agreed and the data pipeline is in place, recurring attestations run substantially faster. What is the difference between a proof of reserves audit and a proof of reserves attestation? Mostly the level of assurance and who stands behind it. An attestation is a report on a specific subject matter at a point in time, that you hold these assets and owe these customer liabilities as at an agreed snapshot, performed against a methodology fixed before testing starts. An audit in the statutory sense is an opinion on a complete set of financial statements for a period, issued by a licensed audit firm under audit standards. Most exchanges and custodians need the attestation frequently and the audit annually. The word audit is used loosely in this market, so read what any provider actually tested before relying on it. What is a reserve of assets audit under MiCA for ART and EMT issuers? It is the recurring examination of the pool backing an asset-referenced or e-money token. MiCA requires issuers to hold a reserve that is segregated from the issuer's own assets, composed and custodied to defined standards, and capable of meeting redemption at par. The examination establishes that the reserve exists, that it is held where the issuer says and under the issuer's control, that its composition matches the whitepaper commitment, and that it covers tokens actually in circulation rather than tokens issued on paper. We perform the on-chain side of that work and coordinate the rest with your auditor and counsel. Who performs third-party proof of reserves audits in Cyprus? Independent firms with the cryptographic capability to prove wallet control and the accounting capability to test the liability side. Ondology Labs performs proof of reserves attestations from Nicosia for exchanges, custodians, issuers and funds across Cyprus and the EU. Where the engagement needs a statutory audit opinion alongside the attestation, that is issued by CYAUSE Audit Services Ltd, our ICPAC-licensed audit partner. The important test when choosing a provider is whether they test liabilities at all: a report that lists wallet balances without establishing what you owe customers is not proof of anything. More questions answered on our general FAQ . Related Reading How auditors verify crypto wallet ownership (ISA 500, 505 and 620) The MiCA transition window closes in July 2026 DAC8 and EU crypto tax transparency Crypto audit support for auditors and their clients Ready to publish your reserves? Tell us about your custody setup and customer base. We will scope the engagement, agree the methodology, and set a cadence you can sustain. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request an Attestation Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Independent AML Review for CASPs in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/auditing/aml-compliance Description: Independent AML reviews and crypto AML audits for CASPs, exchanges and custodians in Cyprus: KYC, transaction monitoring, sanctions screening, wallet risk and Travel Rule, tested on real files. Home / Services / Blockchain Auditing / AML & Compliance Crypto AML Audits in Cyprus Independent AML reviews for CASPs in Cyprus We test the controls you actually run. Independent AML reviews and crypto AML audits for CASPs, exchanges, custodians, payment firms, and funds in Cyprus and across the EU. We review KYC and onboarding, transaction monitoring, sanctions screening, wallet risk exposure, and Travel Rule handling against CySEC supervision, MiCA, and the EU AML package, then tell you plainly what needs fixing. Request an AML Review All Auditing Services Written Controls Versus Operating Controls Most firms we review have a policy manual. Fewer can show that what the manual says is what the case files record. An audit is the difference between the two. What we read The business-wide risk assessment, AML policies and procedures, the compliance officer's terms of reference, training records, board and committee minutes, and the vendor documentation behind your screening and monitoring stack. We check whether these describe your business or someone else's template. What we test Samples of real customer files, monitoring alerts and how they were closed, screening hits and their disposition, Travel Rule transfers including the ones that failed, and internal reports. We also screen and trace a sample of wallets on-chain ourselves rather than relying only on your dashboard. What an AML Audit Covers Six control areas, tested against the obligations that apply to your permissions and your product set rather than a generic checklist. KYC, CDD & onboarding Identification and verification, beneficial ownership, source of funds and wealth, enhanced due diligence triggers, and whether the risk rating assigned at onboarding is actually driven by the evidence collected. Transaction monitoring Rule coverage against your real product and customer risk, threshold calibration, alert volumes, disposition quality, escalation, and whether tuning decisions are documented and approved. Sanctions & PEP screening List coverage and refresh frequency, fuzzy matching settings, false positive handling, rescreening of the existing book, and screening of counterparties rather than customers alone. Wallet risk & blockchain analytics Which analytics provider is used, how risk scores drive decisions, escalation thresholds, and independent sampling of exposure on-chain to see whether the tooling output matches reality. Travel Rule & TFR compliance Collection and transmission of originator and beneficiary data, counterparty due diligence, self-hosted wallet handling, and what happens when required information is missing or unanswered. Reporting, records & governance Suspicious transaction reporting to MOKAS, internal escalation to the compliance officer, record retention, staff training, the business-wide risk assessment, and board and senior management oversight. Who We Audit Obliged entities under Cyprus AML law, firms preparing for supervision, and businesses whose banking or acquiring relationships depend on showing independent assurance. Exchanges & trading platforms High onboarding volume and fast-moving flows put the most pressure on monitoring rules and alert handling. We test whether the controls scale with the book rather than only with the policy. CASPs authorised or applying in Cyprus Whether you hold a CySEC authorisation or are preparing the application, the AML framework is assessed as part of the firm. We review it against what a supervisor will look for. Custodians & wallet providers Client asset safeguarding sits next to AML obligations. We look at onboarding, source of funds, and the screening applied to deposits and withdrawals from self-hosted wallets. Payment & e-money firms handling crypto Crypto rails bolted onto an existing payments business often inherit a framework designed for fiat. We identify where the old controls do not reach the new flows. Funds & asset managers Investor due diligence, source of wealth, and the provenance of subscribed assets. Administrators and depositaries increasingly expect independent evidence rather than assertion. Crypto-native businesses & token issuers Firms that grew before the framework did. We help establish a defensible baseline and a realistic sequence for closing the gap, without pretending it can be done in a week. How the Engagement Works Scope agreed in writing first, testing on real files second, findings ranked so you can sequence the work rather than face an undifferentiated list. 01 Scoping & risk assessment review We agree which entities, products, and jurisdictions are in scope, and start from your business-wide risk assessment. If it does not reflect the business you actually run, that is the first finding. 02 Policy & framework review Policies, procedures, and the compliance officer function are read against the obligations that apply to you. We note where documents are current, where they are inherited boilerplate, and where they contradict each other. 03 Control testing on real files We sample customer files, alerts, screening hits, Travel Rule transfers, and reports. Written controls are compared with what the case files show was actually done. 04 On-chain exposure testing We independently screen a sample of wallets and flows against risk data and trace them ourselves, so exposure is measured against the chain rather than against your dashboard. 05 Report & remediation plan A written report with findings ranked by severity, the evidence behind each one, and a sequenced remediation plan. We can re-test after you have implemented the fixes. What an Audit Does and Doesn't Cover An AML audit is a point-in-time review of controls. It is useful precisely because it is bounded, and we state those bounds in the report rather than leaving them implied. It does cover Whether the controls you documented were operating on the files we sampled Where your framework diverges from CySEC, MiCA, and EU AML obligations Whether monitoring and screening settings match your real customer and product risk On-chain exposure measured independently rather than taken from your tooling A ranked, evidenced set of findings with a sequenced remediation plan It does not cover Any guarantee of regulatory approval: we are not a regulator and cannot bind one Your ongoing obligations, which continue in full between and after reviews Suspicious transaction reporting, which remains yours to decide and file with MOKAS Remediation itself, which your team or your vendors implement, not us Transactions or periods outside the agreed scope and sample Sampling means an unqualified report is not proof that nothing was missed. It is evidence that a competent independent party tested the framework and set out what it found. The Cyprus and EU Rulebook Crypto-asset service providers in Cyprus are supervised by CySEC and are obliged entities under the Cyprus AML law implementing the EU directives. MiCA brought CASPs into a harmonised authorisation regime, so the AML framework is now assessed as part of a supervised firm rather than as a voluntary standard. The EU AML package layers on top of that. A directly applicable AML Regulation replaces much of the national discretion firms have relied on, and the new EU authority, AMLA, will drive common supervisory expectations across member states. The Transfer of Funds Regulation applies the Travel Rule to crypto transfers with no de minimis threshold, so originator and beneficiary information has to travel with the transfer. Suspicious transaction reports go to MOKAS, the Cyprus financial intelligence unit, and the quality of that reporting is itself something a supervisor will look at. We test against this framework as it applies to your permissions. Where a requirement is still bedding in or the supervisory expectation is not yet settled, we say so instead of presenting an interpretation as settled law. Read our note on the MiCA transition window AML Compliance Audit FAQ What is an AML compliance audit for a crypto business? It is an independent review of the anti-money-laundering controls you actually operate, tested against the obligations that apply to you. We look at customer due diligence and onboarding, ongoing monitoring, transaction monitoring rules, sanctions and PEP screening, blockchain analytics screening of wallet exposure, Travel Rule handling, suspicious transaction reporting, record-keeping, training, and the compliance officer function. The output is a written report with findings ranked by severity and a remediation plan you can work through. Who needs one in Cyprus? Crypto-asset service providers supervised by CySEC, firms preparing an authorisation application, and any obliged entity whose AML framework has to withstand supervisory review. It is also common for firms whose banking partner, payment processor, or acquirer asks for independent assurance before opening or keeping an account. Cyprus AML law, implementing the EU directives, requires obliged entities to maintain an independent audit function to test their AML policies and controls where that is appropriate to the size and nature of the business. For smaller firms, outsourcing that review is usually the practical route. Whether it applies to you specifically is a question for your own counsel. Is an independent AML review the same as an AML audit? Yes, for practical purposes. Firms, banks, and regulators use the two terms for the same exercise: someone independent of the people who run your AML controls tests whether those controls work as designed and as the rules require. What matters is not the label but the independence of the reviewer, the scope tested, and whether the work is evidenced on real customer files and transactions. Ours is all three, and the report states the scope and the evidence we relied on. Is passing your audit a regulatory approval? No. We are not a regulator and we cannot bind one. An audit is an independent opinion on the controls we tested, on the evidence we saw, at the time we saw it. CySEC, MOKAS, and any other authority reach their own conclusions and may weigh things differently. What an audit gives you is a documented, independent view of where you stand and what to fix, which is materially better than discovering both during an inspection. How do MiCA and the EU AML package change what you review? MiCA brought crypto-asset service providers into a harmonised authorisation regime, so the AML framework is now assessed as part of a supervised firm rather than a voluntary standard. Separately, the EU AML package introduces a directly applicable AML Regulation and the new EU authority AMLA, which narrows national discretion and raises expectations on risk assessment, beneficial ownership, and group-wide policies. The Transfer of Funds Regulation applies the Travel Rule to crypto transfers with no de minimis threshold. In practice this means we test against a rulebook that is converging across the EU rather than a purely Cypriot one. What does Travel Rule testing actually involve? We check whether originator and beneficiary information is collected, transmitted, and received in the required form on every in-scope transfer, not just the ones your provider happens to cover. That includes how you handle counterparties who do not respond, transfers to and from self-hosted wallets, the due diligence you perform on other providers before exchanging data, and what happens to a transfer when required information is missing. Most gaps we find are in the exception handling rather than the happy path. Do you tune our transaction monitoring rules? We test them and tell you what we find. That means reviewing whether the rule set reflects your actual customer base and product risk, sampling alerts to check the thresholds are producing meaningful output rather than noise, and looking at how alerts are dispositioned and escalated. A monitoring system generating thousands of alerts nobody closes is a finding, not a control. We recommend changes; implementing and validating them is work your team or your vendor performs. How does blockchain analytics fit into the review? Screening addresses and counterparties against risk data is now an expected control, and it is one we can test on the chain itself rather than only on paper. We review which provider you use, how risk scores feed into your decisions, what thresholds trigger escalation, and whether exposure is reassessed over time. We also independently sample wallets and flows to see whether the exposure your tooling reports matches what the chain shows. What happens if you find serious problems? We tell you plainly, in writing, with the evidence. Findings are ranked so you can sequence the work, and we distinguish between a control that is missing, one that exists but is not operating, and one that is operating but is not documented. We do not report to your regulator on your behalf, and we do not make suspicious transaction reports for you. Deciding what to report to MOKAS and when remains your obligation, and remediation is yours to execute. How long does an engagement take, and how often should we repeat it? For a mid-sized firm, typically a few weeks from scoping to report, depending on how quickly policies, system exports, and case files reach us. Annual is the usual cadence, with a follow-up review after remediation if the first round found material gaps. A review also makes sense ahead of an authorisation application, after a change of business model or major new product, or when onboarding volume grows faster than the compliance function did. More questions answered on our general FAQ . Related Reading MiCA's transition window is closing before July 2026 EU privacy token ban: what it signals for Cyprus US Treasury signals a policy shift on crypto mixers Find the gaps before a supervisor does Tell us your permissions, products, and where you think the weak points are. We will scope the review, agree the sample, and give you a report you can hand to your board. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request an AML Review Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Statutory Crypto Company Audits in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/auditing/financial-statement-audits Description: Statutory crypto audits in Cyprus for exchanges, CASPs and funds. CYAUSE Audit Services (ICPAC-licensed) signs the opinion; we verify the chain behind it. Home / Services / Blockchain Auditing / Financial Statement Audits Financial Statement Audits in Cyprus Statutory audits for crypto companies in Cyprus A statutory audit that actually reads the chain. Audited financial statements for crypto exchanges, CASPs, funds and Web3 companies in Cyprus, and the audit evidence CySEC expects behind a CASP's own funds and safeguarding figures. Delivered together with CYAUSE Audit Services Ltd , our ICPAC-licensed audit partner. They issue the opinion. We prove what is on the chain behind it. Request an Audit All Auditing Services Already have an auditor, or auditing a crypto client yourself? You want Crypto Audit Support : we provide the on-chain examination and working papers, and your auditor keeps the engagement and the opinion. × In partnership with CYAUSE Audit Services CYAUSE Audit Services Ltd is an ICPAC-licensed audit and accounting firm in Cyprus. Statutory audit opinions on the engagements we run jointly are issued by CYAUSE as the licensed audit office, while we provide the on-chain examination that a digital-asset balance sheet requires. CYAUSE brings The ICPAC audit licence and the statutory audit opinion Financial statement audit methodology under IFRS Cyprus tax, regulatory, and CySEC licensing experience A dedicated audit crypto department Ondology Labs brings Cryptographic verification of wallet control On-chain balances read directly from the chain, not from a schedule Reconciliation of chain activity to the accounting ledger Identification of connected and related-party addresses The Engagement Team Two firms, one engagement. These are the people who do the work. Corporate & Audit Team CYAUSE Audit Services Ltd Carries the audit licence, the methodology, and the opinion. Kyriakos Tramountanellis Engagement Partner Carries responsibility for the audit as the signing partner: client acceptance and independence checks at the outset, the audit judgements taken along the way, and the opinion itself. Founding director of CYAUSE and a UK Fellow Chartered Accountant who trained with UHY Hacker Young in London, he is also the point of reference for the Cyprus tax and CySEC licensing questions that surface mid-engagement. FCA (ICAEW) ICPAC ACCA Advanced CySEC exams Advanced AML exams Marinos Tramountanellis Audit Manager Runs the day-to-day audit fieldwork on engagements where digital assets sit on the balance sheet. He sets the sample, tests the controls and disclosures, and works directly against our on-chain findings to turn them into audit evidence. Leads the Audit Crypto Department at CYAUSE, which he joined in 2017 as an ACCA trainee. Lead Manager, Audit Crypto Department ACCA background Crypto Expert Team Ondology Labs Proves what is on the chain and turns it into audit evidence. Iraklis Anastasiou Blockchain Lead Leads the on-chain side of the engagement. Agrees the wallet, exchange, and custodian scope with the audit team, then establishes control of every reported address by cryptographic signature or a nominal transfer. Anything that cannot be proven is reported as unverified rather than assumed. He is the first point of contact on scope and timetable. ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis Panayiotis Kattides Chain Analytics Lead Builds and runs the analysis behind the evidence. Reconciles on-chain movement to the accounting ledger, separates internal transfers from genuine economic events across bridges and swaps, and clusters connected addresses that point to related-party transactions the accounting system never recorded. ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection More about our audit partner on the CYAUSE team page , and about us on our team page . Why a Crypto Balance Sheet Needs More Than a Standard Audit A bank balance is confirmed by writing to the bank. A wallet balance has nobody to write to. It is confirmed by proving control of a private key and reading the chain An audit team without that capability has little choice but to rely on a schedule prepared by management, which is exactly the assertion the audit exists to test. The same problem runs through the rest of the file. Internal transfers between a company's own wallets look identical to disposals unless someone maps the wallets. Bridges and swaps turn one economic event into several on-chain legs. Staking rewards and airdrops arrive without an invoice. Connected addresses can reveal related-party transactions that never appear in the accounting system at all. That is the work we do alongside CYAUSE: the on-chain examination that turns a digital-asset balance sheet into something an auditor can actually form an opinion on. What the Audit Covers A full statutory audit, with the digital-asset areas evidenced on-chain rather than accepted on assertion. Digital assets on the balance sheet Existence, ownership, and valuation of crypto holdings at the reporting date, verified against the chain rather than against a management schedule. Wallet control and custody Cryptographic evidence that the entity controls the wallets it reports, across hot, cold, multi-signature, and MPC arrangements, plus assets held with third-party custodians. Revenue and transaction flows Trading, fee, staking, and protocol revenue traced from the chain to the ledger, with internal transfers separated from genuine economic events. Liabilities and customer balances Amounts owed to customers or token holders, tested for completeness against the internal ledger rather than accepted at face value. Related parties and connected wallets Identification of connected addresses and counterparties that indicate related-party transactions requiring disclosure. Disclosures and going concern Whether the financial statements disclose digital-asset risk, valuation policy, and custody arrangements in a way a reader can rely on. How a Joint Audit Runs One engagement, one timetable, one set of audited financial statements. 01 Scoping and acceptance We agree the reporting framework, the entities and wallets in scope, and the timetable. CYAUSE performs its own client acceptance and independence checks as the licensed audit office. 02 On-chain examination We verify wallet control cryptographically, read balances directly from the chain at the reporting date, and reconcile every on-chain movement to the ledger. 03 Financial statement audit fieldwork CYAUSE performs the statutory audit work, covering controls, testing, judgements, and disclosures, using our on-chain findings as audit evidence over the digital-asset balances. 04 Resolution of differences Unexplained flows, misclassified internal transfers, and valuation differences are investigated and resolved rather than adjusted away. 05 Audit opinion and report CYAUSE issues the audit opinion as the ICPAC-licensed audit office. You receive financial statements your board, investors, bank, and regulator can rely on. What an Audit Does and Doesn't Do An audit opinion is a specific thing with specific limits, and both are worth stating before the engagement rather than after. It does Give an independent opinion on whether the statements are fairly stated Verify digital-asset holdings against the chain, not against a schedule Test revenue, liabilities, and related parties as part of the whole entity Produce statements your bank, board, investors, and regulator can rely on It does not Guarantee that no fraud exists; an audit is not a fraud investigation Assess your AML framework, which is a separate compliance review Prepare your books; reconciliation must happen before the audit starts Predict solvency or performance after the reporting date If your records are not yet reconciled, start with transaction reconciliation . If you need to show customers their deposits are backed between audits, that is proof of reserves . Financial Statement Audit FAQ Does a blockchain company in Cyprus need an audit? In almost all cases, yes, and not because it is good practice. A company registered in Cyprus is required to prepare annual financial statements, have them audited by a licensed audit firm, and file them with the Registrar of Companies alongside its tax return. The obligation attaches to the company, not to what the company does. Running a crypto exchange, a Web3 product, a DAO treasury, or a token issuer does not exempt you from it. What being a blockchain business changes is not whether you are audited but what the audit has to examine: the obligation is ordinary, the evidence is not. That gap is why crypto-native companies in Cyprus routinely struggle to close an audit on time. If you hold a CySEC authorisation as a crypto-asset service provider, the audit sits alongside your supervisory obligations rather than replacing them: your AML framework and client-asset safeguarding are reviewed separately. Exemptions in Cyprus are narrow and change, so we confirm your exact filing position and deadlines with CYAUSE at scoping rather than leaving you to assume them. We are a Web3 company or DAO rather than a financial business. Does this apply? If the entity is a Cyprus-registered company, the filing obligation is the same as for any other company. What differs is the evidence: treasury held in multi-signature wallets, protocol revenue arriving on-chain without invoices, contributor payments made in tokens, and governance decisions recorded on-chain rather than in board minutes. Those are all auditable, but only by a team that can read them. We see this structure often and scope for it directly. Who actually signs the audit opinion? CYAUSE Audit Services Ltd does, as the ICPAC-licensed audit office. In Cyprus a statutory audit opinion can only be issued by a licensed audit firm, so the partnership is structured accordingly: CYAUSE carries the audit responsibility and the licence, and Ondology Labs provides the blockchain examination that produces audit evidence over the digital-asset balances. You engage one team and receive one set of audited financial statements. Why does a crypto business need a specialist for a normal audit? Because the evidence lives somewhere a conventional audit programme does not look. A bank balance is confirmed by writing to the bank. A wallet balance has no one to write to. It is confirmed by proving control of a private key and reading the chain. Auditors without that capability tend to rely on management-prepared schedules, which is precisely the assertion an audit is supposed to test independently. What does the on-chain part of the audit actually involve? Proving control of every reported wallet by cryptographic signature or a nominal transfer on our instruction, reading balances directly from the chain at the reporting date, reconciling on-chain movement to the ledger, separating internal transfers from genuine economic events, and identifying connected addresses that suggest related-party transactions. Anything we cannot verify is reported as unverified rather than assumed. Which reporting framework do you audit under? IFRS as adopted in the EU is the usual framework for Cyprus entities, and it is what most digital-asset businesses here report under. The accounting treatment of crypto assets under IFRS is not always intuitive, particularly on classification and measurement, so we agree the treatment and its basis early rather than at the reporting date. How is this different from a proof of reserves attestation? Scope and level of assurance. A proof of reserves engagement is a targeted attestation about assets and customer liabilities at a point in time. A financial statement audit is an opinion on the whole entity, covering revenue, expenses, going concern, related parties, and disclosures, issued under statutory audit standards. Many businesses need both: reserves attestations frequently for customers, and an annual audit for regulators, banks, and investors. We are a CASP authorised in Cyprus. Does this cover our obligations? An audited set of financial statements is one part of what a supervised firm has to produce, and it is the part this engagement delivers. It does not by itself evidence your AML framework or your client-asset safeguarding, which are separate reviews. Confirm your specific filing obligations with your own compliance function or counsel; we scope the audit around what you are actually required to file. What do you need from us, and how long does it take? The wallet and exchange account list, ledger and accounting system exports, custody documentation, and the prior year financial statements. Timelines depend far more on the state of your records than on the audit itself: a business whose on-chain activity is already reconciled moves quickly, while one reconciling for the first time should expect that work to dominate the timetable. Our books are not reconciled. Can you still audit us? Not straight away, and it is better to say so than to start and stall. Reconciliation is a prerequisite, not part of the audit: an auditor cannot both prepare the underlying records and issue an independent opinion on them. Where the gap is significant we will tell you at scoping and set out what has to happen first. Do you audit businesses outside Cyprus? The statutory audit is delivered through CYAUSE as a Cyprus-licensed audit firm, so it fits Cyprus-registered entities and their group reporting most directly. For entities audited elsewhere, we are frequently engaged by the incumbent auditor to perform the digital-asset examination and provide evidence they can rely on. That is our crypto audit support service, and it is a common, well-understood arrangement. We already have an auditor we want to keep. Is this the wrong page? It is the wrong service, and we offer the right one. This page describes the full statutory audit, delivered jointly with CYAUSE as the licensed audit office. If you have an auditor you trust and the engagement is only stuck on the digital-asset areas, what you need is crypto audit support: we perform the on-chain examination, verify wallet control, reconcile chain activity to the ledger, and hand your auditor working papers they can rely on. Your auditor keeps the engagement and issues the opinion. Audit firms with crypto clients engage us on the same basis. What are the audit requirements for a CASP in Cyprus? A CASP authorised in Cyprus faces two layers. First, the ordinary company obligation: a Cyprus-registered company must prepare annual financial statements, have them audited by an ICPAC-licensed audit firm, and file them with the Registrar of Companies. Second, the supervisory layer: under MiCA your own funds requirement is measured against a floor set by the service class and against a quarter of the preceding year's fixed overheads, and that overhead figure comes out of audited accounts. Safeguarding and segregation of client assets are evidenced separately but tested against the same books. We scope both with CYAUSE at the outset so the audit answers the Registrar and CySEC in one pass. Does a crypto exchange need audited financial statements? Yes, in almost every case. If the exchange is a Cyprus-registered company it is required to file audited financial statements regardless of what it trades. If it holds a CASP authorisation, the audited accounts also feed the prudential figures the supervisor reviews, so the audit stops being a filing formality and becomes part of your licence maintenance. Exchanges operating through a non-Cyprus entity should confirm the equivalent obligation in their own jurisdiction; where their incumbent auditor cannot test the digital-asset balances, we are engaged to do that part. Does the auditor of a crypto company in Cyprus have to be ICPAC-licensed? Yes. Statutory audit work in Cyprus may only be signed by a firm licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus, and the register is public so you can verify any firm before engaging it. Ondology Labs is not an audit firm and does not issue opinions. On a joint engagement CYAUSE Audit Services Ltd holds the licence and signs; we perform the on-chain examination that supports the digital-asset balances. Anyone offering to sign a Cyprus statutory audit without an ICPAC licence should be treated as a red flag. More questions answered on our general FAQ . Related Reading CASP audit requirements under MiCA in Cyprus What a crypto audit costs in Cyprus, and what drives the fee The MiCA transition window closes in July 2026 How to read a proof of reserves report DAC8 and EU crypto tax transparency Ready for your year-end? Tell us your reporting framework, your wallet and exchange footprint, and your filing deadline. We will scope the audit with CYAUSE and tell you honestly what has to happen before fieldwork can start. A named engagement partner and a fixed timetable An honest read on whether your records are audit-ready One team for the audit and the on-chain examination Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request an Audit Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # Crypto Transaction Reconciliation Services | Ondology Labs URL: https://ondologylabs.com/services/auditing/transaction-reconciliation Description: Crypto transaction reconciliation for finance teams and funds. We match on-chain and exchange activity to your ledger, classify it correctly, investigate breaks, and get your records audit-ready. Home / Services / Blockchain Auditing / Transaction Reconciliation Crypto Transaction Reconciliation in Cyprus Crypto transaction reconciliation for finance teams Reconcile every on-chain movement to your internal ledger. Crypto accounting reconciliation for finance teams, controllers, and funds holding digital assets on balance sheet. We match wallet and exchange activity to your books, classify each transaction correctly, apply cost basis consistently, and hand back a ledger with the evidence attached. This is the work that has to be finished before an audit can begin. Request a Reconciliation All Auditing Services Why the Chain and the Ledger Disagree Nobody makes a mistake to cause this. The two records are built to describe different things, so they drift apart from the first month of activity. The chain records movements A blockchain records transfers of value between addresses. It does not know which addresses you own, whether a transfer was a sale or a move to cold storage, or that four token transfers in one block were a single trade. It has no concept of a period, a counterparty name, or an invoice. The ledger records events Your accounting system records economic events with a date, a value, and a classification. It expects one entry per event. Reconciliation is the translation layer between the two, and without it the balances in your books are assertions rather than supported figures. Where Breaks Actually Come From Six causes account for most of the differences we find. The first two account for most of the value. Wallets and chains nobody listed Activity spread across several chains and dozens of addresses, some created for a single deployment and never recorded. A ledger cannot reconcile to a wallet set that finance does not know exists. Internal transfers read as disposals Movements between your own wallets and exchange accounts look exactly like sales on-chain. Treated as disposals, they invent gains and losses and reset cost basis on assets you never sold. Exchange sub-accounts and off-chain movement Trades, transfers between sub-accounts, funding and fee entries never touch a chain. They exist only in exchange exports, in different formats, with different timestamps and rounding. Gas, fees, and dust Network fees are deducted outside the amount your ledger records, failed transactions still cost gas, and token dust accumulates. Small individually, material over a year, and a permanent source of small unexplained differences. One event, several legs Bridges, swaps, and router contracts emit multiple transfers for a single economic event. Recorded leg by leg, one trade becomes several phantom transactions with fabricated gains attached. Rewards, airdrops, and derivative tokens Staking rewards, airdrops, wrapped tokens, liquidity position tokens, and NFTs arrive without an invoice or a counterparty. Each needs a recognition point, a value, and a treatment applied consistently. Classification Is Where the Money Is Won or Lost The most expensive error in crypto bookkeeping is a misclassified internal transfer. Moving assets from an exchange to your own cold wallet is not a disposal. On-chain it looks exactly like one. Treated as a sale, it books a gain or loss that never occurred and resets the cost basis of the asset on the receiving side. Repeat that across a year of treasury management and the reported position is wrong in both directions, usually by more than any other single issue in the file. Everything therefore starts with proving which addresses and accounts are yours. Once the account map is confirmed, most classification follows from it. What remains is the genuine judgement: when a staking reward is recognised and at what value, whether gas on a purchase is capitalised or expensed, how a wrapped token relates to the asset it represents, and whether depositing into a liquidity pool is a disposal under the treatment you have adopted. Cost basis sits on top of this. Whether you apply FIFO, weighted average, or specific identification depends on your reporting framework and your jurisdiction, and it is a decision to take with your auditor and tax adviser rather than one to inherit from a software default. The rule that does not change is consistency. One method, applied across every wallet and account, changed only for a documented reason. An inconsistent method is harder to defend than an unfavourable one. How the Engagement Works The account map first, the data second, the judgement calls documented as they are made rather than reconstructed at year end. 01 Establish the complete account map We build the definitive list of wallets, chains, exchange accounts, sub-accounts, and custodians, and confirm which addresses are genuinely yours. Everything downstream depends on this list being complete. 02 Pull and normalise the data On-chain history for every address, exchange and custodian exports, and your ledger extract are pulled into one normalised dataset with consistent timestamps, decimals, and asset identifiers. 03 Classify and reassemble events Each movement is classified: internal transfer, purchase, disposal, fee, reward, or receipt. Multi-leg bridges and swaps are reassembled into the single economic event they represent. 04 Match, value, and investigate breaks On-chain events are matched to ledger entries, valued on an agreed source and convention, and cost basis is applied. Anything that does not match is traced rather than plugged. 05 Deliver the reconciled ledger You receive the reconciled ledger, a break report with everything still open, and a written record of every treatment decision taken, in the form an auditor will ask for. Unexplained Flows Get Investigated, Not Plugged Every crypto reconciliation of any size produces movements nobody can immediately explain. The tempting fix is a balancing entry. It is also the fix that turns a solvable problem into a permanent one, because a plug conceals a missing wallet, an unrecorded trade, a duplicated export, and a genuine misappropriation with exactly the same neatness. We trace unexplained flows on-chain instead. Where the counterparty is an exchange, a bridge, or a known service, that usually identifies the missing record. Where it is not, the trace itself becomes evidence. Most of what we find is administrative: a wallet outside the finance team's list, a bridge leg recorded twice, a fee structure nobody passed on. Occasionally it is not, and the point of investigating is that you find out which. Anything still open at the end goes into the break report with its value and what we established, so your auditor sees a disclosed item rather than a mystery. What You Receive Working papers your finance team can use at the next close and your auditor can pick up without a translation call. Reconciled ledger A period-by-period ledger where each balance and movement is tied to an on-chain transaction hash or an exchange record, with the supporting reference retained. Break report Every difference we could not resolve, with its value, the accounts involved, what we established, and what we would need from you to close it. Nothing absorbed into a plug entry. Cost basis schedule Holdings by asset and lot under the method you have adopted, applied consistently across every wallet and account, with realised and unrealised positions separated. Treatment memorandum The accounting position taken on gas, rewards, airdrops, wrapped tokens, bridges, and DeFi positions, with the reasoning. This is the document that answers most auditor questions before they are asked. Wallet and account register The confirmed inventory of addresses, exchange accounts, and custodians in scope, which becomes the control document your finance team maintains from then on. Close checklist and handover A documented month-end procedure your team can run in-house, so the next close is a repeatable process rather than another reconstruction project. Monthly Close Versus Year-End Preparation These are the same discipline at different costs. A monthly close reconciles a few weeks of activity while the person who authorised each transaction still remembers it. Breaks are small, context is available, and treatment decisions are made once and reused. Year after year, this is the cheaper way to run a crypto balance sheet. Year-end preparation is the same work compressed, usually across twelve months of history, often with staff turnover in between. It is entirely doable, and it is what most first engagements look like. It simply costs more and produces more items that can only be estimated rather than proven. If you are heading into a financial statement audit or a proof of reserves attestation , reconciliation is the precondition for both. An auditor cannot obtain evidence for balances that were never tied to the chain. Once the ledger is reconciled, crypto audit support picks up from there and turns it into evidence your auditor can rely on. What Reconciliation Does and Doesn't Cover This is preparation work with a defined boundary. We set the boundary out at the start rather than at the point somebody relies on the wrong thing. It does cover Matching on-chain and exchange activity to your ledger, entry by entry Correct classification of internal transfers, disposals, fees, rewards, and receipts Multi-leg swaps, bridges, and DeFi activity reassembled into single economic events Cost basis applied consistently under the method you have adopted Unexplained flows traced on-chain and reported rather than absorbed Treatment decisions documented in the form an auditor will ask for It does not cover An audit opinion — reconciliation confers no assurance of any kind Wallets or accounts outside the list you give us, which we cannot know exist Proof of positions where the underlying records are missing, only best estimates A ruling on your tax position, which is for your tax adviser to determine Verification that counterparties are who your records say they are Fixing the underlying process, unless you engage us for the handover as well The completeness limit is the one that matters most. A reconciliation is only as complete as the wallet and account list behind it, so we spend real effort testing that list rather than accepting it. Where historical records are genuinely gone, we label the position as estimated and say what it rests on. We do not present an estimate as a proven figure. Transaction Reconciliation FAQ What is crypto transaction reconciliation? It is the accounting work of matching every on-chain movement to an entry in your internal ledger, and every ledger entry back to something that happened on a chain or in an exchange account. The output is a ledger where each balance is supported by evidence, and a break report listing what could not be matched. It is bookkeeping, not assurance. It is also the work that has to be finished before an audit can start. Why does on-chain data not reconcile to our ledger already? Because the chain records movements, not economic events, and your ledger records economic events, not movements. One trade through a bridge and a swap can produce four or five on-chain legs. A transfer between two wallets you own looks identical to a sale. Gas is deducted in a way most accounting systems never see. Add several chains, exchange sub-accounts, staking rewards, airdrops, wrapped tokens, and liquidity positions, and the two records diverge quietly from the first month. What is the single most common reconciliation error you find? Misclassified internal transfers. Moving assets between your own wallets, or from an exchange to cold storage, is not a disposal. When a tool or a bookkeeper treats it as one, the ledger records a sale that never happened, books a gain or loss against it, and resets the cost basis on the receiving side. In a year of activity this compounds into a reported position that is wrong in both directions. Every reconciliation we run starts by proving which addresses and accounts are yours, because that one question decides most of the classification. How do you handle gas fees, staking rewards, and airdrops? Consistently, and documented. Gas is a real cost that has to be recognised somewhere. Depending on the transaction it may be capitalised into the cost of an acquired asset, expensed, or treated as part of a disposal cost. Staking rewards and airdrops are receipts of new assets and need a recognition point and a value at that point, which then becomes their cost basis. There is genuine judgement in each of these. What matters is that the treatment is chosen deliberately, applied to every similar transaction, and written down so your auditor can follow it. What about swaps, bridges, and DeFi positions? These are where most reconciliations break down. A bridge produces a burn or lock on one chain and a mint or release on another, with no on-chain link between them. A swap through a router can emit several token transfers for one trade. Depositing into a liquidity pool exchanges your assets for a position token, which may or may not be a disposal depending on the arrangement and the treatment adopted. We reassemble the legs into the single economic event they represent, then record that event once rather than recording each leg as its own transaction. Which cost-basis method should we use? That depends on your reporting framework, your jurisdiction, and what your auditor and tax adviser will accept. FIFO is the most commonly applied and the easiest to defend. Weighted average is used where it is permitted and where volume makes lot tracking impractical. Specific identification is possible where records genuinely support it. We are not going to tell you which one to adopt on a web page, because the answer is entity-specific. The rule that never changes is consistency: pick a method, apply it across every wallet and account, and change it only with a documented reason. What happens when you find flows nobody can explain? We investigate them rather than plug them. An unexplained flow is either a missing record, a misclassification, an omitted wallet, an activity nobody told finance about, or something worse. Each of those has a different fix, and a plug entry hides all of them equally well. We trace the counterparty on-chain, look for the matching internal record, and come back to you with what the chain shows. Anything still unresolved goes into the break report with its value and what we know about it, so it is visible rather than absorbed. Is reconciliation the same as an audit? No. Reconciliation produces a supported ledger. An audit produces an independent opinion on financial statements. Reconciliation is preparation work and carries no assurance. Most crypto businesses that fail an audit fail because the underlying records were never reconciled, so the auditor could not obtain evidence for the balances. Getting this done first shortens the audit, reduces the questions, and removes the most expensive category of surprise. How long does it take, and can you do it monthly? A first engagement covering a year or more of history across several chains typically takes a few weeks, most of it spent establishing the complete wallet and account list and resolving historical breaks. Once the treatment decisions are documented and the data pipeline is in place, a monthly close runs in a fraction of that. Firms that reconcile monthly find fewer and cheaper problems than firms that leave it to year end, because the person who can explain a transaction is still there and still remembers it. What is a crypto transaction reconciliation report, and will our auditor accept it? It is the document that ties every on-chain and exchange movement to a line in your ledger, with differences identified, explained and either corrected or carried as a documented exception. A useful one states the wallets and accounts in scope, the period and the block heights covered, the classification rules applied, the value source used, every break found with its cause and resolution, and what remains unexplained. Auditors accept a reconciliation as the starting point for their own testing rather than as a substitute for it, which is the correct treatment. Where your auditor cannot test the underlying crypto balances themselves, that is crypto audit support and it is a separate engagement. More questions answered on our general FAQ . Related Reading Your auditor will not sign off on the crypto balances AML audit readiness for crypto firms in Cyprus How to read a proof of reserves report DAC8 and EU crypto tax transparency Get the books tied to the chain Tell us how many chains, wallets, and exchange accounts you run and how far back the history goes. We will scope the reconciliation and tell you what it will take to close. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Request a Reconciliation Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # DAC8 Reporting in Cyprus: Deadlines and Readiness | Ondology Labs URL: https://ondologylabs.com/services/auditing/dac8-tax-reporting Description: DAC8 crypto reporting in Cyprus: first reports for 2026 are due 30 June 2027. We scope who reports, then build, reconcile and prepare the dataset for your tax advisor. Home / Services / Blockchain Auditing / DAC8 & Tax Reporting DAC8 & Tax Reporting DAC8 crypto reporting in Cyprus and across Europe The first reporting year is already running. DAC8 reporting readiness and crypto report preparation, built from the data up. For crypto-asset service providers in Cyprus and every EU member state, and for the businesses those providers report on. We scope who and what is reportable, aggregate and value transactions from exchange records and the chain itself, reconcile the dataset to your books, and prepare the crypto report your tax advisor files. Get Reporting Support All Auditing Services 1 Jan 2026 Collection live DAC8 applies. The first reporting year is already running. 1 Jan 2027 Pre-existing users Self-certifications due for accounts opened before 2026. 30 Jun 2027 First reports in Cyprus Filings covering the 2026 year. Other member states set their own 2027 dates. Cyprus transposed DAC8 on 27 March 2026, retroactive to 1 January 2026. The late law did not move the deadlines. Reports start with 2026 activity: transactions from before 2026 are not reported, though their records still matter for cost basis. DAC8 in Cyprus, DAC8 Across Europe One directive, 27 member states, one filing. The data work is the same everywhere; the local details are not. DAC8 in Cyprus Transposed on 27 March 2026, retroactive to 1 January 2026, so the late law moved no deadlines Applies to providers licensed under MiCA by CySEC and to crypto-asset operators serving users without a MiCA registration First crypto reports, covering the 2026 year, due to the Cyprus Tax Department by 30 June 2027 We are based in Nicosia and work with the Cyprus supervisory and filing picture first-hand DAC8 across Europe The same directive applies in all 27 EU member states from 1 January 2026 A provider files its crypto report in one member state; the data is exchanged automatically with every state where a user is tax resident Non-EU platforms with EU-resident users are caught as crypto-asset operators, so leaving the EU does not leave the regime We prepare DAC8 reporting for any EU filing jurisdiction; only the endpoint and local deadline change Two Sides of the Same Regime Providers report. Everyone else gets reported on. Both need records that agree with the chain. For CASPs and crypto-asset operators If you provide crypto-asset services to EU-resident users, DAC8 has applied to you since 1 January 2026. You are already in the first reporting year: self-certifications to collect, transactions to aggregate per user and per asset at fair market value, and a first report due in 2027. We build that dataset from your records and the chain itself, reconcile it, and prepare it for filing with your tax advisor. Applicability scoped against MiCA authorisation and operator status Reportable transactions aggregated and valued from source data A dataset your advisor can file and your auditor can rely on For crypto businesses, funds, and treasuries You may have no DAC8 reporting duty of your own, but every exchange you use now reports your activity to the tax authorities automatically. What they report should match what you file, and that takes tax-ready records: cost basis tracked, realised gains and losses computed from actual on-chain history, and internal transfers kept out of the taxable numbers. We reconstruct and maintain exactly that. Cost-basis and realised gains built from chain and exchange records Your filings reconciled against what platforms report about you Defensible answers ready before a tax authority asks the question What the Service Covers From scoping whether you report at all to a validated dataset your tax advisor can file, with every figure traceable to source. Applicability assessment Whether you are a reporting crypto-asset service provider at all, which entities and products are caught, and which member state you report to. Documented, so the conclusion survives staff changes and regulator questions. Due diligence readiness Self-certification collection reviewed against the deadlines: onboarding flows for new users, the backlog of pre-existing users due by 1 January 2027, and the reminder-and-block procedure DAC8 requires for users who refuse. Transaction aggregation and valuation Reportable transactions compiled per user and per crypto-asset: fiat-to-crypto, crypto-to-crypto, transfers, and retail payments, each valued at fair market value in the way the report requires. Reconciliation to the chain and the books The reporting dataset tied back to on-chain movement and the accounting ledger, so the numbers you report agree with the numbers you audit. Breaks are investigated, not plugged. Report preparation The validated dataset prepared in the structure the submission requires, ready for your tax advisor to review and file, with a documented trail from every reported figure back to its source. Annual cycle and remediation DAC8 repeats every year. We set up the collection and reconciliation so year two is routine, and we reconstruct historical data where the first year started late or incomplete. How an Engagement Runs Scoped honestly, built from source data, reconciled before anything is reported. 01 Scoping We establish whether and where you report, which users and products are in scope, and the state of your data. If you are not caught by DAC8 at all, we say so and stop there. 02 Gap assessment Self-certifications, transaction records, valuations, and TINs checked against what the report needs. You get a concrete list of what is missing and what it takes to close each gap. 03 Dataset build Reportable transactions aggregated per user and per asset from exchange records, internal systems, and the chain, valued at fair market value at the right points in time. 04 Reconciliation and validation The dataset reconciled to on-chain movement and the ledger, with unexplained differences investigated before anything is reported rather than after. 05 Handover and filing support The prepared report goes to your tax advisor for review and submission. We stay available for their questions, and for the tax authority follow-ups that come with a first year. Where Our Role Starts and Stops We do the data. Tax law belongs to tax advisors, and pretending otherwise would make both jobs worse. We do Determine your reportable footprint and document the basis Build, value, and reconcile the reporting dataset from source data Reconstruct historical records where collection started late Prepare the report for your tax advisor and support their review We do not Give tax or legal advice, or take positions on contested tax points File the report; submission stays with you and your tax advisor Review your AML framework, which is a separate compliance audit Report numbers we could not tie back to the chain or your records If your books have never been tied to on-chain activity, start with transaction reconciliation . For the AML side of the same supervisory picture, see AML & compliance audits . DAC8 & Tax Reporting FAQ What is DAC8, in one paragraph? DAC8 is the eighth amendment to the EU Directive on administrative cooperation in tax (Directive (EU) 2023/2226). It transposes the OECD Crypto-Asset Reporting Framework into EU law and applies from 1 January 2026. Crypto-asset service providers with EU-resident users must identify those users, collect tax self-certifications including tax residence and taxpayer identification numbers, aggregate their reportable transactions per user and per asset at fair market value, and report the lot to a tax authority annually. That authority then exchanges the data automatically with every member state where a user is tax resident. There is no minimum threshold: any reportable activity above zero is reported. Who actually has to report under DAC8? Reporting crypto-asset service providers, which covers two groups: providers authorised under MiCA, and crypto-asset operators serving EU users without a MiCA authorisation, including non-EU platforms with EU-resident customers. Exchanges, brokers, custodial wallet providers, and platforms that control access to user assets are all caught. Individuals and ordinary companies that merely hold or trade crypto do not file DAC8 reports themselves, but they are the subject of the reports their platforms file, which is why their own records need to agree with what is reported about them. What are the deadlines we are actually working against? Three matter. Data collection has applied since 1 January 2026, so the first reporting year is already running and cannot be started retroactively without reconstruction work. Self-certifications from pre-existing users, meaning accounts opened before 2026, are due by 1 January 2027. The first reports, covering the 2026 calendar year, fall due in 2027; Cyprus has set 30 June 2027, and other member states set their own dates within the EU window. We confirm the exact filing deadline for your reporting jurisdiction at scoping rather than leaving you to assume it. Does DAC8 require reporting crypto transactions from before 2026? No. DAC8 reporting starts with the 2026 calendar year: the first report covers activity from 1 January 2026 and falls due in 2027. Transactions before that date are not reported under DAC8, and the due diligence on pre-existing users looks at accounts opened before 2026, not at their old transactions. Two things still make older records matter. Gains on assets sold in 2026 depend on what they cost when they were bought, often years earlier, so cost basis needs the history. And DAC8 does not replace the powers tax authorities already have to request information, nationally or from another EU state, so pre-2026 activity can still be asked about. Keep the history; it is not part of the report. Has Cyprus actually transposed DAC8? Yes. Cyprus missed the original 31 December 2025 transposition deadline, then passed the implementing law on 27 March 2026 with retroactive effect from 1 January 2026. Retroactive is the important word: the late law did not move the start of the first reporting year, so obligations run from January 2026 regardless of when the law arrived. The law applies to entities licensed in Cyprus under MiCA and to crypto-asset operators providing services without a MiCA registration requirement. What happens if a user refuses to provide a self-certification? DAC8 puts the enforcement on you. After the initial request and two reminders, once 60 days have passed, the provider is required to block the user from performing reportable transactions until the self-certification arrives. That means your onboarding and operations need a working reminder-and-block procedure, with the dates evidenced, not just a policy document that mentions one. It is one of the specific things we test in the due diligence readiness review. What goes into a DAC8 crypto report? For each reportable user: identity, tax residence, and taxpayer identification number, all supported by a valid self-certification. For their activity: aggregate amounts per crypto-asset for exchanges between crypto and fiat, exchanges between crypto-assets, certain transfers including to unhosted wallets, and retail payment transactions, together with the number of transactions and fair market values. The aggregation sounds simple and is not: it requires classifying every movement correctly, and misclassified internal transfers are the most common way a crypto report ends up wrong. Do you support DAC8 reporting across Europe, or only in Cyprus? Across Europe. DAC8 is the same directive in all 27 EU member states, applying from the same 1 January 2026 start, and a provider files its crypto report in one member state, which then exchanges the data automatically with every state where a user is tax resident. The data preparation is identical wherever you file: the same aggregation, the same valuations, the same reconciliation to the chain. Only the filing endpoint and the local deadline change, and we confirm those for your reporting jurisdiction at scoping. We are based in Cyprus and know its regime first-hand, and we prepare DAC8 reporting for providers filing elsewhere in Europe on exactly the same basis. Are you tax advisors? Who actually files the report? We are not tax advisors, and this service is deliberately drawn to stop where tax advice starts. What we do is the data: determining your reportable footprint, building the aggregated dataset from chain and exchange records, reconciling it, and preparing it for submission with every figure traceable to source. Interpretation of tax law, positions on contested points, and the filing itself belong to your tax advisor, and we work alongside whoever that is. If you do not have one, we can involve the tax team of CYAUSE, the ICPAC-licensed firm we deliver statutory audits with. We are not a CASP, just a business holding crypto. Why would we need this? Because from 2026 the information flows whether you participate or not. Every EU-facing platform you use reports your activity, identified by your tax number, to your tax authority. If your filings are built on incomplete records, the mismatch is now visible automatically. The useful response is tax-ready records: cost basis reconstructed from actual transaction history, realised gains and losses computed consistently, internal transfers between your own wallets excluded from taxable events, and the whole thing reconcilable to the chain. That is this service for non-reporting businesses, and it is the same discipline we apply in transaction reconciliation. We did not start collecting data in January 2026. How bad is it? Recoverable, and common: the first year of any new reporting regime finds most firms mid-stream. The chain does not forget, exchange records can be exported after the fact, and valuations can be established retrospectively from market data. Self-certifications are the harder gap because they depend on users responding, which is why the backlog work should start immediately rather than in the autumn of 2027. The honest framing is that reconstruction costs more than collection, and the cost grows with the delay. How does DAC8 relate to CARF and to non-EU jurisdictions? DAC8 is the EU implementation of the OECD Crypto-Asset Reporting Framework, and dozens of non-EU jurisdictions have committed to CARF exchanges on a similar timetable. In practice that means the reporting architecture you build for DAC8 is the same one CARF will ask of you elsewhere, and data prepared properly once serves both. It also means moving operations outside the EU does not move you outside the regime: a non-EU platform with EU-resident users is still a reporting crypto-asset operator under DAC8. How does this fit with your audit and reconciliation services? They share one foundation: records that agree with the chain. Transaction reconciliation is the underlying discipline and is where to start if your books have never been tied to on-chain activity. DAC8 reporting builds the regulatory dataset on top of reconciled records. And when your financial statements are audited, whether through our own audit service with CYAUSE or with your existing auditor through crypto audit support, the same verified data serves the audit evidence. Firms that treat these as one data problem pay for the work once; firms that treat them separately pay three times. More questions answered on our general FAQ . Sources The regulations, guidance and registers this page relies on. Check them directly. EUR-Lex : Council Directive (EU) 2023/2226 amending Directive 2011/16/EU on administrative cooperation in taxation (DAC8) The directive: reporting crypto-asset service providers, due diligence, self-certification, reportable transactions. European Commission : DAC8, Taxation and Customs Union Overview, application from 1 January 2026, and the link to the OECD Crypto-Asset Reporting Framework. Cyprus Tax Department : Tax Department, Ministry of Finance Competent authority for DAC8 reporting in Cyprus. Law 38(I)/2026 of 27 March 2026 transposed DAC8 with effect from 1 January 2026; the first report, for 2026, is due by 30 June 2027. Related Reading DAC8 and the EU's crypto tax transparency dragnet How DAC8 and CARF affect international expats in the EU The GENIUS Act and the tax status of digital assets MiCA Readiness & CASP Compliance: the supervisory side of the same regime Behind on the 2026 reporting year? Tell us whether you hold a MiCA authorisation, where your users are, and what your records look like today. We will tell you honestly whether you report, what is missing, and what it takes to be ready before the deadline rather than after it. A clear answer on whether DAC8 catches you at all A gap list with the work sequenced against the deadlines A dataset your tax advisor can file without redoing it Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Get Reporting Support Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Crypto Compliance in Cyprus: MiCA, AML & DAC8 | Ondology Labs URL: https://ondologylabs.com/services/compliance Description: Crypto compliance for the EU rulebook: MiCA readiness and CASP compliance evidence, independent AML compliance audits, and DAC8 crypto reporting for exchanges, custodians, funds, and token issuers in Cyprus and across the EU. Crypto Compliance in Cyprus Crypto compliance for the EU rulebook Evidence your supervisor can test, not policies they have to trust. MiCA, AML, and DAC8 all ask the same underlying question: do your records agree with the chain? We build that answer once and keep it current, for CASPs, exchanges, custodians, funds, and token issuers in Cyprus and across the EU. Facing the closed MiCA transition window? Start with MiCA readiness . Already authorised? Your obligations did not end at the licence, see MiCA ongoing compliance . Budgeting an application? Our MiCA licence cost breakdown sets out CySEC's fees and the capital rules . Checking who already holds a licence? See our list of MiCA-licensed CASPs in Cyprus . Supervisor testing your AML framework? That is AML & compliance audits . The own funds figure a supervisor reviews comes out of statutory crypto audits , and if your auditor cannot test the crypto balances, start with crypto audit support . Get a Gap Assessment Looking for Auditing? What We Cover MiCA Readiness & CASP Compliance The transition window has closed and enforcement has started. We assess your gaps against the CASP obligations, verify custody and client asset segregation on-chain, attest reserves, test your management body against the suitability requirements, and build the evidence pack your legal counsel and your supervisor rely on. Learn more MiCA Ongoing Compliance For firms already authorised. The recurring cycle that starts the day the licence is granted: annual compliance reviews against the CASP obligations, Article 67 own funds evidence, safeguarding and segregation verified on-chain, and responses to CySEC information requests and inspections. Learn more AML & Compliance Audits Independent testing of KYC and onboarding, transaction monitoring, sanctions screening, wallet risk, and Travel Rule handling, on real files rather than policy documents. Learn more DAC8 & Tax Reporting DAC8 crypto reporting for CASPs and crypto-asset operators across Europe: applicability scoping, transaction aggregation and valuation, and reports reconciled to the chain and the books. The first reporting year is already running. Learn more Four Obligations, Four Authorities "Crypto compliance" in Cyprus is not one obligation. It is four, owed to four different authorities, and satisfying one does not satisfy the others: DAC8 tax reporting → Cyprus Tax Department Reports about your users: identities, tax residence, and aggregated crypto transactions, exchanged automatically with other EU member states. How we help MiCA supervisory reporting → CySEC Reports about your firm: own funds, safeguarding of client assets, volumes, incidents, and material changes, under your CASP authorisation. How we help Suspicious transaction reports → MOKAS (the Cyprus FIU) Reports about a specific customer or transaction, filed promptly on suspicion of money laundering or terrorist financing. No threshold, no calendar. How we help Your own tax return → Cyprus Tax Department Your own position, including gains on crypto disposals taxed at a flat 8% under Article 20E of the Income Tax Law since 1 January 2026. How we help The full map, with every deadline, is in our reference guide: Crypto Reporting Obligations in Cyprus . Key facts: the Cyprus compliance timeline As at September 2026 The MiCA Article 143(3) transitional period for Cyprus crypto-asset service providers ended on 1 July 2026; providing crypto-asset services from Cyprus without MiCA authorisation is now unauthorised activity. CySEC required MiCA authorisation applications by 27 February 2026, with wind-down plans expected from firms that did not apply. Cyprus passed its DAC8 implementing law on 27 March 2026, retroactive to 1 January 2026; the first report, covering calendar year 2026, is due by 30 June 2027. Self-certifications from pre-existing users are due under DAC8 by 1 January 2027. Gains on crypto disposals are taxed at a flat 8% under Article 20E of the Income Tax Law from 1 January 2026; the claim that crypto gains are untaxed in Cyprus is out of date. How Compliance Work Runs 01 Scope the Obligations We establish which regimes catch you: MiCA authorisation, AML supervision, DAC8 reporting, or all three, and the state of your records against each. 02 Assess the Gaps Controls and records tested against the requirements on real data. You get a documented gap list with the work sequenced, not a scare memo. 03 Build the Evidence Wallet control verified cryptographically, client assets evidenced as segregated, reserves attested, and books reconciled to the chain. 04 Keep It Current Compliance is a cycle, not a certificate. The reconciliation and attestation cadence repeats, so supervisory questions are answered from live records. Compliance FAQ What is MiCA, in one paragraph? MiCA is the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), the EU's single rulebook for crypto-asset markets. It has applied in full since 30 December 2024. Firms providing crypto-asset services to EU clients must be authorised as Crypto-Asset Service Providers (CASPs) in one member state, after which they can passport their services across all 27. The authorisation bar is high: governance, capital adequacy, operational resilience, segregation and safeguarding of client assets, complaints handling, and record-keeping are all tested, and the obligations continue for as long as the licence does. Stablecoin issuers face separate, stricter titles covering e-money tokens and asset-referenced tokens. What is MiCA ongoing compliance, and how is it different from MiCA readiness? Readiness is everything up to the licence: a gap assessment, remediation, and the evidence pack behind an application. Ongoing compliance is everything after it: the recurring cycle of reviews, evidence, notifications and supervisory responses that proves you still meet the conditions you were authorised against. The distinction matters commercially because firms routinely budget for the first and not the second, then find that their first supervisory contact tests arrangements nobody has looked at since the application was filed. Authorisation is the entry ticket. Supervision is the job. What is an AML compliance audit for a crypto business? It is an independent review of the anti-money-laundering controls you actually operate, tested against the obligations that apply to you. We look at customer due diligence and onboarding, ongoing monitoring, transaction monitoring rules, sanctions and PEP screening, blockchain analytics screening of wallet exposure, Travel Rule handling, suspicious transaction reporting, record-keeping, training, and the compliance officer function. The output is a written report with findings ranked by severity and a remediation plan you can work through. What is DAC8, in one paragraph? DAC8 is the eighth amendment to the EU Directive on administrative cooperation in tax (Directive (EU) 2023/2226). It transposes the OECD Crypto-Asset Reporting Framework into EU law and applies from 1 January 2026. Crypto-asset service providers with EU-resident users must identify those users, collect tax self-certifications including tax residence and taxpayer identification numbers, aggregate their reportable transactions per user and per asset at fair market value, and report the lot to a tax authority annually. That authority then exchanges the data automatically with every member state where a user is tax resident. There is no minimum threshold: any reportable activity above zero is reported. More questions answered on our general FAQ . Related Reading Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the 8% tax MiCA authorisation in Cyprus: the complete guide AML audit readiness for crypto businesses in Cyprus Can you prove what your policies claim? Tell us where you stand with MiCA, AML or DAC8 and what your supervisor has asked for. We will scope the gap assessment and what evidence it needs. A gap register you can act on, not a policy pack Custody and segregation verified on-chain We work alongside your legal counsel Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Get a Gap Assessment Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # MiCA Readiness & Gap Assessment in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/compliance/mica-readiness Description: MiCA readiness for CASPs in Cyprus and the EU: gap assessment against CASP obligations, custody and segregation evidence, authorisation evidence pack. Home / Services / Crypto Compliance / MiCA Readiness MiCA Readiness & Gap Assessment MiCA readiness and gap assessment in Cyprus and across the EU The transition window has closed. Enforcement has started. MiCA readiness built on evidence, not policy documents. For crypto-asset service providers preparing to apply or mid-application, and for firms whose national registrations expired with the transition windows. We assess your gaps against the CASP obligations, verify custody and client asset segregation on-chain, attest reserves, and build the authorisation evidence pack, working alongside your legal counsel rather than instead of them. Already authorised? The supervisory cycle is MiCA ongoing compliance . Get a Gap Assessment All Compliance Services 30 Dec 2024 MiCA fully in force The CASP authorisation regime applies across all 27 member states. 1 Jul 2026 Last transition windows closed France, Italy, Luxembourg, Czechia, and Spain ended the final grandfathering periods. 14 Aug 2026 Enforcement has started Austria's FMA issued the first published MiCA fine. Supervisors are now testing, not onboarding. Transition periods were set nationally under Article 143(3), so the earliest closed in mid 2025. There is no member state left where a pre-MiCA registration still works. One Rulebook, Two Starting Points Whether you hold a licence or missed the window, the supervisor's question is the same: can you prove what your policies claim? For firms mid-application or preparing to apply An application is judged on evidence, not intent. While you are preparing or mid-application, the work is proving that the arrangements you are about to describe already hold: client assets segregated and provably safeguarded, reserves that can be evidenced on demand, and records that reconcile to the chain. We build that evidence layer so the filing your counsel makes is demonstrable. Custody and segregation of client assets evidenced on-chain, not just in policy documents Recurring reserve and safeguarding attestations supervisors and clients can rely on Application-stage evidence packs prepared with your legal counsel, not instead of them For firms that outgrew their national registration The transition era is over. If you served EU clients under a national registration and did not complete a CASP authorisation, you are now operating in a market where the grace periods have closed and enforcement has started. The way back in is a gap assessment that tells you honestly how far you are from the requirements, and a remediation plan sequenced against what an application actually needs. A documented gap assessment against the CASP obligations that apply to your services Remediation work sequenced so the application-critical evidence is built first One data foundation that also serves your AML audit and DAC8 reporting duties What the Service Covers From an honest gap assessment to a running evidence cycle, with every claim a supervisor might test backed by data. MiCA gap assessment Your governance, custody, safeguarding, conflicts, complaints, and record-keeping arrangements assessed against the CASP obligations that apply to your specific services. Documented per requirement, with each gap rated and a concrete close-out action, so the result is a work plan rather than a scare memo. Custody and segregation evidence MiCA requires client assets to be segregated and safeguarded. We verify wallet control cryptographically, map client asset flows against your own, and document the segregation on-chain, producing evidence a supervisor can test rather than assertions they have to take on trust. Reserve and safeguarding attestations Recurring, independently prepared attestations that reserves back what you owe clients, built on the same discipline as our proof of reserves work: cryptographic verification of wallet ownership on one side, a committed liability set on the other. Management body suitability MiCA requires your management body to be suitable individually and collectively, which means the board has to hold demonstrable crypto competence rather than financial services seniority alone. We assess directors and key function holders against Article 68 and the joint EBA and ESMA guidelines, then assemble the suitability file: a competence matrix, evidence for the collective test, and the gaps named while there is still time to close them. Qualifying shareholder source of wealth Shareholders with qualifying holdings are assessed too, and a founder whose stake was built on-chain has to evidence where that wealth came from. We reconstruct the acquisition history from the chain, risk-screen the counterparties, and document the provenance to a standard a supervisor can test. It is a tracing exercise, which is why it sits with us rather than with a governance consultant. Authorisation evidence pack For the application itself: the data and controls evidence your legal counsel needs to substantiate the custody, safeguarding, and record-keeping sections of a CySEC or other EU CASP application. Counsel drafts and files; we make sure the operational claims in the filing are true and demonstrable. Hand-off into the supervisory cycle Authorisation is the entry ticket, not the finish line. What we build for the application is handed over as the starting state of the recurring evidence cycle, which continues under MiCA ongoing compliance once your licence is granted. AML and DAC8 alignment MiCA authorisation, AML supervision, and DAC8 reporting all draw on the same underlying records. We build the data foundation once, so the same reconciled, chain-verified dataset serves all three, instead of three teams paying for the same work three times. How an Engagement Runs Scoped honestly, evidenced from the chain up, documented for the people who have to rely on it. 01 Scoping We establish which MiCA obligations actually apply: which crypto-asset services you provide, where your clients are, what authorisation you hold or need, and the state of your records. If MiCA does not catch you, we say so and stop there. 02 Gap assessment Custody, safeguarding, segregation, governance evidence, and record-keeping tested against the requirements, on real data rather than policy documents. You get a concrete list of what is missing and what closing each gap takes. 03 Evidence build Wallet control verified cryptographically, client asset segregation documented on-chain, reserves attested, and books reconciled to chain activity. The claims your application or your supervisor relies on become demonstrable. 04 Documentation and handover Findings and evidence assembled into the form the consumer needs it: an evidence pack for your legal counsel during authorisation, or a remediation record and attestation set for ongoing supervision. 05 Hand-off The reconciliation and attestation cadence is documented so it can repeat. Once you are authorised, running it is MiCA ongoing compliance, and we stay available for the questions your counsel or auditor raises in between. Where Our Role Starts and Stops We do the evidence. Legal interpretation and the application itself belong to your counsel, and pretending otherwise would make both jobs worse. We do Assess your operations against the CASP obligations and document the gaps Verify wallet control cryptographically and evidence client asset segregation on-chain Prepare recurring reserve and safeguarding attestations Assess management body suitability and trace qualifying shareholder source of wealth Build the evidence pack your legal counsel needs for authorisation and supervision We do not Give legal advice or interpret MiCA on contested points; that is counsel’s work Draft or file the authorisation application; we evidence it Take board seats or supply nominee directors; the independence our audit work rests on requires staying off your board Certify compliance we could not verify against the chain or your records Promise timelines before scoping has seen the state of your data For the AML side of the same supervisory picture, see AML & compliance audits . If your books have never been tied to on-chain activity, start with transaction reconciliation . The audited accounts behind your own funds figure come from statutory crypto audits . MiCA Readiness FAQ What is MiCA, in one paragraph? MiCA is the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), the EU's single rulebook for crypto-asset markets. It has applied in full since 30 December 2024. Firms providing crypto-asset services to EU clients must be authorised as Crypto-Asset Service Providers (CASPs) in one member state, after which they can passport their services across all 27. The authorisation bar is high: governance, capital adequacy, operational resilience, segregation and safeguarding of client assets, complaints handling, and record-keeping are all tested, and the obligations continue for as long as the licence does. Stablecoin issuers face separate, stricter titles covering e-money tokens and asset-referenced tokens. Is the transition window really closed? Yes, for practical purposes. MiCA let each member state set its own grandfathering window under Article 143(3), which is why deadlines varied: the Netherlands, Finland, and Hungary ended theirs in mid 2025, Germany, Ireland, and Lithuania in December 2025, and the longest windows, in France, Italy, Luxembourg, Czechia, and Spain, closed on 1 July 2026. As of today there is no member state where a firm can rely on a pre-MiCA national registration to serve clients. A firm without CASP authorisation serving EU clients is operating outside the regime, and grandfathering rights were always national, so they never covered passporting into other states anyway. Who supervises CASPs in Cyprus, and what do they expect? The Cyprus Securities and Exchange Commission (CySEC) authorises and supervises CASPs in Cyprus. An application stands or falls on whether the firm can demonstrate what its policies claim: that client assets are actually segregated and safeguarded, that governance and capital meet the requirements, that systems are resilient, and that records are complete and retrievable. Supervision after authorisation runs on the same logic. Our role is the demonstrable part: we verify wallet control, document segregation on-chain, attest reserves, and reconcile records, so the operational claims in an application or a supervisory response are backed by evidence rather than assertion. Has anyone actually been fined under MiCA yet? Yes. Enforcement has started. The first published MiCA fine came on 14 August 2026, when Austria's Financial Market Authority penalised Bitpanda EUR 70,000 for late white paper filing, premature marketing, and missing disclaimers. The amount is small; the signal is not. Supervisors have moved from onboarding the industry to testing it, and the early cases show they are willing to act on procedural failures, not just on collapses. Firms whose compliance exists mainly in policy documents should assume the gap between paper and practice is now the thing being examined. What evidence do supervisors actually ask for? The recurring themes are custody and client asset protection: proof that the firm controls the wallets it claims to control, that client assets are segregated from the firm's own, that reserves cover what is owed to clients, and that the books agree with the chain. These are exactly the questions an on-chain verification answers well and a policy document answers badly. A firm that can produce a cryptographic wallet-control verification, a current reserve attestation, and a reconciliation of ledger to chain is in a different conversation with its supervisor than a firm that needs weeks to assemble the same picture. What does MiCA require of our board of directors? Article 68 requires members of the management body to be of sufficiently good repute and to possess appropriate knowledge, skills and experience, both individually and collectively. The collective test is the one firms underestimate. A board of experienced financial services people with no demonstrable crypto competence can fail it even though every individual looks impeccable on paper, and the joint EBA and ESMA guidelines published in June 2024 give supervisors a common methodology for making exactly that judgement. The same expectation runs down into key function holders, so the compliance officer, the money laundering compliance officer, the head of custody, and the head of IT are all in scope, along with credible deputies for each. Firms tend to discover the gap late, when the application is already sitting with the supervisor. Can you provide a crypto expert to sit on our board? No, and the reason is worth stating plainly. We audit crypto businesses, and a firm cannot place its own people on the board of a company it audits without destroying the independence that makes the audit worth anything. Providing directors is also a regulated administrative service in Cyprus under Law 196(I)/2012, which is a different licence from the work we do. What we do instead is assess your management body against the MiCA suitability requirements, document the competence gap, and build the fit and proper file your supervisor will test. Where a gap can only be closed by a new appointment, that is a conversation for your legal counsel and a search firm, and we will tell you so rather than sell you something we should not be selling. Are you lawyers? Who runs the authorisation application? We are not a law firm, and this service is deliberately drawn to stop where legal advice starts. The authorisation application, the legal interpretation of MiCA, and regulatory strategy belong to your legal counsel, and we work alongside whoever that is. What we own is the evidence layer: the gap assessment on the operational side, cryptographic verification of custody claims, reserve attestations, and records reconciled to the chain. In practice counsel drafts the application and we make sure the operational statements in it are true and demonstrable, which is the part applications most often stumble on. How does MiCA readiness relate to your AML audits and DAC8 reporting? They are three regimes drawing on one data foundation. MiCA governs your authorisation and conduct as a CASP, AML law makes you an obliged entity whose controls get audited, and DAC8 makes you a tax reporting entity from January 2026. All three ultimately test whether your records agree with the chain. We build that foundation once: reconciled transactions, verified wallet control, documented client asset segregation. The same dataset then serves the MiCA evidence pack, the AML compliance audit, and the DAC8 crypto report, which is materially cheaper than treating them as three unrelated projects. We issue a stablecoin. Does this service cover us? Partly, and we are precise about which part. MiCA's e-money token and asset-referenced token titles impose reserve, redemption, and disclosure obligations on issuers, and the reserve side is squarely our work: independent attestation that the reserve exists, is controlled, and covers the tokens in circulation. The legal structuring of an EMT or ART, and the overlap with payment services law where token flows resemble payment processing, are questions for your counsel. If you need both, we slot into the counsel-led engagement as the party that proves the reserve numbers. We are a non-EU platform. Does MiCA reach us? If you serve EU-resident clients, assume yes. MiCA allows a narrow reverse solicitation exemption, where a client approaches the firm entirely on their own initiative, and EU supervisors have made clear they read it narrowly: marketing into the EU in any form defeats it. A non-EU platform with a real EU client base needs a CASP authorisation in a member state, and the same platform is very likely also a reporting crypto-asset operator under DAC8. We scope both questions honestly at the start, with your counsel on the legal perimeter, and tell you if the answer is that you are outside the regime. How long does it take to get ready? It depends almost entirely on the state of your records and custody arrangements, which is why the engagement starts with scoping rather than a quote. A firm with clean books, documented wallet control, and existing reconciliation discipline can assemble an evidence pack in weeks. A firm whose client asset segregation exists in spirit but not on-chain, or whose ledger has never been tied to chain activity, is looking at a remediation project first, and the honest sequencing is to fix the foundation before asserting anything to a supervisor. The gap assessment gives you that timeline with reasons, not a number invented to win the work. What is a MiCA readiness assessment? A structured review of where your firm stands against the CASP obligations before you rely on being compliant. It covers the authorisation conditions, governance and management body suitability, custody and segregation of client assets, prudential and own funds requirements, conduct and disclosure duties, and the AML framework MiCA assumes sits underneath. The output is a gap register with each gap rated, evidenced, and assigned an owner and a remediation route, rather than a policy pack. Firms use it either to prepare an application or to test an existing position before a supervisor does. What does a MiCA gap assessment cover, and how long does it take? It covers the same obligation set as the readiness assessment and produces the gap register that drives everything after it. Timing depends on how many wallets, chains, custodians and entities are in scope and on how complete your existing documentation is. A single-entity CASP with a clean wallet inventory and current policies is a matter of weeks; a group with multiple entities, mixed custody models and reconstruction work outstanding takes longer, and we say which of the two you are at scoping rather than after. We give you the wallet and evidence inventory as a deliverable in its own right, because it stays useful long after the assessment. Is MiCA readiness the same as ongoing MiCA compliance? No, and conflating them is a common and expensive mistake. Readiness is pre-authorisation work: closing gaps, building the evidence pack, and getting an application to a state a supervisor will accept. Ongoing compliance is what starts the day the licence is granted, the recurring cycle of annual reviews, periodic reporting, safeguarding evidence, material change notifications and responses to supervisory requests. Authorisation is the entry ticket, not the finish line. This page covers readiness; ongoing supervisory work is a separate engagement. More questions answered on our general FAQ . Sources The regulations, guidance and registers this page relies on. Check them directly. EUR-Lex : Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) The regulation itself, including Article 68 (management body) and Article 143 (transitional measures). ESMA : Markets in Crypto-Assets Regulation (MiCA) hub Technical standards, guidelines and the register of authorised CASPs. ESMA : Common Supervisory Action on CASPs’ digital operational resilience for custody (8 July 2026) The exercise CySEC runs as on-site inspections and desk reviews from the second half of 2026 to the first half of 2027. CySEC : Press release: MiCA licence applications due by 27 February 2026 The Cyprus application deadline and the end of the national transitional period on 1 July 2026. CySEC : CASP register (national regime) Related Reading MiCA ongoing compliance: what starts once you are authorised MiCA's transition window is closing: what crypto companies must solve Crypto audits in 2026: Tether, Bitpanda, and the new standard AML audit readiness for crypto businesses in Cyprus DAC8 & Tax Reporting: the tax-reporting side of the same regime Where do you stand under MiCA? Tell us what services you provide, where your clients are, and whether you hold or are seeking a CASP authorisation. We will tell you honestly which obligations catch you, what evidence you are missing, and what it takes to close the gaps before a supervisor asks rather than after. A clear picture of which MiCA obligations apply to you A gap list rated by severity, with the work sequenced Evidence your counsel and your supervisor can actually test Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Get a Gap Assessment Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # MiCA Ongoing Compliance for CASPs in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/compliance/mica-ongoing-compliance Description: MiCA ongoing compliance for authorised CASPs in Cyprus: post-authorisation obligations, CySEC reporting, annual compliance review and evidence cycle. Home / Services / Crypto Compliance / MiCA Ongoing Compliance MiCA Ongoing Compliance MiCA ongoing compliance for authorised CASPs Authorisation was the entry ticket. Supervision is the job. The obligations that start the day your licence is granted, evidenced on a cycle rather than reconstructed when someone asks. Annual compliance reviews, safeguarding and segregation verified on-chain, prudential figures that tie to audited accounts, and responses to CySEC information requests and inspections. We work alongside your compliance function and your counsel, not in place of them. Book an Annual Compliance Review Not yet authorised? The Obligations Do Not Pause A licence is granted against arrangements. Supervision tests whether those arrangements are still running, and it tests them on its own schedule. Annually Own funds against fixed overheads Article 67 sets own funds at the higher of your service-class floor and a quarter of the preceding year’s fixed overheads, reviewed annually. The overhead figure comes out of audited accounts. Annually Governance and suitability review Article 68 governance arrangements, management body suitability, and the outsourcing and conflicts registers, re-assessed and minuted rather than assumed to still hold. Continuously Safeguarding and segregation evidence Article 70 requires client assets to be segregated and ownership rights protected in insolvency. That is a standing state, so the evidence has to be produced on a cadence, not once at authorisation. On the event Notifications without delay Article 69 requires notifying the competent authority of any change to the management body before new members act. Material changes to the conditions of your authorisation follow the same logic. Article references are to Regulation (EU) 2023/1114. CySEC sets its own periodic reporting cadences by circular on top of these, so confirm the current ones with your compliance function rather than assuming last year's. Two Ways Firms Arrive Here Either the licence is new and nobody owns the cycle yet, or a supervisor has asked a question the records do not comfortably answer. Newly authorised CASPs in the first supervisory year The licence arrived and the project team moved on. What replaces it is a cycle: evidence that has to be produced whether or not anyone asks, reviews that have to be minuted, and a first supervisory contact that will test whether the arrangements described in the application are the arrangements actually running. Most firms discover the gap between the two in year one. An obligations register mapped to your specific services, not a generic MiCA checklist The recurring evidence cycle set up and handed over, so it survives staff changes A first annual review that tells you what a supervisor would find before one looks Established CASPs facing an inspection or information request A request has landed, or the Common Supervisory Action on custody resilience has reached you, and the evidence is spread across wallets, spreadsheets, and people who have since left. We reconstruct what can be reconstructed, say plainly what cannot, and build the response so the same request costs a fraction of the effort next time. Evidence assembled against the specific articles the request cites On-chain reconstruction of custody and segregation for the period under review An honest position on what the records do not support, before you assert it What the Service Covers The recurring evidence a supervised firm has to be able to produce, built on a cadence so producing it is retrieval rather than reconstruction. Annual compliance review A documented review of your arrangements against the CASP obligations that apply to your services, article by article, with findings rated and assigned. The output is something your board can act on and your supervisor can read, rather than a restatement of the policies you already have. Obligations register and compliance calendar Every recurring duty, who owns it, what evidences it, and when it falls due. Built once against your permissions and maintained after, so nothing depends on one person remembering that a review was due in March. Safeguarding and segregation attestations Recurring on-chain verification that client assets are held where you say, segregated from your own, and reconcilable to client balances. This is the Article 70 evidence that is hardest to reconstruct after the fact and easiest to produce on a cadence. Own funds and prudential evidence The Article 67 calculation prepared and evidenced: the class floor, the fixed overhead figure from your audited accounts, the higher of the two, and proof the funds are held as own funds rather than sitting in the same account as operating cash. Material change and notification evidence Article 69 requires notifying changes to the management body before new members act. We maintain the evidence pack behind each notification, including suitability assessments, so the filing your counsel makes is supported rather than asserted. Supervisory request and inspection response When CySEC asks, we assemble the on-chain and reconciliation evidence against the articles cited, in the format requested, to the deadline given. Where the records do not support an answer, we say so in the response rather than after it. Records, complaints and outsourcing evidence The unglamorous obligations that inspections actually open with: Article 71 complaints handled and logged, Article 72 conflicts identified and disclosed, Article 73 outsourcing arrangements documented and monitored, and records retained in a form that can be produced. AML and DAC8 data alignment Your MiCA evidence, AML audit trail, and DAC8 reporting all rest on the same transaction data. We reconcile them once so the three do not tell a supervisor three slightly different stories about the same year. How the Cycle Runs Set up once against your permissions, then run on a calendar that fires before a deadline rather than after one. 01 Onboarding review We read the authorisation file and compare what it describes to what is running. The output is a gap list between your stated arrangements and your actual ones, which is the gap a supervisor tests first. 02 Register and calendar Your obligations mapped to your permissions, each with an owner, an evidence definition, and a due date. This becomes the control document the cycle runs from. 03 Recurring evidence cycle Safeguarding and segregation verified on-chain, reconciliations run, prudential figures refreshed, and each one filed where it can be produced on request rather than rebuilt on request. 04 Supervisory response When a request or inspection arrives, the evidence is assembled against the articles cited and delivered in the format asked for. Prepared cycles turn a scramble into a retrieval. 05 Annual board report A written position on where the firm stands against its obligations, what changed this year, what was remediated, and what remains open. The document a board needs to sign off compliance honestly. Where Our Role Starts and Stops Your compliance officer stays accountable. We produce the evidence underneath them. We do Run the annual compliance review and document the findings Verify safeguarding and segregation on-chain, on a recurring cadence Prepare the Article 67 own funds evidence from your audited accounts Assemble responses to supervisory information requests and inspections Maintain the obligations register, compliance calendar and evidence trail We do not Act as your appointed compliance officer or MLCO; those roles carry personal accountability and cannot be contracted out Give legal advice or interpret MiCA on contested points; that is counsel’s work File regulatory returns or notifications on your behalf; we evidence them, your compliance function files them Take board seats or supply nominee directors; the independence our audit work rests on requires staying off your board Certify compliance we could not verify against the chain or your records Not yet authorised? Gap assessments and application evidence are MiCA readiness . For the AML side of the same supervisory picture, see AML & compliance audits , and the audited accounts behind your own funds figure come from statutory crypto audits . MiCA Ongoing Compliance FAQ What are a CASP’s ongoing obligations under MiCA after authorisation? They run continuously and they are not a subset of the application. Under Regulation (EU) 2023/1114 a CASP must keep acting honestly, fairly and professionally in clients’ best interests (Article 66); hold own funds at the higher of its service-class floor and a quarter of the preceding year’s fixed overheads, reviewed annually (Article 67); maintain governance arrangements and a suitable management body (Article 68); notify the competent authority of changes to that body before new members act (Article 69); safeguard and segregate client crypto-assets and funds (Article 70); operate complaints-handling procedures (Article 71); identify, prevent, manage and disclose conflicts of interest (Article 72); control and monitor outsourcing (Article 73); and maintain a wind-down plan (Article 74). On top of the regulation sit CySEC’s own periodic returns and circulars. What is MiCA ongoing compliance, and how is it different from MiCA readiness? Readiness is everything up to the licence: a gap assessment, remediation, and the evidence pack behind an application. Ongoing compliance is everything after it: the recurring cycle of reviews, evidence, notifications and supervisory responses that proves you still meet the conditions you were authorised against. The distinction matters commercially because firms routinely budget for the first and not the second, then find that their first supervisory contact tests arrangements nobody has looked at since the application was filed. Authorisation is the entry ticket. Supervision is the job. What does CASP compliance monitoring involve in practice? Producing evidence on a cadence rather than on demand. In practice that means a register of every obligation that applies to your specific permissions, an owner and an evidence definition for each, and a calendar that fires before the due date rather than after. The recurring work is mostly custody and segregation verification, reconciliation of on-chain activity to the ledger, refreshing the prudential figures, and keeping the complaints, conflicts and outsourcing records current. The test of whether monitoring is real is simple: if a supervisor asked today for last quarter’s safeguarding evidence, could you produce it without reconstructing it? What should a CASP annual compliance review cover? Every obligation that applies to your permissions, assessed against what the firm actually did rather than what its policies say it does. That means governance and management body suitability re-assessed rather than assumed; the Article 67 own funds calculation rerun against the latest audited fixed overheads; safeguarding and segregation tested on-chain for the period; complaints, conflicts and outsourcing registers reviewed; and last year’s open findings either closed or carried with a reason. The output should be a rated findings list with owners and dates, and a written position the board can sign. What does CySEC ask for in a supervisory information request or on-site inspection? Evidence, in a specified format, to a deadline. Typically that means the arrangements described in your authorisation file, records demonstrating they operated over a stated period, wallet and client-balance data supporting your safeguarding and segregation claims, the prudential calculation and its inputs, minutes of the governance decisions you are relying on, and the complaints and outsourcing registers. ESMA’s Common Supervisory Action on CASPs’ digital operational resilience for custody runs from the second half of 2026 into the first half of 2027, and CySEC communicated it to Cyprus firms by circular in August 2026, so custody arrangements are the live focus. How often should a CASP evidence safeguarding and segregation of client assets? More often than annually, because Article 70 describes a standing state rather than a periodic event. Client assets must be segregated and their ownership protected including in the event of the firm’s insolvency, which means the question a supervisor asks is not whether you segregated at year end but whether you were segregated throughout. A monthly or quarterly on-chain verification tied to client balances answers that; an annual snapshot does not. The practical argument for the shorter cycle is cost: a break found this month is explainable, and the same break found eleven months later usually is not. How is the Article 67 own funds requirement reviewed each year, and where do audited accounts come in? Article 67 sets own funds at the higher of the floor for your service class and one quarter of the fixed overheads of the preceding year, reviewed annually. The second limb is why the audit matters: the fixed overhead figure has to come from somewhere defensible, and that is your audited financial statements. This is the point where MiCA compliance and the statutory audit stop being separate workstreams, because a supervisor reviewing your prudential position is reading numbers an auditor signed. Holding own funds in the same account as operating cash is a common and avoidable finding. Which changes must be notified to CySEC after authorisation? Article 69 is explicit about the management body: a CASP must notify its competent authority without delay of any changes to that body, before any new member exercises activities, and provide the information needed to assess suitability under Article 68. Beyond that, material changes to the conditions on which authorisation was granted follow the same principle, including changes to the services provided, custody arrangements, outsourcing of critical functions, and qualifying shareholdings. The filing itself belongs to your compliance function and counsel. What we maintain is the evidence pack underneath it, so the notification is supported rather than asserted. Does DORA apply to CASPs, and how does it interact with MiCA supervision? Yes. Authorised CASPs are financial entities for the purposes of the Digital Operational Resilience Act, so ICT risk management, incident reporting, resilience testing and third-party risk obligations apply alongside MiCA. The two intersect most visibly in custody: ESMA’s Common Supervisory Action for 2026 and 2027 examines CASPs’ digital operational resilience specifically in relation to custody activities, which is a MiCA Article 70 subject being tested through a DORA lens. Firms that treat the two as separate projects tend to produce two sets of evidence about one set of systems. Can you act as our outsourced MiCA compliance function? No, and you should be wary of anyone who says yes. The compliance function and the anti-money-laundering compliance officer are roles the firm appoints and the supervisor assesses; they carry personal accountability and cannot be contracted out to a service provider. What can be outsourced, subject to the Article 73 outsourcing requirements, is the evidence work underneath: the recurring verification, reconciliation, register maintenance and review documentation that your compliance function relies on. That is what we do, and your appointed officer remains the accountable person. What happens if a CASP falls out of compliance after authorisation? It depends almost entirely on whether you found it or the supervisor did. Competent authorities have a graduated toolkit, from information requests and remediation timetables through to administrative fines, public statements, restrictions on services and, under Article 64, withdrawal of authorisation. A breach that is self-identified, documented, notified and remediated is a different conversation from one a supervisor uncovers in an inspection while the firm is asserting that the arrangements work. That asymmetry is the strongest practical argument for a real review cycle rather than a nominal one. How does ongoing MiCA compliance fit with the AML audit and DAC8 reporting cycle? They draw on the same data, so they should be run off one reconciled foundation rather than three. Your MiCA safeguarding evidence, your AML transaction monitoring and control testing, and your DAC8 reporting all ultimately describe the same wallets, the same client balances and the same movements. Firms that build them separately end up defending small inconsistencies between three descriptions of one year, which is an avoidable and expensive way to spend an inspection. We reconcile once and let the three obligations draw from it. More questions answered on our general FAQ . Sources The regulations, guidance and registers this page relies on. Check them directly. EUR-Lex : Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) Articles 66 to 74, the continuing obligations of every authorised CASP, and Article 64 on withdrawal of authorisation. ESMA : Markets in Crypto-Assets Regulation (MiCA) hub Technical standards and guidelines that fill in the reporting and record-keeping detail, plus the register of authorised CASPs. ESMA : Common Supervisory Action on CASPs’ digital operational resilience for custody activities The exercise running from the second half of 2026 into the first half of 2027, communicated to Cyprus firms by CySEC Circular C794 on 6 August 2026. EUR-Lex : Regulation (EU) 2022/2554 on digital operational resilience (DORA) Applies to authorised CASPs as financial entities, and supplies the resilience lens the custody supervisory action is applied through. CySEC : Circulars Where the Cyprus supervisor publishes the reporting cadences and supervisory notices that sit on top of MiCA, including Circular C794 on the custody supervisory action. CySEC : CASP register The public register of authorised Cyprus CASPs. Related Reading MiCA obligations after authorisation: the CASP compliance calendar MiCA authorisation in Cyprus: the complete guide Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the new 8% tax AML audit readiness for crypto firms in Cyprus Statutory crypto audits: the audited accounts behind your own funds figure Could you produce last quarter's evidence today? Tell us when you were authorised, which services you are permitted for, and whether a supervisor has been in touch. We will scope the review and the cycle that follows it. A first review that finds what an inspection would An obligations register and calendar you keep Evidence produced on a cadence, not on demand Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Book an Annual Compliance Review Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # MiCA-Licensed CASPs in Cyprus: The Full List | Ondology Labs URL: https://ondologylabs.com/services/compliance/mica-licensed-casps-cyprus Description: All 24 crypto firms licensed or notified under MiCA in Cyprus, from ESMA's register as updated 7 October 2026: route, date, authorised services and official website. Home / Services / Crypto Compliance / MiCA-Licensed CASPs in Cyprus MiCA Register, Cyprus MiCA-licensed crypto firms in Cyprus 24 firms, from ESMA's register as updated on 7 October 2026 . Every firm that can provide crypto-asset services from Cyprus under MiCA: 16 authorised by CySEC as crypto-asset service providers, 5 already-regulated firms that notified CySEC under Article 60 , and 3 that ESMA lists but CySEC's pages do not yet show . The list rebuilds itself from ESMA's weekly file, so it stays current without anyone retyping it. MiCA-authorised and notified crypto-asset service providers with Cyprus as home member state, from ESMA's interim MiCA register updated 7 October 2026 . Firm Route Date Services Website in the register Aquilla Nummus Ltd Not yet on CySEC lists 20 July 2026 a Custody and administration e Execution of orders g Reception and transmission of orders i Portfolio management www.aquillanummus.com PM MTF LTD Not yet on CySEC lists 20 July 2026 a Custody and administration b Operating a trading platform e Execution of orders g Reception and transmission of orders j Transfer services mtf.perpetuals.com Solidgate SG Digital Assets Limited CASP licence (Art. 63) 13 July 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services solidgate.com/casp Cloverum Finance (CY) Limited CASP licence (Art. 63) 6 July 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services www.cloverum.com tothemoon Brilliantscope Trading Limited CASP licence (Art. 63) 29 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders f Placing g Reception and transmission of orders j Transfer services tothemoon.com COMPLYCRYPTO DEPOSITORY EU LIMITED CASP licence (Art. 63) 29 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services www.complycrypto.eu NOEMON TECH LTD CASP licence (Art. 63) 29 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders f Placing g Reception and transmission of orders h Advice i Portfolio management j Transfer services www.noemon.tech TRIA BRIDGE LIMITED (ex Tokenomica Bridge Ltd) CASP licence (Art. 63) 29 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders h Advice i Portfolio management j Transfer services triabridge.com Unlimit Crypto Ltd Not yet on CySEC lists 29 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders f Placing g Reception and transmission of orders j Transfer services www.crypto.unlimit.com Ronin EM Ltd CASP licence (Art. 63) 22 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services em.ron.in Krypto Knight Ltd CASP licence (Art. 63) 15 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services www.krypto-knight.com NAGA X CASP licence (Art. 63) 8 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders h Advice i Portfolio management j Transfer services www.nagax.com/eu DASK KRYPTO S.K. DASK KRYPTO LTD CASP licence (Art. 63) 8 June 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services www.daskkrypto.eu Trading.com Markets EU Ltd Notified firm (Art. 60) 23 March 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders i Portfolio management www.trading.com/eu J2TX Ltd CASP licence (Art. 63) 16 March 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders j Transfer services www.j2tx.com Noemon Finance Ltd Notified firm (Art. 60) 2 March 2026 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders g Reception and transmission of orders h Advice i Portfolio management www.noemon.finance PELICAN EXCHANGE EUROPE (CY) LTD Notified firm (Art. 60) 22 December 2025 e Execution of orders g Reception and transmission of orders h Advice i Portfolio management www.pelicaneu.com XTB Limited Notified firm (Art. 60) 15 December 2025 a Custody and administration e Execution of orders g Reception and transmission of orders www.xtb.com/cy capital.com CAPITAL VAULT LTD CASP licence (Art. 63) 1 December 2025 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders j Transfer services www.capital.com Revolut Digital Assets (Europe) Ltd CASP licence (Art. 63) 20 October 2025 a Custody and administration b Operating a trading platform c Exchange for funds d Exchange for other crypto-assets f Placing j Transfer services www.revolut.com/en-CY/crypto TEROXX DIGITAL ASSET LTD CASP licence (Art. 63) 13 October 2025 a Custody and administration c Exchange for funds d Exchange for other crypto-assets e Execution of orders f Placing h Advice i Portfolio management j Transfer services www.teroxx.com COLLECT & EXCHANGE CY LTD CASP licence (Art. 63) 22 September 2025 a Custody and administration c Exchange for funds d Exchange for other crypto-assets j Transfer services collectnexchange.cy Trading 212 Markets Ltd Notified firm (Art. 60) 22 September 2025 a Custody and administration c Exchange for funds e Execution of orders g Reception and transmission of orders www.trading212.com eToro eToro (Europe) Ltd CASP licence (Art. 63) 16 January 2025 a Custody and administration c Exchange for funds e Execution of orders g Reception and transmission of orders h Advice i Portfolio management j Transfer services www.etoro.com Services, as lettered in MiCA Article 3(1)(16) a Custody and administration b Operating a trading platform c Exchange for funds d Exchange for other crypto-assets e Execution of orders f Placing g Reception and transmission of orders h Advice i Portfolio management j Transfer services No longer authorised: Tradu (ended 24 April 2026) . Two Routes Into the Same Register New entrants apply for a licence. Firms already regulated under other EU rules can notify instead. ESMA lists both together. CASP licence (Article 63) A firm that is not already regulated applies to CySEC for authorisation as a crypto-asset service provider. CySEC checks the file for completeness, assesses it, and lists the firm as a licensee once authorised. This is the route for exchanges, brokers, and custodians starting out under MiCA. Notification (Article 60) A credit institution may provide crypto-asset services after notifying its home regulator at least 40 working days before it starts. An investment firm may do the same, but only for crypto services equivalent to the investment services it is already authorised for. In Cyprus this is mostly the CySEC-licensed investment firms adding crypto to an existing offering. How to Check a Crypto Firm Yourself Find the firm in ESMA's MiCA register or on CySEC's lists of licensees and notified firms . Check that the service you want is one it is authorised for. A broker licensed to receive and transmit orders is not licensed to hold your crypto. Compare the website address you are on with the one in the register, letter by letter. Cloned sites that borrow a licensed firm's name are a common fraud. If you were contacted out of the blue, or promised recovery of money you lost, stop and read our guide to the first 24 hours after a crypto theft . MiCA Register FAQ How many crypto firms are licensed under MiCA in Cyprus? 24 firms can provide crypto-asset services from Cyprus under MiCA, according to ESMA's register as updated on 7 October 2026. 16 hold a crypto-asset service provider (CASP) authorisation from CySEC, 5 are investment firms that notified CySEC under Article 60, and 3 appear in ESMA's register but not yet on either of CySEC's lists. One more firm appears with an authorisation that has ended. What is the difference between a CASP licence and an Article 60 notification? A firm that is not already regulated has to apply to CySEC for authorisation as a crypto-asset service provider; CySEC lists these firms as licensees under Article 63, the article on assessing the application. Firms already authorised under other EU financial rules can take a shorter route under Article 60. A credit institution may provide crypto-asset services after notifying its home regulator at least 40 working days before it starts. An investment firm may do the same, but only for crypto-asset services equivalent to the investment services it is already authorised for. Both routes end in the same register, which is why ESMA lists them together. Where does this list come from, and how current is it? From ESMA's interim MiCA register, which ESMA republishes weekly as a downloadable file. Our site rebuilds the list from that file automatically, and the date at the top of the page is the date of ESMA's latest update, currently 7 October 2026. ESMA's file does not say whether a firm is a CASP or an Article 60 notifier, so we take that from CySEC's own two lists and check it by hand. Where the two sources disagree, the page says so rather than guessing. Does a MiCA licence mean a firm is safe to use? It means the firm met MiCA’s requirements when it was authorised or notified, and that CySEC supervises it now. It is not an endorsement, and it says nothing about the investments a firm offers. Two checks are worth making before you deal with any firm on this list: that the services you want are among those it is authorised for, and that the website you are on is the one in the register. Cloned websites using a licensed firm’s name are a common fraud. Can a Cyprus CASP serve clients in other EU countries? Yes. A CASP authorised in one member state can provide its services across the EU after notifying its home regulator of the member states it intends to serve, which is the MiCA passport. ESMA’s register records those member states for each firm, so the register entry is also the place to check whether a Cyprus firm is entitled to serve clients in your country. We are not on the list yet. Where do we start? With an honest gap assessment against the CASP obligations before you file, because applications stall on evidence, not on forms: wallet architecture, client asset segregation, safeguarding, and suitability of the management body. Our MiCA readiness service is built for exactly that stage, and the authorisation guide on our blog walks through the process and the capital each service class requires. Firms already on the list face a different job, the continuing obligations, which our MiCA ongoing compliance service covers. Sources The regulations, guidance and registers this page relies on. Check them directly. ESMA : Markets in Crypto-Assets Regulation (MiCA), including the interim MiCA register ESMA publishes the register weekly as CSV files until it moves into ESMA’s IT systems. ESMA : Interim MiCA register: authorised CASPs (CASPS.csv) The file this page is built from, filtered to firms whose home member state is Cyprus. CySEC : MiCAR CASPs: Licensees (Article 63) CySEC’s list of authorised crypto-asset service providers. CySEC : MiCAR CASPs: Notification (Article 60) Firms already regulated under other EU rules that notified CySEC under Article 60. ESMA : Interactive single rulebook: MiCA Article 60 The notification route for credit institutions, investment firms and other regulated entities. Related Reading MiCA authorisation in Cyprus: the complete guide MiCA readiness and gap assessment MiCA ongoing compliance for authorised CASPs MiCA obligations after authorisation: the compliance calendar Applying, or already on the list? Applicants stall on evidence, not forms: wallet architecture, client asset segregation, safeguarding. Licensed firms face the continuing obligations every quarter. We do the on-chain side of both. A gap assessment before you file, not after CySEC asks Safeguarding and segregation evidenced on-chain Reserve attestations your clients can verify Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Talk to Us About MiCA Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # MiCA Licence Cost in Cyprus: CySEC Fees & Capital | Ondology Labs URL: https://ondologylabs.com/services/compliance/mica-licence-cost-cyprus Description: What a MiCA CASP licence costs in Cyprus: CySEC fees from €5,000 per service (€95,000 for all ten), annual fees, minimum capital and the statutory timeline, from the primary documents. Home / Services / Crypto Compliance / MiCA Licence Cost MiCA Licence Cost, Cyprus What a MiCA licence costs in Cyprus CySEC's fees, MiCA's capital rules, and the statutory clock, from the primary documents. Figures for a Cyprus crypto-asset service provider licence vary wildly online, from €4,500 to six figures. The real numbers are public: CySEC charges an application fee for each service you apply for, and the fees add up. Every figure on this page links to the directive, policy statement, or article it comes from. €5,000 to €95,000 CySEC application fees Charged per service, then added up. €50,000 to €150,000 Minimum capital Or a quarter of fixed overheads, if higher. About 90 working days CySEC's statutory time For a complete file. Your own time is extra. CySEC Fees, Service by Service The application fee is paid once, with the application; CySEC treats an application without it as not submitted. The annual fee applies from the month you start providing the service. CySEC application fee and fixed annual fee for each MiCA crypto-asset service, from Directive DI 73-2009-04. Service (MiCA letter) Application fee Annual fee, fixed part a Custody and administration €10,000 €10,000 b Operating a trading platform €30,000 €20,000 c Exchange for funds €5,000 €5,000 d Exchange for other crypto-assets €5,000 €5,000 e Execution of orders €8,000 €5,000 f Placing €8,000 €5,000 g Reception and transmission of orders €8,000 €5,000 h Advice €8,000 €8,000 i Portfolio management €8,000 €8,000 j Transfer services €5,000 €5,000 All ten services €95,000 €76,000 On top of the fixed part, crypto-service revenue above €500,000 attracts a variable annual charge, and the whole annual fee is capped at €500,000: EUR 500,001 to 1 million 1% Up to EUR 5 million 0.4% Up to EUR 10 million 0.3% Above EUR 10 million 0.1% Revenue means gross revenue from crypto-asset services: the binding Greek text of the directive says so, although CySEC's unofficial English version says net income. The directive does not make clear whether each rate applies to its band or to the whole revenue, so confirm the calculation with CySEC or counsel before you budget on it. The annual fee is due within four months of the end of your financial year. Minimum Capital Under MiCA Article 67 asks for the higher of a fixed amount by class or one quarter of last year's fixed overheads. A new firm uses its projected overheads for the first 12 months. Class 1 €50,000 Execution of orders, placing, transfer services, reception and transmission of orders, advice, portfolio management Class 2 €125,000 Any class 1 service, plus custody and administration, or exchange for funds or for other crypto-assets Class 3 €150,000 Any class 2 service, plus operating a trading platform The requirement can be met with own funds, with an insurance policy or comparable guarantee covering the EU, or with a mix. A policy must run for at least a year, carry at least 90 days' notice of cancellation, and be disclosed on your website. How Long CySEC Takes MiCA caps the regulator's time, not yours. For a file that is complete first time, the steps below add up to about 90 working days, roughly four months. 01 Completeness check : up to 25 working days ( Art. 63(1) to (3) ) CySEC acknowledges the application within 5 working days and decides within 25 whether the file is complete. If it is not, it sets a deadline for the missing information and can refuse to review a file that misses it. 02 Assessment : up to 40 working days ( Art. 63(9) ) CySEC assesses the complete application against MiCA. 03 One information request : up to 20 working days ( Art. 63(12) ) Up to the 20th working day of the assessment, CySEC can ask for more information once. The clock pauses for at most 20 working days. 04 Decision notified : up to 5 working days ( Art. 63(9) ) CySEC notifies the applicant of its decision. CySEC publishes no estimate of its own. The clock does not run while an incomplete file waits for the applicant, which is where most of the real delay comes from: missing safeguarding evidence, unclear wallet architecture, and unresolved suitability questions. Other CySEC Charges Change to the management body: €2,000 for each change. Proposed acquisition of a qualifying holding: €8,000. Notifying a crypto-asset white paper, for trading platforms admitting tokens: €1,000 each. DORA ICT oversight fee: €2,000 a year for micro firms, €5,000 small, €10,000 medium, €20,000 others. Costs the Law Requires but Does Not Price Certifications from your external auditors and legal advisers, attached to the application Audited annual financial statements, which the fee and the capital test both rely on A registered office and effective management in the EU, with at least one EU-resident director A senior manager appointed as money laundering compliance officer, and skilled staff Client funds placed with a bank or central bank by the end of the next business day Figures You Will See Elsewhere, Checked Each of these appears on pages that rank for MiCA licence costs. Each is wrong or incomplete against the primary documents. “ The CySEC fee is €4,500. ” No such fee exists in the fee directive. The lowest CASP application fee is €5,000, and fees are charged per service. “ The licence fee is €30,000. ” That is the fee for one service, operating a trading platform. Fees add up across every service in the application, to €95,000 for all ten. “ A flat fee of €8,000 or €10,000, and no annual fee in the first year. ” That describes the old national CASP register. Under MiCA the fee varies by service, and the annual fee is charged pro rata from the month services begin. “ Firms that applied by 27 February 2026 could keep operating until CySEC decided. ” The transitional period ended on 1 July 2026 regardless. Since then, providing crypto-asset services from Cyprus requires MiCA authorisation. “ CySEC dropped its crypto fee in 2026. ” A January 2026 consultation proposed deleting a €5,000 fee for investment firms extending into crypto. It concerns investment firms only, was a proposal, and leaves MiCA CASP fees unchanged. MiCA Licence Cost FAQ How much does a MiCA licence cost in Cyprus? CySEC charges an application fee for each crypto-asset service you apply for, from €5,000 to €30,000, and the fees add up: applying for all ten services costs €95,000. Once authorised, you pay an annual supervision fee per service (€76,000 a year for all ten) plus a percentage of crypto-service revenue above €500,000, capped at €500,000 in total. Separately, MiCA requires minimum capital of €50,000, €125,000 or €150,000 depending on your services, or a quarter of last year's fixed overheads if that is higher. Professional fees for preparing the application are on top and vary with scope. How long does CySEC take to decide a MiCA application? MiCA caps the regulator's working time, not the whole process. CySEC has 25 working days to decide whether the file is complete and 40 working days to assess a complete file, can pause the assessment once for up to 20 working days to ask for more information, and notifies its decision within 5 working days. Added together that is about 90 working days, roughly four months. The time an applicant takes to fill gaps is not capped, which is why incomplete files take far longer. CySEC publishes no estimate of its own. How much capital does a crypto-asset service provider need in Cyprus? MiCA Article 67 requires the higher of two amounts: a fixed minimum by class (€50,000 for advice, execution, placing, transfer, order transmission and portfolio management; €125,000 if you also provide custody or exchange; €150,000 if you operate a trading platform) or one quarter of the previous year’s fixed overheads. A new firm uses its projected fixed overheads for its first 12 months. The requirement can be met with own funds, an insurance policy or comparable guarantee, or a mix of the two. Is there an annual fee after authorisation? Yes. Each authorised service carries a fixed annual fee, from €5,000 to €20,000, and crypto-service revenue above €500,000 attracts a variable charge of between 1% and 0.1% depending on the band, with the total annual fee capped at €500,000. Revenue means gross revenue from crypto-asset services under the binding Greek text of the directive. The fee is payable within four months of the end of the financial year, and in the first year it is charged pro rata from the month services begin. Which costs does the law make unavoidable, beyond CySEC fees? Several, though the law sets no price for them. The application must attach certifications from the applicant’s external auditors and legal advisers. Audited annual financial statements are needed for the turnover-based fee and the fixed-overheads capital test. MiCA requires a registered office and effective management in the EU with at least one EU-resident director, staff with the necessary skills, and client funds placed with a credit institution or central bank by the end of the next business day. Cyprus AML law requires a senior manager appointed as money laundering compliance officer. Can an investment firm avoid the CASP application? For services equivalent to its existing investment services, yes. Under MiCA Article 60 an investment firm can notify CySEC at least 40 working days before it starts, instead of applying for a separate CASP authorisation, so the per-service CASP application fees above do not apply. A separate €5,000 charge for investment firms extending into crypto, under CySEC’s investment firm fee rules, was proposed for deletion in January 2026, so check whether it still applies when you file. The route is limited to the crypto equivalents of what the firm is already authorised for; anything beyond that needs the full application. Sources The regulations, guidance and registers this page relies on. Check them directly. CySEC : Directive DI 73-2009-04 on Charges and Fees (unofficial English text) Application fees per service (Annex II Part III), annual fees and turnover rates (Annex I), payment rules. Cyprus Gazette : R.A.D. 415/2024, the binding Greek text of the directive (13 December 2024) Defines turnover as gross revenue ("μεικτά έσοδα"), where the English version says net income. CySEC : Policy Statement PS-03-2024 on fees under MiCA Confirms the application fee is the cumulative fee for every service applied for. CySEC : Policy Statement PS-03-2025 on DORA oversight fees Annual ICT oversight fee for CASPs from €2,000 to €20,000 by size. EUR-Lex : Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) Article 59 (substance), 60 (notification route), 63 (timetable), 67 and Annex IV (capital), 70 (client funds), 143 (transition). CySEC : Press release, 23 December 2025: MiCA applications due by 27 February 2026 The application deadline for firms under the national regime, and the end of the transition on 1 July 2026. CySEC : Consultation Paper CP-01-2026 (12 January 2026) The proposal to delete a €5,000 fee for investment firms extending into crypto; not a change to CASP fees. Related Reading MiCA authorisation in Cyprus: the complete guide MiCA-licensed CASPs in Cyprus: the full list MiCA readiness and gap assessment MiCA obligations after authorisation: the compliance calendar The fees are fixed. The delay is not. What stretches an application well beyond four months is the evidence CySEC has to ask for. A gap assessment before you file finds those gaps while fixing them is still cheap. Your services mapped to fees and capital class Safeguarding and wallet evidence checked before CySEC sees it A gap list sequenced against your filing date Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Get a Gap Assessment Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Blockchain Forensics & Crypto Recovery in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/forensics Description: Lost your crypto? Blockchain forensics, transaction tracing, and crypto recovery across Cyprus and Greece. Court-ready, legally admissible evidence backed by forensic expertise. Blockchain Forensics in Cyprus Blockchain forensics in Cyprus Lost your crypto? Follow the funds, prove the case. Blockchain forensics and crypto recovery in Cyprus for legal professionals, businesses, and government agencies. We trace, analyze, and document cryptocurrency transactions to produce legally admissible, court-ready evidence with a documented chain of custody. If funds have already been stolen, start with crypto asset recovery . Request a Consultation Need your books audited? Crypto Asset Recovery Stolen or scammed crypto traced to its off-ramp, with the court-ready evidence needed to freeze and reclaim it, and an honest read on whether that is realistic. Learn more Main Services Advanced Transaction Tracing In-depth blockchain analysis to trace funds across multiple wallets, exchanges, and platforms. Learn more Investigations Scoped investigations for companies, funds, and law firms, combining on-chain evidence with internal records. Learn more Expert Witness & Court Support Independent expert reports on blockchain evidence, expert meetings, and oral testimony at the hearing. Learn more Divorce & Inheritance Cases Crypto holdings found, valued at the dates that matter, and traced, for family lawyers, executors, and administrators. Learn more Supporting Capabilities Custom Blockchain Visualizations Interactive, court-ready visual maps illustrating the flow of funds, produced as part of tracing and investigation work or on request. Blockchain API Services Wallet risk scoring, transaction activity feeds, and customized blockchain data requests for teams that need our data in their systems. Technical Advisory & Training Crypto forensic training and technical support for legal teams, compliance officers, and investigators, delivered with our partner Centre 8 Education. From Incident to Courtroom Forensics engagements usually run as a chain. You can enter at any link, and stop at any link: 01 · Trace Transaction tracing Where did the value go? Address clustering, entity attribution, and cross-chain analysis through bridges and swaps establish the flow of funds and where they came to rest. 02 · Investigate Investigations What actually happened? On-chain evidence is combined with internal records and open-source intelligence into findings a board, liquidator, or regulator can act on. 03 · Recover Crypto asset recovery Can any of it come back? Funds that reached a regulated exchange can often be frozen through legal channels; we produce the evidence for freezing orders, police referral, and civil recovery. 04 · Testify Expert witness Will it hold up in court? Expert reports with documented methodology and chain of custody, expert meetings and joint statements, and oral evidence at the hearing. Before you engage anyone, including us The crypto recovery space is full of scammers. We never cold-contact victims, never guarantee recovery, and never ask for upfront percentage-of-recovery fees or payments to "unlock" funds. Verify us independently on our verification page before you share case details with anyone claiming to be Ondology Labs. Forensics FAQ What is blockchain transaction tracing? Tracing is the reconstruction of how value moved across a blockchain, starting from an address or a transaction hash and following the flow outward. Public chains record every transfer permanently, but the raw record is a list of hashes and amounts with no structure. Tracing turns that into an ordered account of what left an address, where it went at each hop, where it was converted or bridged, and where it came to rest. The output is an analysis, not a database export. Can stolen cryptocurrency actually be recovered? Sometimes, and honestly, not always. Recovery is realistic when the stolen funds land somewhere with a legal owner we can reach: a centralised exchange, a custodian, a payment processor, or a counterparty inside a cooperating jurisdiction. In those cases tracing plus a freezing order can return funds. Recovery is unlikely when funds have been through a mixer, converted to a privacy coin, or moved to a jurisdiction that will not act. We tell you which situation you are in after the initial trace, before you commit to a full engagement. Do you guarantee crypto recovery? No, and no legitimate firm can. Recovery depends on where the funds went: assets that reach a regulated exchange can often be frozen through legal channels, while funds sitting in a private wallet cannot be seized by anyone without legal process against the holder. We tell you honestly what the trace shows and what your realistic options are. Treat any "guaranteed recovery" promise as a red flag for fraud. More questions answered on our general FAQ . Related Reading The first 24 hours after your crypto is stolen: a step-by-step guide What lawyers should look for in a crypto expert witness Ransomware surges 50% in 2025: speed and forensics in incident response Bundle Packages Legal Case Support Bundle Transaction tracing, evidence collection, expert testimony. Fraud & Money Laundering Investigation Bundle Advanced transaction tracing, and blockchain visualization. Government Agency Compliance & Training Bundle Crypto forensic training, technical advisory. *Discounted for SMEs & Government Agencies via HRDA. Full-Scope Crypto Investigation Bundle All services included in a comprehensive package (Includes 24/7 Support). Funds moved and you need to know where? Tell us what happened and when. The earliest hours matter most, and the first conversation costs nothing. Confidential, and free for theft victims to start Court-ready documentation and chain of custody No percentage-of-recovery fees up front Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Talk to an Investigator Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: September 21 , 2026 --- # Crypto Asset Recovery Cyprus | Recover Stolen Crypto | Ondology Labs URL: https://ondologylabs.com/services/forensics/crypto-asset-recovery Description: Crypto asset recovery in Cyprus and Greece. We trace stolen cryptocurrency across chains, identify where it was cashed out, and build court-ready evidence to freeze and reclaim funds. No upfront recovery fees, no false promises. Home / Services / Blockchain Forensics / Crypto Asset Recovery Crypto Asset Recovery in Cyprus Crypto asset recovery in Cyprus Stolen crypto? We trace it, and we tell you the truth. Crypto asset recovery for victims of theft, fraud, and investment scams across Cyprus, Greece, and the EU. We trace stolen cryptocurrency across chains, identify where it was cashed out, and build the court-ready evidence your lawyer or the police need to freeze and reclaim it. Report a Theft All Forensics Services If the theft just happened, act today Stolen funds are typically laundered within hours. Before anything else: stop sending money, move any remaining balance to a new wallet with a fresh seed phrase, and preserve every transaction hash, wallet address, screenshot, and message. Do not pay anyone who contacts you offering to recover your funds for an upfront fee. That is a second scam, and it is aimed specifically at people in your position. Cases We Take Most crypto loss falls into a handful of patterns. Each leaves a different trail, and each has a different realistic path to recovery. Investment & trading platform fraud A platform showed growing returns, then blocked withdrawals or demanded "tax" and "unlocking" fees. We trace the deposits from your wallet to the operator's infrastructure and identify where the value was cashed out. Romance & social engineering scams Transfers made over weeks or months to someone you trusted, often through a fake trading app. These leave a long, traceable trail, and frequently connect to a wider network of victims. Wallet compromise & drainer attacks A leaked seed phrase, a malicious signature, or a drainer contract emptied your wallet. We reconstruct exactly what was signed, follow the outflow, and identify the consolidation addresses. Exchange hacks & insider theft Funds moved out of a corporate or custodial wallet without authorisation. We work with your internal records to separate legitimate movement from theft and produce evidence for insurers and regulators. Business email compromise A payment was redirected to an attacker-controlled address after a spoofed invoice or hijacked email thread. Speed matters most here: these funds often move straight to an exchange. Ransomware payments Where a ransom was paid, tracing the payment supports insurance claims, sanctions screening, and law-enforcement referral, and occasionally identifies the operator cluster. How Crypto Recovery Works Recovery is an evidence exercise before it is a legal one. Funds come back when a trace can point a court or an exchange at a specific account. 01 Case intake & triage You send us the addresses, transaction hashes, and background. We assess within a short window whether the trail is live enough to be worth pursuing, and say so plainly if it is not. 02 On-chain tracing We follow the funds hop by hop across wallets, chains, bridges, and swaps, clustering addresses that belong to the same actor and separating the stolen value from unrelated flows. 03 Attribution & off-ramp identification We identify where the funds came to rest: named exchanges, custodians, payment processors, or services with a real-world operator who can be served with a legal request. 04 Court-ready evidence report You receive a documented report with a chain of custody, visual flow-of-funds maps, and a clear narrative your lawyer, the police, or a compliance team can act on directly. 05 Recovery support We support the legal step that follows, whether freezing requests to exchanges, police referral, or civil proceedings, and provide expert testimony where a case reaches a hearing. What Makes Recovery Possible We would rather turn a case away than take money for a trace that cannot go anywhere. Here is what actually separates the two outcomes. Recovery is realistic when The funds reach a regulated exchange or custodian that responds to legal process You act quickly enough that a balance is still sitting there to freeze The counterparty is identifiable and within a cooperating jurisdiction The amounts justify civil proceedings or attract law-enforcement attention You have preserved the transaction hashes, addresses, and communications Recovery is unlikely when Funds passed through a mixer or were converted to a privacy coin The trail ends in a jurisdiction that will not act on a foreign order Months have passed and the receiving accounts are long since emptied The loss was a market or protocol failure rather than a theft Even then, a trace has value: it supports an insurance claim, a tax write-off, a police report, or a claim against a platform that failed its own controls. How to Spot a Fake Crypto Recovery Service Recovery scams target people who have just lost money, and they are now more common than genuine recovery firms in search results. Any one of these signs is enough to walk away. They found you Unsolicited contact by phone, email, or social media, often soon after you posted about your loss. They promise results Guaranteed recovery, or a percentage back, before anyone has looked at where the funds went. They want money first An upfront fee, a "release fee", or a "tax" that has to be paid before funds can be unlocked. They want your keys Your seed phrase, private keys, or remote access to your device. No genuine investigator ever needs them. They claim to hack or reverse Confirmed blockchain transactions cannot be reversed, and "hacking the scammer" is not a recovery method. They borrow authority Claims to act for a regulator, the police, or a court. CySEC has warned that it never contacts individuals unsolicited and has no mandate to collect fees from investors. A genuine firm charges for defined work, explains what tracing can and cannot achieve, and recovers funds through legal process with your lawyer and the police. CySEC's warning was reported by the Cyprus Mail in August 2024 . Before sharing case details with anyone claiming to be us, check our verification page . Why Ondology Labs Evidence built for court Documented methodology and chain of custody, not a screenshot of a block explorer. Reports designed to survive challenge. We work with your lawyer Cyprus and Greece are our home jurisdictions. We hand your legal team something they can file, and testify if the case is heard. Cross-chain, not chain-limited We follow funds through bridges and swaps rather than stopping at a chain boundary — which is where most traces quietly end. Crypto Recovery FAQ Can stolen cryptocurrency actually be recovered? Sometimes, and honestly, not always. Recovery is realistic when the stolen funds land somewhere with a legal owner we can reach: a centralised exchange, a custodian, a payment processor, or a counterparty inside a cooperating jurisdiction. In those cases tracing plus a freezing order can return funds. Recovery is unlikely when funds have been through a mixer, converted to a privacy coin, or moved to a jurisdiction that will not act. We tell you which situation you are in after the initial trace, before you commit to a full engagement. How quickly do I need to act after crypto is stolen? Immediately. Stolen funds are usually laundered within hours to days, and the realistic window for freezing them at an exchange is short. The single most valuable thing you can do is preserve evidence now: wallet addresses, transaction hashes, exchange account details, and every message from the people involved. Then get a trace started. Older cases are still worth investigating, because on-chain records are permanent, but the probability of freezing a live balance drops sharply with time. Do you guarantee recovery, or charge an upfront fee? We never guarantee recovery. Any firm that does is a red flag, and "recovery scams" that target victims a second time are common. We charge for defined investigative work: tracing, analysis, and a documented report you own. Whether funds come back depends on where they went and on the legal process that follows, and neither is something an investigator can promise in advance. Do I need to report the theft to the police first? You should report it, and in Cyprus that means the Cyprus Police Financial Crime Unit, but you do not need to wait for a police outcome before starting a trace. In practice a professional tracing report makes a police report substantially more actionable, because it converts "my crypto was stolen" into specific addresses, amounts, timestamps, and named exchanges that investigators and prosecutors can act on. What information do you need from me to start? At minimum: the wallet addresses involved, the transaction hashes of the outgoing transfers, the approximate dates and amounts, and which blockchain or blockchains were used. Anything else helps: exchange account statements, screenshots of the platform or person you dealt with, chat logs, emails, and the website or app you used. If you are missing some of this, we can often reconstruct it from the addresses alone. Which blockchains and assets do you cover? Bitcoin, Ethereum and the major EVM chains, and the other principal networks used to move stolen value, together with the stablecoins and tokens issued on them. We follow funds across bridges and swaps rather than stopping at a chain boundary, which is where many traces are abandoned. Will your report hold up in court? Yes, that is what it is built for. Our reports document methodology, maintain a chain of custody over the evidence, and present the flow of funds in a form a judge, arbitrator, or bank compliance officer can follow. We also provide expert testimony where a case reaches a hearing. Do you work with clients outside Cyprus? Yes. Blockchain evidence is not jurisdictional, so we trace for clients across the EU and beyond. Cyprus and Greece are where we are on the ground and best placed to support the local legal process directly, and elsewhere we work alongside your own lawyers. More questions answered on our general FAQ . Related Reading The top crypto scams in Cyprus and Greece How blockchain forensics works in Cyprus and Greece Ransomware surges: crypto incident response Tell us what happened Send us the addresses and transaction hashes. We will tell you whether the trail is live and what recovery would realistically involve — before you commit to anything. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Start a Case Review Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Crypto Expert Witness in Cyprus & Greece | Ondology Labs URL: https://ondologylabs.com/services/forensics/expert-witness Description: Independent crypto expert witness for lawyers in Cyprus, Greece and the EU, for either side or jointly, including cryptocurrency defence expert work: court-ready reports and oral testimony. Home / Services / Blockchain Forensics / Expert Witness Crypto Expert Witness in Cyprus & Greece Crypto expert witness in Cyprus and Greece Blockchain evidence that holds up under cross-examination. Expert witness and court support for lawyers running cryptocurrency cases in Cyprus, Greece, and across the EU. We produce independent, court-ready expert reports on on-chain evidence, work to your timetable, and give oral evidence at the hearing. Instructed by claimants, defendants, or jointly, including as a cryptocurrency defence expert in criminal cases. Our duty is to the court, and we say what the evidence says. Instruct an Expert All Forensics Services Our duty is to the court An expert instructed by one party still owes an overriding duty to the tribunal hearing the case. That duty comes before any duty to the party paying the fee, and we state it in every report. In practice it means we will not adopt the conclusion you would prefer if the chain data does not support it. We will tell you early, privately, and in time for you to decide how to proceed. This is not a disclaimer. It is the reason an expert report carries weight at all. An expert who shades findings to suit the instructing side is exposed on the first day of cross-examination, and the client pays for it. Who You Would Be Instructing Expert engagements are led personally by the firm's founders. You are instructing a named individual, not a queue. Iraklis Anastasiou Co-Founder & CEO, Ondology Labs LinkedIn profile Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis Panayiotis Kattides Co-Founder & CTO, Ondology Labs LinkedIn profile Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection Full CVs, including relevant instructions and appointments, are available to instructing lawyers on request. Proceedings We Are Instructed In Crypto now turns up in disputes that have nothing to do with crypto. The common thread is a question about where value went, who controlled it, and what the record proves. Civil fraud & asset tracing Following misappropriated value across wallets, chains, and off-ramps, and evidencing whether it can still be identified in a traceable form. Often the core of both the claim and the eventual enforcement. Freezing & interim applications Focused analysis on short notice to support an urgent application: where the funds are now, which exchange or custodian holds them, and the risk of dissipation. Prepared to be filed, not summarised later. Insolvency & bankruptcy Identifying digital assets belonging to the estate, reconstructing transfers made before the relevant date, and valuing holdings at the dates that matter to office holders and creditors. Criminal prosecution & defence Evidence for prosecuting authorities, and independent review for the defence. Attribution assumptions in crypto cases are frequently overstated, and testing them is legitimate expert work on either side. Regulatory & arbitration Expert evidence in enforcement proceedings and commercial arbitration, including disputes over custody, exchange conduct, token issuance, and the performance of contractual obligations on-chain. Matrimonial & probate Undisclosed crypto holdings in financial remedy proceedings and estate disputes. We test whether a disclosed position is complete and identify what the on-chain record shows against it. What the Expert Report Contains Opposing counsel rarely disputes the transactions. Blockchain data is public and verifiable. What gets attacked is the reasoning laid over it, so the report is built to show every step of that reasoning. Instructions & questions The letter of instruction and the specific questions put to us, reproduced so the scope of the opinion is unambiguous and nothing is answered that was not asked. Methodology & data sources The tools, chains, data providers, and analytical steps used, set out so another competent expert could repeat the work and reach the same result. Chain of custody How each item of evidence was obtained, when, by whom, and how it has been preserved since. Blockchain data is verifiable at source, and we record what is needed to verify it. Findings & flow of funds The conclusions in plain language, supported by transaction schedules and visual flow-of-funds maps a judge can follow without a technical briefing. Assumptions & limitations Every point where the trail could not be resolved, where attribution rests on inference rather than proof, and where an alternative explanation is open. Stated by us, before opposing counsel states it. Declaration & duty to the court A statement of our qualifications, our independence from the parties, and our understanding that our duty to the court overrides any duty to the party instructing us. How an Instruction Runs Scope and deadline agreed in writing before analysis begins, so the terms of the opinion cannot be adjusted once the findings are known. 01 Conflict check & scoping call You tell us the parties, the issues, and the timetable. We clear conflicts, confirm the work is within our expertise, and tell you if it is not. 02 Letter of instruction You set the questions in writing. We agree scope, fee basis, and the report deadline before any analysis starts, so the terms of the opinion are fixed in advance. 03 Evidence review & analysis We work through the disclosure and the on-chain record, trace the transactions in issue, and test the assumptions rather than adopting them from the case papers. 04 Draft findings & report We share draft findings so you can identify factual errors and matters we have misunderstood. The conclusions themselves are ours and are not negotiated. 05 Hearing & cross-examination Expert meetings, joint statements where a second expert is instructed, and oral evidence at the hearing, explaining the analysis and defending the methodology under questioning. Joint Experts, Meetings and the Hearing Most of the technical disagreement in a crypto case narrows before anyone reaches the witness box, because both experts are looking at the same public ledger. Joint and single joint instructions We accept single joint expert appointments where the parties or the tribunal prefer one expert to two, and we take joint instructions on agreed terms. Where each side has its own expert, we take part in expert discussions and in producing a joint statement that records what is agreed, what is not, and the reason for the difference. Narrowing the technical issues early usually saves more hearing time than any argument about them later. Giving oral evidence We attend to give evidence and to be cross-examined on the report. The work that matters here was done months earlier: an opinion with documented methodology, stated assumptions, and limitations disclosed on the face of the report is a much harder target than one that has to be defended for the first time under questioning. We answer the question asked, we concede the point where the point is good, and we do not argue the client's case from the witness box. What Blockchain Evidence Can and Cannot Establish Worth agreeing before instructions, because the gap between the two is where most crypto expert evidence is successfully attacked. It can establish That a specific transfer of a specific amount occurred at a recorded time The path funds took across wallets, chains, bridges, and swaps That a set of addresses behaves as a single controlled cluster That value reached a named exchange, custodian, or identifiable service That a party's disclosed position is inconsistent with the on-chain record It cannot establish on its own Who physically held the keys at the moment a transaction was signed The intention or state of mind behind a transfer The identity behind an address without off-chain corroboration What happened inside an exchange, where movements are off-chain A reliable path through a mixer or a privacy-preserving protocol Where a finding depends on inference rather than proof, we say so in the report and explain what would be needed to close the gap — usually exchange records obtained through disclosure or a third-party order. Cyprus, Greece and instructions from abroad We are a blockchain forensics firm based in Cyprus, and we work directly with legal teams in Cyprus and Greece. Blockchain evidence itself is not jurisdictional. The same ledger is available wherever the case is heard, which is why we are also instructed by lawyers elsewhere in the EU and beyond, working alongside them rather than in place of local counsel. The procedural requirements for expert evidence do vary by forum: the form of the expert declaration, the rules on court permission, disclosure of instructions, and whether experts meet before the hearing. We ask the instructing lawyer to confirm the rules that apply in their forum and we write the report to comply with them. We do not advise on procedure, and we do not give legal advice. That is your side of the file. If funds are still traceable, start with crypto asset recovery Expert Witness FAQ What does a crypto expert witness actually do? Two things. First, analyse the blockchain evidence in a case and set out the findings in a written report the court can rely on: what moved, when, between which addresses, and what can and cannot be inferred from that. Second, explain it. A judge or arbitrator will usually have no technical background, so the value is in translating on-chain data into plain findings that survive scrutiny, and in appearing to give oral evidence and be cross-examined on them if the matter is heard. Who instructs you, and in what kinds of proceedings? Lawyers, almost always. Litigators running civil fraud and asset tracing claims, counsel preparing freezing or other interim applications, insolvency practitioners, criminal prosecutors and defence teams, regulatory enforcement lawyers, arbitration counsel, and family and probate practitioners dealing with assets a party has not disclosed. We are also instructed by in-house counsel and by insurers. Occasionally a party instructs us directly, but the report is usually stronger when it comes through the legal team who know what is in issue. Will you support our case? We will analyse the evidence and report what it shows. That is not the same thing, and it is worth being blunt about. An expert instructed by one side still owes an overriding duty to the court, above any duty to the party paying the fee. If the chain data does not support the position you would like it to support, we will say so in the report. That is the point of an independent expert. An expert who shades findings to suit the instructing party is worth nothing once cross-examination starts, and the damage lands on the client rather than the expert. What is in the expert report? Our instructions and the questions we were asked. Our qualifications and the basis of our expertise. The material we were given and the material we obtained ourselves. The methodology, tools, and data sources used, in enough detail that another competent expert could repeat the exercise. The chain of custody over the evidence. The findings, with flow-of-funds diagrams and the underlying transaction schedules exhibited. The limitations and assumptions. And a declaration of independence and of our duty to the court. Why does methodology matter so much? Because it is the first thing opposing counsel attacks. Blockchain data is public, so the transactions themselves are rarely disputed. What gets disputed is the reasoning laid over them: address clustering, attribution of a wallet to a person or entity, the treatment of mixers and bridges, and the assumptions used where a hop cannot be resolved. A report that documents each inferential step, and separates observed fact from expert opinion, holds. A report that presents conclusions without showing the work does not. Can you act as a defence expert in a criminal crypto case? Yes. Defence lawyers instruct us to review the blockchain evidence a prosecution relies on: whether the addresses are attributed to the defendant on solid grounds, whether funds were followed correctly through swaps, bridges, and exchanges, and whether the conclusions go further than the data allows. Attribution in crypto cases is frequently overstated, and testing it is legitimate expert work. Our duty is to the court on either side, so if the prosecution analysis holds up, our report says so. Can you work as a single joint expert, or attend expert meetings? Yes to both. We accept single joint expert appointments where the parties or the court prefer one expert rather than two, and we take joint instructions on agreed terms. Where each side has its own expert, we take part in expert discussions and in producing a joint statement identifying what is agreed, what is not, and why. In practice much of the technical disagreement in crypto cases narrows quickly at that stage, because the underlying data is common to both experts. Can you work to a court timetable? We agree a deadline before accepting instructions, and we do not accept instructions we cannot meet. Tell us the date the report is due and what else is fixed in the timetable: disclosure, expert meetings, the hearing window. Urgent applications are a different rhythm: for a freezing or interim application we can produce a focused analysis and supporting evidence on short notice, then a fuller report later. If the scope is not achievable in the time available, we will say so at the outset rather than deliver something thin. Which jurisdictions do you cover? Cyprus and Greece are where we are based and where we work directly with local legal teams and courts. Blockchain evidence itself is not jurisdictional, so we are also instructed by lawyers elsewhere in the EU and beyond, working alongside them on procedure and local requirements for expert evidence. We ask instructing lawyers to confirm the procedural rules that apply to expert evidence in their forum, and we write the report to comply with them. What do you need from us to start? A clear letter of instruction stating the questions you want answered and the issues in the proceedings, the relevant pleadings or case summary, and the underlying evidence: wallet addresses, transaction hashes, exchange records, disclosure material, and any prior expert reports. The timetable and the hearing date. And the identity of the parties, so we can run a conflict check before accepting. If some of the on-chain material is missing, we can often reconstruct it from the addresses. More questions answered on our general FAQ . Related Reading Blockchain forensics in Cyprus and Greece EU privacy token ban and crypto forensics Common crypto scams and your rights Considering an expert on a crypto case? Send us the issues, the timetable, and the parties for a conflict check. We will tell you whether the evidence can answer your questions before you instruct. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Discuss an Instruction Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Crypto in Divorce & Inheritance Cases: Cyprus, Greece | Ondology Labs URL: https://ondologylabs.com/services/forensics/crypto-divorce-inheritance Description: Crypto assets in divorce and inheritance cases in Cyprus and Greece: we find holdings, value them at the dates that matter, trace disposals and report for the court. Home / Services / Blockchain Forensics / Divorce & Inheritance Family & Estate Cases Crypto assets in divorce and inheritance cases The asset most easily left off an affidavit, and among the hardest to value. For family lawyers, executors, and administrators in Cyprus and Greece. We find crypto holdings from the traces they leave, establish what was held at the dates that matter, follow anything that moved, and report it in a form a court can rely on. Cyprus courts already deal with it: in 2024 the Limassol Family Court froze half the value of listed assets, cryptocurrencies among them, in a property dispute. Discuss a Case Expert Witness Work Why Crypto Is Different in These Cases Four things make crypto harder than a bank account or a property, and each one is something the evidence has to answer. It can sit outside every statement Crypto in a self-custody wallet appears on no bank statement and in no account a spouse or executor can request. What usually shows is the edge of it: a bank transfer to an exchange, an exchange statement, an address in an old email. Control means the keys, not the paperwork Whoever holds the private keys can move the funds, whatever a court order or a will says. Keys lost on death or withheld in a dispute can put the assets beyond anyone’s reach, and the European supervisors list lost keys among the main ways people lose crypto. The value moves with the date Cyprus measures the property at the date cohabitation ended or a date the court fixes; Greek courts value a contribution claim at the date the action is filed. With an asset that can halve or double in months, the choice of date is a large part of the dispute. It can move after the separation Funds can be sent to new wallets, swapped into other assets, or bridged to another chain in minutes. The chain keeps the record, which is why disposals that look invisible can usually be traced. What We Deliver Evidence work, scoped to the questions your case turns on. Identifying holdings From the documents you already have: bank transfers to exchanges, exchange statements, addresses in disclosure or correspondence. We work out which wallets belong together and what they held. Balances at the relevant dates Holdings read from the chain at the date that matters, separation, filing, or death, with a documented price source, and at any other date the court or the parties need. Tracing disposals Where assets went after a cut-off date: to new wallets, through swaps and bridges, or to exchanges where they were cashed out, with each step tied to a transaction. Points for disclosure requests The exchanges and service providers the trail leads to, so your requests and applications name the right institutions and the right accounts. A report for the court Methodology, findings, and limits set out so the other side can test them and the court can rely on them, with expert evidence at hearing if required. Where the Evidence Meets the Law The provisions that make the evidence matter, as they read in the primary texts. Cyprus A spouse who contributed in any way to the increase in the other’s property can claim the share deriving from that contribution, presumed to be one third unless a greater or lesser contribution is proved (Law 232/1991, s.14). The court can order a sworn affidavit describing the property held at the date cohabitation ended or another date it fixes; where assets were later disposed of, the respondent must prove it (s.14A). False or incomplete information is an offence (s.14B). An administrator must collect the estate with reasonable speed and file an inventory with the court (Administration of Estates Law, Cap. 189, ss.40 and 41). In 2024 the Limassol Family Court barred a respondent from disposing of 50% of the value of listed assets, cryptocurrencies among them, in a property dispute (E.R. v P.R., App. 45/2023). Greece A spouse who contributed in any way to the increase in the other’s property can claim the share deriving from that contribution, presumed to be one third (Civil Code art. 1400, as quoted by the Areios Pagos in 1731/2025). The Areios Pagos treats the claim as a monetary debt of value, measured on the increase between marriage and the date the claim arises, with the filing of the action the critical time for valuation. On death a person’s property passes as a whole to the heirs (Civil Code art. 1710). We found no published Greek court decision that deals with crypto in an estate. We are forensic analysts, not lawyers. Translations from Greek are ours; your lawyer should confirm how each provision applies to your case. Divorce & Inheritance FAQ Can crypto be hidden in a divorce? It can be left off a statement, but it is hard to make it disappear. Crypto bought with money from a bank account leaves a transfer to an exchange; exchange accounts produce statements; and every on-chain movement is permanently recorded. In Cyprus the court can order a sworn affidavit of the property held at the relevant date, and false or incomplete information is an offence. Our work is to connect the edges that do show, transfers, statements, addresses, to the holdings and movements behind them. How is crypto valued in a divorce in Cyprus or Greece? At the date the law or the court makes relevant, and that date matters more for crypto than for most assets. In Cyprus the property is described as at the date cohabitation ended or another date the court fixes. Greek courts value a contribution claim at the time the action is filed. We read the holdings from the chain at each date that matters and price them from a documented source, so the parties argue about the date, not about the numbers. Can an executor recover crypto from an estate without the keys? It depends where the crypto is held. Assets on an exchange or with a custodian sit in an account the provider controls, and the provider has its own process for estates, so the executor’s task is to find the account and evidence the right to it. Assets in a self-custody wallet can only be moved with the private keys; without them no one can move the funds, including us. We can still establish what the deceased held and where, which matters for the inventory and the distribution. What do you need from us to start? Whatever you already have that touches crypto: bank statements showing transfers to or from exchanges, exchange statements or emails, any wallet addresses, and the dates that matter in the case. We confirm at the outset what can be established from those, what further disclosure would help, and what cannot be established at all. Do you give legal advice? No. We are forensic analysts, not lawyers. We find, trace, and value crypto and report on it in a form a court can use; the legal strategy, the claims, and the applications stay with your lawyer, and we work alongside them. The legal provisions on this page are context for the evidence work, quoted from their sources, and your lawyer should confirm how they apply to your case. Sources The regulations, guidance and registers this page relies on. Check them directly. CyLaw : Law 232/1991 on the property relations of spouses (in Greek) Section 14 (contribution claim, one-third presumption), 14A (affidavit of property), 14B (false information). CyLaw : Administration of Estates Law, Cap. 189 Sections 40 and 41: the administrator’s inventory and duty to collect the estate. CyLaw : Wills and Succession Law, Cap. 195 Estate defined as the movable and immovable property held at death. CyLaw : E.R. v P.R., Limassol Family Court, App. 45/2023, 19 August 2024 (in Greek) Interim order covering listed assets including cryptocurrencies. Areios Pagos : Judgment 1731/2025 (in Greek) Quotes Civil Code art. 1400 and sets out how the contribution claim is measured and valued. Areios Pagos : Judgment 849/2025 (in Greek) Quotes Civil Code art. 1710 on succession to the estate as a whole. European Supervisory Authorities : Joint warning to consumers on the risks of crypto-assets (March 2022) Price volatility and the loss of assets through lost private keys. Related Reading Crypto expert witness and court support Crypto tracing services How to choose a crypto expert witness Blockchain forensics in Cyprus and Greece Crypto somewhere in the case? Tell us what you have: a transfer to an exchange, a statement, an address, the dates that matter. We will tell you plainly what can be established from it and what cannot, before any work starts. Holdings identified from the traces they leave Values at the dates your case turns on A report the other side can test and the court can rely on Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Discuss a Case Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Crypto Tracing Services in Cyprus | Ondology Labs URL: https://ondologylabs.com/services/forensics/transaction-tracing Description: Crypto tracing services from Nicosia: blockchain transaction tracing across wallets, bridges and swaps for lawyers, compliance teams and businesses, with honest limits on what a trace proves. Home / Services / Blockchain Forensics / Transaction Tracing Blockchain Transaction Tracing Crypto tracing services in Cyprus Analysis that shows where the value went. Blockchain transaction tracing and on-chain analysis for lawyers, compliance teams, businesses, exchanges, and insurers, from our base in Nicosia. We trace cryptocurrency transactions across wallets, bridges, swaps, and chains, and deliver a documented analysis you can act on: flow-of-funds diagrams, transaction schedules, and a written report that states its own limits. Commission a Trace All Forensics Services If your crypto was stolen, you are on the wrong page This page is about the analysis itself, bought by people who need to understand a flow of funds. If you are a victim of theft, fraud, or an investment scam and what you want is your money back, the work is the same tracing but the engagement is different: it is time-critical, it targets the off-ramp, and it is built around freezing a balance and supporting legal process. Start there instead. Go to crypto asset recovery What a Trace Actually Produces A public blockchain records every transfer permanently, but the raw record is a list of hashes and amounts with no structure and no names. Tracing is the work of turning that into an ordered account: what left a given address, where it went at each hop, where it was converted or bridged, and where it came to rest. The deliverable is an analysis with reasoning attached, not a data export. Three techniques carry most of the weight. Flow reconstruction follows value hop by hop and separates the funds in issue from unrelated balances that pass through the same addresses. Address clustering groups addresses that appear to be under common control. Entity attribution links those clusters to real services: exchanges, custodians, bridges, lending protocols, and known illicit infrastructure. The first is observation. The other two are inference, and we label them that way. Screening Is Not Tracing The two get sold interchangeably and they answer different questions. Most teams need both, at different moments. Screening an address An automated lookup against a risk database. It returns a score or a label based on what is already recorded about that address and its immediate neighbours. It runs in milliseconds, scales to every transaction you process, and is the right control at the point of onboarding or payment. What it cannot tell you is where the funds originated, how they got to the address, or whether a clean score reflects genuine history or merely an absence of coverage. Tracing the flow A human analysis of the actual transaction path, across hops, conversions, and chains, aimed at a specific question. It takes days rather than milliseconds and it is not something you run on everything. You commission it when a screening result needs an explanation, when the amount at stake justifies the work, or when you need a documented answer that will be read by a regulator, a board, a court, or a counterparty who will not accept a score. Who Commissions a Trace The common thread is a decision that depends on the answer: whether to onboard, to pay, to underwrite, to escalate, to publish, or to sue. Counterparty and wallet due diligence Before you take payment from a wallet, onboard a client, or close a deal, an analysis of where that wallet's funds came from and what it has interacted with. Useful when a screening score is clean but the volume, timing, or counterparties do not look ordinary. Compliance and AML investigations Alert escalation for exchanges, VASPs, and financial institutions. Where an automated flag needs a human answer, we reconstruct the flow behind it and document the conclusion for the file, whichever way it goes. Internal fraud and misappropriation Corporate treasury, custody, or payroll funds moved without authorisation. We separate legitimate movement from the transactions in issue using your internal records alongside the chain data. Insurance and lending exposure Underwriting and claims work where the question is the provenance of a holding or the plausibility of a stated loss. On-chain history is verifiable at source, which makes it unusually good evidence for both. Litigation and enforcement support Analysis instructed by lawyers to answer a defined question in a live matter: whether assets remain traceable, where they are held, and what the record supports. Presented so it can be exhibited later. Research and investigative journalism Structured analysis of protocol exploits, market manipulation, and illicit flows, with the underlying transaction data supplied so your own team or a fact-checker can verify each claim. Clustering and Attribution, Stated Honestly This is where on-chain analysis is strongest and where it is most often overstated. The distinction is worth understanding before you rely on anyone's output. How clustering works The core heuristic is co-spending: when several addresses are used as inputs to one transaction, one party almost certainly held all those keys. Change address identification extends the cluster further. Behavioural signals add to it, including fee settings, timing patterns, script types, and reuse of the same deposit infrastructure. Each of these is a probabilistic judgement. Co-spend logic is strong on Bitcoin and much weaker on account-based chains, deliberate avoidance defeats it, and a shared custodial wallet can produce a cluster spanning thousands of unrelated users. We record which heuristic supports each cluster and how much weight it bears. Where attribution comes from Naming a cluster requires something off-chain. The usual sources are known deposit addresses at exchanges and services, addresses named in sanctions listings and enforcement actions, published disclosures, contract deployments, and claims the owner has made publicly. None of that identifies an individual. It identifies a service, and the service knows its account holder even though we do not. That is the practical route to a real name: reach the venue, then use legal process. Where the data supports only an inference, the report says inference. Following value across bridges, swaps, and chains Value rarely stays on one chain. It leaves through a bridge, arrives as a wrapped asset somewhere else, passes through a decentralised exchange, and moves on. Each of those events breaks a naive trace, because the outgoing and incoming legs are separate records on separate ledgers with no shared identifier in the transaction itself. This is where a large share of traces quietly stop and get reported as dead ends. They usually are not. Bridge contracts emit events, most bridging protocols carry a message identifier, and where neither is available the legs can be reconciled by timing and by amount net of fees and slippage. Swaps are handled the same way: the input asset, the pool, and the output asset are all on-chain. We continue the trace on the receiving chain and report the whole path as one flow rather than as unconnected fragments. It is slower than stopping at the boundary, and it is frequently the difference between an answer and a shrug. How We Run a Trace Scope agreed first. A trace without a defined question expands without limit and produces volume instead of findings. 01 Scope and starting points We agree the question first, then the addresses, hashes, and date range that answer it. A trace without a defined question expands without limit and produces volume rather than findings. 02 Flow reconstruction We follow value hop by hop from the starting points, separating the funds in issue from unrelated balances that pass through the same addresses, and recording every transaction relied on. 03 Clustering and attribution We group addresses under apparent common control, identify services, exchanges, and contracts along the path, and record which heuristic or data source supports each identification. 04 Cross-chain continuation Where funds bridge or swap, we match the outgoing and incoming legs by contract event, identifier, timing, and amount, then continue the trace on the receiving chain rather than closing the file. 05 Analysis and deliverables We produce the written analysis, the flow-of-funds diagrams, and the transaction schedules, with limitations and open alternatives stated on the face of the report rather than left implicit. What You Receive Every finding is traceable back to a public transaction you can verify yourself. That is the standard we write to, whether the report ends up in a compliance file or an exhibit bundle. Flow-of-funds diagrams The path drawn as a graph, with amounts, dates, and named services on the edges. Built to be read by a compliance committee or a judge without a technical briefing first. Transaction schedules Every hop relied on, tabulated with hash, chain, timestamp, asset, and amount. Anyone can verify each row against a public block explorer, which is the point. Written analysis The findings in plain language, tied to the specific question asked, with the reasoning shown step by step rather than presented as a conclusion to be taken on trust. Methodology statement The tools, data providers, chains, and heuristics used, in enough detail that another competent analyst could repeat the work and reach the same result. Chain of custody How each item of evidence was obtained, when, by whom, and how it has been preserved since. Recorded from the start, because it cannot be reconstructed afterwards. Limitations and assumptions Where the trail could not be resolved, where an identification rests on inference, and where an alternative explanation remains open. Stated by us before anyone else states it. Where the analysis is intended for proceedings, it is written to be exhibited and defended. See expert witness and court support for how a trace becomes evidence. Mixers, privacy protocols, and where a trace legitimately ends A mixer exists to break the link between a deposit and a withdrawal, and privacy chains conceal amounts and parties at the protocol level. When funds enter either, the trace usually ends. Partial results are sometimes available: unusual amounts, poor timing discipline, and repeated withdrawal patterns can support a probabilistic link, and a deposit into a sanctioned service is itself a finding worth recording. But a suspected link is not a traced path, and we will not present one as the other. We also stop when continuing stops producing evidence. Saying a trail ended is a finding, and it is more useful than an invoice for another week of analysis that will reach the same place. What Tracing Can and Cannot Establish Worth agreeing before you commission anything, because the gap between the two columns is where on-chain analysis gets oversold. A trace can establish That a specific amount moved between specific addresses at a recorded time The path value took across wallets, bridges, swaps, and chains That a set of addresses behaves as one controlled cluster, to a stated confidence That funds reached a named exchange, custodian, protocol, or sanctioned service That a stated position or disclosure is inconsistent with the on-chain record Where the trail ends, and precisely why it ends there A trace cannot establish Who held the keys when a transaction was signed, without off-chain evidence The intention behind a transfer, or whether it was authorised A real-world identity from chain data alone: clustering is probabilistic, not proof What happened inside an exchange, where balances move off-chain A reliable path through a mixer or a privacy-preserving protocol Any obligation on anyone to freeze, return, or compensate; that needs legal process Where a finding rests on inference rather than proof, we say so and explain what would close the gap. Usually that is exchange records obtained through legal process, or documents held by you. Transaction Tracing FAQ What is blockchain transaction tracing? Tracing is the reconstruction of how value moved across a blockchain, starting from an address or a transaction hash and following the flow outward. Public chains record every transfer permanently, but the raw record is a list of hashes and amounts with no structure. Tracing turns that into an ordered account of what left an address, where it went at each hop, where it was converted or bridged, and where it came to rest. The output is an analysis, not a database export. How is tracing different from screening an address? Screening checks one address against a risk database and returns a score or a label. It is fast, automated, and shallow: it tells you what is already known about that address, and nothing about the funds themselves. Tracing follows the actual transaction path across hops, chains, and conversions to establish where value came from and where it went. Screening is a filter you run on everything. Tracing is what you do when the filter flags something, or when the answer matters enough to justify the work. What is address clustering, and how reliable is it? Clustering groups addresses that appear to be under common control. The main heuristics are co-spending, where several inputs signed into one transaction imply one key holder, and behavioural patterns such as change address selection, consistent fee settings, timing, and reuse of infrastructure. These are inferences, not proofs. Co-spend logic is strong on Bitcoin and much weaker on account-based chains. Heuristics can be defeated deliberately, and shared custodial wallets can produce a cluster that spans thousands of unrelated users. We state which heuristic supports each cluster and how confident we are in it. Can you tell me who owns an address? Sometimes, and only with qualification. Attribution comes from linking on-chain behaviour to off-chain information: known deposit addresses at exchanges and services, published or leaked address disclosures, addresses named in enforcement actions, contract deployments, and public claims by the owner. Where the funds reach a regulated venue, the venue knows the account holder even though we do not, which is the usual route to a real identity through legal process. Where attribution rests on inference, we say so and describe what would be needed to confirm it. Can you follow funds across bridges, swaps, and different chains? Yes, and it is the part of the work that most often decides whether a trace is useful. Value routinely leaves one chain through a bridge, arrives as a wrapped asset on another, and is swapped through a decentralised exchange before moving on. Each of those events breaks a naive trace, because the outgoing and incoming transactions are separate records on separate ledgers. We match them using bridge contract events, message identifiers, timing, and amount reconciliation net of fees. Many traces are abandoned at exactly this boundary and reported as a dead end when they are not one. What happens when funds go through a mixer or a privacy coin? Usually the trace ends there, and we say so rather than presenting a guess as a finding. A mixer is designed to break the link between deposit and withdrawal, and privacy-preserving chains hide amounts and parties at the protocol level. Partial results are sometimes available: unusual amounts, poor timing discipline, or reuse of the same withdrawal pattern can support a probabilistic link, and deposits into a sanctioned service are themselves a finding worth recording. But we distinguish clearly between a traced path and a suspected one, and we will not sell continued analysis past the point where it stops producing evidence. What do I actually receive at the end of a trace? A written analysis setting out the scope, the methodology, the data sources, the findings, and the limitations. Flow-of-funds diagrams showing the path visually at a level a non-technical reader can follow. Transaction schedules exhibiting every hop relied on, with hashes, timestamps, amounts, and chains, so that anyone can verify the underlying data independently. Where the analysis may be used in proceedings, a documented chain of custody over how each item of evidence was obtained and preserved. What information do you need to start a trace? At minimum one starting point: an address, a transaction hash, or an exchange deposit reference, plus the chain it sits on. Anything else narrows the work and reduces the cost: dates and amounts, the counterparty name if you have one, invoices or contracts, exchange statements, and the question you actually want answered. That last item matters more than people expect. "Is this counterparty exposed to sanctioned entities" and "where did these funds originate" are different analyses on the same data. Which chains and assets do you cover? Bitcoin, Ethereum and the major EVM networks, the principal non-EVM chains used to move value at scale, and the stablecoins and tokens issued across them. Coverage matters less than continuity: the practical test is whether an analysis can follow value through a bridge and a swap onto a chain it did not start on, and report it as one flow rather than several unconnected fragments. More questions answered on our general FAQ . Related Reading How blockchain forensics works in Cyprus and Greece U.S. Treasury signals a policy shift on crypto mixers EU privacy token ban and crypto forensics Have an address and a question? Send us the starting point and what you need to know. We will tell you what the chain data can answer, what it cannot, and what the analysis would involve. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Discuss a Trace Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: October 13 , 2026 --- # Crypto Investigations for Companies & Boards | Ondology Labs URL: https://ondologylabs.com/services/forensics/investigations Description: Cryptocurrency fraud investigations in Cyprus for companies, VASPs, funds, insolvency practitioners, and law firms. Scoped, confidential, evidence-led findings combining on-chain and off-chain sources. Home / Services / Blockchain Forensics / Investigations Digital Asset Investigations in Cyprus Crypto investigations for companies and boards When an organisation needs to know what actually happened. Cryptocurrency fraud investigations for companies, exchanges and VASPs, funds, insolvency practitioners, boards, insurers, and the law firms that instruct on their behalf. A scoped, confidential engagement that combines on-chain evidence with internal records, corporate structures, documents, and interviews, and ends in a written report you can act on. Discuss an Investigation All Forensics Services Is an investigation what you need? An investigation answers a question about people and conduct: what happened, who was involved, and what the evidence supports. That is a different question from where the money went, and it needs more than a blockchain. If your question is purely about funds, you want transaction tracing . If you are a victim of theft and you want the value back, start with crypto asset recovery . If proceedings are already running and you need an independent opinion for the court, you want an expert witness . An investigation is the engagement you commission when something has gone wrong inside or around an organisation, nobody yet knows the shape of it, and a decision has to be taken about people, money, or disclosure. Investigations We Are Engaged For The trigger is usually a number that will not reconcile, a compliance alert, a whistleblower, or a counterparty that has stopped answering. What follows is the same discipline in each case: establish the facts before anyone acts on an assumption. Internal fraud & insider misappropriation A suspicion that an employee, contractor, or officer has diverted digital assets, abused treasury or wallet access, or manipulated records to hide it. Often surfaces as a reconciliation that will not close. Partner, counterparty & supplier fraud Value paid away against fabricated invoices, undisclosed related parties, or a counterparty whose stated business does not match its on-chain behaviour. Frequently involves entities in several jurisdictions. Platform & project failure Examining a platform or token project before committing to it, or reconstructing what happened after it collapsed: where user funds went, when the shortfall began, and who was directing the movements. Insolvency asset identification Work for office holders and creditors: identifying digital assets belonging to the estate, reconstructing transfers made before the relevant date, and separating estate property from personal holdings. Sanctions & AML breach investigations A hit, an alert, or an audit finding suggests exposure a firm should not have taken. We establish what actually occurred, over what period, how it passed controls, and what the records show. Pre-transaction due diligence Examining a person, company, or project before an acquisition, an investment, an onboarding decision, or a senior hire. Corporate history, adverse findings, and the on-chain record behind the claims. How an Investigation Is Governed Two decisions in the first week determine whether the findings can be relied on later: who the investigator reports to, and how the evidence is handled. Reporting lines and independence Whoever engages us should sit outside the conduct being examined. In practice that is the board, the audit or risk committee, a non-executive director, or the organisation's external lawyers instructing on the client's behalf. Where management is within scope, management should not set the scope, direct the work, or see findings first. We agree the reporting line and the distribution list in writing before starting, run a conflict check, and confirm the questions we are being asked. None of this implies anything about the people involved. It is what stops a reasonable finding being dismissed later on the grounds that the investigator was reporting to the person under examination. Confidentiality and chain of custody Work proceeds on a need-to-know basis, with material in access-controlled storage and correspondence limited to named recipients. Evidence is recorded from the point of collection: what was taken, when, from where, by whom, and how it has been held since. On-chain material is captured at a fixed point and remains verifiable at source. Sequencing matters as much as security. Preserving records, logs, and access before any subject becomes aware of the engagement is usually the difference between a complete evidence set and a partial one, because deletion and asset movement start the moment word gets out. On-Chain Evidence, and Everything Around It The blockchain shows movement. It does not show authorisation, intent, or who was at the keyboard. Those come from the records the organisation already holds, and from the people who were there. On-chain records Wallet and transaction history across the major chains, address clustering, bridges, swaps, and off-ramps. Permanent, public, and verifiable at source, which makes it the most durable evidence in most cases. Exchange & custodian records Account statements, deposit and withdrawal history, and identity material held by regulated venues. Obtained through the client, through their lawyers, or through the authorities. We do not obtain it by any other route. Internal systems & documents Accounting ledgers, treasury and wallet approvals, access logs, contracts, board minutes, and email where the organisation lawfully holds it and has a proper basis to review it. Corporate & banking material Company filings, ownership and directorship records, group structures, and bank statements where available. Digital asset fraud almost always touches a company and a bank account somewhere. Open-source intelligence Registries, court and insolvency records, sanctions and adverse media, domain and infrastructure data, and the public footprint of the people and projects involved. Gathered from public sources only. Interviews Structured conversations with staff and third parties who agree to speak, conducted after the documentary and on-chain evidence is in hand rather than before, and recorded in a written note. The on-chain analysis itself is our transaction tracing capability, run inside the investigation rather than sold as a separate exercise. How an Investigation Runs Scope, reporting line, and distribution agreed in writing before any work starts. Scope can change as findings emerge, but it changes by instruction, not by drift. 01 Instruction & scoping You tell us the concern and who is engaging. We run a conflict check, agree the questions in writing, fix the reporting line, and set the distribution list before any work begins. 02 Evidence preservation Securing what could be lost first: system access, logs, devices, records, and the on-chain position as at a fixed point. This happens before anyone in scope is aware of the engagement. 03 Analysis & corroboration On-chain tracing run against internal records, banking material, and corporate structures. A finding is not a finding until it is supported from more than one direction. 04 Interim findings We report to the engaging party as material issues emerge rather than holding everything to the end, so decisions about people, systems, and disclosure can be taken in time to matter. 05 Report & handover A written report with findings, evidence schedules, chain of custody, and stated limitations. Handed to whoever was named at the outset, with a briefing if the recipients want one. Interim findings, the report, and privilege We report material issues as they emerge rather than saving everything for the end. Boards usually have to make decisions before an investigation closes: whether to suspend access, whether to preserve a claim, whether something has to be disclosed to a regulator, an insurer, or a counterparty. Interim findings are given for that purpose and are clearly marked as provisional, because early readings do change once further evidence arrives. The final report sets out the instructions and the agreed scope, the material examined and how it was obtained, the methodology, the findings with the evidence supporting each one, and the limitations. Evidence schedules and flow-of-funds exhibits are annexed. We separate what the record establishes from what we infer from it, and we say where the evidence runs out. If the matter later moves into proceedings, that same work supports a formal expert report and testimony , which is a separate instruction carrying a duty to the court. Privilege is a legal question and not one we answer. It depends on the jurisdiction, on who instructs, and on how the work is documented. Many organisations instruct through external counsel with that in mind, and we are comfortable working under that structure. Confirm the position with your own lawyers before the engagement starts, because the structure set up at the beginning is hard to change afterwards. What an Investigation Can and Cannot Deliver Worth agreeing before the engagement, because expectations set at the start are what the report is measured against at the end. It can deliver A documented account of what the available evidence supports A reconstructed timeline of transfers, approvals, and access Identification of the accounts, entities, and structures involved The control failures that allowed it, and where they still exist Evidence packaged for your lawyers, insurers, or the authorities An honest read on how far the evidence will carry the point It cannot deliver Certainty — findings rest on evidence, and evidence has limits A guaranteed conclusion, since some investigations end inconclusive Compulsion, because we cannot require anyone to answer or produce Seizure or freezing of assets, accounts, or wallets Any law-enforcement or regulatory power, which we do not hold The decision on dismissal, reporting, or litigation, which is yours Where the evidence does not settle a question, we say so and set out what further material would resolve it. We will not write a conclusion the record will not carry, and we will not soften one it does. Crypto Investigation FAQ What is the difference between an investigation and transaction tracing? Tracing answers a question about funds: what moved, when, and where it ended up. An investigation answers a question about people and conduct: what happened, who was involved, and what the evidence supports. Tracing is one input into an investigation, usually an important one, but rarely sufficient on its own. An investigation also draws on internal records, system logs, corporate structures, banking material, open-source research, and interviews, and it ends with findings about events rather than a map of transfers. If what you need is the map, start with transaction tracing and instruct an investigation only if the answer raises questions about people. Who should engage us, and who should we report to? Whoever is engaging should sit outside the conduct under examination. In practice that means the board, the audit or risk committee, a non-executive director, or the organisation's external lawyers instructing on the client's behalf. Where management is within scope, management should not control the engagement, set the scope, or receive findings first. This is not a comment on anyone's integrity. It is what makes the findings usable later, because the first question anyone asks about an internal investigation is who was directing it. How is the scope set, and can it change? We agree the questions in writing before work starts: what is being examined, which people, entities, accounts, and periods are in scope, what we are not being asked to look at, and who receives the output. Scope can change, and often does, because investigations surface things nobody expected. When that happens we come back to you with what we have found and a proposed variation rather than quietly widening the work. Nothing outside the agreed scope is examined without instruction. Will the investigation be confidential? We work on a need-to-know basis and agree the distribution list at the outset. Material is held in access-controlled storage, correspondence stays with the named recipients, and we do not confirm the existence of an engagement to anyone outside it. In an internal matter, confidentiality is also operational: if the subject learns of the work before evidence is preserved, records get deleted and funds get moved. Sequencing evidence preservation ahead of any interview is usually the single most important decision in the first week. What about legal privilege? Privilege is a legal question, and it depends on the jurisdiction, the nature of the engagement, and how the work is instructed and documented. We are accountants and investigators, not your lawyers, and we do not advise on it. Many organisations choose to instruct through external counsel with privilege in mind, and we are used to working under that structure. Confirm the position with your own lawyers before the engagement starts, because the way instructions and reporting lines are set up at the beginning is difficult to correct afterwards. Do you have any powers to compel evidence or freeze assets? No. We are a private firm, not law enforcement and not a regulator. We cannot compel anyone to answer questions, obtain records by order, search premises, seize devices, or freeze an account or a wallet. What we can do is work with the material the organisation lawfully holds or can lawfully obtain, analyse public blockchain records, and produce evidence in a form that supports whatever step you decide to take next, including a report to the authorities or an application made through your lawyers. What if the findings are inconclusive? Then the report says so. Some investigations end without establishing what happened, because the records were incomplete, the trail ran into services that do not respond, or the available evidence supports more than one explanation. Reporting an inconclusive result plainly is more useful than reporting a conclusion that the evidence will not carry, and much safer for the organisation if the matter is later tested by a regulator, an insurer, or a court. We will also set out what further material would resolve the point, if anything would. We have been hacked. Is that an investigation or a recovery engagement? It can be both, and the order matters. In the first hours the priority is containment, evidence preservation, and following the funds while they are still moving, which is recovery and tracing work. The investigation follows: how the attacker got in, whether internal access or internal knowledge was involved, what controls failed, what the organisation is obliged to tell regulators, customers, and insurers, and whether anything similar happened previously and went unnoticed. If the incident is live, start with crypto asset recovery and treat the investigation as the second phase. What do you deliver at the end, and can it be used in proceedings? A written report setting out the instructions, the scope, the material examined, the methodology, the findings, the basis for each finding, and the limitations. Evidence schedules and flow-of-funds exhibits are annexed, with a chain of custody recorded from the point of collection. Many investigations stop there and are used internally. Where the matter goes further, the same work usually supports a formal expert report and testimony, which is a separate instruction with different duties attached. It is easier to write an investigation report that can carry that weight than to retrofit one that cannot. More questions answered on our general FAQ . Related Reading Inside the CoinDCX $44m hack and the forensic response AML audit readiness for crypto firms in Cyprus Blockchain forensics in Cyprus and Greece Something has gone wrong and you need the facts Tell us the concern and who would be engaging. We will tell you what an investigation can realistically establish, and what it will take, before you commit to one. Don’t fill this out if you’re human: Full Name Email Address Company/Organization Phone (optional) Service of Interest General Inquiry Crypto Audit Support Financial Statement Audits Proof of Reserves & Solvency Transaction Reconciliation Treasury & Wallet Audits AML & Compliance Audits DAC8 & Tax Reporting MiCA Readiness (pre-authorisation) MiCA Ongoing Compliance (authorised CASPs) Crypto Asset Recovery Investigations Transaction Tracing Expert Witness & Court Support Message Start a Confidential Conversation Reply within one business day, then a 20-minute scoping call and a fixed-fee proposal. Statutory opinions are issued by our ICPAC-licensed audit partner. Verify us before you engage. Last reviewed: August 9 , 2026 --- # Crypto Audit, Compliance & Forensics FAQ | Ondology Labs URL: https://ondologylabs.com/faq Description: Answers to common questions about crypto audits, proof of reserves, MiCA and DAC8 compliance, and blockchain forensics in Cyprus, Greece and the EU. Frequently Asked Questions Answers to common questions about our blockchain auditing, blockchain forensics, and crypto recovery services in Cyprus. What is blockchain auditing, and how is it different from a smart-contract audit? Blockchain auditing is the independent financial and forensic audit of an organisation’s crypto holdings, transactions, and reserves, verifying that the on-chain reality matches the books. It is distinct from a smart-contract (code) audit: we audit the money and the controls, not the source code. Our work covers financial-statement audits, proof of reserves, transaction reconciliation, and AML controls. Crypto audit services in Cyprus Are your audits backed by a licensed firm in Cyprus? Yes. We partner with ICPAC-licensed firms (the Institute of Certified Public Accountants of Cyprus is the body that authorises statutory audit work in Cyprus), so independent audit opinions are issued through licensed partners your investors, board, and regulators can rely on, combined with the on-chain forensic depth most accounting firms don’t have. Statutory crypto company audits What is a proof-of-reserves audit? A proof-of-reserves audit is an independent, on-chain attestation that an exchange or custodian actually holds enough assets to fully back its customer liabilities. We cryptographically verify wallet ownership, confirm balances on-chain, and reconcile them against internal records, so you can prove solvency to customers and regulators rather than just assert it. Proof of reserves audits and attestations How does blockchain auditing help with CySEC and MiCA compliance? Under MiCA, CySEC is the competent authority in Cyprus for crypto-asset service providers (CASPs) and most crypto-assets. The national transitional regime for CASPs ended on 1 July 2026, so full authorisation is now the only route. Our AML and compliance audits review your KYC/AML controls, wallet-risk exposure, and reserve backing against EU and Cyprus requirements, giving you documented, audit-ready evidence of compliance. MiCA readiness and gap assessment What is blockchain forensics, and is your evidence usable in court? Blockchain forensics is the discipline of tracing, analysing, and documenting cryptocurrency transactions to produce evidence suitable for legal proceedings, distinct from general analytics or monitoring. Our investigations follow a documented methodology with a clear chain of custody, producing legally admissible, court-ready reports and expert testimony for legal teams, businesses, and government agencies. Blockchain forensics services What should I do if my crypto is stolen in Cyprus? Act fast and contact us immediately. Stolen funds can be moved through mixers or cross-chain bridges within hours, so the earliest hours matter most. We trace the funds on-chain, document the trail, notify exchanges that may be able to freeze assets, and coordinate with law enforcement in Cyprus, Greece, and beyond. The sooner we start, the better the odds of recovery. Crypto asset recovery Can you actually recover lost or stolen cryptocurrency? Sometimes. It depends on where the funds went and how quickly we are engaged. We trace transaction pathways across wallets, exchanges, and chains to identify where assets landed; when funds reach a regulated exchange they can often be frozen and recovered through legal channels. We are honest about the odds up front and never guarantee recovery, but early forensic tracing materially improves the chances. Crypto asset recovery Do you offer blockchain auditing, compliance, and forensics services in Cyprus and Greece? Yes. We are based in Nicosia, Cyprus, and serve clients across Cyprus, Greece, and the wider EU. We provide blockchain auditing backed by ICPAC-licensed partner firms, crypto compliance support including MiCA readiness and DAC8 reporting, blockchain forensics and crypto recovery, and AML/compliance advisory, for exchanges, funds, law firms, regulators, banks, and fintechs. All our services Who do you typically work with? We work with crypto exchanges, funds, and digital-asset businesses needing audited, verifiable financials; law firms and prosecutors needing on-chain evidence and expert testimony; banks, fintechs, and CASPs needing AML and compliance assurance; and individuals or businesses that have lost crypto to fraud or theft. All our services How much do your services cost? It depends on the engagement. Audit support, proof of reserves, and compliance work are scoped up front and quoted as a fixed fee once we understand the wallets, chains, and volumes involved. Investigations and recovery cases are phased: a scoped initial assessment first, so you know what the evidence shows before committing to more. For theft victims the first conversation is free, and we never charge a percentage-of-recovery fee up front. Anyone demanding an upfront fee to "release" or "recover" your funds is running a second scam. What a crypto audit costs in Cyprus How do I know Ondology Labs is legitimate? Check us independently. Ondology Labs is a registered Cyprus company based at Hawaii Tower, Themistokli Dervi 41, Nicosia, with named founders you can verify on LinkedIn, an ISO/TC 307 technical committee membership, and an ICPAC-licensed audit partner (CYAUSE Audit Services) behind our statutory audit work. We never cold-contact victims and we never ask for payment through gift cards or crypto transfers to "unlock" recovered funds. If someone claiming to be us does any of that, it is an impersonator. Verify us independently Do you guarantee crypto recovery? No, and no legitimate firm can. Recovery depends on where the funds went: assets that reach a regulated exchange can often be frozen through legal channels, while funds sitting in a private wallet cannot be seized by anyone without legal process against the holder. We tell you honestly what the trace shows and what your realistic options are. Treat any "guaranteed recovery" promise as a red flag for fraud. Crypto asset recovery Do you work with law firms and insolvency practitioners? Yes, regularly. For law firms we produce court-ready expert reports on blockchain evidence, tracing exhibits, joint expert statements, and oral testimony. For insolvency practitioners we identify and document crypto assets in an estate, trace pre-insolvency transfers, and support recovery actions. Instructions can run through your firm so the work sits under legal privilege where appropriate. Expert witness and court support Which auditors in Cyprus can audit a crypto company? Only an ICPAC-licensed audit firm can sign a statutory audit in Cyprus, and the register of licensed firms is public, so any firm you are considering can be checked before you engage it. The practical constraint is narrower than the legal one: plenty of licensed firms can audit a Cyprus company but cannot independently test digital-asset balances, because a wallet has nobody to write to for confirmation. That is why crypto audits in Cyprus are usually delivered as a pairing. We work with CYAUSE Audit Services Ltd, which holds the licence and issues the opinion, while we prove wallet control and read the chain behind it. Crypto audit services in Cyprus What does a crypto audit in Cyprus cover? The same four assertions as any audit, tested against evidence that lives on a blockchain rather than at a bank. Existence: the assets are real and readable on-chain at the reporting date. Rights and control: the company can actually move them, proven cryptographically rather than asserted on a schedule. Valuation: holdings are priced from a documented source under the right accounting treatment, usually IAS 38 or IAS 2. Completeness: no wallet, exchange account or custodial position has been left out. On top of that sit reconciliation of on-chain activity to the ledger and, for regulated firms, the safeguarding and prudential evidence a supervisor expects. Statutory crypto company audits --- # Crypto Audit, Compliance & Forensics Blog | Ondology Labs URL: https://ondologylabs.com/blog Description: Guides and analysis on crypto audits, MiCA, DAC8, AML and blockchain forensics for CASPs, funds and advisers in Cyprus, Greece and the EU. Our Blog All Auditing Compliance Tax & DAC8 Forensics 9 min read Your Auditor Will Not Sign Off on the Crypto Balances: What to Do Before Year-End The call usually comes in November. The audit is going fine until it reaches the digital assets, and then it stops. Here is what your auditor is actually stuck on, what happens to the opinion if it stays stuck, and the three ways out. September 21, 2026 Read More → 8 min read How Auditors Verify Crypto Wallet Ownership (ISA 500, 505 and 620) There is no bank to write to for a confirmation. So how does an auditor establish that the wallets on a management schedule actually belong to the company? Three methods, their limits, and how each is documented as audit evidence. September 21, 2026 Read More → 7 min read CASP Audit Requirements Under MiCA in Cyprus: Statutory Audit, Own Funds and Safeguarding Evidence A CASP authorisation does not create a separate audit regime. It creates a supervisor who reads your audited accounts for a purpose the Companies Law never contemplated. Here is what gets audited, and what CySEC reads it for. September 21, 2026 Read More → 8 min read MiCA Obligations After Authorisation: The 2027 CASP Compliance Calendar The authorisation project ends and the team disbands. What replaces it is a cycle nobody has written down. Here are the continuing obligations under MiCA, arranged by how often they actually fall due. September 21, 2026 Read More → 7 min read What a Crypto Audit Costs in Cyprus (and What Drives the Fee) Nobody will give you a number on the first call, and the reason is not evasion. Four factors drive the fee, three of them are inside your control, and one of them can change the price by a multiple. September 21, 2026 Read More → 9 min read Best Crypto Accounting Tools Comparison (2026 Benchmark) DAC8, MiCA and the GENIUS Act have turned crypto bookkeeping into a legal mandate. A benchmark of the leading digital asset subledgers, general ledgers and audit partners, and how to choose between them. September 21, 2026 Read More → 4 min read The Institutional Stablecoin Avant-Garde: Banks and Fintechs Tokenize Fiat Traditional finance is moving from cautious experimentation to full-scale tokenized fiat issuance. Driven by MiCA regulatory clarity, global bank consortiums, and emerging cross-border treasury rails, sovereign-backed digital tokens are poised to redefine wholesale settlement and global liquidity. September 7, 2026 Read More → 6 min read MiCA Authorisation in Cyprus: The Complete Guide The transitional period is over: providing crypto-asset services from Cyprus now requires MiCA authorisation. How the CySEC process works, what capital each service class needs, what actually goes in the application, and a readiness checklist you can run this week. September 2, 2026 Read More → 5 min read Crypto Audit Requirements in Cyprus: Who Needs One and What It Involves Every Cyprus company files audited financial statements, and holding crypto does not change that. What changes is the evidence. Who needs a crypto audit, what the auditor will ask for, and how to prepare, entity by entity. September 2, 2026 Read More → 13 min read Crypto Reporting Obligations in Cyprus: DAC8, MiCA, AML and the New 8% Tax Crypto reporting in Cyprus is four separate obligations to four authorities: DAC8 filings to the Tax Department, supervisory reporting to CySEC, suspicious transaction reports to MOKAS, and your own return, which now carries a flat 8% tax on crypto disposals under Article 20E. Every deadline, in one place. September 1, 2026 Read More → 4 min read Crypto Audits in 2026: DAC8, MiCA and the Tether KPMG Audit As DAC8 and MiCA take effect in 2026, crypto firms face unprecedented regulatory scrutiny. Why traditional financial audits fall short, and how Tether and Bitpanda are setting new digital asset standards. August 29, 2026 Read More → 9 min read What Lawyers Should Look For in a Crypto Expert Witness How to assess a blockchain expert witness before you instruct, what a crypto expert report must contain to survive scrutiny, and the questions that expose a weak opposing report. August 9, 2026 Read More → 9 min read AML Audit Readiness for Crypto Firms in Cyprus: The Gaps We Find Most The same eight gaps come up in almost every AML review of a Cyprus crypto firm. Here is what they look like, why supervisors notice them, and how to close each one before an inspection does. August 5, 2026 Read More → 9 min read How to Read a Proof of Reserves Report (And Spot a Meaningless One) Most published proof of reserves shows only assets, and assets alone prove nothing. Here is how to read an attestation properly, plus a checklist of questions to ask before you trust one. July 30, 2026 Read More → 9 min read The First 24 Hours After Your Crypto Is Stolen: A Step-by-Step Guide Your crypto is gone and every hour counts. Here is exactly what to do in the first 24 hours: secure what remains, preserve evidence, report the theft in Cyprus, and start a trace. July 22, 2026 Read More → 7 min read The GENIUS Act and the Tax Status of Digital Assets: Stablecoins, the IRS and Form 1099-DA The GENIUS Act reshaped U.S. stablecoin regulation, but the IRS still treats digital assets as property under Notice 2014-21. Here's what it means for wash sale rules, tax-loss harvesting and Form 1099-DA reporting. July 19, 2026 Read More → 8 min read The DAC8 Directive: The EU's Crypto Tax Transparency Dragnet Explained The EU's DAC8 directive ends crypto anonymity from January 2026. Explore local tax rates, filing rules and severe penalties across Germany, Italy, France, Spain, Cyprus, Greece, the Netherlands and Malta. July 17, 2026 Read More → 8 min read DAC8 and CARF: A Crypto Tax Guide for International Expats Living in the EU How DAC8 and CARF affect U.S., Indian, UAE and Singaporean expats living in the EU: double tax treaties, residency tie-breaker tests, FATCA/FBAR risks and the U.S. Exit Tax. July 15, 2026 Read More → 4 min read Which RWA Tokens Are Not Securities? A Regulatory Breakdown Across Europe, Cyprus and Germany Learn which RWA tokens may not be securities in Europe, Cyprus and Germany, including commodity-backed, utility, payment and ownership tokens. March 20, 2026 Read More → 4 min read MiCA's Transition Window Is Closing: What Crypto Companies Must Solve Before July 2026 MiCA's transition window closes in July 2026. Here's what crypto firms in the EU (and Cyprus) must solve before full CASP authorization and regulatory enforcement. February 27, 2026 Read More → 4 min read U.S. Treasury Signals Policy Shift on Crypto Mixers: Privacy, Compliance and the Next Phase of Blockchain Oversight U.S. Treasury signals a shift on crypto mixers, acknowledging legitimate privacy uses while urging stronger AML oversight, DeFi rules and forensic monitoring. January 30, 2026 Read More → 4 min read Ransomware Surges 50% in 2025: Why Speed and Forensics Now Define Crypto Incident Response Ransomware attacks surged 50% in 2025. Ondology Labs and Cyberfraud Investigators partner to accelerate crypto forensics and asset recovery. December 4, 2025 Read More → 4 min read CoinDCX $44 million hack: inside the breach and the urgent role for forensic investigations CoinDCX suffers a $44M crypto hack via insider device compromise. Here's why forensic investigations are critical. July 31, 2025 Read More → 4 min read EU Privacy Token Ban: What It Signals for Cyprus and Crypto Forensics EU bans privacy tokens and anonymous crypto accounts from 2027. What it means for Cyprus and why forensic investigations will be vital. May 21, 2025 Read More → 5 min read Navigating Crypto Crime: A Look at Blockchain Forensics in Cyprus and Greece Blockchain forensics traces and documents crypto transactions to produce court-ready evidence. What it can and cannot establish, how an investigation runs, and who does what in Cyprus and Greece: police, MOKAS, CySEC, the Hellenic FIU and HCMC. October 31, 2023 Read More → --- # Auditor Will Not Sign Off on Crypto Balances | Ondology Labs URL: https://ondologylabs.com/blog/auditor-wont-sign-off-crypto-balances Description: Your auditor cannot verify your cryptocurrency balances. What that means for the opinion, the three ways to fix it, and the timeline before year-end. ← Back to Blog Your Auditor Will Not Sign Off on the Crypto Balances: What to Do Before Year-End By Panayiotis Kattides · September 21, 2026 An auditor who will not sign off on your crypto balances is not being difficult. They are being correct, and the fix is usually available if you start before the year-end rather than after it. Key takeaways A wallet address on a management schedule is not audit evidence. Anyone can paste an address they do not control. If the auditor cannot obtain sufficient appropriate evidence, the result is a qualified opinion or a disclaimer, not a delayed one. Three fixes exist: reconcile the ledger to the chain, prove wallet control without moving the keys, and bring in an auditor's expert under ISA 620. All three are far cheaper before the reporting date than after it, because control can be proven today and cannot be proven retrospectively. The call tends to arrive in November. The audit started on time, the revenue testing went fine, the payables circularisation came back clean, and then the engagement reached the line on the balance sheet that says digital assets. Now it has stopped. The audit manager is asking for something the finance team does not recognise as a reasonable request, the finance team is sending screenshots, and both sides are becoming quietly convinced the other does not understand the subject. Both sides are usually right about that. What follows is the translation, written from the auditor's side of the table, because the fastest way out is to understand precisely what they are stuck on. What Your Auditor Is Actually Stuck On An audit of any balance tests a small number of assertions. For an asset those are, roughly: does it exist, do you have the rights to it, is it valued correctly, and is the list complete. A bank balance satisfies all four cheaply, because a bank is a third party who will confirm in writing what you hold, and a bank statement is produced by someone with no incentive to help you misstate it. A blockchain removes that third party. The balance is public and verifiable by anyone, which sounds like it should make the audit easier, and for existence it does. The problem is the other three. Rights and control. An address holding 400 ETH proves that 400 ETH sits at that address. It proves nothing about whose ETH it is. Copying somebody else's address into a schedule is trivial, and a schedule of addresses prepared by management is precisely the kind of assertion the audit exists to test independently rather than accept. This is the assertion that stalls most engagements, and it is the one most finance teams are surprised by, because from the inside there has never been any doubt about whose wallets they are. Completeness. Existence testing starts from your list and checks the items on it. Completeness runs the other way: it asks whether anything is missing from the list. A wallet nobody remembered, an exchange sub-account opened for one trade in March, a staking position, a bridged balance sitting on a chain the finance team does not follow. There is no equivalent of a bank confirmation that returns every account you hold, so completeness has to be built from the transaction history outward. Valuation. Usually the most tractable of the three, but not automatic. It needs a documented price source, a documented time of day, a consistent treatment across assets, and the correct accounting model. Most crypto holdings are intangible assets under IAS 38 unless the entity is a broker-trader, in which case IAS 2 may apply, and the measurement consequences of that choice are significant. The IFRS Interpretations Committee agenda decision of June 2019 is still the reference point. What Happens If It Stays Stuck This is the part that tends to focus minds, because the common assumption is that an unresolved crypto balance delays the audit. It does not. It changes the opinion. When an auditor cannot obtain sufficient appropriate audit evidence over a balance, they are required to consider the effect on their report. If the amount is material but not pervasive, the result is a qualified opinion: the accounts are fair except for the digital assets, with the reason stated in the report for anyone to read. If the digital assets are most of the balance sheet, which for a crypto-native business they usually are, the effect is pervasive and the result is a disclaimer of opinion. The auditor states that they were unable to form a view at all. Either outcome is a public document filed with the Registrar of Companies. Banks read it. Acquirers read it during diligence and price it. Investors with information rights read it. If you hold a CASP authorisation, your supervisor reads it, and a qualification over client assets invites a question you would rather not be answering. A modified opinion is not a paperwork problem that gets tidied up next year; it sits in the filing history permanently. What the auditor needs versus what most finance teams provide Four audit assertions. Existence is satisfied by a chain reading. Rights, completeness and valuation are not satisfied by a management schedule of wallet addresses and require independent evidence. What you provided What the audit needs Screenshot of a wallet balance Shows a number at a moment Existence Satisfied: balance read from the chain Schedule listing your addresses Prepared by management Rights and control Gap: needs proof of key control The wallets finance knows about Starts from your own list Completeness Gap: needs history worked outward A price pulled from an exchange Source and timing undocumented Valuation Gap: needs a documented policy Existence is the one assertion a blockchain satisfies for free. The other three are where audits stall. Fix One: Reconcile the Ledger to the Chain Before anything else can be tested, the ledger has to agree with the chain. In practice this means every wallet and exchange account in scope is identified, every movement in the period is pulled from the chain and the exchange APIs, each movement is matched to a journal entry, and the differences are investigated rather than plugged. The breaks that come out of this are predictable: internal transfers booked as disposals, network fees never recorded, staking rewards accumulating with no entry at all, an exchange account that was funded and forgotten, and a handful of movements nobody can explain because the person who made them has left. None of these are unusual and none of them are fatal. They simply have to be resolved before an auditor can test anything, and resolving them is transaction reconciliation rather than audit work. An auditor cannot both prepare your records and express an independent opinion on them. This is the step most commonly underestimated. A year of history across several chains, reconstructed in December, is a matter of weeks rather than days, and it is the precondition for everything below. Fix Two: Prove Wallet Control Without Moving the Keys The rights assertion is the one people assume is impossible to satisfy without doing something dangerous with the private keys. It is not. There are two accepted methods and neither requires exposing a key. A signed message. The wallet signs a short piece of text supplied by the auditor, typically containing the entity name and the date so it cannot be reused. Anyone can verify the resulting signature against the public address. It demonstrates that whoever produced it holds the private key, and it moves nothing. A nominal transfer on instruction. The auditor specifies a small amount, a destination and a moment, and the entity makes that transfer. Because the auditor chose the parameters and the timing, the transaction shows the entity could move the funds on demand. This is the fallback where the custody arrangement will not produce an arbitrary signed message, which is common with some institutional custodians and multi-party computation setups. For assets held at an exchange or a custodian, neither method applies, because you do not hold the keys. That position is confirmed directly with the custodian, which is an ordinary third-party confirmation and carries the ordinary limitation: it is only as good as the counterparty's own records and controls. The timing point matters more than any of the detail. Control is proven in the present tense. You can demonstrate today that you control a wallet, and that evidence is strong. You cannot demonstrate in March that you controlled a wallet the previous December if the keys have since been rotated, the custodian has changed, or the employee who held the hardware device has left. Every month of delay makes this harder and some of it eventually becomes impossible. Fix Three: Bring in an Auditor's Expert Under ISA 620 The third fix is the one that resolves most engagements, and it is routine rather than exotic. ISA 620 covers the use of an auditor's expert: where the engagement team needs expertise in a field other than accounting and auditing to obtain sufficient appropriate evidence, they may engage a specialist while remaining solely responsible for the opinion. Auditors do this constantly for property valuations, actuarial assumptions, and complex legal questions. Digital assets are the same pattern. The audit firm keeps the engagement, the client relationship and the opinion. The expert performs the on-chain examination, and the audit file records the expert's competence, capability and objectivity, the scope agreed in writing, and the findings in a form the engagement team can evaluate. From the client's side this is usually the least disruptive route, because the auditor you already have does not have to be replaced. From the auditor's side it is a well-understood mechanism that their own quality reviewers will recognise. This is what our crypto audit support engagement is, and audit firms engage us on that basis as often as their clients do. Where the engagement needs the full statutory audit rather than support to an existing one, that runs through statutory crypto audits with our ICPAC-licensed audit partner, who signs the opinion. The Timeline for a December Year-End Working backwards from a 31 December reporting date, and assuming you are reading this with the year-end still ahead of you: Now. Produce the complete inventory of wallets, exchange accounts and custodial positions. This single document is the most valuable thing you can create today, and it is the one that takes longest if you leave it. Now. Prove control of every self-custodied wallet on that list, while the keys and the people are where they are. This is the piece that decays. Before year-end. Reconcile the year to date and resolve the breaks, so December is a short exercise rather than a reconstruction. At year-end. Capture balances at the reporting date with the block heights and timestamps recorded, alongside the custodian confirmations. January. Hand the working papers to the audit team with the methodology documented, so their testing is evaluation rather than investigation. If the year-end has already passed, none of this becomes impossible. It becomes more expensive, and some evidence degrades from proof to inference, which the auditor will weigh accordingly. A Short Checklist to Take to Your Auditor If you want to shorten the next conversation, arrive with answers to these: Which wallets, exchange accounts and custodial positions are in scope, and who confirmed the list is complete? For each self-custodied wallet, can you produce a signed message or accept an instructed transfer? For each custodial position, who will sign the confirmation and by when? Is the ledger reconciled to the chain for the full period, and what remains unexplained? What is the price source, the time of day, and the accounting model, and is it applied consistently? Has the engagement team decided whether it is using an auditor's expert, and if so, has scope been agreed in writing? An auditor who cannot get comfortable is not an obstacle to work around. They are telling you, early and in writing, that your records do not currently support the numbers in your accounts. That is worth knowing in November, and considerably less pleasant to discover from a supervisor, an acquirer, or a bank. How Ondology Labs can help: We are engaged by audit firms as an auditor's expert and by companies whose audit has stalled. That work is crypto audit support : wallet ownership verification, balances read from the chain, and working papers your audit file can carry. Where the books need to be tied to the chain first, that is transaction reconciliation , and where you need the full opinion, statutory crypto audits run with our ICPAC-licensed partner. Related reading: How auditors verify crypto wallet ownership · Who needs a crypto audit in Cyprus · What a crypto audit costs in Cyprus Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # How Auditors Verify Crypto Wallet Ownership | Ondology Labs URL: https://ondologylabs.com/blog/how-auditors-verify-crypto-wallet-ownership Description: How auditors prove a company controls a crypto wallet: signed messages, instructed transfers, custodian confirmations, and what counts as audit evidence. ← Back to Blog How Auditors Verify Crypto Wallet Ownership (ISA 500, 505 and 620) By Panayiotis Kattides · September 21, 2026 The hardest assertion in a crypto audit is not what you hold. It is that it is yours. Here is how that is actually proven, and what each method does and does not establish. Key takeaways There is no counterparty to confirm a self-custodied wallet, so ownership is proven by demonstrating control of the private key. A signed message is the cleanest method and moves no funds. An instructed transfer is the fallback where signing is not available. Both must be initiated by the auditor. A signature the client produced at a time of its own choosing proves much less. Custodial holdings fall back to third-party confirmation under ISA 505, with the ordinary limitation that it is only as good as the custodian. Every audit of a company holding digital assets reaches the same question, usually within the first fortnight. Management has produced a schedule of wallet addresses and balances. The balances are verifiable by anyone with an internet connection. The ownership is not verifiable at all, at least not from the schedule. This article sets out the three methods that are actually used, what each one proves, where each one fails, and how the result is documented so it functions as audit evidence rather than as a reassuring email. Why a Bank Confirmation Has No On-Chain Equivalent ISA 505 covers external confirmations, and it exists because evidence obtained directly from an independent third party is more reliable than evidence produced inside the entity. For cash, the auditor writes to the bank. The bank has its own records, its own regulator and no interest in helping the client misstate a balance, and it replies directly to the auditor. A blockchain has no such party. The ledger is public and cannot be edited, which is a genuine advantage for the existence assertion, but there is nobody to write to. The chain records that an address holds a balance. It has no concept of who the address belongs to, and it will never tell you, because that information was never on it. So ownership has to be established some other way, and the only meaningful definition of ownership in this setting is control. If you can move the asset, it is yours in every sense an audit cares about. If you cannot, no document saying otherwise is worth much. Method One: The Signed Message The cleanest method. A private key can sign an arbitrary piece of text, producing a signature that anyone can verify against the corresponding public address without ever seeing the key. The auditor supplies the text, the entity signs it with the wallet in question, and the auditor verifies it independently. Two details separate a useful signature from a decorative one. The auditor supplies the text, and it must be unpredictable. In practice it contains the entity's name, the audit period, the date, and often a random string. If the client chooses the wording, a signature produced last year for another purpose can be presented as though it were produced today. It proves control at the moment of signing. A signature obtained in February evidences control in February. Where the audit needs comfort over the reporting date, the signature is read together with the transaction history: an address that the entity demonstrably controls now, and which shows continuous activity consistent with the entity's own records across the period, supports a reasonable conclusion about the reporting date. An address that was emptied in January and signed in April supports considerably less. The method is well supported on Bitcoin and on EVM chains, and nothing moves, which makes it the first choice wherever it is available. Method Two: The Instructed Transfer Where signing is not available, and it often is not with institutional custody platforms, multi-party computation wallets and some multi-signature arrangements, the fallback is to have the entity move a small amount on the auditor's instruction. The auditor specifies the amount, the destination address and the window in which it must happen. The entity makes the transfer. The auditor observes it on-chain. Because all three parameters were chosen by the auditor, the transaction demonstrates that the entity could move funds from that address on demand. The mechanism is only as good as its unpredictability, and this is where it is most often done badly. A transfer the client announces in advance, or makes at a time of its own choosing, or makes to an address it nominated itself, proves substantially less than one made to an auditor-specified destination inside an auditor-specified window. The point of the exercise is that it cannot be arranged in advance. It has real costs. It incurs network fees, it creates a transaction that has to be accounted for, and for cold storage under a serious key-management policy, requiring a transfer may mean convening signatories and opening a procedure the client would prefer to run on its own schedule. Those are reasonable objections, which is why a signed message is preferred wherever the custody setup supports it. Three methods of proving wallet ownership compared Signed message: nothing moves, auditor-initiated, strongest and preferred. Instructed transfer: funds move, auditor-initiated, used where signing is unavailable. Custodian confirmation: used for assets held by a third party, limited by the custodian's own records. Signed message Preferred Funds moved: none Proves: key control Cost: none Fails when the custody platform cannot sign arbitrary text Text set by the auditor Instructed transfer Fallback Funds moved: nominal Proves: ability to spend Cost: fees, an entry Weak if announced, self-timed, or sent to a self-nominated address Parameters set by the auditor Custodian confirmation Custodial only Funds moved: none Proves: a claim on assets Cost: none Only as reliable as the custodian's own records and controls Sent and received directly All three are legitimate. What separates strong evidence from weak is who set the parameters. Method Three: Custodian and Exchange Confirmations Where the assets sit with a third party, neither of the first two methods applies, because the entity does not hold the keys. What it holds is a claim against the custodian, and that is confirmed the ordinary way under ISA 505: a request sent directly to the custodian and a response returned directly to the auditor. The standard's usual cautions apply with some force here. A confirmation is only as reliable as the party providing it, and the crypto custody market ranges from regulated institutions with audited control reports to offshore exchanges whose internal records have never been examined by anyone. A confirmation from the first kind is strong evidence. A screenshot of an account page from the second is not a confirmation at all, and an API key handed to the auditor is better than a screenshot but is still reading the exchange's own display of its own records. Where a custodian has a service organisation control report covering the relevant period, that materially changes what the confirmation is worth, and it is worth asking for. Reading Balances at the Reporting Date Once ownership is settled, balances are the straightforward part, with two details that matter for reproducibility. Record the block, not just the date. A blockchain does not have a midnight. It has blocks. The defensible approach is to fix the last block before the reporting cut-off in the relevant time zone, record its height and timestamp, and read every balance at that height. Anyone can then re-run the same query and get the same answer, which is what makes it evidence rather than an assertion. Include everything the address controls. A native balance is the beginning. Token balances, staked positions, amounts locked in lending protocols, liquidity positions and pending rewards may all be economically the entity's and none of them appear in a naive balance query. Completeness failures here are common and are usually the result of asking a simpler question than the position deserved. Documenting It as Audit Evidence Under ISA 500 ISA 500 requires audit evidence to be sufficient and appropriate, and the practical test on the file is whether someone else could follow what was done and reach the same conclusion. For wallet verification that means recording: The exact message text supplied and who supplied it, with the signature and the verification output. For instructed transfers, the parameters the auditor set, when they were communicated, and the resulting transaction hash. The block height and timestamp at which each balance was read, and the query or tool used. The data source, with a note on why it is considered reliable, since a block explorer is itself a third party. Anything that could not be verified, stated plainly, with the effect on the conclusion. That last point is the one that distinguishes a working paper from a sales document. A file that records two wallets verified by signature, one by instructed transfer, and one custodial balance confirmed only by an unsigned screenshot is far more useful than a file that quietly implies all four were treated the same way. Where ISA 620 Fits None of the above requires the audit firm to build this capability in-house. ISA 620 allows the engagement team to use an auditor's expert where expertise outside accounting and auditing is needed to obtain sufficient appropriate evidence, and the team remains solely responsible for the opinion. In practice the expert performs the verification and the balance reading, and the engagement team evaluates the work: assessing the expert's competence, capability and objectivity, agreeing the scope and nature of the work in writing beforehand, and testing that the findings are consistent with other audit evidence. The file records that evaluation rather than simply attaching the expert's report. This is the most common way we are engaged. The audit firm keeps the client, the engagement and the opinion; we do the on-chain work and hand over papers the file can carry. Details are on our crypto audit support page, and where the engagement is a reserves attestation rather than a full audit, that is proof of reserves . The Short Version Ownership of a self-custodied wallet is proven by demonstrating control, either through a signature over auditor-supplied text or through a transfer made on auditor-set parameters. Custodial positions are confirmed with the custodian, weighted by how much that custodian's records are worth. Balances are read at a recorded block height so anyone can reproduce them. Everything is documented, including what could not be verified. None of this is conceptually harder than auditing a bank balance. It is simply unfamiliar, and unfamiliarity is what turns a three-day procedure into a three-month standoff. How Ondology Labs can help: We are engaged by audit firms as an auditor's expert under ISA 620 and by companies whose auditor cannot test the crypto balances. That is crypto audit support . For exchanges and custodians who need to evidence reserves against customer liabilities, that is proof of reserves , and for the full opinion, statutory crypto audits with our ICPAC-licensed partner. Related reading: Your auditor will not sign off on the crypto balances · How to read a proof of reserves report · Who needs a crypto audit in Cyprus Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # CASP Audit Requirements in Cyprus Under MiCA | Ondology Labs URL: https://ondologylabs.com/blog/casp-audit-requirements-mica-cyprus Description: What a Cyprus CASP must have audited under MiCA: statutory financial statements, Article 67 own funds against fixed overheads, and safeguarding evidence. ← Back to Blog CASP Audit Requirements Under MiCA in Cyprus: Statutory Audit, Own Funds and Safeguarding Evidence By Panayiotis Kattides · September 21, 2026 Most CASPs think of the statutory audit as a filing obligation and the MiCA prudential requirement as a compliance obligation. Article 67 connects them, and firms that run them as separate projects find out in the wrong order. Key takeaways MiCA does not create a separate audit. The Cyprus Companies Law obligation to file audited accounts applies regardless. What MiCA adds is a reader. Article 67 sets own funds at the higher of your class floor and a quarter of the preceding year's fixed overheads, reviewed annually, and that overhead figure comes from audited accounts. Article 70 safeguarding and segregation of client assets is evidenced separately from the audit, but tested against the same records. Only an ICPAC-licensed firm can sign a Cyprus statutory audit, and the register is public. A question we are asked often enough to write down: now that we hold a CASP authorisation, what exactly has to be audited? The answer is less dramatic than most firms expect, and the consequences are larger. MiCA does not impose a new audit regime on crypto-asset service providers. What it does is give the accounts you were already required to file a second reader with a different purpose, and connect one of your continuing authorisation conditions directly to a number inside them. Layer One: The Companies Law Baseline A company registered in Cyprus must prepare annual financial statements, have them audited by a licensed audit firm, and file them with the Registrar of Companies alongside its tax return. This obligation attaches to the company, not to what the company does. Operating a crypto exchange, issuing a token, or running a custody business does not create the obligation and does not exempt you from it. What being a digital-asset business changes is not whether you are audited but what the audit has to examine, and that is where crypto-native firms routinely miss deadlines. The obligation is ordinary; the evidence is not. An auditor testing a bank balance writes to the bank. An auditor testing a wallet balance has nobody to write to, and has to establish control of a private key instead. We have written separately about how that is actually done . Only a firm licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus, may sign a statutory audit here. The register is public, and checking it before engaging anyone is five minutes well spent. On joint engagements we work with CYAUSE Audit Services , who hold the licence and sign the opinion, while we perform the on-chain examination behind the digital-asset balances. Layer Two: Article 67 and the Fixed Overhead Test This is the layer that surprises people, and it is the reason a CASP cannot treat its audit as a back-office formality. Article 67 of Regulation (EU) 2023/1114 requires a CASP to hold prudential safeguards at least equal to the higher of two amounts: the permanent minimum capital set for its class of services, and one quarter of the fixed overheads of the preceding year, reviewed annually. Read that second limb carefully. Your continuing authorisation condition is pegged to a figure derived from last year's cost base, and that figure has to come from somewhere defensible. In practice it comes from your audited financial statements, because that is the only version of your cost base that a third party has examined. Three consequences follow, and all three are avoidable. A growing firm's requirement rises behind it. If you scaled up headcount and infrastructure last year, the fixed overhead quarter computed on that year may exceed the class floor you have been comfortably clearing since authorisation. Firms that never recompute discover this when a supervisor does. A late audit delays a compliance calculation, not just a filing. If the audited accounts are not finalised, the overhead figure supporting your current prudential position is unaudited. That is an uncomfortable position to explain, and it is the point at which an audit stalled on unverifiable crypto balances stops being an accounting problem. Own funds must actually be own funds. Holding the required amount in the same account as operating cash, or in client-facing balances, is a common and entirely avoidable finding. The funds have to be identifiable as own funds, and you have to be able to show it. Layer Three: Safeguarding and Segregation Evidence Article 70 requires a CASP holding clients' crypto-assets, or the means of access to them, to make adequate arrangements to safeguard clients' ownership rights, particularly in the event of the provider's insolvency, and to prevent the use of clients' assets for its own account. This is not an audit requirement and it is not satisfied by the annual audit. It is a continuing operational state, which means the question a supervisor asks is not whether you were segregated at the reporting date but whether you were segregated throughout. A single year-end snapshot answers the first question and not the second. What holds up, in our experience, is a documented mapping of which addresses hold client assets and which hold the firm's own, verification of control over both sets, a reconciliation of on-chain client holdings to the internal client balance ledger at a regular cadence, and a record of exceptions and how they were resolved. Because the audit examines the same wallets and the same movements, the sensible arrangement is to build this once and let both obligations draw from it. Running them separately produces two descriptions of the same year that rarely agree in every detail, and explaining the difference is an expensive way to spend an inspection. The timing is live. ESMA's Common Supervisory Action on CASPs' digital operational resilience in relation to custody activities runs from the second half of 2026 into the first half of 2027, and CySEC communicated it to Cyprus firms by circular in August 2026. Custody arrangements are the focus of supervisory attention right now. What CySEC Reads in Your Audited Accounts A supervisor does not read financial statements the way a shareholder does. The specific things a CASP's accounts are read for: The fixed overhead base feeding the Article 67 calculation, and whether the classification of costs as fixed is reasonable. Whether client assets appear on your balance sheet , and whether the accounting treatment is consistent with the segregation you claim operationally. The audit opinion itself. A qualification or a disclaimer over digital assets is a direct statement that your holdings could not be independently verified, which is awkward for a firm whose authorisation rests on safeguarding those holdings. Going concern. A CASP that cannot fund its own wind-down is a supervisory problem before it is a commercial one, which is why Article 74 requires a wind-down plan at all. Related party transactions , particularly any movement of assets between the firm, its owners and connected entities. Asset-Referenced and E-Money Token Issuers If you issue an asset-referenced token or an e-money token, there is a further layer. The reserve backing the token is subject to its own requirements on composition, custody and segregation from the issuer's assets, and it must be capable of meeting redemption at par. Establishing that is a distinct exercise from the statutory audit: it examines whether the reserve exists, whether it is held where the issuer says and under the issuer's control, whether its composition matches the commitment in the whitepaper, and whether it covers tokens actually in circulation rather than tokens issued on paper. That work is proof of reserves and reserve of assets , and it typically runs on a far shorter cycle than an annual audit. A Timeline for a Newly Authorised CASP The first supervised year is the one where most of the avoidable problems are created, usually by treating the licence as the end of a project rather than the start of a cycle. On authorisation. Establish the wallet inventory separating client from own assets, and prove control of both sets while the people and keys are current. First quarter. Set the reconciliation cadence between on-chain client holdings and the client balance ledger. Monthly is defensible; annual is not. Before year-end. Reconcile the year to date, so the audit starts from tied records rather than a reconstruction project. At the reporting date. Capture balances at a recorded block height, with custodian confirmations requested in parallel. On signing the accounts. Recompute the Article 67 requirement against the newly audited fixed overheads, and document the result before anyone asks for it. The Checklist Is your auditor ICPAC-licensed, and have you checked the register rather than taken it on trust? Can your auditor independently verify the digital-asset balances, or have they told you they cannot? Do you know your current Article 67 requirement, computed on the latest audited fixed overheads? Are own funds held separately and identifiably, rather than mixed with operating cash? Can you produce last quarter's client asset segregation evidence today, without rebuilding it? If you issue an ART or EMT, when was the reserve last examined by someone independent? A firm that can answer all six has a supervisory conversation that is short. The gap between authorisation and the first real supervisory contact is the cheapest time to close them, and it is the window most firms spend on something else. How Ondology Labs can help: Statutory audits for Cyprus CASPs run through statutory crypto audits with CYAUSE Audit Services, our ICPAC-licensed partner, who issue the opinion while we verify the chain behind it. Pre-authorisation gap work is MiCA readiness , the post-authorisation cycle is MiCA ongoing compliance , and reserve examinations are proof of reserves . Related reading: MiCA obligations after authorisation · MiCA authorisation in Cyprus · Who needs a crypto audit in Cyprus Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # 2027 CASP Compliance Calendar for Cyprus | Ondology Labs URL: https://ondologylabs.com/blog/mica-obligations-after-authorisation-compliance-calendar Description: The 2027 compliance calendar for a CySEC-authorised CASP, date by date: AML reports, DORA, DAC8, CySEC fees, plus the continuing MiCA obligations by cadence. ← Back to Blog MiCA Obligations After Authorisation: The 2027 CASP Compliance Calendar By Panayiotis Kattides · September 21, 2026 · Updated October 13, 2026 A licence is granted against arrangements you described. Supervision tests whether those arrangements are still running. The gap between the two opens quietly, and almost always in the first year. Key takeaways MiCA's continuing obligations for CASPs sit in Articles 66 to 74 and apply from the day the licence is granted, not from the first inspection. Article 69 requires notifying changes to the management body before new members act, not at the next convenient reporting date. Article 67 own funds are reviewed annually against the preceding year's fixed overheads, which ties your prudential position to your audited accounts. The test of whether your cycle is real: could you produce last quarter's safeguarding evidence today, without rebuilding it? The 2027 Calendar, Date by Date The fixed dates for a CySEC-authorised CASP in 2027, assuming a 31 December financial year end. Every date below comes from the regulation, directive, or circular linked beside it; where CySEC has not yet set the 2027 date, the row says so. Fixed 2027 deadlines for a crypto-asset service provider authorised by CySEC, as published by 13 October 2026. 2027 date What is due To whom Source 1 January DAC8: tax self-certifications collected from users whose accounts existed before 2026 Internal due diligence DAC8, Annex VI 15th of every month AML Monthly Prevention Statement for the previous month CySEC CySEC AML Directive, para 11 28 February Compliance officer’s annual AML report to the board Board AML Directive, para 10(2) 28 February DORA register of information, reference date 31 December, in XBRL-CSV. A Sunday in 2027, and CySEC allows no roll-over CySEC DORA Art. 28(3); CySEC circular 31 March, at the latest Compliance officer’s annual report and the board minutes, within 20 days of the board meeting CySEC AML Directive, para 10(3); Circular C655 30 April, at the latest Internal auditor’s AML report and the board minutes, within 20 days of the board meeting CySEC AML Directive, para 6 30 April Annual supervision fee: a fixed part per service plus a share of crypto-service revenue, capped at €500,000 CySEC Directive DI 73-2009-04, para 6(3) Spring, date set by circular Statistical return RBSF-CASP (8 May in 2026) and the AML sectoral risk assessment form (17 April in 2026). 2027 dates not yet announced CySEC Circular C771 ; C763 30 June First DAC8 report, covering calendar year 2026 Cyprus Tax Department Law 38(I)/2026 1 to 15 September DORA self-categorisation form for the annual ICT oversight fee CySEC Circular C731 30 November DORA annual ICT oversight fee paid CySEC Directive DIR73-2009-07 Proposed, not yet in force. A December 2025 CySEC consultation proposes periodic Article 67 prudential returns, quarterly for class 2 and 3 CASPs (by 11 February, 12 May, 11 August and 11 November) and annual for class 1, plus audited financial statements within four months of the year end. As of 13 October 2026 the directive had not been adopted. Read the consultation paper . Due on events, not dates. Changes to the management body are notified before the new member acts (MiCA Article 69). A major ICT incident needs an initial report within 4 hours of classification and no later than 24 hours after you become aware of it, an intermediate report within 72 hours, and a final report within a month (DORA Article 19, CySEC Circular C700 ). And custody clients receive a statement of position at least once every three months (MiCA Article 75). For what each fee costs, see our MiCA licence cost breakdown . Authorisation projects have a shape. There is a deadline, a visible goal, external counsel, a board that pays attention, and a moment when the licence arrives and everyone is relieved. Then the project team returns to its day jobs, the external advisers close their files, and the arrangements described in the application carry on running, unexamined, for somewhere between one and three years. What replaces the project is a cycle, and in most newly authorised firms nobody has written it down. This article is an attempt at that document: the continuing obligations under Regulation (EU) 2023/1114 , arranged by how often they actually fall due rather than by article number. One caveat before the calendar. The cadences below that come from the regulation are stated as the regulation states them. Cadences for a national supervisor's own periodic returns are set by circular and change, so confirm the current ones with your compliance function rather than working from any article on the internet, including this one. CASP continuing obligations by cadence Four bands. Continuous: safeguarding and segregation, conduct, conflicts. Monthly or quarterly: client asset reconciliation, complaints log, supervisory returns. Annual: own funds against fixed overheads, governance and suitability review, outsourcing register, wind-down plan. Event driven: management body changes, material changes, incidents, supervisory requests. Continuous Safeguarding and segregation of client assets (Art 70) · honest, fair and professional conduct (Art 66) · conflicts identified and disclosed (Art 72) Monthly or quarterly Client holdings reconciled to the client balance ledger · complaints logged and resolved (Art 71) · supervisory returns on the cadence CySEC sets Annual Own funds recomputed against last year's fixed overheads (Art 67) · governance and management body suitability reviewed (Art 68) Outsourcing arrangements reviewed (Art 73) · wind-down plan refreshed (Art 74) · audited financial statements filed Event driven, without delay Management body changes before new members act (Art 69) · material changes to authorisation conditions · incidents · supervisory requests Article references are to Regulation (EU) 2023/1114. Supervisory return cadences are set nationally by circular. Day One After the Licence Three things are worth doing in the first fortnight, while the application file is still fresh in everyone's memory and the people who built it are still reachable. Write down what you actually told them. The application described specific arrangements: how client assets are segregated, who is on the management body, which functions are outsourced, how complaints are handled. That description is now the standard you are measured against. Extract it into a register of commitments, because in eighteen months nobody will remember what was in an annex. Assign every obligation an owner. Not a department. A person, with a named deputy. The most common failure mode we see is an obligation that everyone assumed belonged to someone else, discovered during an information request. Prove wallet control now. Control is demonstrable in the present tense and not retrospectively. Establishing it while the current keys, custodians and staff are in place costs very little; reconstructing it after a key rotation and a departure may be impossible. Continuous: The Obligations That Never Fall Due Some obligations have no date attached because they describe a standing state. Article 70 safeguarding is the important one: client assets must be segregated and their ownership protected, including in the event of your insolvency, and client assets must not be used for your own account. The practical implication is that evidence has to be produced periodically even though the obligation is continuous. A supervisor asking about segregation is not asking about the reporting date. They are asking about a period, and a firm that took one snapshot at year-end cannot answer. This is the single biggest difference between how firms think about this obligation and how it is tested. Monthly or Quarterly: The Reconciliation Cadence The recurring work is mostly reconciliation. On-chain client holdings matched against the internal client balance ledger, differences investigated and resolved, exceptions logged with their cause and resolution. The argument for a short cycle is not regulatory purity, it is cost. A break found this month is explainable, because the person who caused it is still here and still remembers. The same break found eleven months later is an investigation. Firms that reconcile monthly spend less in total than firms that reconcile annually, which is counterintuitive until the first year-end reconstruction. Complaints handling under Article 71 belongs in the same rhythm. Supervisors ask for the complaints log early in an inspection, because it is a cheap and reliable indicator of whether a firm's procedures exist in practice. An empty log is not automatically good news; it usually prompts a question about whether complaints are being recognised as complaints. Annual: The Review That Should Not Be a Formality Own funds. Article 67 requires prudential safeguards at the higher of your class floor and a quarter of the preceding year's fixed overheads, reviewed annually. The review is explicit in the article, and the overhead figure comes from audited accounts, which is why a stalled audit becomes a compliance problem rather than an accounting one. If you grew last year, recompute before assuming the floor still governs. Governance and suitability. Article 68 covers governance arrangements and the requirement that the management body have appropriate knowledge, skills and experience and be of good repute. Suitability is not assessed once at authorisation and then assumed to persist. Circumstances change, and the assessment should be redone and minuted rather than inherited. Outsourcing. Article 73 requires that outsourcing does not impair the quality of internal control or the supervisor's ability to monitor compliance. Crypto firms outsource a great deal, often to providers chosen quickly during build-out, and the register drifts. An annual review of what is outsourced, to whom, under what contract, and with what monitoring is usually where the surprises are. Wind-down. Article 74 requires a plan for orderly wind-down. Written once and never revisited, it describes a business that no longer exists. Event Driven: The Ones With No Warning Article 69 is explicit and it is the obligation most often missed. A CASP must notify its competent authority without delay of any changes to its management body, before any new member exercises activities, and provide the information needed to assess suitability under Article 68. Read the sequencing: the notification comes before the person starts, not at the next reporting date and not once their appointment is confirmed internally. A director who joined in March and was notified in June created a breach that runs for three months and is trivially visible from your own board minutes. Material changes to the conditions on which authorisation was granted follow the same principle: new services, a changed custody model, outsourcing a critical function, a change in qualifying shareholdings. When in doubt, the cost of an unnecessary notification is an email, and the cost of a missed one is a finding. Who Owns What A boundary worth stating plainly, because it is routinely blurred by service providers. The board owns the arrangements and signs off that they work. This cannot be delegated outward. The compliance officer and the MLCO are appointed roles assessed by the supervisor, carrying personal accountability. They cannot be contracted out to a firm, and anyone offering to be your outsourced compliance officer is describing something that does not exist. Legal counsel owns interpretation and the filings. An evidence provider produces the verification, reconciliation and review documentation the compliance function relies on. That work can be outsourced, subject to Article 73. We are in the fourth category, which is why our MiCA ongoing compliance page says plainly what we do not do. One Test If you want a single question to judge whether your cycle is real rather than nominal, it is this: if CySEC asked today for last quarter's client asset segregation evidence, could you produce it, or would you have to rebuild it? Firms that can produce it have a short, unremarkable supervisory relationship. Firms that rebuild it discover during the rebuild what else has drifted, on a deadline, in front of an audience. The difference between the two is not diligence or headcount. It is whether the evidence is generated on a cadence or on request. How Ondology Labs can help: We run the recurring evidence cycle underneath your compliance function: annual reviews, safeguarding and segregation verified on-chain, Article 67 evidence reconciled to audited accounts, and responses to supervisory requests. That is MiCA ongoing compliance . If you are not yet authorised, start at MiCA readiness . The AML side is AML and compliance audits , and the reporting side is DAC8 and tax reporting . Related reading: CASP audit requirements under MiCA in Cyprus · MiCA authorisation in Cyprus · AML audit readiness for crypto firms in Cyprus Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # What a Crypto Audit Costs in Cyprus | Ondology Labs URL: https://ondologylabs.com/blog/crypto-audit-cost-cyprus Description: Why nobody quotes a crypto audit fee up front, the four factors that actually drive it, and the things you can do to bring the number down. ← Back to Blog What a Crypto Audit Costs in Cyprus (and What Drives the Fee) By Panayiotis Kattides · September 21, 2026 The honest answer to what a crypto audit costs is that it depends almost entirely on the state of your records, and that the same engagement can differ by a multiple between two firms of identical size. Key takeaways The biggest driver is not your size. It is whether your ledger already ties to the chain. Wallet and chain count drives effort more than transaction volume does. Ten thousand transactions across one chain is easier than two hundred across nine. Custody model matters: self-custody can be proven cryptographically, offshore exchange positions often cannot be confirmed well at all. Three different engagements get called "a crypto audit" and they differ in cost by an order of magnitude. Establish which one you need first. We are asked for a number on most first calls, and we decline on most first calls, which is unsatisfying for everyone. This article explains what sits behind that, because understanding the fee drivers is genuinely useful: three of the four are inside your control, and acting on them before you ask for a quote changes the quote. Why Nobody Quotes on the First Call Not evasion, and not a negotiating tactic. The variance is simply enormous. Two companies can look identical from outside. Same headcount, same balance sheet, same business model. One has a maintained wallet register, a monthly reconciliation and a documented valuation policy. The other has assets across nine chains, a register that was last updated when the CFO before this one left, and a year of history that has never been tied to anything. The audit work in the second case can be several times the first, and there is no way to tell which you are from the outside. A firm that quotes a fixed fee before scoping is either padding heavily to cover the downside, or is about to come back with a variation once it discovers what it took on. Neither is a good start. What we do instead is a short scoping exercise, mostly a conversation and a look at your wallet inventory, and then a fixed fee for the work that exercise revealed. Driver One: The State of Your Reconciliation This is the dominant factor and it is worth more than the other three combined. If your ledger already agrees with the chain, the auditor's job is to test a reconciliation that exists. If it does not, someone has to build it first, and that someone cannot be the auditor, because an auditor who prepares your records cannot express an independent opinion on them. So it becomes a separate transaction reconciliation engagement that has to complete before the audit can meaningfully start. Three rough states, in ascending order of cost: Reconciled monthly, breaks investigated. The audit tests what exists. Cheapest, and the gap to the next state is wider than most people expect. Reconciled at year-end only. Twelve months compressed into one exercise, with staff turnover in between and transactions nobody present can explain. Materially more expensive, and some items end up estimated rather than proven. Never reconciled. A reconstruction project, priced as one. This is also where an audit is most likely to end in a qualification, because some of what is missing cannot be recovered at any price. If you do one thing after reading this, reconcile the year to date before you ask anyone for a fee. The four drivers of a crypto audit fee and how much each moves it Reconciliation state has the largest effect on fee and is within your control. Wallet and chain count has a large effect and is partly within your control. Custody model has a moderate effect and is partly within your control. Entity and regulatory layer has a moderate effect and is largely fixed. Driver Effect on the fee Yours to change Reconciliation state Yes Does the ledger already tie to the chain? Wallet and chain count Partly Nine chains cost more than nine thousand transactions Custody model Partly Self-custody is provable; a weak exchange often is not Entity and regulatory layer Rarely A CASP audit carries evidence a private company's does not Bar length is the relative effect on effort, not a price. The point is that the largest driver is the one you can fix. Driver Two: Wallet and Chain Count Counterintuitive for anyone who thinks in terms of transaction volume: ten thousand transactions on a single chain is a cheaper audit than two hundred transactions across nine chains. Volume scales with tooling. Breadth does not. Each additional chain brings its own address formats, its own data sources with their own reliability, its own token standards, its own conventions for what a transaction even is, and its own edge cases around staking, wrapping and bridging. Each additional wallet is another control assertion to test. Bridges are the worst of it, because a bridged movement is two transactions on two chains that have to be identified as one economic event, and nothing on either chain says so. The lever here is real but only forward-looking: consolidate. Firms that reduce from fourteen wallets to five, or retire a chain they no longer trade, pay less in every subsequent year. It does nothing for the year already behind you. Driver Three: Custody Model How you hold assets determines what can be proven and how cheaply. Self-custody is, perhaps surprisingly, the cheapest to evidence. Control can be proven cryptographically with a signed message, the balance is public, and the whole exercise is fast. Institutional custody with a reputable provider is straightforward: a direct confirmation, and where the custodian has a service organisation control report, the confirmation carries real weight. Exchange-held balances vary enormously. A regulated venue that responds to confirmation requests is fine. An offshore exchange that will not respond to anyone, where the best available evidence is an API read of the exchange's own display of its own records, is a problem no amount of fee solves. Firms are sometimes surprised that this is the item that qualifies an opinion rather than the complicated DeFi position. Multi-signature and MPC sit in between: provable, but sometimes only by instructed transfer rather than signature, which takes coordination. Driver Four: Entity Type and Regulatory Layer A private company holding treasury crypto needs the balances verified and the accounting right. An authorised CASP needs that plus the evidence its supervisor reads: client asset segregation, the Article 67 own funds position computed against audited fixed overheads, and safeguarding arrangements that hold across the period rather than at a snapshot. We have set that out in full in CASP audit requirements under MiCA in Cyprus . An ART or EMT issuer adds reserve examination on top. A fund adds investor reporting and valuation scrutiny. This driver is mostly not yours to change, but it should be established on the first call, because it determines which of three quite different engagements you are actually buying. Three Things Called "A Crypto Audit" A great deal of confusion about price comes from the word covering three engagements that differ by an order of magnitude. Crypto audit support . Your existing auditor keeps the engagement and the opinion; we perform the on-chain examination and hand over working papers. Narrowest scope, lowest cost, and the right answer when the audit is only stuck on the digital assets. Proof of reserves . A targeted attestation about assets and customer liabilities at a point in time. Priced per cycle and usually run several times a year, so the annual cost depends on frequency. A statutory audit . An opinion on the whole entity, issued under audit standards by a licensed firm. The broadest scope and the highest cost, and the only one that satisfies the Registrar of Companies. Firms sometimes arrive asking for the third when the first would resolve their actual problem, and occasionally the reverse. Establishing which one you need is the single most useful thing a first call can achieve. How to Bring the Number Down In rough order of impact: Reconcile before you ask. The largest lever by a wide margin, and it is entirely yours. Produce a complete wallet and account inventory. Cheap for you, expensive for anyone else, and it is the first thing every engagement needs. Prove control while you can. Signatures obtained today are cheap; reconstructing control after a key rotation may be impossible at any price. Consolidate wallets and retire dormant chains. Pays back every year after this one. Write down your valuation policy. Source, time of day, treatment. One page that prevents a recurring argument. Move off custodians who will not confirm. The most uncomfortable item on this list and occasionally the decisive one. Engage earlier in the year. Work done in October is cheaper than the same work in February, because evidence is still available and nobody is working to a filing deadline. A firm that does the first three typically finds the eventual fee unremarkable, in the way that audit fees for conventional businesses are unremarkable. A firm that does none of them is not really buying an audit. It is buying a reconstruction of its own financial history, with an opinion at the end, and that is a different product at a different price. How Ondology Labs can help: We scope up front and quote a fixed fee once we understand the wallets, chains and volumes involved. Depending on what the scoping finds, that is crypto audit support , transaction reconciliation first, or a full statutory crypto audit with our ICPAC-licensed partner. All of it starts on our crypto audit services page. Related reading: Your auditor will not sign off on the crypto balances · Who needs a crypto audit in Cyprus · Best crypto accounting tools compared Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # Best Crypto Accounting Tools 2026: Benchmark | Ondology Labs URL: https://ondologylabs.com/blog/best-crypto-accounting-tools-comparison-2026-benchmark Description: Bitwave, Cryptio, Tres Finance, Lukka, Breezing, SoftLedger, Ledgible and Cryptoworth compared on chains, ERP sync, audit credentials and price, plus where an independent audit firm fits. ← Back to Blog Best Crypto Accounting Tools Comparison (2026 Benchmark) By Iraklis Anastasiou · September 21, 2026 · Updated September 21, 2026 The regulation of the cryptocurrency ecosystem has crossed an irreversible threshold. Corporate treasuries holding Bitcoin, as well as other blockchain-denominated digital tokens, DeFi protocols managing decentralized balance sheets, and traditional financial institutions entering Web3 can no longer rely on manual spreadsheets or generic accounting software. The catalyst is a synchronized, transatlantic legislative overhaul that has transformed crypto bookkeeping from an operational afterthought into a strict legal mandate. The CLARITY Act would have settled US market structure by splitting oversight between the SEC for securities and the CFTC for digital commodities , but the Senate cloture vote failed in September 2026 . The evidentiary burden has not gone away with it. US broker-dealers, spot exchanges, and token issuers still have to deploy high-fidelity subledgers capable of proving exact asset provenance, real-time cost basis, and segregated customer custody to federal examiners. What did become law is narrower. The GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act) now imposes rigorous 1:1 reserve backing , mandatory public disclosures, and routine audit requirements on payment stablecoin issuers. The broader market structure bill stalled, so while targeted guardrails like the GENIUS Act manage stablecoin reserves, the US digital asset market remains without a durable statutory framework. Without legislative safe harbors, American crypto businesses must brace for continued "regulation by enforcement" from federal agencies. Across the Atlantic, the European Union is tightening the vise on institutional data integrity. Beyond the baseline requirements of the Markets in Crypto-Assets (MiCA) directive, financial entities handling digital assets are now bound by the digital operational resilience act (DORA). DORA mandates severe IT risk management, third-party software vetting, and data continuity controls, meaning the software a firm uses to track on-chain assets must meet bank-grade security standards. Furthermore, as tokenized traditional assets proliferate, compliance with MiFID II requires meticulous best-execution reporting, trade transparency, and client fund segregation that legacy systems simply cannot compute. To navigate these overlapping, multi-jurisdictional compliance minefields, alongside global tax mandates like the OECD's CARF and the EU's DAC8, financial officers require robust software platforms and professional auditing services. The mandate is clear: translate high-volume, fragmented on-chain transactions into audit-ready financial statements compliant with US GAAP and IFRS . This benchmark report compares the leading digital asset accounting engines, subledgers, general ledgers, and audit solutions available to enterprise finance teams operating in this new regulatory reality. Architectural & Functional Comparison Matrix How we compiled this, and our interest in it. Figures were taken from each vendor's own published material in September 2026. Where a vendor publishes pricing we link to that page; where pricing is quote-based, the range shown is indicative, drawn from third-party reporting rather than the vendor, and should be treated as a starting point rather than a quote. Certifications are as claimed by each vendor. Ondology Labs appears in this comparison as an audit provider rather than a software vendor, so read our own row with that interest in mind, and verify current figures with each vendor before you decide. Digital asset accounting platforms compared on positioning, chain coverage, ERP sync, audit credentials and price, September 2026. Platform Core Focus & Positioning Supported Chains / Sources General Ledger / ERP Sync Regulatory & Audit Credentials Primary Price Point Bitwave Enterprise Subledger & B2B Payments 80+ Blockchains NetSuite (SDN Partner), QuickBooks, Sage Intacct, Xero, Oracle Cloud, MS Dynamics SOC 1 Type 2, SOC 2 Type 2; Deloitte & RSM Alliances Quote-based, indicatively $80K–$500K+/year Cryptio Regulated Institutional Subledger 150+ Blockchains & Custodians Native ERP Sync (NetSuite, SAP, Xero, custom exports) SOC 1 & SOC 2 Type 1 & 2 (PwC Audited) Quote-based, indicatively $60K–$400K/year Tres Finance Multi-Chain Institutional Reconciliation 220+ Networks & Banks General ERP Sync & custom financial exports SOC 1 & SOC 2 Data Quality Standards Quote-based enterprise Lukka Institutional Data Infrastructure 100+ Chains, 500+ Exchange Sources NetSuite, SAP, financial data pipelines SOC 1 & SOC 2; SAB 122 & MiCA aligned Quote-based enterprise Breezing SMB & Accounting Firm Subledger 58 Blockchains, 17 Exchanges Direct sync with Xero, QuickBooks Online, Bexio SOC 2 Type II; Swiss Made Software $29–$2,917/month , published SoftLedger Full Native General Ledger (GL) GL-focused (API ingest for crypto add-on) Native GL (replaces external accounting software) SOC 1 Type II $13,500/year base , published Ledgible Tax Professionals & Regulatory Reporting Multi-chain (SOC-certified platform) NetSuite, Xero, QuickBooks, UltraTax CS, GoSystem SOC 1 & SOC 2 Type 2; CARF & DAC8 engine $49–$199+/yr (Indiv) to Enterprise Cryptoworth High-Fidelity Subledger for DAOs & DeFi 1,000+ Integrations claimed NetSuite, Sage Intacct, QuickBooks SOC-certified security claimed Quote-based enterprise Ondology Labs Independent Audit & DAC8/MiCA Services Major chains (On-demand forensic data ingest) Non-software model (Outputs ISA working papers & reports) ICPAC-Licensed Statutory Partner; ISA 500/620 compliant Engagement-based pricing A tool produces the numbers. It does not get them signed off. None of the platforms above proves to an auditor that the wallets belong to you, or that the ledger agrees with the chain. If your auditor is asking for that evidence, our crypto audit support provides it. If the subledger and the chain already disagree, start with transaction reconciliation . Either way, tell us what your auditor needs and we will scope it. Enterprise Subledgers & Multi-Chain Reconciliation Bitwave: Deep Enterprise & ERP Integration Bitwave is built for US-headquartered enterprises, publicly traded entities, and middle-market corporations with complex ERP requirements. As an official Oracle NetSuite SuiteCloud Developer Network (SDN) partner, it offers native, automated synchronization with enterprise general ledgers. Bitwave excels in handling intricate smart contract interactions, indexing over 50,000 DeFi protocols, and providing B2B stablecoin invoicing via integrations such as the Canton Network. Strengths: Dual SOC 1 Type 2 and SOC 2 Type 2 certifications, strategic alliance with Deloitte, and advanced stablecoin payment rails. Considerations: Highest entry barrier, with annual subscriptions typically ranging between $80,000 and $500,000 plus implementation fees. Cryptio: Audit-Grade Institutional Compliance Cryptio focuses on regulated financial institutions, digital asset funds, and crypto-native enterprises requiring high data integrity. Utilizing node-based indexing directly from raw blockchain data, Cryptio mitigates the risk of third-party API discrepancies. Its internal controls were audited by PwC, making its subledger data readily acceptable to Big Four auditors. Strengths: SOC 1 and SOC 2 Type 2 audited by PwC, multi-inventory virtual segregation, and robust coverage across 150+ blockchains and custodians. Considerations: Less extensive automated DeFi workflows compared to Bitwave. Tres Finance: Network Breadth & Automated Reconciliation Tres Finance stands out for its coverage across 220+ Web3 networks, centralized exchanges, and banking sources. Designed to solve multi-chain accounting fragmentation, Tres implements a triple-verified reconciliation engine to match wallet balances against General Ledger entries automatically. Strengths: Unmatched chain breadth, strong audit trail documentation, and asset management portfolio reporting. Considerations: Enterprise pricing requires sales consultation. Specialized Infrastructure, General Ledgers, and Tax Solutions Lukka: Institutional Valuation & Data Infrastructure Lukka transitioned its focus to providing enterprise-grade financial data infrastructure. Processing over 10 billion daily trading ticks across 27 price-discovery exchanges, Lukka acts as an institutional reference-data layer for valuation, automated variance reconciliation, and regulatory compliance (including SEC SAB 122 and MiCA). Strengths: Unrivaled institutional pricing engine and pre-configured regulatory report templates. Considerations: Operates as a data infrastructure layer rather than a full turnkey accounting subledger. SoftLedger: The Full General Ledger Solution Unlike subledger solutions that sit between the blockchain and an external accounting system (like QuickBooks or NetSuite), SoftLedger is the general ledger. It features real-time multi-entity consolidation, intercompany elimination entries, and a multi-dimensional general ledger where digital assets are tracked directly inside the core accounting system. Strengths: Eliminates the need to maintain separate accounting software; includes multi-entity consolidation out-of-the-box. Considerations: Requires migrating the entire financial stack to SoftLedger. Breezing: Modern SMB & Mid-Market Subledger Breezing targets small-to-midsize businesses, Web3 startups, and accounting agencies using Xero, QuickBooks Online, or Bexio. It publishes full pricing tiers, from $29 per month to $2,917 per month, with unlimited wallet connections and user seats across all tiers. Only Breezing and SoftLedger publish figures at all; every other platform here is quote-based. Strengths: Transparent pricing, SOC 2 Type II certified, Swiss data protection standards, and direct invoice/bill matching without dummy clearing accounts. Considerations: Focused on 58 core blockchains; not designed for heavy NetSuite/SAP enterprise deployments. Ledgible: Regulatory Tax Engine (CARF & DAC8) Ledgible bridges crypto activity with professional tax software systems, including Thomson Reuters UltraTax CS and GoSystem Tax RS. Its categorization engine natively handles Form 1099-DA compliance in the United States alongside global CARF and European DAC8 reporting standards. Strengths: Specialized tax compliance engine for CPAs, tax practitioners, and enterprise compliance desks. Considerations: Primary focus is tax compliance and regulatory reporting rather than deep operational inventory management. Cryptoworth: DeFi Subledger Precision Cryptoworth targets DAOs, Web3 projects, and high-frequency DeFi funds needing granular cost-basis calculation across decentralized liquidity pools, staking contracts, and cross-chain bridges. Strengths: High-fidelity inventory tracking across claims of over 1,000 integrations. Considerations: Requires specialized setup for non-standard DeFi contracts. Professional services versus software A key structural distinction in digital asset accounting is the division between continuous software subledgers (Bitwave, Cryptio, Tres, etc.) and independent audit/attestation services. Ondology Labs operates as a specialized audit and compliance advisory firm headquartered in Cyprus. Rather than acting as a continuous SaaS subledger, Ondology Labs provides point-in-time independent financial statement audit support, Proof of Reserves attestations, DAC8 tax reporting packs, and MiCA regulatory evidence for European CASPs. By working directly from public chain data and cryptographic key signatures, Ondology Labs generates audit working papers designed for reliance under International Standards on Auditing (ISA 500 and ISA 620) and issues statutory audit opinions via its ICPAC-licensed partner firm. For many regulated entities, the ideal operational posture involves deploying a SaaS subledger like Bitwave or Cryptio for daily bookkeeping, while engaging a firm like Ondology Labs for year-end statutory audits, Proof of Reserves verification, and regulatory filings. The decision path below applies to any CASP, EMI or institution holding crypto assets, whatever its operating jurisdiction. Strategic Evaluation Matrix Which platform fits which requirement, by decision metric. Decision Metric Primary Driver Benchmark Winner / Best Fit Native General Ledger Need a single platform to replace existing accounting software entirely. SoftLedger Tres Finance Enterprise ERP Alignment Require seamless, co-developed NetSuite integration and US enterprise workflows. Bitwave Cryptoworth Audit-Grade Verification Require PwC-audited data pipelines for strict institutional and fund auditing. Cryptio Maximum Chain Coverage Operating across non-EVM, exotic, or emerging Layer-1/Layer-2 networks. Tres Finance Cryptoworth Valuation Data Engine Require tick-by-tick pricing infrastructure and SEC SAB 122 compliance data. Lukka SMB Cost Efficiency Seeking low, published monthly pricing with direct Xero/QuickBooks synchronization. Breezing SoftLedger Tax & Global Regulatory Need specialized Form 1099-DA, CARF, and European DAC8 tax compliance engines. Ledgible Independent Statutory Audit Require ICPAC-licensed statutory opinions, Proof of Reserves, DAC8 integrations, or MiCA attestations. Ondology Labs Selecting the appropriate digital asset accounting architecture depends on three factors: entity size, existing ERP infrastructure, and jurisdictional regulatory exposure. For US Enterprises & NetSuite Users: Bitwave remains the premier choice due to its direct SuiteCloud Developer Network integration, robust controls, and B2B stablecoin features. For Global Regulated Institutions & Funds: Cryptio and Tres Finance provide superior node-level data validation and multi-chain reconciliation tailored for institutional audit scrutiny. For Mid-Market & Web3 SMBs: Breezing delivers an unmatched value proposition with transparent pricing, zero user-seat caps, and simple Xero/QuickBooks integration. For Statutory Compliance & Audits: Software tools handle day-to-day transaction flows, but firms subject to Europe's MiCA directive or global DAC8 mandates should pair their subledger with specialized auditing firms like Ondology Labs to ensure cryptographic proof of reserves and audit-ready working papers. The era of managing corporate digital asset holdings through unverified spreadsheets or improvised software patches has given way to a supervised reporting framework. As legislative frameworks like the GENIUS Act and CLARITY Act in the United States, alongside MiCA, DORA, MiFID II, and DAC8 in the European Union, enforce strict institutional standards, software selection has become a strategic risk-management mandate. For enterprise CFOs and controllers, the key to navigating this landscape lies in aligning organizational complexity with the right technology stack. High-volume corporations requiring deep Oracle NetSuite integration will find their benchmark in Bitwave . Regulated institutions prioritizing audit-grade chain index integrity will lean toward Cryptio or Tres Finance . Organizations replacing their core GL entirely can leverage SoftLedger , while growing SMBs on Xero or QuickBooks gain a clear, cost-effective path via Breezing . Crucially, software platforms only provide half the equation. As statutory audits, Proof of Reserves, and regulatory filings draw unprecedented scrutiny from auditors and tax authorities, pairing continuous subledgers with specialized independent audit partners like Ondology Labs ensures that multi-chain data stands up under full regulatory examination. In 2026 and beyond, financial compliance is no longer just a cost center, it is the baseline for institutional credibility in Web3. How Ondology Labs can help: A subledger produces the numbers, but somebody still has to attest to them. We deliver statutory crypto financial statement audits with CYAUSE Audit Services, our ICPAC-licensed audit partner, provide crypto audit support as the technical experts for audit firms and in-house finance teams, run proof of reserves engagements , prepare DAC8 reporting packs , and assemble MiCA readiness evidence for European CASPs. Where the subledger output and the chain disagree, transaction reconciliation is how we close the gap. This comparison is general information based on publicly available vendor material, not a recommendation or professional advice for any specific situation. Related reading: Crypto audits in 2026: the new standard · How to read a proof of reserves report · Crypto reporting obligations in Cyprus . · What a crypto audit costs in Cyprus Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Institutional Stablecoins: Banks Tokenize Fiat | Ondology Labs URL: https://ondologylabs.com/blog/institutional-stablecoins-banks-tokenize-fiat Description: Twenty-one global banks plan a 2027 dollar token while Revolut, ODDO BHF and Bancomat issue MiCA-compliant euro stablecoins. What it means for treasurers. ← Back to Blog The Institutional Stablecoin Avant-Garde: Banks and Fintechs Tokenize Fiat By Iraklis Anastasiou · September 7, 2026 Since their emergence in 2014, stablecoins, which have surpassed $200 billion in circulation, have operated primarily as the liquidity lifeblood of crypto speculation, dominated by non-bank issuers operating on the fringes of the global banking system. However, as 2026 unfolds, a profound structural transformation is underway. Stablecoins have historically been structured to compose of fiat currency , commodity, or other cryptocurrencies. The era of non-bank monopoly over digital dollars and euros is drawing to a close. In its place, an institutional avant-garde, composed of Tier-1 global lenders, licensed fintech scale-ups, and century-old private banks, is stepping up to issue regulated, bank-grade stablecoins designed specifically for institutional treasury, cross-border settlement, and tokenized commercial payments. The USD Megaconsortium: 21 Banks Eye 2027 In a watershed development for global wholesale finance, twenty-one major international financial institutions committed on September 1, 2026, to establish a joint company during the second half of this year to issue a U.S. dollar-denominated stablecoin, targeting a commercial market launch in H1 2027. The heavy-hitting consortium brings together North American giants including Goldman Sachs, Citi, Bank of America, Wells Fargo, Fidelity Investments, Scotiabank, and TD Bank alongside major European institutions such as Deutsche Bank, UBS, Banco Santander, Crédit Agricole, Lloyds Banking Group, BBVA, and Commerzbank. Drawing on bank-grade compliance, deep capital buffers, and institutional risk management, the unified dollar stablecoin aims to provide a trusted 24/7 settlement layer for wholesale interbank clearing, capital markets margin management, and cross-border corporate payments. By uniting 17 global systemically important banks (G-SIBs), the project seeks to displace fragmented private stablecoin rails with a single, highly liquid institutional standard. Europe’s Euro Counteroffensive Under MiCA While U.S. dollar tokens currently represent over 98% of total global stablecoin supply, Europe is mounting an aggressive, regulatory-backed counteroffensive powered by the Markets in Crypto-Assets (MiCA) framework. The EU’s legal clarity has given traditional financial institutions the regulatory confidence necessary to issue e-money tokens (EMTs) directly on public and permissioned blockchains. Leading the fintech assault, London-based Revolut launched its first euro-backed stablecoin , EURR, on August 26, 2026. Issued by Luxembourg-based Bridge Building S.A., a subsidiary of Bridge, which was acquired by Stripe for $1.1 billion in early 2025, EURR is fully compliant with MiCA requirements and backed 1:1 by reserve assets. Initially rolled out to eligible customers in Denmark, Poland, and Portugal across Ethereum and Polygon networks, EURR connects Revolut's 80 million global users directly to on-chain finance, positioning the fintech giant to challenge dollar-denominated dominance in European digital trade. Concurrently, traditional European banks are forming powerful regional alliances. In Italy, domestic payment leader Bancomat enlisted nine major banking partners, including Intesa Sanpaolo, Crédit Agricole Italia, Banca Generali, Monte dei Paschi di Siena (MPS), Banca Sella, and BPER, to launch "EUR.bank." Backed by the Italian Banking Association (ABI), EUR.bank acts as a systemic banking currency to modernize interbank settlements. On a broader scale, the Qivalis consortium has expanded to 37 pan-European lenders , pooling balance sheets to establish euro-denominated settlement rails as a direct counterweight to U.S. dollar stablecoin hegemony. Private banking institutions are also moving fast. Franco-German wealth management titan ODDO BHF, a group with roots dating back to 1849, launched EUROD , one of the first MiCA-regulated euro stablecoins issued by a European bank. Built on Polygon Layer-2 with custody infrastructure supplied by Fireblocks and liquidity provided by market-maker Flowdesk, EUROD targets institutional asset management, automated corporate treasury, and B2B trade execution. Emerging Market Treasury & Custody Evolution The institutional stablecoin revolution extends well beyond North America and Europe. In emerging markets across Southeast Asia and Latin America, corporate treasurers are increasingly replacing friction-laden SWIFT rails with regulated stablecoin corridors. The expansion of institutional digital fiat is equally pronounced across the Asia-Pacific (APAC) region, where sovereign regulators are creating formal registration pathways to integrate local fiat currencies onto distributed ledgers. A prime example of this regional evolution unfolded in Indonesia, Southeast Asia’s largest economy. In mid-2026, Indonesia’s Financial Services Authority (Otoritas Jasa Keuangan or OJK) marked a milestone for institutional digital assets by formally graduating key stablecoin and custody models from its regulatory sandbox. OJK recorded PT Adhyoka Berkah Maju’s IDRP as an approved rupiah-stablecoin issuer framework. IDRP provides a compliant, rupiah-denominated digital settlement unit designed for corporate treasuries, local merchant settlement, and tokenized trade finance. These emerging market frameworks establish strict production rollout models, requiring a clear separation between legal issuer obligations, segregated reserve custody, and named redemption executors. By establishing transparent, policy-enforced registration pathways and exportable audit proofs, institutional corridors allow multinational corporations to execute instant 24/7 cross-border FX settlements while adhering to local central bank guidelines. As the competitive race between consortium dollars and regulated euro tokens intensifies, the fundamental nature of global liquidity is being rewritten. The convergence of strict regulatory frameworks like MiCA and DAC8 with the engineering prowess of enterprise custodians and blockchain networks has elevated stablecoins from speculative digital tokens to core financial infrastructure. For chief financial officers and institutional treasurers, the question is no longer whether to integrate stablecoin rails, but which regulated institutional standard will anchor their 24/7 global balance sheet. How Ondology Labs can help: A bank-grade stablecoin stands or falls on the evidence behind its reserves and its licence. We run MiCA readiness reviews for issuers and CASPs preparing a CySEC file, deliver proof of reserves engagements that reconcile on-chain supply to segregated reserve assets, and provide crypto audit support to the audit firms and finance teams that have to sign off on tokenized fiat. Related reading: MiCA authorisation in Cyprus: the complete guide · How to read a proof of reserves report · The GENIUS Act and the tax status of stablecoins . Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # MiCA Authorisation in Cyprus: The Guide | Ondology Labs URL: https://ondologylabs.com/blog/mica-authorisation-cyprus-guide Description: How CASP authorisation under MiCA works in Cyprus: the CySEC process, capital by service class, what goes in the application, timelines, passporting to the EU, and a readiness checklist. ← Back to Blog MiCA Authorisation in Cyprus: The Complete Guide By Iraklis Anastasiou · September 2, 2026 · Updated October 13, 2026 Key takeaways Since 1 July 2026, providing crypto-asset services from Cyprus without MiCA authorisation is unauthorised activity; the transitional period is over. CySEC is the competent authority. New applications remain open; the February 2026 deadline applied to firms relying on the transitional regime. Minimum capital depends on your service class: EUR 50,000, 125,000 or 150,000, and own funds must also cover a quarter of last year's fixed overheads if that is higher, a figure that comes out of your audited financial statements . The hardest parts of the file are evidence, not paperwork: safeguarding of client assets, management body suitability, and shareholder source of wealth. One Cyprus authorisation passports the services across the entire EU on notification. MiCA, the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114), replaced the patchwork of national crypto registrations with a single authorisation that works across the Union. For Cyprus that transition is complete: the Article 143(3) transitional period ended on 1 July 2026, and a firm providing crypto-asset services from Cyprus today either holds a CASP authorisation, has an application under assessment after applying in time, or is operating unlawfully. This guide walks through the authorisation as it actually runs in Cyprus: who needs it, what it costs in capital, what goes in the file, how long it takes, and what changes after the licence arrives. It is written for founders and compliance officers planning an application, and it is deliberately blunt about the parts applicants underestimate. It is not legal advice, and a real application should be prepared with counsel; our role in these projects is the evidence layer, which we describe at the end. Who Needs CASP Authorisation Authorisation is required for providing any of the ten crypto-asset services in MiCA Article 3 to clients in the EU as a business: custody and administration of crypto-assets; operating a trading platform; exchanging crypto for funds or for other crypto-assets; executing orders; placing crypto-assets; reception and transmission of orders; advice; portfolio management; and transfer services. If your revenue model touches client crypto in any of those ways, assume you are in scope and work backwards from there. Two groups regularly get this wrong. Pure software providers whose users self-custody generally fall outside the services list, but the analysis turns on facts, not on what the marketing page says. And non-EU firms serving EU clients cannot rely on reverse solicitation beyond its genuinely narrow meaning: a client who found you through your own promotion was solicited. Capital: What Each Class Requires MiCA Article 67 sets prudential safeguards as the higher of a permanent minimum and a quarter of the preceding year's fixed overheads. The permanent minimum depends on the class of services (Annex IV): Table: MiCA minimum capital by CASP service class (Annex IV) Class Services covered Minimum capital Class 1 Execution of orders, placing, reception and transmission, advice, portfolio management, transfer services EUR 50,000 Class 2 Any Class 1 service plus custody and administration, exchange of crypto-assets for funds or other crypto-assets EUR 125,000 Class 3 Any Class 2 service plus operating a trading platform EUR 150,000 Treat the minimum as a floor, not a plan. The fixed-overheads test binds as soon as the business has any real cost base, and CySEC expects the programme of operations to show capital adequacy on projected, not just current, numbers. What Goes in the Application The Article 62 application is a business file, not a form. In practice the Cyprus file breaks into five blocks: The business: programme of operations, service classes, target clients, three-year financials, and the fee model. The people: management body suitability under Article 68 against the joint EBA and ESMA guidelines, covering competence, reputation, time commitment and collective knowledge, plus identity and source-of-wealth evidence for every qualifying shareholder (10% or more). The controls: governance arrangements, AML/CFT framework, complaints handling, conflicts, outsourcing, and ICT risk management aligned with DORA. The assets: custody policy and proof that clients' crypto-assets and funds are segregated from the firm's own, the single area where supervisors most want evidence rather than narrative. The exit: a wind-down plan showing client assets can be returned in an orderly failure. The blocks that stall applications are the evidence-heavy ones: suitability, source of wealth, and safeguarding. A policy saying client assets are segregated is an assertion; wallet architecture plus on-chain proof that client and proprietary assets never commingle is evidence. That distinction is most of the difference between a smooth review and a long one, and it is the core of our MiCA readiness service . Process and Timeline in Cyprus Applications go to CySEC as the Cyprus competent authority. MiCA gives the authority 25 working days to confirm the file is complete and then 40 working days to assess it. An incomplete file goes back with a deadline to fix it, and during the assessment the authority can pause the clock once, for up to 20 working days, to ask for more information. The law caps the regulator's time, not the applicant's: realistic planning for a well-prepared file is measured in months, with the applicant's own response speed the biggest variable. Our MiCA licence cost breakdown sets out the statutory clock step by step, with CySEC's fees for each service. Incomplete safeguarding evidence and unresolved suitability questions are the classic clock-stoppers. Firms that applied by CySEC's 27 February 2026 cut-off under the transitional regime and are still under assessment should treat supervisory correspondence as the priority queue it is. Everyone else applying fresh should assume full scrutiny with no transitional goodwill. Passporting: Cyprus as the EU Entry Point A Cyprus CASP authorisation is an EU authorisation, and every firm that holds one, or has notified under Article 60, appears on our list of MiCA-licensed CASPs in Cyprus . Under Article 65, expanding into other member states is a notification, not a new licence: the firm informs CySEC of the states and services, the information is transmitted to the host authorities, and the firm can provide services cross-border shortly after. For groups choosing a base, that makes the real comparison between member states one of supervisory quality, ecosystem and tax, and Cyprus scores on all three for digital-asset businesses, including the 15% corporate rate and the professional infrastructure that has grown around CySEC-regulated firms. Greece, notably, becomes a notification away. After Authorisation: The Part Everyone Underestimates The licence starts obligations rather than ending them: ongoing own-funds coverage, safeguarding that holds every day rather than on application day, incident and complaints records, and supervisory reporting to CySEC. Cyprus has already shown enforcement appetite across the EU's new framework, and the first MiCA fines elsewhere in Europe landed in 2026. The firms that find supervision easy are the ones whose evidence cycle runs continuously: reconciliation, reserve attestation, and segregation proof produced on a cadence rather than reconstructed on demand. That ongoing cycle, not the application, is where most of our MiCA work happens. MiCA Readiness Checklist Run this before engaging anyone, including us. It maps the file blocks above to yes/no questions: Have you fixed the exact service classes you need, and sized capital against both the Annex IV minimum and a quarter of fixed overheads? Can every management body member evidence competence, reputation and time commitment against the EBA/ESMA suitability guidelines? Can every 10%+ shareholder document source of wealth, including any crypto-origin wealth with an on-chain trail? Does your wallet architecture separate client from proprietary assets, and can you prove it on-chain today? Do your books reconcile to the chain at month-end without manual heroics? Is there a written wind-down plan that returns client assets in an orderly failure? Are AML/CFT, complaints, outsourcing and ICT (DORA) frameworks written AND operating, with records to show it? Do you have counsel for the legal drafting and an evidence partner for the on-chain proof? Anything answered "no" is application work. Anything answered "yes, but we could not show it quickly" is also application work. How Ondology Labs can help: We are the evidence layer of a MiCA application, working alongside your legal counsel: gap assessments against the CASP obligations, cryptographic wallet-control verification, on-chain proof of client asset segregation, reserve attestations, Article 68 suitability assessments and shareholder source-of-wealth evidence , plus the ongoing supervisory evidence cycle after authorisation. We are not a law firm and this guide is not legal advice. Once authorised, the audited accounts behind your own funds figure come from statutory crypto audits with our ICPAC-licensed partner . Once the licence is granted, the recurring cycle continues under MiCA ongoing compliance . Related reading: MiCA's transition window is closing · Crypto reporting obligations in Cyprus · Crypto audit requirements in Cyprus . · MiCA obligations after authorisation · CASP audit requirements under MiCA in Cyprus Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Who Needs a Crypto Audit in Cyprus? | Ondology Labs URL: https://ondologylabs.com/blog/crypto-audit-requirements-cyprus Description: Who needs a crypto audit in Cyprus, entity by entity: companies holding crypto, CASPs under MiCA, funds. What the auditor asks for and how to prepare. ← Back to Blog Crypto Audit Requirements in Cyprus: Who Needs One and What It Involves By Iraklis Anastasiou · September 2, 2026 · Updated September 21, 2026 Key takeaways Cyprus companies file audited financial statements under the Companies Law; holding crypto does not exempt you, it just makes the audit harder. The evidence problem is specific: auditors must verify existence, ownership, valuation and completeness of assets no bank can confirm. CASPs face a second layer: CySEC supervisory expectations under MiCA on safeguarding and own funds. Since 1 January 2026, crypto activity has direct tax consequences in Cyprus: 15% corporate income tax and a flat 8% on crypto disposals under Article 20E. Preparation, above all reconciliation of the chain to the ledger, decides whether an audit takes weeks or quarters. The question we hear most from crypto businesses in Cyprus is some version of "do we actually need an audit?" The short answer is that if you operate through a Cyprus company, you almost certainly do, because Cyprus requires it of companies generally. The longer answer, the one that matters for planning, is about which layer of requirements applies to you and what evidence your auditor will need that a traditional client never has to think about. The Baseline: Every Cyprus Company Is Audited Under the Cyprus Companies Law (Cap. 113), companies prepare financial statements under IFRS and have them audited by a licensed statutory auditor. Audited accounts also underpin the corporate tax return. There is a narrow carve-out introduced in recent years allowing the smallest companies (net turnover up to EUR 200,000 and total gross assets up to EUR 500,000) to obtain a review engagement instead of a full audit, but a crypto business that custodies assets, trades, or raises outside capital will rarely sit inside it, and banks, investors and regulators generally expect the audit regardless. In Cyprus, a statutory audit opinion can only be issued by an audit office licensed by ICPAC, the Institute of Certified Public Accountants of Cyprus. That is why our own audit work is structured as a partnership: the statutory audits we deliver run with CYAUSE Audit Services Ltd, the ICPAC-licensed office that issues the opinion, while Ondology Labs produces the on-chain evidence the opinion rests on. Why Crypto Makes the Audit Hard Audit standards ask the same questions of every material asset: does it exist, does the company own and control it, is it valued correctly, and is the record complete? For a bank balance, one confirmation letter answers all four. For crypto there is no bank to write to, so each assertion needs its own evidence: Existence: balances read directly from the chain at the reporting date, not from a screenshot of a wallet interface or an exchange dashboard. Ownership and control: cryptographic proof that the company controls the claimed addresses, typically a signed message or a microtransaction from each wallet, covering the actual signing arrangements including multi-sig and custodial setups. Valuation: a defensible fair value at the reporting date from documented price sources, with an accounting policy that deals with the awkward fact that IFRS treats most crypto holdings as intangible assets (IAS 38) or, for broker-traders, inventory (IAS 2). Completeness: confidence that the wallets presented are all the wallets, which is where forensic techniques such as tracing flows out of known addresses earn their place in an audit file. Most stalled crypto audits stall on the last point plus reconciliation: the on-chain activity does not agree with the accounting ledger, and nobody can explain the difference. That is a bookkeeping problem, not an audit problem, and it is fixable before the audit starts with transaction reconciliation . Requirements by Entity Type Table: Crypto assurance requirements in Cyprus by entity type, as at September 2026 Entity What is required Who demands it Cyprus Ltd holding crypto (treasury, investments) Statutory audit of the financial statements, with crypto-specific evidence over existence, control, valuation and completeness. Companies Law; Tax Department (the return rests on audited accounts); banks and counterparties. CASP authorised under MiCA Statutory audit plus ongoing supervisory evidence: safeguarding and segregation of client assets, own-funds coverage, and records CySEC can test. Companies Law; CySEC under MiCA. Fund or fund manager with digital assets Audited financial statements plus position verification the administrator and depositary can rely on at each reporting date. Fund legislation and CySEC; administrators, depositaries and investors. Exchange or custodian publishing proof of reserves A reserves attestation: cryptographic wallet-control verification and a liability commitment customers can check. An attestation, not an audit. Customers and the market; increasingly expected after the 2026 wave of exchange attestations. Foreign company with a Cyprus subsidiary The Cyprus entity is audited locally; group auditors typically need component evidence over any crypto it holds. Companies Law; the group auditor. The Tax Layer Nobody Should Ignore From 1 January 2026, Cyprus taxes gains on the disposal of crypto-assets at a flat 8% under Article 20E of the Income Tax Law, for companies and individuals alike, while the corporate income tax rate rose to 15%. Both changes make the quality of your crypto records a tax matter, not just an audit matter: the 8% applies per disposal, which includes crypto-to-crypto exchanges, so a complete acquisition and disposal history is now the foundation of the return. The full picture, including DAC8 reporting on your users, is in our reference guide to crypto reporting obligations in Cyprus . What the Audit Actually Involves A crypto audit engagement in Cyprus typically runs in four stages. Scoping agrees the wallets, exchange accounts, chains and ledgers in scope, and surfaces the accounting-policy questions early. Evidence collection reads balances from the chain at the reporting date and verifies control of each address cryptographically. Reconciliation matches on-chain and exchange activity to the ledger and resolves the breaks. Reporting turns all of it into working papers a statutory auditor can rely on, or, in the full statutory engagement, into the audited financial statements themselves. Timelines depend almost entirely on the state of the records. A business that reconciles monthly can be audit-ready in weeks. A business handing over three years of unreconciled DeFi activity should expect the preparation to take longer than the audit. Fees follow the same logic, which is why we scope fixed fees only after seeing the wallet count, chains and volumes involved. If You Already Have an Auditor Keep them. The most common engagement we run is crypto audit support : your incumbent auditor keeps the engagement and the opinion, and we deliver the specialist digital-asset procedures inside it, from wallet-control verification to reconciliation working papers. Audit firms engage us directly on the same basis for their own crypto clients. Independence rules are respected in both directions: we do not audit records we prepared, and we say so up front when a scoping conversation heads that way. How to Prepare: The Short Checklist Inventory every wallet and exchange account, including dormant ones; completeness questions start here. Reconcile on-chain activity to your ledger monthly, not annually. Document who can sign for each wallet and how keys are controlled. Fix an accounting policy for classification and valuation before year-end, not during the audit. Keep acquisition records: dates, amounts and cost basis now drive the Article 20E computation too. How Ondology Labs can help: We deliver statutory crypto audits with CYAUSE Audit Services, our ICPAC-licensed audit partner, provide crypto audit support to incumbent auditors and their clients, and get records audit-ready through transaction reconciliation . Exchanges and custodians can add proof of reserves attestations . This page is general information, not audit, tax or legal advice for any specific situation. Related reading: Crypto audits in 2026: the new standard · How to read a proof of reserves report · Crypto reporting obligations in Cyprus . · Your auditor will not sign off on the crypto balances · What a crypto audit costs in Cyprus Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Cyprus Crypto Reporting: DAC8, MiCA, AML & 8% Tax | Ondology Labs URL: https://ondologylabs.com/blog/crypto-reporting-obligations-cyprus Description: Cyprus crypto reporting explained: DAC8 filings, MiCA reporting to CySEC, STRs to MOKAS, and the new 8% tax on disposals under Article 20E. Every deadline in one place. ← Back to Blog Crypto Reporting Obligations in Cyprus: DAC8, MiCA, AML and the New 8% Tax By Iraklis Anastasiou · September 1, 2026 · Updated September 21, 2026 "Crypto reporting" in Cyprus is not one obligation. It is four, owed to four different authorities, on four different clocks, and the firms that get into trouble are usually the ones that assumed satisfying one of them satisfied the others. Key takeaways Crypto reporting in Cyprus is four separate obligations to four authorities: DAC8 to the Tax Department (about your users), MiCA reporting to CySEC (about your firm), suspicious transaction reports to MOKAS, and your own tax return. The first DAC8 report, covering calendar year 2026, is due by 30 June 2027; self-certifications from pre-existing users by 1 January 2027. The MiCA transitional period ended on 1 July 2026; unauthorised provision of crypto-asset services from Cyprus is now unlawful. Gains on crypto disposals are taxed at a flat 8% under Article 20E from 1 January 2026, and crypto-to-crypto exchanges count as disposals. We are asked some version of the same question every month. A crypto firm in Cyprus, often newly authorised or midway through an application, wants to know what it actually has to report. The honest answer is that the question needs splitting before it can be answered, because the word "reporting" is doing four separate jobs at once. A tax report under DAC8 goes to the Cyprus Tax Department and describes your users. Regulatory reporting goes to CySEC and describes your firm. A suspicious transaction report goes to MOKAS and describes one customer's behaviour, urgently. Your own tax return describes your own income. Different data, different owners, different deadlines, and very different consequences for getting each one wrong. All four moved in 2026, which is why so much of the guidance still circulating is wrong. Cyprus transposed DAC8 in March, backdated to January. The MiCA transitional window closed on 1 July. And a new Article 20E introduced a flat 8% tax on crypto disposals from 1 January, ending years of the island being described as a place where crypto gains are simply untaxed. This is a map of all four as they stand in September 2026. It is written for compliance officers, finance leads and the boards that sign off on what they produce. It is not tax or legal advice, and where a position is genuinely unsettled we say so rather than presenting one reading as settled law. The Four Regimes at a Glance If you take one thing from this page, take this table. Most of the confusion we see resolves the moment someone sees the four obligations side by side and understands that they are not substitutes for one another. Table 1: The four crypto reporting regimes in Cyprus, as at September 2026 Regime What is reported Who files Goes to Timing DAC8 tax reporting Your users: identity, tax residence, taxpayer identification number, and aggregated crypto transactions valued per user and per asset. Reporting crypto-asset service providers and crypto-asset operators serving EU-resident users. Cyprus Tax Department, for automatic exchange with other member states. Data collection since 1 Jan 2026. Self-certifications for pre-existing users by 1 Jan 2027. First report, covering 2026, by 30 June 2027. MiCA supervisory reporting Your firm: own funds, safeguarding of client assets, business volumes, material changes, complaints, and operational or ICT incidents. CASPs authorised under MiCA, plus issuers of asset-referenced and e-money tokens. CySEC. Ongoing and periodic. Frequency and content depend on your permissions and the circulars in force. AML suspicious transaction reporting A specific customer or transaction giving rise to knowledge or suspicion of money laundering or terrorist financing. All obliged entities, CASPs included. MOKAS, the Cyprus financial intelligence unit. Promptly, on suspicion. No monetary threshold and no reporting calendar. Your own tax return Your own position, including gains on crypto disposals taxed at 8% under Article 20E of the Income Tax Law. Cyprus tax resident individuals and companies, including non-domiciled residents. Cyprus Tax Department. Annually, on the ordinary return deadlines for your taxpayer type. Note what the table implies. Only the first regime is triggered by having users, only the second by being licensed, and only the third by seeing something suspicious. The fourth applies to you whether or not you run a crypto business at all. A firm can owe all four, and an individual investor with no business at all can still owe the fourth. 1. DAC8: Reporting Your Users to the Tax Department DAC8 is the EU's crypto tax transparency regime, and it is the obligation Cyprus firms are least prepared for. Partly because it is new, and partly because its first filing deadline sits far enough away to feel unreal while the data collection behind it is already running. What Cyprus Did, and When Cyprus missed the original transposition deadline of 31 December 2025 and passed its implementing law on 27 March 2026, with retroactive effect from 1 January 2026. Retroactive is the word that matters. The late arrival of the law did not move the start of the first reporting year, so obligations run from January 2026 regardless of when the text landed. A firm that waited for the Cyprus law before starting to collect data is already behind, and the gap has to be closed by reconstruction rather than by going forward cleanly. The law reaches entities licensed in Cyprus under MiCA and crypto-asset operators providing services without a MiCA registration requirement. That second category catches more businesses than firms expect, which is the subject of the trap below. The Three Dates That Govern Your Year Three deadlines drive everything else. Data collection has applied since 1 January 2026 , so the first reporting year is already in progress. Self-certifications from pre-existing users, meaning accounts opened before 2026, are due by 1 January 2027 . The first reports, covering the 2026 calendar year, fall due in 2027, and Cyprus has set 30 June 2027 . Other member states set their own dates inside the EU window, so a group filing in more than one jurisdiction should confirm each one rather than assuming the Cyprus date travels. The Trap: "We Are Not an Exchange, So This Is Not Us" The most common misreading we encounter. DAC8 attaches to the provision of crypto-asset services to EU-resident users, not to whether you think of yourself as an exchange or whether you hold a MiCA licence. A firm executing transactions on behalf of clients, operating a trading platform, or providing transfer services can be a reporting crypto-asset operator without ever having applied for anything. Being outside the EU does not help either: a non-EU platform with EU-resident users is still in scope. Scoping this properly is a one-off exercise that costs very little and settles the question with reasoning on the record. Assuming your way out of it is the expensive option, because the assumption is only tested when a reporting year has already closed. 2. MiCA and CySEC: Reporting Your Firm to Your Supervisor The second regime is supervisory rather than fiscal. Crypto-asset service providers in Cyprus are supervised by the Cyprus Securities and Exchange Commission , and once you are authorised under MiCA, reporting is continuous rather than periodic in the way a tax filing is. Cyprus used the transitional period that MiCA's Article 143(3) leaves to member states, and that window has now closed. Firms registered under the old national regime could continue until 1 July 2026 , and CySEC required anyone intending to seek authorisation through Cyprus to have applied by 27 February 2026 , with a wind-down plan expected from those who did not. The practical consequence for September 2026 is that providing crypto-asset services from Cyprus without MiCA authorisation is no longer a transitional position, it is an unauthorised one. Everything below follows from being a supervised firm. What a CASP owes its supervisor falls into a few recognisable families. The exact content and frequency depend on which services you are permitted to provide, so treat the following as the shape of the obligation and confirm the specifics against your own authorisation conditions and the circulars in force. The families are: periodic prudential and operational reporting , covering own funds, safeguarding of client assets and business volumes; notification of material changes , meaning shareholding, management, outsourcing and any change to the services you provide; complaints reporting ; incident reporting , both operational and ICT-related, where DORA has raised expectations for firms in scope; and, for issuers of asset-referenced and e-money tokens, a separate reporting stream tied to reserves and redemption. The failure we see here is rarely a missed return. It is that the numbers in the supervisory report cannot be reconciled to the chain or to the ledger when someone asks how they were produced. A report you cannot reproduce is a finding waiting to happen, which is why our transaction reconciliation and MiCA readiness work usually starts with the evidence trail rather than the form. 3. AML: Reporting Suspicion to MOKAS The third regime is the one with no deadline, which is precisely what makes it hard to run. Suspicious transaction reports go to MOKAS , the Cyprus financial intelligence unit, under the Cyprus law implementing the EU anti-money laundering directives. The trigger is knowledge or suspicion, and the timing is "promptly", not "quarterly". Two things about STRs are consistently misunderstood. First, there is no monetary threshold that switches the obligation on. A small transaction that makes no sense is reportable; a large transaction that makes complete sense is not. Firms that have quietly built a de facto threshold into their escalation process have built a defect. Second, filing is not the end of the matter. Tipping off is a separate offence, and the decision about whether to continue the customer relationship after filing is one you have to document rather than default. The quality issue we find in reviews is not under-reporting so much as undifferentiated reporting. A firm that files everything is not demonstrating diligence, it is transferring its judgement to the FIU, and supervisors read high volume with thin narrative for what it is. We cover this and the related control gaps in more depth in our note on AML audit readiness for Cyprus crypto firms . The Travel Rule Is a Reporting Obligation Too The EU Transfer of Funds Regulation extends the travel rule to crypto-asset transfers, which means originator and beneficiary information has to accompany transfers between service providers. Firms tend to file this mentally under "AML tooling" rather than "reporting", and then discover at review time that the obligation has an evidential dimension: you have to be able to show what you sent, what you received, and what you did when the information was missing or incomplete. Exception handling is where this breaks. Transfers to and from self-hosted wallets, counterparties who send incomplete data, and the question of what constitutes a reasonable delay before rejecting a transfer are all areas where firms have a policy and no evidence that the policy was followed. That is a reporting failure even when no report was due. 4. Your Own Tax Position The fourth regime is the one people usually mean when they ask about "crypto tax in Cyprus", and it is separate from all three above. DAC8 concerns what you report about your users. This concerns what you and your own business report about yourselves. It is also the part of the Cyprus picture that changed most in 2026, and a great deal of the advice still circulating online describes the old position. Cyprus Now Has a Dedicated Crypto Tax Article Until the end of 2025, Cyprus had no provision written specifically for digital assets. Practitioners worked from general Income Tax Law principles, the "titles" exemption and the badges of trade, and outcomes turned on whether activity was characterised as investment or as trading. That ambiguity is what produced the widely repeated claim that crypto gains in Cyprus are simply untaxed. That position no longer holds. The 2026 tax reform inserted Article 20E into the Income Tax Law , via the Income Tax (Amending) (No. 4) Law of 2025, and it applies from 1 January 2026 . It taxes gains from the disposal of crypto-assets at a flat 8% , for individuals and companies alike. "Crypto-asset" takes the MiCA definition in Article 3(1)(5) of Regulation (EU) 2023/1114, which is a deliberate and useful piece of drafting: the tax definition and the regulatory definition are the same definition. Four events count as a disposal, and the last two are the ones people miss: sale for fiat, exchange of one crypto-asset for another, gift or transfer without consideration, and payment for goods or services. A crypto-to-crypto swap is a taxable disposal even though no fiat moved and nothing reached a bank account. Simply holding is not taxed. The Details That Change Behaviour Three features of Article 20E matter more than the headline rate. Losses are ring-fenced. A loss on a crypto disposal can be set only against crypto disposal gains realised in the same tax year. It cannot be carried forward, surrendered by group relief, or offset against other income. Unused losses are simply lost, which makes the timing of realisations matter far more than it does elsewhere in the Cyprus system. Mining is carved out. Crypto-assets acquired through mining fall outside the 8% regime and are dealt with under the general provisions, meaning ordinary corporate or personal rates. Staking rewards and airdrops likewise sit outside Article 20E on receipt, though a later disposal of those assets comes back inside the 8%. A business with mixed activity therefore has to track how each holding was acquired, not just what it sold, and that is a data problem long before it is a tax problem. Non-dom status does not exempt it. The non-domiciled regime exempts dividends and interest from the special defence contribution, and a number of people have assumed crypto gains travel with them. Under the 2026 law they do not. A non-dom Cyprus tax resident disposing of crypto-assets is within the 8%. Around this sit the wider reform changes: corporate income tax moved from 12.5% to 15% from 1 January 2026, in line with the OECD global minimum, so the general rate that applies to mining income and to trading profits outside Article 20E moved with it. This regime is new, and new regimes generate practice questions faster than guidance answers them. Cost basis on assets acquired long before 2026, valuation on crypto-to-crypto swaps, and the boundary between staking receipts and disposals are all areas where we would expect the detail to firm up. Take advice on your own facts. What we do is build and reconcile the underlying dataset, including acquisition method, cost basis and disposal history across chains and venues, which is almost always the part that is missing. The characterisation of that data is a matter for your tax advisor, and the two jobs should not be collapsed into one. Where These Obligations Collide The regimes are legally separate but they draw on overlapping data, and that overlap is where the real risk sits. Three collisions are worth planning for. Consistency across filings. The transaction population behind a DAC8 report, the volumes in a CySEC return and the revenue in a tax computation are different views of the same underlying activity. When they are produced by different teams from different extracts, they disagree, and the disagreement is visible to anyone who looks at two of them together. Building the three from one reconciled source is the single highest-value structural fix available. Self-certification and KYC are not the same record. DAC8 wants tax residency and taxpayer identification numbers. AML onboarding wants identity and source of funds. Firms frequently assume their KYC file already satisfies DAC8 and find at collection time that the tax fields were never captured, for exactly the users who are now hardest to reach. An STR does not discharge a reporting obligation. Filing a suspicious transaction report about a user does not remove that user from your DAC8 population, and it does not change what you report to your supervisor. Obvious when stated, and not always obvious in the moment. A Realistic Sequence If all four apply to you and none of them are in good order, the sequence below reflects what we would actually do rather than what a maturity model would suggest. First, scope DAC8 and write the conclusion down. It is cheap, it is time-critical because the reporting year is running, and the answer determines how much of the rest matters. Include the reasoning, not just the conclusion. Second, find out what your 2026 data actually looks like. Not whether you have data, but whether you can produce, for a given user, a complete and valued transaction history reconciled to the chain. Do this before building anything. Most remediation plans we see are written before anyone has looked, and are wrong in consequence. Third, close the self-certification gap for pre-existing users. This has a hard deadline of 1 January 2027 and it depends on customer responsiveness, which you do not control. It needs the most lead time and gets the least. Fourth, reconcile once and reuse. Build the reconciled transaction source that the DAC8 dataset, the supervisory returns and the tax computation all draw from, rather than three parallel extracts that will drift. Fifth, test the AML reporting chain end to end. Take a real alert and follow it to a filed report, or to a documented decision not to file. If the trail breaks anywhere, that is your finding, and you would rather have it than an inspector. What This Page Cannot Tell You Three honest limitations. The exact content and frequency of CySEC reporting depend on your permissions and on circulars that change, so verify against what is in force for your firm rather than against this summary. Article 20E is barely a year old, and the practice questions it raises, cost basis on assets acquired well before 2026, valuation on crypto-to-crypto swaps, and the treatment of staking receipts, will be settled by guidance and practice that does not fully exist yet. And parts of the EU AML framework are still bedding in as the AML package phases in, so where supervisory expectation has not settled, a documented interpretation with reasoning behind it is defensible and silence is not. Dates and positions in this article were verified in September 2026. Regulatory timetables in this area have moved more than once, and Cyprus transposed DAC8 three months late, so confirm anything you are about to rely on before you rely on it. How Ondology Labs can help: We work on the data underneath all four regimes rather than on the forms themselves. That means DAC8 reporting support , from applicability scoping to a reporting dataset reconciled to the chain and to your books, MiCA readiness and CASP compliance evidence , independent AML compliance audits covering the escalation and reporting chain end to end, and transaction reconciliation that gives your tax advisor an acquisition and disposal history they can actually work from. We are based in Nicosia and most of this work is done for firms supervised here. Where your auditor cannot test the crypto balances themselves, that is crypto audit support , and the full statutory opinion is audited financial statements . Related reading: AML audit readiness for crypto firms in Cyprus · The DAC8 directive explained · MiCA's transition window · Best crypto accounting tools compared . · CASP audit requirements under MiCA in Cyprus Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Crypto Audits in 2026: The New Standard | Ondology Labs URL: https://ondologylabs.com/blog/crypto-audits-2026-tether-bitpanda-new-standard Description: Why 2026 is the year crypto audits became unavoidable: DAC8, MiCA enforcement, the Tether KPMG audit, and the Bitpanda fine. What the new standard means for you. ← Back to Blog Crypto Audits in 2026: DAC8, MiCA and the Tether KPMG Audit By Iraklis Anastasiou · August 29, 2026 · Updated September 21, 2026 Standard financial checks aren't enough to secure the digital asset industry. As new frameworks like DAC8 mandate transparency, auditors must rely on deep technical expertise to verify everything from smart contracts to physical gold reserves. In the wake of multiple high-profile crypto collapses, namely FTX and Zondacrypto , the digital asset industry has been forced to mature. It is abundantly clear that a traditional financial audit, designed for fiat bank accounts and physical inventory, is woefully inadequate for a crypto balance sheet. The unique nature of blockchain technology introduces financial assertions that require specialized scrutiny, pushing auditors to look beyond standard practices. Blockchain-based remittance companies, cryptocurrency exchanges, and stablecoin issuers are some of the immediate enterprises that will require crypto audits. The Intricacies of Crypto Audits When a standard auditor approaches a balance sheet, they test for existence, valuation, and rights and obligations. In traditional finance, verifying existence is often as simple as requesting a bank statement. In crypto, "existence" means proving control over the private keys that govern a wallet address, or validating the data integrity of the underlying blockchain records against the client's internal custodian records. But control does not inherently equal ownership, which complicates the "rights and obligations" assertion. Are the assets held in a custodial capacity for users, or do they belong to the exchange? Furthermore, valuation remains a complex puzzle. While Bitcoin and Ethereum have deep liquidity, valuing thinly traded altcoins or complex derivative tokens requires sophisticated fair-value modeling that accommodates hyper-volatility. These valuations can also rely on assessments of the company status as well as a number of benchmarking sources such as credible indexes. Why Auditors Need Technical Experts Because of these complexities, standard CPAs often find themselves out of their depth. Under international auditing standards, auditors are increasingly relying on technical experts to provide assurance. Blockchain cybersecurity and data science specialists are needed to evaluate the architecture of cold and hot wallets, audit the underlying code of smart contracts, and assess the cryptographic proofs (such as Merkle trees ) used by exchanges for proof of reserves on the assets they hold in an offchain environment. Without this technical assurance, an auditor cannot confidently sign off on the financial statements, as a single, overlooked smart contract vulnerability could instantly wipe out a firm's reserves. The Expanding Regulatory Net The regulatory landscape has also shifted dramatically, forcing companies to adopt robust reporting systems. The European Union's DAC8 directive , which entered its implementation phase in January 2026, acts as a stringent crypto tax-reporting framework. It requires service providers to automatically gather and share transaction data and user tax residency information with authorities, closing the visibility gap between traditional finance and digital assets. Coupled with the markets in crypto-assets (MiCA) regulation, which imposes strict rules on market conduct, compliance is no longer optional. A recent example underscores this strict environment: on August 14, 2026, Austria's financial market authority (FMA) issued Europe's first published MiCA penalty to Vienna-based exchange Bitpanda. The €70,000 fine penalized the firm for procedural misses regarding a crypto-asset white paper and its accompanying marketing disclosures. Specifically, the FMA identified three technical breaches. First, Bitpanda submitted a required token white paper to the regulator fewer than the strictly mandated 20 working days prior to publication. Second, promotional material was distributed before the white paper was actually published, reversing the sequence MiCA demands. Finally, the marketing communication omitted mandatory disclaimers, such as a statement noting the document had not been reviewed by a competent authority, alongside required contact details. Bitpanda swiftly addressed the intervention, characterizing the episode as a procedural misstep concerning timing and formal specifications rather than a deeper compliance failure. The firm opted for an accelerated, consensual conclusion to the proceedings with the FMA. The fine, while financially small for a major platform, especially given that Bitpanda secured a full MiCA license from Germany's BaFin earlier in the year, sends a powerful signal. It demonstrates a definitive shift from the mere issuance of licenses to active, rigid enforcement of disclosure standards across the European Economic Area. Case Studies of Success Despite the regulatory hurdles and technical challenges, industry leaders are proving that comprehensive audits are possible. In mid-August 2026, Tether, the issuer of the world's largest stablecoin, announced the completion of its first full independent financial audit of its 2025 statements, conducted by Big Four firm KPMG US. For years, critics questioned whether Tether truly held the reserves it claimed. KPMG's audit went far beyond a standard digital check. To verify the "existence" and "valuation" assertions, auditors physically inspected and counted Tether's gold holdings in vault locations, rather than relying solely on custodian records. They also extensively audited the smart contracts and cryptographic proofs that bind the USDT tokens on various blockchains. The audit yielded a clean opinion, revealing that Tether held a staggering $6.814 billion in excess reserves above its liabilities, and generated over $10 billion in net profit for 2025. This granular level of physical and cryptographic verification represents a new gold standard for stablecoin issuers. Source: Reuters Meanwhile, Bitpanda has demonstrated that operational security is just as critical as financial assurance. In February 2026, the firm completed its first System and Organization Controls (SOC) 2 Type II attestation. Unlike a standard point-in-time financial audit, a SOC 2 Type II involves a months-long rigorous examination by independent auditors to ensure that a company's security controls, availability, and confidentiality are consistently and operationally enforced. Source: Yahoo Finance As the digital asset market continues to bridge the gap with traditional finance, the expectations placed on crypto balance sheets will only grow. The combined forces of DAC8, MiCA, and the demand for institutional-grade assurance dictate that a standard audit is merely the starting point. Today's successful crypto audits require a fusion of traditional accounting principles, deep cryptographic expertise, and an unwavering commitment to regulatory compliance. How Ondology Labs can help: This fusion is exactly what we do. We deliver full crypto financial statement audits with our ICPAC-licensed audit partner, provide crypto audit support as the technical experts for audit firms and companies with their own auditors, and prepare DAC8 crypto reporting for CASPs in Cyprus and across Europe. Related reading: How to read a proof of reserves report · The MiCA transition window closes in July 2026 · Best crypto accounting tools compared . · How auditors verify crypto wallet ownership Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # GENIUS Act: How Stablecoins Are Taxed | Ondology Labs URL: https://ondologylabs.com/blog/genius-act-digital-asset-tax-stablecoins Description: How the GENIUS Act changes the tax status of stablecoins and digital assets in the US: IRS treatment, Form 1099-DA, and what it means for EU crypto businesses. ← Back to Blog The GENIUS Act and the Tax Status of Digital Assets: Stablecoins, the IRS and Form 1099-DA By Iraklis Anastasiou · July 19, 2026 U.S. investors face strict reserve disclosures and incoming IRS Form 1099-DA compliance, while the IRS maintains its rigorous "intangible property" tax status for digital assets. Part 1 of 3 · The 2026 Crypto Tax Transparency Series Part 1: The GENIUS Act & U.S. tax · Part 2: The EU's DAC8 dragnet · Part 3: Crypto tax for expats in the EU The global digital asset ecosystem is undergoing its most significant structural shift to date, transitioning from a state of regulatory ambiguity and voluntary disclosure to a highly standardized, mandatory crypto-asset reporting framework. The GENIUS Act represents a significant milestone in federal cryptocurrency legislation in the United States. Introduced on July 18, 2025, by Senator Bill Hagerty, the bipartisan legislation established a comprehensive federal regulatory system for dollar-backed payment stablecoins . The primary policy objective is to fortify the global reserve status of the U.S. dollar by driving demand for U.S. Treasury instruments , which serve as the mandated backing for regulated stablecoins, while integrating digital transaction rails directly into the traditional financial architecture. Mechanically, the GENIUS Act establishes a dual-track oversight system, authorizing both FDIC-supervised banks and new limited-purpose stablecoin companies chartered by the Office of the Comptroller of the Currency (OCC) to mint payment stablecoins on public blockchains. To address systemic liquidity risks, the legislation mandates that all permitted payment stablecoin issuers (PPSIs) maintain 1:1 reserves consisting exclusively of highly liquid, low-risk assets, specifically cash, Federal Reserve balances, or short-term Treasury bills with maturities of 90 days or fewer. Under the rules, which officially become effective on January 18, 2027, issuers are strictly prohibited from rehypothecating reserve assets to fund other investments or offering any form of yield or interest to stablecoin holders. Additionally, issuers are treated as financial institutions under the Bank Secrecy Act, requiring them to implement comprehensive anti-money laundering (AML) programs, customer due diligence procedures, and the technical capability to seize, freeze, or burn tokens upon lawful order. Market Regulation vs. Tax Enforcement: A Deliberate Divergence The regulatory divergence between the classification of assets for market oversight versus tax enforcement remains a key point of interest for market participants. While the GENIUS Act excludes compliant stablecoins from the definitions of "securities" and "commodities" to bypass SEC and CFTC jurisdiction, the IRS maintains its property classification regardless of these designations. This is further highlighted by the CLARITY Bill , which passed the House and remains pending in the Senate; although the CLARITY Bill seeks to designate digital assets as either securities under the SEC or commodities under the CFTC based on their functional decentralization, it carries no direct tax impact, as the IRS does not recognize these regulatory classifications for capital gains purposes. Furthermore, because cryptocurrencies are classified as property, they remain exempt from the wash sale rules under Section 1091 of the Internal Revenue Code. This allows spot traders to execute tax-loss harvesting strategies by selling tokens at a loss and immediately repurchasing them without disallowance. However, this exemption does not apply to tokenized securities, which are digital representations of traditional equities, bonds, or mutual funds registered with the SEC. Under the new IRS Form 1099-DA reporting requirements, U.S. brokers must perform due diligence on digital accounts, reporting gross proceeds starting in 2025 and cost basis information starting in 2026, with a dedicated reporting box (Box 1i) specifically tracking disallowed wash sale losses on tokenized securities. (For a deeper look at which tokens escape securities treatment, see our breakdown of which RWA tokens are not securities .) This current framework stands in contrast to past legislative proposals, such as the crypto tax provisions within the Lummis-Gillibrand Responsible Financial Innovation Act (RIFA). The Lummis proposal aimed to make digital assets more practical for daily use by introducing a de minimis capital gains tax exemption for personal transactions, which would exempt capital gains of less than $300 from reporting, subject to an aggregate annual cap of $5,000. Additionally, the Lummis bill proposed deferring the taxation of mining and staking rewards until the tokens are sold or disposed of , preventing phantom tax liabilities caused by price volatility at the point of earning, while formally extending Section 1091 wash sale restrictions to all standard cryptocurrency transactions. Table 1: How the GENIUS Act, the CLARITY Bill and the Lummis-Gillibrand proposal compare Regulatory Parameter The GENIUS Act (P.L. 119-27) The CLARITY Bill (Pending Senate) Lummis-Gillibrand Proposal (RIFA) Primary Focus Comprehensive federal regulatory framework for payment stablecoins. Regulatory oversight boundaries based on functional decentralization. Comprehensive tax and regulatory integration for all digital assets. Reserve Mandates Strict 1:1 reserves in cash or Treasurys; monthly public disclosures. Not applicable (focuses on token classification and jurisdiction). Not applicable (focuses primarily on market and tax rules). U.S. Tax Classification Unchanged; stablecoins remain intangible property. Unchanged; property classification maintained regardless of SEC/CFTC labels. Proposed property status with specific transactional and yield carve-outs. Wash Sale Rules No impact; spot stablecoins remain exempt from Section 1091. No impact; spot digital assets remain exempt from Section 1091. Formally extends Section 1091 wash sale rules to all digital assets. Staking & Mining Tax No direct tax provisions; yield is taxed as ordinary income. No direct tax provisions; standard ordinary income rules apply. Defers taxation of rewards until the point of sale or disposal. De Minimis Exemption None; all transactions are taxable disposals. None; standard realization principles apply to all transactions. Exempts personal transaction gains under $300 (up to $5,000 annually). The IRS Position Is Unchanged: Digital Assets Remain Property For tax purposes, the regulatory formalization of stablecoins under the GENIUS Act does not fundamentally alter the underlying tax classification of digital assets. The Internal Revenue Service continues to treat cryptocurrencies and stablecoins as intangible property under Notice 2014-21, meaning that general property tax principles apply to every digital transaction. Consequently, swapping a payment stablecoin such as USDC or USDT for another cryptocurrency, or using it to pay for goods and services, constitutes a taxable disposal, realizing a capital gain or loss based on the difference between the taxpayer's cost basis and the fair market value of the asset at the time of the transaction. Staking and lending yields remain taxable as ordinary income valued in U.S. dollars at the point of receipt. Table 2: Current tax treatment and reporting by asset and transaction type Asset & Transaction Type Current Tax Treatment Current Reporting Forms Post-GENIUS Act Landscape (2026+) Payment Stablecoins Taxable disposal upon swap or fiat conversion; property status. IRS Form 8949 and Schedule D. Subject to Form 1099-DA issuer reporting; possible future de minimis guidance. Standard Cryptocurrencies Taxable disposal upon swap or fiat conversion; property status. IRS Form 8949 and Schedule D. Mandatory broker reporting on Form 1099-DA (gross proceeds in 2025, cost basis in 2026). Staking / Mining Rewards Taxed as ordinary income at fair market value upon receipt of control. IRS Form 1040, Schedule C (for trade/business) or Schedule 1. Subject to immediate valuation and reporting; no tax deferral under current law. Tokenized Securities Subject to capital gains tax and Section 1091 wash sale disallowances. IRS Form 8949, Schedule D, and Form 1099-DA. Mandatory tracking of wash sales via Box 1i on Form 1099-DA. Operational Directives for U.S. Market Participants For U.S. digital asset market participants, financial institutions, and corporate treasurers, the following operational directives must be integrated immediately: Maintain comprehensive fair market value (FMV) records. Continuously record the exact USD fair market value of all stablecoin balances and transactions on the precise date and time of purchase, swap, or disposal, as every transaction remains a taxable event under standard property guidelines. Segregate spot crypto from tokenized securities. Formally separate spot cryptocurrencies and stablecoins (exempt from the Section 1091 wash sale rule) from tokenized securities, ensuring that disallowed losses on the latter are accurately tracked in accordance with Box 1i of the new IRS Form 1099-DA. Classify stablecoins correctly on the balance sheet. Ensure corporate accounting policies classify stablecoins as cash or cash equivalents only if they are issued by an authorized "permitted payment stablecoin issuer" (PPSI) under the GENIUS Act, reporting other positions as distinct intangible assets under GAAP. Track staking and yield allocations. Properly document all cryptocurrency staking rewards and stablecoin lending yields as ordinary income at their exact fair market value upon receipt of control, preparing for incoming Form 1099-DA reporting regimes once federal OCC chartering is operationalized. Audit reserve disclosures. Establish internal risk-management pipelines to audit the monthly reserve disclosures and quarterly attestations mandated by the GENIUS Act to avoid illiquidity or sudden asset depegs. Figure 1: Parallel regulatory drivers, the U.S. GENIUS Act and the EU's DAC8, converging into a global crypto transparency framework The legislation intentionally avoids modifying the Internal Revenue Code, and market participants face a significant divergence between streamlined regulatory oversight and an unchanged, high-friction tax framework. Under IRS Notice 2014-21, stablecoins remain treated as property rather than currency, requiring traders and corporations to account for every single on-chain swap and conversion. The synchronization of the GENIUS Act in the United States and the DAC8 directive in the European Union represents a fundamental change in the digital asset regulatory landscape. The historical assumption of informational opacity is no longer a viable operational strategy. Digital asset transactions are now fully visible to tax authorities, requiring investors, platform operators, and tax advisors to establish robust compliance processes to mitigate risk and adapt to this highly transparent environment. How Ondology Labs Can Help As reserve attestations, cost-basis reconstruction, and Form 1099-DA reporting become table stakes, verifiable on-chain records matter more than ever. Ondology Labs provides blockchain auditing (proof of reserves, transaction reconciliation, and AML audits) alongside blockchain forensics and tracing that reconstruct transactional histories with court-ready evidence. For issuers, treasurers, and funds preparing for this transparent, mandatory-reporting era, that combination turns compliance from a liability into a competitive advantage. Continue with Part 2: The DAC8 Directive and the EU's crypto tax transparency dragnet . How Ondology Labs can help: Reserve claims only mean something when someone independent tests them. We provide proof of reserves audits and attestations covering both the assets held and the liabilities owed, statutory crypto audits with our ICPAC-licensed partner, and crypto audit support for engagements that already have an auditor. Related reading: The DAC8 directive: the EU's crypto tax transparency dragnet · Crypto reporting obligations in Cyprus · DAC8 and CARF: a crypto tax guide for EU expats Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # DAC8 Directive: EU Crypto Tax Transparency | Ondology Labs URL: https://ondologylabs.com/blog/dac8-directive-eu-crypto-tax-transparency Description: The EU's DAC8 directive ends crypto anonymity from January 2026: who reports, what gets reported, and the penalties across Germany, Italy, France, Spain and Cyprus. ← Back to Blog The DAC8 Directive: The EU's Crypto Tax Transparency Dragnet Explained By Iraklis Anastasiou · July 17, 2026 As the EU's DAC8 directive takes effect across all 27 member states, crypto platforms are enforcing mandatory TIN collection to automatically share transaction-level data, bringing an end to non-reporting from Germany to Malta. Part 2 of 3 · The 2026 Crypto Tax Transparency Series Part 1: The GENIUS Act & U.S. tax · Part 2: The EU's DAC8 dragnet · Part 3: Crypto tax for expats in the EU In the European Union, the adoption of Council Directive (EU) 2023/2226, known as DAC8, marks the end of information asymmetry between crypto platforms and tax authorities. Formally adopted on October 17, 2023, and entering into effect across all 27 member states on January 1, 2026, DAC8 establishes a standardized framework for the automatic exchange of tax-relevant transaction data. The directive transposes the OECD's Crypto-Asset Reporting Framework (CARF) and the revised Common Reporting Standard (CRS 2.0) into binding EU law, targeting an estimated €1.4 billion in annual lost tax revenue from unreported crypto transactions. Under DAC8, Reporting Crypto-Asset Service Providers (RCASPs), which include centralized exchanges, custodial wallet providers, brokers, and certain decentralized finance (DeFi) platforms that maintain functional control over user access, must identify their EU-resident users, verify their tax residencies, collect their Taxpayer Identification Numbers (TINs), and report their transactional data annually. The reporting scope is comprehensive, covering crypto-to-fiat exchanges, crypto-to-crypto swaps, transfers to unhosted wallets, and retail payment transactions. Crucially, DAC8 operates without any de minimis threshold, meaning that any transaction or account balance above zero is reported. The enforcement mechanisms of DAC8 are particularly stringent. If a user fails to supply the required self-certification or a valid TIN, the platform is legally obligated to issue two formal reminders. If the user does not comply within 60 days of the second reminder, the platform must block their account from performing any reportable transactions, restricting usage strictly to withdrawals. Non-compliant platforms face administrative fines ranging from €20,000 to €500,000 and the potential revocation of their operating licenses. Data collection commenced on January 1, 2026, with the first reports due from platforms to national authorities by January 31, 2027, or June 30, 2027, depending on the member state's specific guidelines. The first automatic exchanges between EU tax administrations will take place on September 30, 2027, covering the entire 2026 calendar year. This European transparency layer operates in tandem with a broader global rollout of the OECD's CARF, which utilizes the same XML reporting schema and database structures. Over 75 jurisdictions have committed to CARF, which is being implemented in distinct waves, ensuring that offshore tax havens are integrated into the global reporting network. Table 1: The global CARF implementation waves Implementation Wave First Exchange Year Mandatory Data Collection Selected Participating Jurisdictions Wave 1 2027 January 1, 2026 All 27 EU Member States, United Kingdom, Japan, South Korea, Brazil, Colombia, South Africa. Wave 2 2028 January 1, 2027 Australia, Canada, Hong Kong, Singapore, Switzerland, United Arab Emirates. Wave 3 2029 January 1, 2028 United States (under domestic FATCA / 1099-DA integration). Non-Committed Undetermined Not yet legislated India, Argentina, El Salvador, Georgia, Vietnam, Philippines. National Tax Policies and Non-Compliance Penalties Within the EU While DAC8 standardizes the collection and exchange of data across the EU, it does not harmonize tax rates or domestic classifications of digital assets. Member states continue to apply highly heterogeneous tax regimes, and their respective tax administrations have established specific, severe penalties for taxpayers who fail to accurately declare their digital asset income. Germany: Germany does not treat cryptocurrencies as capital assets, classifying them instead as private money. Gains from the sale of digital assets are completely tax-free if the assets are held for longer than 12 months within private portfolios; if held for less than one year, gains are taxed at the taxpayer's progressive income tax rate. Under Germany's transposition of DAC8 via the Crypto-Asset Tax Transparency Act (KStTG), any failure to disclose taxable transactions will trigger retrospective income tax reassessments, an annual interest penalty of 1.8% on the unpaid tax liability, and potential criminal charges for deliberate tax evasion. Italy: Italy imposes a flat capital gains tax rate of 33% on crypto-asset profits exceeding a statutory threshold of €2,000 within a tax year. If an Italian resident fails to declare their crypto holdings or transactions, the authorities can impose administrative penalties ranging from 90% to 180% of the unpaid tax amount, in addition to interest charges. France: French tax residents are subject to a flat tax rate of 30% (a 12.8% income tax component and 17.2% in social levies) on private digital asset gains. French tax law requires the mandatory declaration of all foreign crypto exchange accounts via Form 3916-bis . Taxpayers who deliberately conceal accounts or transactions face a 40% surcharge plus interest, escalating to an 80% surcharge in cases of established fraud. Spain: Spain taxes digital asset capital gains under a progressive scale ranging from 19% to 28%. Spanish tax authorities use DAC8 data to automatically cross-reference transactions against individual personal income tax returns (IRPF), and the burden of proof is shifted to the taxpayer to reconcile discrepancies. Penalties reach 50% of the unpaid tax for negligent non-reporting, rising to 150% where Hacienda determines intentional concealment. Discrepancies exceeding €120,000 carry criminal prosecution for tax fraud. Cyprus: Under the 2026 tax reform package effective January 1, 2026, Cyprus introduced dedicated rules under Article 20E of the Income Tax Law. Eligible individual tax residents can elect to tax crypto disposal profits, including fiat sales, swaps, gifting, and retail payments, at a flat rate of 8%. Capital gains from crypto assets listed on recognized exchanges remain 100% exempt for casual private investors, while active staking and mining rewards fall under standard progressive bands (0–35%) or corporate income tax (raised from 12.5% to 15% in 2026). Under-declaration triggers audits, a 3.50% statutory late-payment interest rate, and administrative surcharges. Greece: Greece lacks a crypto-specific income-tax line, requiring taxpayers to declare digital assets as "securities" under general personal returns. Capital gains from crypto transfers are taxed at a flat 15% ; systematic professional trading is taxed under progressive business income rates (9% up to 44%). Investors log activity in Form E1 under Code 743 (acquisitions), Code 781 (sales), and Code 865 (capital gains); losses (Code 871) offset gains and carry forward for 5 years. Late or inaccurate filings trigger fines of 10%–50% of the unreported tax, rising to a flat 50% for non-filing, plus 8.76% annual interest. The Netherlands: The Netherlands does not levy a standard capital gains tax on individual investors. Crypto is declared as a wealth asset in "Box 3" based on fair market value on January 1st. In 2026, Box 3 rules assume a fictitious 6.00% return on "investments and other assets," taxed at 36%, an effective rate of roughly 2.16% on total portfolio value above a €59,357 allowance. A Supreme Court-approved actual-return rebuttal scheme allows paying 36% only on actual gains where returns are lower. Professional trading, mining, or crypto wages shift the obligation to "Box 1" progressive bands (up to 49.5%). Intentional Box 3 errors carry an automatic 150% fine (75% for gross negligence). Malta: Under Malta's Blockchain Tax Guidelines, treatment relies on token classification. Casual private investors enjoy a 0% capital gains tax on standard "Coins" (like BTC and ETH) and utility tokens, as they are not deemed securities. Security tokens with profit-participating or dividend-like rights follow standard capital gains rules. Professional trading under the "badges of trade" analysis is taxed as trading income at up to 35%, though Malta's full imputation system can reduce the effective corporate rate on distributed dividends to between 5% and nil. Resident non-domiciled individuals are exempt from Maltese tax on foreign-sourced capital gains, even if remitted. Unpaid balances incur late interest of 0.6% per month (7.2% annually). Table 2: EU crypto tax rates, relief, filing forms and non-reporting penalties by member state EU Member State Capital Gains Tax Rate Holding Period Relief Foreign Account Declaration Non-Reporting / Concealment Penalties Germany Progressive scale (up to 45% + surcharges) 100% tax exemption if assets held > 12 months. Not applicable (direct exchange via KStTG reporting). Retrospective reassessment, 1.8% annual interest, and criminal prosecution. Italy Flat 33% (on gains exceeding €2,000) None. RW Section of the annual tax return. Administrative penalties from 90% to 180% of the unpaid tax. France Flat 30% (private); progressive (habitual/business) Only crypto-to-crypto swaps are tax-neutral. Form 3916-bis (mandatory for foreign accounts). 40% surcharge plus interest; up to 80% for severe fraud. Spain Progressive scale (19% to 28%) None. Modelo 721 (for offshore assets). 50% for negligence; 100%–150% for intentional concealment. Cyprus 8% flat (individuals); progressive (0–35%) if professional; 15% CIT (companies) Listed crypto assets 100% exempt for private investors; non-doms exempt from SDC on yields. IR1 personal tax return (standard income categories). Under-declaration triggers audit, 3.5% statutory interest, 5%–10% surcharges. Greece 15% flat (private); progressive (9–44%) for business; 22% CIT None. Losses offset same-year gains and carry forward up to 5 years. Form E1 (Code 743 acquisitions, Code 865 foreign capital gains). 10%–50% of additional tax for inaccuracies; 50% for non-filing; 8.76% annual interest. Netherlands No CGT (private); Box 3 wealth tax: 36% on 6.00% notional return (~2.16% effective); Box 1 up to 49.5% for business Rebuttal scheme allows taxation on actual returns; €59,357 tax-free allowance per person. Box 3 section of the online return (Mijn Belastingdienst → "Overige Bezittingen"). Intentional errors 150%; gross negligence 75%; voluntary disclosure can reduce fines. Malta 0% on personal gains (coins/utility tokens); 35% CIT (effectively 0–5% under imputation); up to 35% for trading income No holding-period requirement. Resident non-doms exempt on foreign gains unless remitted. Standard income tax return. Administrative fines, 0.6%/month interest (7.2% annually), potential default assessments. Operational Directives for Platforms and Taxpayers Verify and document tax residency status. Expatriates and international residents must establish their tax residency under local laws and bilateral Double Taxation Agreements (DTAs), documenting physical presence and economic ties using the OECD Article 4 tie-breaker cascade to support residency claims during audits. Conduct thorough account and data audits. Gather complete historical transaction data across all centralized exchanges, custodial wallets, and on-chain protocols. CARF-compliant software can help reconcile cost basis records and identify discrepancies before data is automatically exchanged in 2027. Address past discrepancies proactively. Taxpayers with undeclared income from prior years should consider domestic voluntary disclosure programs. Disclosing before host authorities receive the automated 2026 dataset can reduce surcharges and minimize criminal audit risk. Complete KYC and TIN verification. Users of EU-regulated platforms (or non-EU platforms serving EU residents) must confirm their correct TINs are on file to prevent mandatory account blocks. Update corporate balance-sheet accounting. Ensure the treatment of stablecoins aligns with the definitions under the GENIUS Act and GAAP. Stablecoins issued by non-permitted or unregulated entities cannot be classified as cash or cash equivalents. How Ondology Labs Can Help DAC8 makes on-chain activity permanently legible to tax administrations, and the same analytics regulators use to cross-reference returns can help firms and investors get ahead of it. Ondology Labs provides Cyprus-based DAC8 reporting support : applicability scoping, aggregation and valuation of reportable transactions, and a reporting dataset reconciled to the chain and the books before automatic exchange begins, backed by blockchain auditing and forensic transaction tracing . For CASPs navigating both DAC8 and the closing MiCA transition window , that is the difference between audit-ready and exposed. Read Part 1: The GENIUS Act and the tax status of digital assets , or continue to Part 3: How DAC8 and CARF affect international expats in the EU . How Ondology Labs can help: We work on the data underneath DAC8 rather than on the filing itself: DAC8 and tax reporting scoping and reports reconciled to the chain and the books, crypto audit support when your auditor cannot test the crypto balances, and statutory crypto audits delivered with our ICPAC-licensed partner. Related reading: Crypto reporting obligations in Cyprus: DAC8, MiCA, AML and the 8% tax · DAC8 and CARF: a crypto tax guide for EU expats · Crypto audits in 2026: the new standard Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # DAC8 & CARF: Crypto Tax Guide for EU Expats | Ondology Labs URL: https://ondologylabs.com/blog/dac8-carf-crypto-tax-international-expats-eu Description: DAC8 and CARF for expats in the EU: what your exchange reports, to which tax authority, from when, and what to fix in your records before it lands. ← Back to Blog DAC8 and CARF: A Crypto Tax Guide for International Expats Living in the EU By Iraklis Anastasiou · July 15, 2026 International tax residents, including U.S., Indian, Emirati and Singaporean expats living in the EU, must navigate a web of global CARF data exchanges and strict tax residency rules that dissolve historical offshore crypto tax havens. Part 3 of 3 · The 2026 Crypto Tax Transparency Series Part 1: The GENIUS Act & U.S. tax · Part 2: The EU's DAC8 dragnet · Part 3: Crypto tax for expats in the EU For international tax residents residing in the EU, the operational launch of DAC8 and its global integration with CARF eliminate the geographic and informational insulation that previously characterized cross-border digital asset holdings, through the free exchange of information between crypto service providers. Following the OECD's endorsement of CARF, the European Union pledged to adopt the rules beginning January 1, 2026, for all EU Member States , and they are now in effect. Tax residency in international law is determined by physical presence, center of vital interests, and treaty tie-breaker rules, subjecting individuals who reside in an EU member state to unlimited tax liability on their worldwide income, regardless of the physical location of the exchange or wallet. Figure 1: How global tax reporting applies to U.S., Indian, UAE and Singaporean expatriates who are EU tax residents 1. United States Citizens Residing in the EU U.S. citizens living within the European Union are subject to a complex, dual-layered tax reporting structure. Because the United States enforces citizenship-based taxation, U.S. citizens must report and pay taxes on their worldwide income to the IRS regardless of their actual country of physical residence. When residing in an EU member state, they are simultaneously classified as local tax residents, subjecting their worldwide digital transactions to the unlimited fiscal jurisdiction of their host European nation. From a compliance perspective, these individuals are monitored through two distinct regulatory frameworks. Any European or offshore exchange used by a U.S. citizen will collect their host EU nation's TIN and report all transactions to the local European tax authority under DAC8. Simultaneously, under FATCA, foreign financial institutions must identify and flag U.S. persons, automatically reporting their account details and balances to the IRS. If these individuals use U.S.-based digital asset brokers, their transactions will be reported to the IRS on Form 1099-DA . To avoid double taxation, U.S. citizens must claim the Foreign Tax Credit (FTC) on Form 1116, offsetting their U.S. federal tax liability by the amount of tax paid to their host EU country. However, because of differences in tax timing, such as Germany exempting gains after one year while the U.S. continues to tax long-term capital gains at rates up to 20%, taxpayers can face significant cash-flow and reporting mismatches. Additionally, a U.S. citizen who attempts to expatriate to resolve this dual-reporting burden may be classified as a "covered expatriate" if their net worth exceeds $2 million or their average annual net income tax liability exceeds statutory thresholds. This classification triggers the U.S. Exit Tax, which treats all worldwide holdings, including all cryptocurrency and stablecoin positions, as if they were sold at fair market value on the day before expatriation, realizing immediate capital gains taxes on all unrealized paper profits. 2. Indian Citizens Residing in the EU Indian nationals who relocate to the EU and meet local physical residency requirements (such as Slovakia's 183-day presence rule or Estonia's rolling 12-month domestic test) must report and pay taxes on their global income, including all digital asset transactions, within their host EU country. This creates a significant mismatch with the domestic tax rules of their home country. In India, digital assets are subject to a flat 30% tax rate with no option to offset losses, alongside a 1% Tax Deducted at Source (TDS) on domestic transactions. Since India is classified as a non-committed jurisdiction under the OECD's CARF, Indian domestic exchanges are not currently participating in the automatic exchange of data with EU member states, creating a temporary informational gap . However, this gap is narrow and carries high compliance risks. As EU tax residents, Indian nationals are legally required to self-report all foreign assets and worldwide transactions. If an EU tax authority detects undeclared transactions on Indian platforms (during an audit or through blockchain analytics tracking transfers to an EU custodial exchange), the taxpayer faces severe non-disclosure penalties. Administrations such as the Spanish Hacienda can apply indirect audit methods, assessing tax based on the unexplained accretion of wealth, resulting in administrative surcharges of up to 150% and potential criminal prosecution. 3. United Arab Emirates Residents Residing in the EU The United Arab Emirates has become a prominent hub for digital assets due to its highly favorable domestic tax policy, which features a 0% personal income and capital gains tax on individual investors. While corporations are subject to a 9% federal corporate tax on profits exceeding AED 375,000, entities operating in free zones like the Dubai International Financial Centre (DIFC) or Abu Dhabi Global Market (ADGM) can maintain a 0% corporate rate on qualifying activities, such as proprietary trading, by demonstrating physical substance. However, if a UAE national or expatriate establishes physical residency in the EU, the UAE's tax-free status is nullified. The individual's worldwide transactions are immediately subject to the tax rates of their host EU country. Any assumption that transactions executed on UAE platforms will remain hidden is outdated. The UAE is a signatory to the CARF MCAA, with mandatory data collection commencing in 2027 and automatic cross-border exchanges with EU tax authorities starting in 2028. Consequently, any digital asset activity conducted on UAE-regulated exchanges (such as those authorized by Dubai's Virtual Assets Regulatory Authority or Abu Dhabi's FSRA) by an EU tax resident will be automatically reported to their home EU tax authority by 2028. Failure to declare these transactions during 2026 and 2027 will lead to retrospective audits and significant non-compliance penalties once the CARF data exchange begins. 4. Singaporean and Asian Residents Residing in the EU Singapore operates under a territorial tax framework and does not impose a general capital gains tax on personal investments. Gains from the disposal of digital payment tokens are tax-free for individual investors, provided the transactions are classified as private investment rather than an active trade or business. If the Inland Revenue Authority of Singapore (IRAS) determines that activity constitutes a business (evaluated using "badges of trade" such as holding periods, transaction frequency, and commercial intent), profits are taxed as ordinary income at progressive rates up to 24% for individuals, or a flat 17% corporate tax rate for companies. For a Singaporean or Asian resident who relocates to the EU, Singapore's capital gains tax exemption does not carry over. As an EU tax resident, their worldwide income is taxable under the progressive or flat-tax structures of their host country, regardless of whether Singapore classifies the activity as private investment. Operationally, Singapore signed the CARF MCAA in November 2024, with mandatory data collection starting in 2027 and automatic data exchanges scheduled for 2028. The IRAS is actively preparing its data pipelines to extract and format transaction-level details into the required OECD XML format. As a result, all transaction records, taxpayer identities, and year-end balances held by EU residents on Singaporean exchanges or custodial platforms will be transmitted directly to European tax authorities, exposing undeclared assets to tax audits and retrospective penalties. Table 1: Crypto tax exposure for international expatriates who become EU tax residents National Origin Home Country Tax Policy on Crypto CARF Status / Exchange Year Host EU Country Tax Implications Primary Compliance and Operational Risks United States Short-term: up to 37%; long-term: up to 20%. Notice 2014-21 property rules apply. Non-CARF participant; relies on FATCA and Form 1099-DA. Dual-layered reporting; must file both host country and U.S. tax returns. FTC timing mismatches; double-taxation risk; FBAR/FATCA compliance; covered-expatriate Exit Tax on unrealized gains. India Flat 30% with no loss offsets; 1% TDS on domestic trades. Non-committed jurisdiction under CARF. Global gains taxed by the EU host country; Indian exchange accounts must be declared. Severe penalties under Spanish/French law for undeclared assets; indirect audit methods based on wealth accretion. United Arab Emirates 0% personal tax; 9% corporate tax over AED 375,000. Committed; Wave 2 exchanges begin in 2028. UAE 0% tax benefit is lost; global gains taxed under host EU country rates. CARF data exchange in 2028 will expose undeclared UAE exchange accounts to retrospective audits and penalties. Singapore 0% capital gains (personal); 17% corporate tax (trading business). Signed CARF MCAA; Wave 2 exchanges begin in 2028. Personal capital gains exemption is lost; gains taxed under host EU country rates. CARF data exchange in 2028 will transmit transaction-level data, exposing any undeclared accounts to audits. Operational Directives for EU-Resident Expats Submit TIN and onboarding verifications proactively. Supply correct, up-to-date TINs and completed self-certification forms to every crypto-asset platform you use. Failure to comply within 60 days of a platform's second reminder legally mandates locking the account from any further transactions. Reconcile cost basis and consolidate activity early. Reconcile historical ledger entries across centralized exchanges, DeFi protocols, and unhosted wallets using CARF-compatible tax tools to preempt discrepancies before automatic exchanges on September 30, 2027. Evaluate and clear prior-year under-declarations. For undeclared gains from years preceding DAC8, coordinate with a qualified tax advisor to pursue a voluntary disclosure correction, which significantly reduces penalty multipliers compared to audits triggered after 2026 dataset transmissions. Establish genuine residency and track day counts. Meticulously document physical day counts, local lease agreements, family center of vital interests, and professional ties to establish a defensible primary tax residency under OECD tie-breaker criteria, using DTAs to mitigate double taxation. Prepare for Wave 2 cross-border transfers. Expatriates from the UAE and Singapore must prepare for automated CARF reporting starting in 2028, auditing foreign accounts to confirm all holdings have been fully declared in their home EU jurisdiction. The implementation of DAC8, in alignment with the OECD's global CARF, marks the end of reporting opacity for European Union tax residents and expatriated international residents alike. By transposing transaction-level data collection directly into binding EU law, the EU has established an automated, cross-border database-matching framework that replicates standard banking transparency. While the first automatic exchange (covering 2026) occurs in 2027, the operational architecture went live on January 1, 2026, meaning all current on-chain and centralized activity is already generating a verifiable paper trail. How Ondology Labs Can Help For expats, the hardest part is proving a clean, coherent transaction history across years of cross-border, multi-exchange activity. Ondology Labs uses the same-grade blockchain forensics and transaction tracing that tax authorities rely on, reconstructing fund flows across chains, wallets, and jurisdictions, paired with DAC8 and tax reporting support to document cost basis and residency-relevant activity with court-ready rigor. If you are an EU tax resident preparing for automatic exchange, that evidence is what turns a potential audit into a straightforward reconciliation. Catch up on Part 1: The GENIUS Act and the tax status of digital assets and Part 2: The DAC8 directive and the EU's transparency dragnet . How Ondology Labs can help: For businesses that will be doing the reporting rather than being reported on, we handle DAC8 and tax reporting , transaction reconciliation so the numbers tie to the chain before they are filed, and crypto audit support where an auditor needs on-chain evidence. Related reading: The DAC8 directive: the EU's crypto tax transparency dragnet · Crypto reporting obligations in Cyprus · The GENIUS Act and the tax status of digital assets Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # EU Privacy Token Ban: What It Means for Cyprus | Ondology Labs URL: https://ondologylabs.com/blog/eu-privacy-token-ban-cyprus-crypto-forensics Description: The EU privacy token ban explained: what AMLR bans from 2027, what it means for Monero and mixers, and what it signals for crypto forensics in Cyprus. ← Back to Blog EU Privacy Token Ban: What It Signals for Cyprus and Crypto Forensics By Iraklis Anastasiou · May 21, 2025 A New Era of AML Oversight in Crypto The European Union has finalized a sweeping Anti‑Money Laundering Regulation (AMLR) set to take effect in 2027, targeting anonymous crypto‑asset accounts and privacy‑preserving tokens like Monero (XMR) and Zcash (ZEC). Under Article 79, credit institutions, financial firms, and crypto‑asset service providers (CASPs) will be banned from facilitating anonymous accounts or handling privacy coins . Implementation details, such as how providers must adapt internal processes, are still being shaped through "level‑two" implementing and delegated acts directed by the European Banking Authority. Moreover, direct oversight will expand: AMLA will begin supervising at least 40 entities from mid‑2027, each with substantial operations across multiple EU states and meeting thresholds such as over €50 million in transaction volume or a minimum of 20,000 clients in a host country. Additionally, mandatory due diligence will kick in for transactions exceeding €1,000. What This Means for Cyprus Cyprus, a growing hub for blockchain and fintech firms, will need to ensure its CASPs comply with the new EU AMLR framework. As a result of this elevated regulatory scrutiny, providers offering privacy-coin services or anonymous account access face regulatory constraints that may require operational restructuring. Additionally, compliance overhaul and cost pressures will arise as firms operating in Cyprus will need to overhaul onboarding, due diligence processes, and privacy-linked services. That may involve investing in enhanced identification protocols, now mandatory for any transactions over €1,000. Conversely, CASPs that invest early in compliant infrastructure and demonstrate strong AML controls may gain trust among EU regulators and institutional clients. They'll be better positioned to scale under the upcoming AMLA oversight regime as they have done so earlier in 2025 with acquiring MiCA licenses . Cyprus-based firms may increasingly be evaluated in cross-border AML risk assessments, meaning geopolitical and strategic considerations must be undertaken by foreign companies that also seek MiFID by acquiring these Cyprus-based firms (Figure 1). Ensuring transparency and cooperation with EU authorities could become a differentiating factor in an industry where trust is paramount. Figure 1: Announcement of MiFID acquisition Source: Crypto.com Strategic Opportunity For Cyprus to Bridge Regulation and Innovation As one of the European Union's most active jurisdictions for crypto-assets, Cyprus stands at a pivotal juncture. There is now a clear avenue for local CASPs and MiCA-licensed entities to redefine their value proposition, shifting toward a compliance-first infrastructure that guarantees both security and programmable transparency. To achieve this, Cypriot institutions can leverage Porto-style programmable wallets. This technology serves as the connective tissue between MiCA's regulatory framework and AMLR's forensic necessities. It allows for the creation of robust financial products, such as tiered corporate wallets equipped with role-based permissions and automated limits. Furthermore, it facilitates cross-chain settlement with immutable compliance trails, granting regulators real-time visibility into policy enforcement while upholding strict client confidentiality. In essence, Cyprus is becoming the EU's regulatory sandbox. By demonstrating that compliance frameworks can function in harmony with technological flexibility, Cypriot operators are setting a new standard. As the digital asset market matures, the institutions that integrate policy directly into their wallet architecture will secure their place as the ecosystem's most trusted operators. During a recent interview with Arthur Firstov, Chief Business Officer at Mercuryo (a payment service provider that enables users to buy cryptocurrencies using fiat currency via various payment methods) mentioned that just as the EU's AMLR forces crypto to mature, Porto , for example, offers the missing architecture to make that maturity functional. When combined with Fireblocks' policy engines , Stripe's Privy infrastructure , and forensic intelligence tools from firms like Crystal Intelligence, Elliptic, or Global Ledger, programmable custody evolves into a full-stack compliance layer. The post-2027 European market will belong to the firms that can prove trust algorithmically, where every wallet, transaction, and audit trail runs on verifiable logic instead of manual checks. Cyprus, with its fintech density and regulatory flexibility, is well-positioned to pilot that vision. Porto and similar programmable wallet frameworks could make the island not just compliant with EU oversight, but a global benchmark for compliant, composable finance. Why Forensic Investigations Are Crucial Amid Heightened Regulation With privacy tokens off-limits and anonymous accounts barred, forensic tools become essential in verifying the legitimacy of historical transactions and distinguishing between compliant activity and illicit flows. For CASPs audited by AMLA or subject to investigations, digital and blockchain forensics provide verifiable audit trails (Figure 2). They strengthen institutional defenses and show transparency to both regulators and clients. In cases of fraud or unauthorized transfers, forensic analytics facilitate tracing and potentially recovering misappropriated funds, even when obfuscated by privacy-layered mechanisms. As anonymity recedes as a feature, user and investor confidence will lean heavily on forensic transparency. Firms effectively leveraging forensic capabilities can position themselves as secure and accountable. Figure 2: Flow visualization of an high-risk wallet address Source: Crystal Intelligence Precision Forensics for a Regulated Future In light of evolving EU AML mandates and the phasing out of privacy tokens, the role of forensic investigations cannot be overstated. Ondology Labs offers specialized digital forensic services and blockchain investigation frameworks that directly address these new regulatory challenges. With expertise in endpoint investigations, onchain tracing, and legally robust chains of custody, Ondology Labs equips exchanges, fintech firms, and regulators to reconstruct complex transactional narratives, even when privacy-enhancing technologies were previously employed. Their blend of technical precision and compliance-readiness makes them an ideal partner for any entity operating under the AMLR's upcoming obligations. The EU's 2027 ban on anonymous accounts and privacy tokens marks a pivotal shift in crypto regulation, aimed at enhancing transparency and combating illicit finance. For Cyprus, the mandate presents both compliance challenges and opportunities for leadership. Against this backdrop, forensic investigations emerge not only as instrumental tools for compliance and accountability but also as foundations for trust in a privacy-curtailed era. As the crypto ecosystem adapts, partnering with expert forensic firms like Ondology Labs can mean the difference between regulatory entanglement and responsible, resilient growth. How Ondology Labs can help: As anonymity recedes under the EU's AML regime, verifiable transaction trails become essential. We provide blockchain forensics and transaction tracing alongside blockchain auditing to keep CASPs audit-ready across Cyprus and Greece. Related reading: The U.S. Treasury's policy shift on crypto mixers · The EU's DAC8 crypto tax directive . Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Inside the CoinDCX $44M Hack | Ondology Labs URL: https://ondologylabs.com/blog/coindcx-44-million-hack Description: How the CoinDCX 44 million dollar hack unfolded on-chain, how the stolen funds were laundered, and what exchanges should learn about hot wallet control. ← Back to Blog CoinDCX $44 million hack: inside the breach and the urgent role for forensic investigations By Iraklis Anastasiou · July 31, 2025 In mid‑July 2025, CoinDCX, one of India's largest cryptocurrency exchanges operated by Neblio Technologies, became the victim of a $44 million hack. According to Bengaluru police and internal investigations, attackers gained unauthorized access by compromising the credentials of a software engineer, Rahul Agarwal, via his company‑issued laptop. At around 2:37 am on July 19, a single USDT was transferred out; within hours, the intruders drained $44 million, distributing funds across six wallets. CoinDCX described the incident as a "sophisticated social engineering attack" orchestrated by an actor posing as a recruiter, tricking Agarwal into installing malware on his device . Bengaluru police subsequently detained Agarwal, who consistently denied direct involvement in the theft, although admitting to freelance work for up to four external clients while still employed at CoinDCX. A suspicious deposit of roughly ₹15 lakh (~$18,000) into his personal account and an alleged WhatsApp call linked to Germany remain under scrutiny. Source: X /@Smtgpt Why forensic investigations are indispensable in such cases Deep system and endpoint forensic analysis It is essential to conduct a full forensic examination of the compromised laptop and server logs to trace malware installation, lateral movements, and unauthorized sessions. Such analysis is fundamental to distinguishing between insider culpability and remote exploitation. On‑chain tracing and fund flow reconstruction Advanced blockchain intelligence tools are vital to map the movement of funds across chains and exchanges. For example, platforms like Crystal Intelligence or TRM Labs aid investigators in piecing together how stolen assets traverse multiple wallets and obfuscation layers (Figure 1). Chain of custody and legal admissibility Maintaining an auditable chain of custody is non‑negotiable. Modern forensic frameworks, especially those integrating blockchain-based evidence management, ensure integrity and transparency in legal proceedings. Cross‑jurisdiction coordination Given that crypto transactions can span borders, forensic labs must collaborate with law enforcement in multiple countries to trace origins, identify beneficiaries, and freeze assets. Figure 1: Flow visualization of an high-risk wallet address Source: Crystal Intelligence Hard Constraints, Not Hopes: The Programmable Custody Stack Account-abstraction wallets (ERC-4337) with policy-first design: passkey login → mint scoped session key → policy engine enforces who/what/where/how much. Device and context attestation at sign and at send (FIDO/WebAuthn, OS integrity). If posture fails, txn can't be constructed: no 'approve later' loopholes. Withdrawal-class segmentation: separate smart accounts (hot ops, warm treasury, cold vault), each with different policy ceilings and approval graphs. Live forensic hooks: every policy decision, signature, and session-key grant logged on-chain/off-chain for immediate investigation. Destination controls: whitelists, chain/asset allow-lists, time-locks on first-seen addresses; velocity + anomaly caps at the wallet layer. These preemptive processes and post-event frameworks are paramount to providing an initial shield for customers' funds, as well as a quick response due to time sensitivity, which can prevent bigger losses in these cases. Ensuring coordination and cooperation from exchanges and law enforcement agencies on a national or global scale is equally as important, as these frameworks can serve as the foundations for catching fraudsters and identifying breaches in time to prevent them. This was underlined by comments in July by Arthur Firstov, Chief Business Officer at Mercuryo (a payment service provider that enables users to buy cryptocurrencies using fiat currency via various payment methods), who said that CoinDCX didn't just suffer a $44M breach; it hit the limits of a non-programmable custody model. He went further to comment that "The fix isn't more training. It's wallet infrastructure that enforces policy by default." Exchanges keep losing to social engineering because their wallets don't speak policy. Move the control plane into the wallet (via ERC-4337 smart accounts, passkeys, and scoped session keys), and your 'last mile' is code, not a compromised laptop. Privy's reach and Stripe's backing show this is going mainstream; Porto's policy model shows how to do it right. After CoinDCX, treating forensics and policy as infrastructure, not incident response, should be table stakes. Selecting the right partner for crypto‑forensic resilience In situations like the CoinDCX hack, timely and rigorous forensic engagement is the linchpin to uncovering attack chains and recovering assets. That's where Blockchain investigators and law enforcement come in. Offering high‑fidelity endpoint investigations, blockchain fund tracing, and legal‑compliant chain‑of‑custody frameworks, investigation experts and dedicated agents bridge the technical and evidentiary gaps in complex cryptocurrency breach cases. Ondology Labs ' insights: Broader implications for the industry Strengthened employee risk mitigation: Exchanges must enforce stricter access controls, regular security training, and monitoring to counter sophisticated social engineering. Regulatory pressure ahead: As high‑profile hacks accumulate, jurisdictions worldwide are likely to tighten oversight on crypto‑asset custodians and mandate forensic readiness. Reputation and trust resilience: Rapid engagement of reputable forensic experts post‑incident helps restore confidence among users and stakeholders. Reminiscent of the recent major Bybit hack , which featured social engineering as well as the use of mixing, the CoinDCX breach illustrates the dual threats of insider access exploitation and orchestrated social engineering. As investigations continue, only comprehensive digital and blockchain forensic work can clarify responsibility, track fund flows, and support asset recovery. For exchanges, legal teams, and enterprises navigating such crises, turning to a forensic partner can be the decisive step from chaos to clarity. How Ondology Labs can help: In a breach, speed decides recovery. We deliver blockchain forensics, fund-flow tracing and crypto recovery with legally admissible, court-ready evidence. Related reading: The 2025 ransomware surge and crypto incident response · Blockchain forensics in Cyprus and Greece . Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Blockchain Forensics in Cyprus and Greece | Ondology Labs URL: https://ondologylabs.com/blog/blockchain-forensics-cyprus-greece Description: Blockchain forensics in Cyprus and Greece: how crypto crime is traced, what evidence stands up in court, and how victims and lawyers should respond. ← Back to Blog Navigating Crypto Crime: A Look at Blockchain Forensics in Cyprus and Greece By Iraklis Anastasiou · October 31, 2023 · Updated September 2, 2026 Blockchain forensics is the practice of tracing, clustering and documenting cryptocurrency transactions to produce evidence that can support a legal case. This page explains what it can and cannot establish, how an investigation actually runs, and who does what in Cyprus and Greece when crypto crime is reported. What Blockchain Forensics Is Every transaction on a public blockchain is permanent and visible to anyone. Blockchain forensics turns that public record into evidence: it links addresses into clusters controlled by the same party, attributes clusters to real-world entities such as exchanges and payment processors, and follows value as it moves through wallets, mixers, bridges and swaps. The output is not a hunch. It is a documented flow of funds with a methodology another expert can test. The discipline is distinct from general blockchain analytics or compliance monitoring. Monitoring asks whether a transaction looks risky. Forensics asks what actually happened, in a form a court, a regulator or an insolvency practitioner can rely on. That difference shows up in the working papers: chain of custody for the data, stated assumptions, and honest limits on every attribution. What It Can and Cannot Establish Tracing can usually establish where funds went, which services they touched, and where they came to rest or were cashed out. When stolen funds reach a regulated exchange, tracing plus a legal process can identify the account holder and freeze what remains. That combination is behind most successful recoveries. What tracing alone cannot do is name the person behind a private wallet. An address is not an identity. Attribution to a person needs an off-chain anchor: an exchange account opened with KYC, an IP log, a device, a slip in operational security. Any firm that promises to "unmask" a wallet from chain data alone is overselling, and we say so plainly in our transaction tracing work. How an Investigation Runs A competent engagement follows a chain. First the trace: transactions mapped across chains, clusters identified, exit points flagged. Then the investigation, where on-chain findings are combined with whatever off-chain material exists, such as exchange records, internal ledgers, correspondence and open-source intelligence; this is the shape of our corporate investigations . If funds are recoverable, the evidence supports freezing orders, police referral or civil claims through crypto asset recovery . And when a matter reaches court, the analysis is presented by an expert witness whose report sets out method, data sources and limitations so it survives cross-examination. Speed matters more than most victims expect. Funds routed through a mixer or bridged to another chain within hours are far harder to follow, and exchanges can only freeze what has not yet been withdrawn. The practical playbook for the earliest hours is in our step-by-step guide, the first 24 hours after your crypto is stolen . Who Does What in Cyprus Cyprus has a defined institutional map for crypto crime, and using it correctly saves weeks. Cyprus Police : theft and fraud are reported to the police, whose cybercrime unit handles the digital side. A police report is also the anchor document that exchanges and insurers ask for. MOKAS , the Cyprus financial intelligence unit, receives suspicious transaction reports from obliged entities and can act on laundering flows; private victims do not file with MOKAS directly, but investigations often intersect with its work. CySEC supervises crypto-asset service providers under MiCA. Since the Article 143(3) transitional period ended on 1 July 2026, providing crypto-asset services from Cyprus without MiCA authorisation is unauthorised activity, which matters when the counterparty in your case is a local platform. The courts : Cyprus civil procedure supports freezing and disclosure relief, and blockchain evidence is presented through expert reports. The forensic work has to be built for that standard from the start, not upgraded afterwards. Who Does What in Greece The Hellenic Police Cyber Crime Division investigates crypto fraud and theft; reports can be filed at local stations or through its online channels. The Hellenic FIU (the Anti-Money Laundering Authority) receives suspicious transaction reports and can freeze assets connected to laundering. The Hellenic Capital Market Commission (HCMC) is Greece's competent authority for crypto-asset service providers under MiCA, the counterpart to CySEC in Cyprus. Because both countries apply the same EU framework, MiCA for authorisation and the EU anti-money-laundering rulebook for reporting, a trace built to Cypriot evidentiary standards travels well to Greek proceedings and vice versa. Cross-border cases inside the EU can also lean on European cooperation channels between police forces and FIUs. The Cases Where Forensics Earns Its Keep Four situations account for most of the forensics work we see in Cyprus and Greece. The first is theft from individuals: wallet drainers, fake trading platforms, romance-led investment fraud and compromised seed phrases, where the immediate questions are where the funds sit now and whether an exchange can still freeze them. The second is incidents at businesses: an exchange hack, an insider moving treasury funds, a payment sent to a spoofed address, where the trace runs alongside an internal investigation. The third is insolvency and disputes: a platform collapses or a counterparty claims the crypto is gone, and a liquidator or litigant needs the assets found and valued before any legal strategy makes sense. The fourth is ransomware, where speed dominates everything; the payment leaves in minutes and the tracing has to start the same day, a dynamic we covered in our analysis of the 2025 ransomware surge . Each of those cases ends differently, and honesty about the likely ending is part of the job. A trace that shows funds sitting in a mixer with no exit is a real answer, even though it is not the answer anyone wanted. It stops the victim spending more money chasing what cannot be reached, and it is precisely the situation where "guaranteed recovery" firms do the most damage. What Makes Blockchain Evidence Admissible Courts in both jurisdictions accept blockchain evidence when it is presented properly, and the standards are the familiar ones for any expert evidence rather than anything crypto-specific. The data must be preserved with a chain of custody, so the analysis can be reproduced from the same inputs. The methodology must be explained: how clusters were formed, which attribution sources were used and how reliable each one is. Assumptions must be separated from findings, and the expert must stay inside their expertise, describing what the chain shows rather than arguing the legal conclusion. Reports written that way survive the other side's expert; reports written as advocacy do not. This is also why forensic work should be built for court from day one even when litigation looks unlikely. Upgrading a quick informal trace into an evidential report after the fact usually means redoing it. Choosing a Forensics Provider Three questions separate serious providers from the rest. First, will the work survive scrutiny: is there a documented methodology, a chain of custody, and a named expert prepared to defend the findings in court? Second, does the provider state limits honestly, including the odds that nothing is recoverable? Third, who is actually behind the firm: a registered company with verifiable people, or a website with a contact form? We keep a verification page for exactly that check, and we encourage you to use it on anyone you consider engaging, including us. How Ondology Labs can help: If you need to trace or recover stolen crypto, we provide blockchain forensics and crypto recovery backed by court-ready evidence across Cyprus and Greece. Related reading: The first 24 hours after your crypto is stolen · What lawyers should look for in a crypto expert witness · Inside the CoinDCX $44M hack . Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Ransomware Up 50%: Crypto Incident Response | Ondology Labs URL: https://ondologylabs.com/blog/ransomware-surges-2025-crypto-incident-response Description: Ransomware payments surged in 2025. How crypto incident response works, what to do in the first hours after an attack, and how payments are traced. ← Back to Blog Ransomware Surges 50% in 2025: Why Speed and Forensics Now Define Crypto Incident Response By Panayiotis Kattides · December 4, 2025 The latest findings from Chainalysis , as reported by Cointelegraph , highlight a troubling escalation in cybercrime: ransomware attacks surged by nearly 50% in 2025, with attackers increasingly leveraging cryptocurrency rails to extract and launder funds. This sharp rise is not just a statistic. It signals a structural shift in how cybercriminals operate and how defenders must respond. Against this backdrop, a new partnership between Ondology Labs and Cyberfraud Investigators reflects a broader industry evolution: the convergence of cyber intelligence and blockchain forensics to combat time-sensitive digital asset crimes. The New Reality of Ransomware in Crypto Ransomware has evolved from opportunistic attacks into highly coordinated, professionalized operations. According to Chainalysis data, several key trends define the current threat landscape: Higher attack frequency: A 50% increase year-over-year reflects expanding attacker capabilities Crypto-native laundering: Funds are rapidly moved across wallets, bridges, and obfuscation tools Shorter response windows: The time between attack and asset dispersion continues to shrink Target diversification: Beyond enterprises, attackers increasingly target SMEs and individuals The implication is clear: traditional investigative timelines are no longer sufficient. Once funds are moved through mixers, cross-chain bridges, or layered wallets, recovery becomes exponentially more difficult. The Critical Role of Crypto Forensics As ransomware actors adopt more sophisticated laundering techniques, blockchain forensic capabilities have become central to incident response. Effective crypto investigations now require: Real-time transaction tracing across multiple blockchains Attribution analysis linking wallets to known threat actors Pattern recognition for identifying obfuscation techniques Actionable intelligence for law enforcement and asset recovery Speed is the defining factor. Delays of even a few hours can allow attackers to fragment funds across dozens of wallets or exit into fiat systems. This is where specialized forensic teams play a decisive role. Partnership Announcement: Ondology Labs × Cyberfraud Investigators In response to this growing threat landscape, Ondology Labs and Cyberfraud Investigators have entered into a strategic partnership aimed at accelerating crypto incident response and asset recovery efforts. With over two years of focused experience in blockchain forensics, Ondology Labs has built a strong track record delivering: Detailed crypto forensic reports Wallet tracing and fund flow reconstruction Investigative support for legal and enforcement actions As part of this collaboration, Ondology Labs will power Cyberfraud Investigators with advanced crypto forensic capabilities, enhancing their ability to respond to crypto-related fraud cases with precision and speed. The partnership is designed to address a critical gap in the market: the need for integrated cyber and blockchain investigations under a unified response framework. Cyberfraud Investigators: Capabilities and Milestones Cyberfraud Investigators has established itself as a growing force in cybercrime response across Cyprus and Greece, focusing on fraud prevention, digital investigations, and victim support. Core Offerings Cybercrime investigations: Handling cases involving fraud, scams, and digital financial crimes Incident response services: Rapid engagement following cyberattacks or unauthorized transactions Victim advisory and support: Assisting individuals and organizations in navigating recovery processes Collaboration with authorities: Supporting law enforcement efforts with structured intelligence Regional Expertise Operating in Cyprus and Greece, Cyberfraud Investigators brings: Strong understanding of local regulatory environments Experience working within cross-border investigation frameworks Established presence in high-risk fraud corridors in the region Growth and Positioning In a relatively short period, the firm has: Built a reputation for responsive case handling Expanded its footprint across multiple jurisdictions in Southern Europe Positioned itself as a bridge between victims, investigators, and enforcement bodies However, like many cyber investigation firms, the increasing complexity of crypto-related cases has necessitated specialized blockchain expertise, a gap this partnership directly addresses. A Combined Force: Speed as a Competitive Advantage The collaboration between Ondology Labs and Cyberfraud Investigators is built around a single operational principle: time is the most critical variable in crypto asset recovery. By combining Cyberfraud Investigators' frontline incident response and case management with Ondology Labs' deep blockchain forensic capabilities, the partnership enables: Faster identification of attacker wallets Immediate tracing of stolen funds Structured reporting for law enforcement and legal proceedings Improved chances of asset recovery before funds are irreversibly dispersed This integrated approach significantly reduces the traditional lag between incident detection and forensic action. The Broader Industry Signal The rise in ransomware activity is not an isolated trend. It reflects the increasing financialization of cybercrime through crypto infrastructure. As a result: Cybersecurity alone is no longer sufficient Compliance frameworks must incorporate forensic readiness Incident response must evolve into multi-disciplinary operations Partnerships like Ondology Labs × Cyberfraud Investigators signal a shift toward specialized, collaborative defense models. Conclusion The 50% surge in ransomware attacks underscores a fundamental reality: crypto-enabled crime is accelerating, and response capabilities must evolve accordingly. In this environment, the ability to act quickly, combining cyber intelligence with blockchain forensics, can determine whether stolen assets are traced and recovered or permanently lost. By joining forces, Ondology Labs and Cyberfraud Investigators are positioning themselves at the forefront of this evolving battlefield, delivering faster, more precise, and more effective crypto investigation capabilities across Cyprus, Greece, and beyond. How Ondology Labs can help: When funds move fast, forensics must move faster. We provide blockchain forensics, real-time tracing and crypto recovery for time-sensitive incident response. Related reading: Inside the CoinDCX $44M hack · The U.S. Treasury's shift on crypto mixers . Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # U.S. Treasury's Policy Shift on Crypto Mixers | Ondology Labs URL: https://ondologylabs.com/blog/us-treasury-crypto-mixers-policy-shift Description: The US Treasury has shifted policy on crypto mixers. What it means for sanctions exposure, compliance teams, and tracing funds through mixing services. ← Back to Blog U.S. Treasury Signals Policy Shift on Crypto Mixers: Privacy, Compliance and the Next Phase of Blockchain Oversight By Iraklis Anastasiou · January 30, 2026 The debate surrounding cryptocurrency mixing services has long been framed in stark terms: either as tools for crime and illicit finance, or as mechanisms for protecting financial privacy. A recent report from the U.S. Treasury suggests the conversation is beginning to mature. In its submission to Congress, the Treasury acknowledged that crypto mixers, services designed to anonymize and obscure blockchain transaction trails, can serve legitimate privacy needs for users operating within the law. The development represents a subtle but important shift in tone from previous enforcement-first approaches that targeted mixers such as Tornado Cash. Instead of treating privacy technologies as inherently suspect, regulators are beginning to recognize a more nuanced reality. Recognizing Lawful Uses of Crypto Mixers The Treasury report highlights that mixers may lawfully be used to protect sensitive financial information on public blockchains. Individuals and organizations may rely on such tools to shield the visibility of their balances, counterparties, and transaction histories. However, this recognition is conditional. According to the Treasury's guidance, mixers could be considered legitimate when paired with safeguards such as record-keeping requirements, compliance protocols, and the ability to support investigations when necessary. This "conditional legitimacy" effectively establishes a regulatory exception: privacy tools themselves are not unlawful, but their design and operation must support accountability and traceability when required. For blockchain developers and service providers, this implies that privacy features must be architected with compliance in mind, a paradigm often described as "privacy with auditability." Congress Faces Pressure to Clarify DeFi AML Obligations Alongside acknowledging legitimate uses for mixers, the Treasury urged Congress to address several regulatory gaps in the decentralized finance (DeFi) ecosystem. One major recommendation is to clarify which DeFi participants (such as developers, validators, front-end operators, or governance bodies) should be subject to anti-money laundering (AML) obligations. Current frameworks were largely designed for centralized financial intermediaries. As DeFi protocols operate through distributed software and autonomous smart contracts, determining regulatory responsibility becomes significantly more complex. By clarifying AML expectations for DeFi actors, regulators aim to ensure that decentralized platforms do not become systemic blind spots in the global financial system. Advancing Privacy-Preserving Digital Identity Another key element in the Treasury's recommendations is the development of privacy-preserving digital identity tools. These technologies could allow users to prove compliance with regulatory requirements without exposing unnecessary personal data. Zero-knowledge proofs and decentralized identity frameworks are frequently cited as potential solutions. Such systems allow users to verify attributes (e.g., being a verified customer or residing in a permitted jurisdiction) without revealing the underlying information. For regulators, these tools may represent a path toward balancing financial surveillance concerns with civil liberties. Considering New Powers to Freeze Suspicious Digital Assets The Treasury report also proposed that lawmakers consider introducing a digital-asset "hold law." This mechanism would allow financial institutions and service providers to temporarily freeze suspicious crypto transactions while investigations are conducted. Such powers would mirror existing controls in traditional finance, where banks may halt transfers flagged by anti-money laundering systems. However, implementing these capabilities in decentralized environments presents practical challenges. Unlike banks, DeFi protocols often lack centralized administrators capable of freezing funds. This regulatory tension, between decentralized architecture and compliance enforcement, will likely remain a central policy debate in the coming years. The Need for Forensic Vigilance in a Privacy-Enhanced Ecosystem While regulators move toward acknowledging legitimate privacy tools, the risks associated with mixers remain substantial. Blockchain analytics firms and law enforcement agencies have repeatedly observed illicit actors using mixers to launder proceeds from cyberattacks, ransomware campaigns, and cross-border sanctions evasion. In this environment, forensic vigilance becomes critical. Effective oversight will require: Continuous blockchain transaction monitoring Cross-platform analytics capable of identifying obfuscation patterns Real-time alerting systems for suspicious activity Structured reporting frameworks aligned with AML compliance obligations Monitoring must extend beyond centralized exchanges to include DeFi protocols, bridges, and privacy-enhancing services where illicit actors may attempt to obscure asset flows. Without robust forensic capabilities, privacy-enhancing technologies could inadvertently create new blind spots for financial crime investigations. Toward a Balanced Framework The Treasury's evolving stance on mixers reflects a broader reality confronting regulators worldwide: blockchain transparency creates unprecedented visibility, yet it also raises legitimate concerns about financial privacy. The policy path emerging in the United States suggests a balanced framework, one that neither bans privacy technologies outright nor allows them to operate without accountability. Achieving that balance will depend on the strength of investigative infrastructure across the digital-asset ecosystem. In practice, this means deploying advanced blockchain analytics, establishing standardized compliance procedures, and ensuring that suspicious activity reporting mechanisms evolve alongside the technology. The Treasury's recognition that crypto mixers can serve lawful purposes marks a notable shift in regulatory thinking. Yet the acknowledgment comes with clear expectations: privacy tools must coexist with accountability. As policymakers work to define AML obligations for DeFi, advance privacy-preserving identity systems, and consider new powers to freeze suspicious assets, the role of forensic monitoring will only become more central. In the emerging regulatory environment, privacy and transparency are no longer opposing forces. They are two pillars that must be engineered to coexist within a resilient and accountable blockchain ecosystem. How Ondology Labs can help: Privacy-with-accountability depends on strong monitoring. We provide blockchain forensics and transaction monitoring plus independent blockchain auditing across chains and DeFi. Related reading: The EU privacy-token ban · The GENIUS Act and digital-asset tax . Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # MiCA Transition Window: July 2026 Deadline | Ondology Labs URL: https://ondologylabs.com/blog/mica-transition-window-july-2026 Description: MiCA's transition window closed on 1 July 2026. What crypto firms in the EU must solve now, from CASP authorisation to custody evidence and own funds. ← Back to Blog MiCA's Transition Window Is Closing: What Crypto Companies Must Solve Before July 2026 By Iraklis Anastasiou · February 27, 2026 · Updated September 21, 2026 Europe finally has a unified crypto rulebook. But for the digital-asset industry, the real test of the Markets in Crypto-Assets Regulation (MiCA) is unfolding during its transition phase. Since December 2024, MiCA is now fully in force across the European Union, creating the first comprehensive regulatory framework for crypto-asset markets within a major economic bloc. However, this regulatory milestone came with a transition period intended to give existing firms time to adapt. For many firms, the window is rapidly closing. While several exchanges and custodians continue servicing EU clients under national registrations, this temporary privilege will expire across much of the Eurozone by July 1, 2026, marking the end of the transition period. From Regulatory Arbitrage to a Unified Market Prior to MiCA, the European crypto landscape resembled a patchwork of national regimes. Germany imposed one of the strictest frameworks, requiring financial-grade custody licenses. France offered an optional PSAN registration regime, while Lithuania became known for a relatively light-touch approach. This environment enabled firms to select jurisdictions based on regulatory flexibility rather than operational robustness. MiCA effectively eliminates that strategy. Under the new framework, crypto firms must obtain authorization as Crypto-Asset Service Providers in one EU member state. Once approved, they can passport services across all 27 EU countries, creating a single, unified market. However, the bar for authorization is significantly higher than most national frameworks. Firms must now demonstrate robust governance structures, capital adequacy, operational resilience, and custody safeguards. For many startups that previously relied on lighter licensing regimes, this represents a profound structural shift. The Misunderstood Deadline The widely cited July 2026 deadline is often misunderstood. MiCA does not impose a uniform transition timeline. Instead, Article 143(3) allows individual member states to determine the length of their transition periods. As a result, Europe has entered a multi-speed compliance environment, divided into three regulatory zones. The Expired Zone: Countries including the Netherlands, Finland and Hungary opted for a short six-month transition period that ended in June 2025. In these jurisdictions, full MiCA authorization is already mandatory. The Mid-Transition Zone: Germany, Ireland and Lithuania allowed a 12-month transition period ending in December 2025. The Maximum Window: France, Italy, Luxembourg and the Czech Republic implemented the full 18-month grace period, which expires on July 1, 2026. Spain also extended its deadline to July 2026. Crucially, grandfathering rights are national in scope. A platform registered in France may continue serving French clients until July 2026, but it cannot passport services into Germany if Germany's transition period has already ended. This nuance has created operational complexity for exchanges attempting to scale across Europe. Stablecoins and Hidden Compliance Risks Another area where companies frequently miscalculate compliance risk is the intersection between MiCA and existing payment regulations. MiCA introduces specific categories for stablecoins, namely Electronic Money Tokens (EMTs) and Asset-Referenced Tokens (ARTs). However, stablecoin issuance and payment flows can also fall under the Payment Services Directive (PSD2). Failing to account for both regimes simultaneously can expose firms to regulatory gaps. For example, a stablecoin platform may comply with MiCA's reserve requirements yet inadvertently trigger PSD2 licensing obligations if its services resemble payment processing. This regulatory overlap remains one of the most complex compliance challenges facing crypto startups in Europe today. What MiCA Means for Cyprus For Cyprus, MiCA represents both a challenge and an opportunity. The island has positioned itself as an emerging fintech hub within the EU, hosting a growing number of crypto firms. Under the new framework, oversight of crypto service providers will fall under the Cyprus Securities and Exchange Commission (CySEC). CySEC will now supervise CASP licensing, operational compliance and market conduct in line with MiCA standards. For firms operating from Cyprus, the regulation introduces several critical requirements: Establishing substantive operations within the EU, including real management and governance structures. Implementing segregated custody systems to protect client assets. Maintaining transparent reporting and risk management frameworks. At the same time, companies that successfully obtain authorization through Cyprus gain access to passporting rights across the entire EU market, significantly expanding their potential client base. As such, Cyprus may become an increasingly attractive jurisdiction for firms seeking long-term regulatory certainty within the European digital-asset ecosystem. The Role of Forensic Vigilance As MiCA transitions from policy to enforcement, forensic vigilance will become a cornerstone of regulatory compliance. Regulators are expected to intensify monitoring of crypto-asset transactions, custody operations and suspicious activity reporting frameworks. For crypto service providers, this means implementing: Continuous blockchain transaction monitoring Suspicious activity detection systems Clear reporting protocols aligned with CySEC and EU AML directives Transparent asset-segregation audit trails The importance of forensic monitoring extends beyond regulatory compliance. It also strengthens market integrity by detecting fraud, insider manipulation and illicit financial flows. Without robust monitoring frameworks, even fully licensed platforms risk regulatory scrutiny or operational disruptions. A Structural Shift for the Crypto Industry For investors and institutional participants, regulatory maturity is quickly becoming a primary risk metric. Key indicators of readiness now include: Verified CASP authorization status in regulatory registers Demonstrated EU operational substance Transparent custody and asset segregation frameworks Robust monitoring and reporting systems The closing of the MiCA transition window will likely trigger significant market consolidation. Platforms that secure authorization will gain a powerful competitive advantage. Those that fail to meet the new regulatory threshold may quietly exit the European market. The Road Ahead MiCA marks the beginning of a new phase in the evolution of the crypto industry. The European market is rapidly shifting away from lightly regulated offshore structures toward institutional-grade regulatory environments. For crypto firms operating in the Eurozone, and particularly in emerging hubs like Cyprus, the months leading up to July 2026 will be decisive. The companies that survive the transition will be those that successfully combine regulatory compliance, operational resilience, and forensic transparency in an increasingly scrutinized financial ecosystem. How Ondology Labs can help: MiCA rewards firms that can prove compliance. We provide blockchain auditing (proof of reserves, reconciliation and AML audits) plus forensic monitoring for CASPs. For the audit layer underneath, see statutory crypto audits and crypto audit support . If you are already authorised, the recurring obligations are MiCA ongoing compliance . Related reading: The EU's DAC8 crypto tax directive · Which RWA tokens are not securities . · MiCA obligations after authorisation Written by Iraklis Anastasiou Co-Founder & CEO, Ondology Labs Iraklis co-founded Ondology Labs and leads its blockchain forensics and auditing work from Nicosia, Cyprus. He has spent more than seven years in cryptocurrency, including over two years as a senior data analyst at Cointelegraph, and works on forensic investigations, transaction tracing, and on-chain analysis for legal teams and digital-asset businesses. MSc in Blockchain and Digital Currency ISO/TC 307 Technical Committee Member 7+ years in cryptocurrency Forensic investigations & data analysis --- # Which RWA Tokens Are Not Securities? | Ondology Labs URL: https://ondologylabs.com/blog/which-rwa-tokens-are-not-securities Description: Which RWA tokens are not securities? How tokenised real-world assets are classified under MiCA and US law, and where the line actually falls. ← Back to Blog Which RWA Tokens Are Not Securities? A Regulatory Breakdown Across Europe, Cyprus and Germany By Panayiotis Kattides · March 20, 2026 The rapidly growing sector of real-world asset tokenization has reignited a familiar regulatory question in TradFi and DeFi: when does a token become a security? While many tokenized assets (particularly those tied to equity, debt, or yield) clearly fall within securities frameworks, a growing subset of decentralized finance RWA tokens is being structured to sit outside those frameworks. For founders, asset issuers, and platforms, understanding these distinctions is no longer optional. It is central to regulatory strategy, especially in tightly supervised jurisdictions such as Cyprus and Germany. The Core Regulatory Principle Across jurisdictions, regulators apply a consistent test. A token is likely to be a security if it involves: An investment of capital An expectation of profit Reliance on the efforts of a third party In the United States, this is formalized through the Howey Test. In Europe, similar logic is embedded within MiFID II and national securities laws. Common Triggers for Security Classification Tokens are typically classified as securities when they include: Profit-sharing mechanisms (dividends, yield) Interest payments or revenue rights Pooled investment exposure Expectation of capital appreciation Active management by an issuer If these elements are absent, a token may fall outside securities regulation, though never outside regulation entirely. Five RWA Token Categories That May Avoid Securities Classification 1. Commodity-Backed Tokens Commodity-backed tokens represent direct ownership or claim over a physical asset such as gold, oil, or agricultural goods. These tokens function similarly to: Warehouse receipts Commodity certificates Digital bearer instruments Holders typically have redemption rights or direct ownership claims, but no expectation of profit generated by an issuer. Regulatory Outcome: Often classified as commodities or property rights, not securities. 2. Asset-Backed Payment or Settlement Tokens These tokens are designed primarily for value transfer and settlement, not investment. Examples include: Gold-backed settlement tokens Government bond-backed stable-value instruments Key characteristics: Redeemable against underlying reserves Stable value orientation No yield, dividends, or profit-sharing Regulatory Outcome: Typically treated under e-money, payment, or stablecoin frameworks (e.g., MiCA), rather than securities law. 3. Utility Tokens Linked to Physical Infrastructure Some RWA tokens provide access to real-world services, rather than financial exposure. Examples include: Energy grid access tokens Compute or storage capacity tokens Telecom or bandwidth tokens The critical distinction lies in intent of use: If purchased for consumption → likely utility If marketed for profit → risk of being classified as a security Regulatory Outcome: Potentially utility tokens, but classification is highly sensitive to marketing and user behavior. 4. Direct Property Ownership Tokens In certain jurisdictions, tokens can represent direct ownership of real estate or physical assets, linked to official registries. Unlike traditional real estate tokenization: No intermediary SPV (Special Purpose Vehicle) No shares or profit participation Direct legal ownership encoded digitally Regulatory Outcome: May be treated as property ownership, not securities, provided legal recognition exists. 5. Digital Certificates of Ownership These tokens function as digital registries, recording ownership of assets such as: Art and collectibles Inventory and goods Carbon credits They do not pool capital or generate returns. Regulatory Outcome: Typically classified as recordkeeping tools, not financial instruments. What Is Considered a Security in Cyprus and Germany? Cyprus (CySEC Framework) In Cyprus, securities classification aligns with EU MiFID II standards, enforced by the Cyprus Securities and Exchange Commission (CySEC). A token is likely a security if it qualifies as a transferable security, including: Shares or equity-like instruments Bonds or debt instruments Units in collective investment schemes Additionally, Cyprus places strong emphasis on: Economic substance over form Whether investors expect returns Whether an issuer actively manages the asset Implication: Even if a token is labeled as a "utility" or "RWA token," CySEC will assess actual economic function, not branding. Germany (BaFin Approach) Germany applies one of the strictest interpretations in Europe through BaFin. BaFin may classify tokens as: Financial instruments Investment assets (Vermögensanlagen) Or securities under the German Securities Trading Act Germany focuses heavily on: Transferability Tradability on secondary markets Investor expectations of return Notably: Even non-traditional structures can fall under regulation if they resemble investment products in practice. The Compliance Challenge: Design vs Reality A recurring issue in RWA tokenization is the gap between token design and real-world usage. A token may be structured as a utility or commodity. But if it is: Marketed as an investment Traded speculatively Associated with expected returns It may still be classified as a security in practice. This is particularly relevant in jurisdictions like Germany and Cyprus, where regulators prioritize economic reality over technical structure. The Need for Regulatory Vigilance As MiCA comes into force across the EU, the margin for misclassification is narrowing. Crypto firms and tokenization platforms must adopt regulatory vigilance across three core areas: 1. Continuous Legal Monitoring Regulatory interpretations are evolving rapidly. Staying up-to-date with guidance from CySEC, BaFin, and ESMA is essential. 2. Robust Compliance Frameworks Firms must implement: Clear token classification methodologies Legal reviews aligned with MiCA and MiFID II Internal governance structures 3. Reporting and Transparency Proper reporting frameworks must be established, including: Transaction monitoring Disclosure of token rights and risks Audit trails for asset backing and ownership Without these controls, even well-designed token models risk regulatory intervention. RWA tokenization does not eliminate regulatory obligations. It redefines them. While certain token structures can fall outside securities classification, the determining factor remains unchanged: the economic relationship between issuer and holder. For firms operating in Europe, especially in regulated environments like Cyprus and Germany, the challenge is no longer just innovation, but precision in legal design and compliance execution. As the market matures, those who align token architecture with regulatory expectations will gain a durable advantage in an increasingly institutionalized digital asset ecosystem. How Ondology Labs can help: Token classification lives or dies on economic substance. We provide blockchain auditing and forensic transaction analysis to evidence how a token actually behaves. Related reading: MiCA's closing transition window · The GENIUS Act and digital-asset tax . Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # Crypto Stolen? The First 24 Hours | Ondology Labs URL: https://ondologylabs.com/blog/crypto-stolen-first-24-hours Description: Your crypto was stolen. What to do in the first 24 hours: trace the funds, alert exchanges that can freeze them, preserve evidence, avoid recovery scams. ← Back to Blog The First 24 Hours After Your Crypto Is Stolen: A Step-by-Step Guide By Panayiotis Kattides · July 22, 2026 · Updated September 2, 2026 If you have just discovered that your cryptocurrency is gone, read this page in order and work through it. The actions below are listed in the sequence that matters most. Do the first one now. Key takeaways Work in sequence: secure what is left first, preserve evidence second, report the same day, then start the trace while the trail is short. Funds can pass through mixers or cross-chain bridges within hours; every hour of delay lowers the odds of a freeze. File the police report on day one. It is the anchor document exchanges and insurers will ask for. Anyone contacting you unprompted and promising guaranteed recovery for an upfront fee is running the second scam. The short version 1. Move any remaining funds to a brand-new wallet with a fresh seed phrase. 2. Screenshot and save every piece of evidence before anything disappears. 3. Report to the Cyprus Police and to the exchange or platform involved. 4. Get a professional trace started while the funds are still traceable. 5. Ignore anyone who contacts you offering to "recover" your money for an upfront fee. Stolen crypto moves fast. In most incidents we see, the funds are split, swapped and pushed through bridges or exchanges within hours of the initial theft. That is the honest reason speed matters: not because panic helps, but because the window in which a transaction trail is clean, short and attributable is measured in hours, not weeks. What you do today shapes what is realistically possible later. This guide is written for individuals and small businesses in Cyprus and the wider EU. If you already know you need a trace, you can go straight to crypto asset recovery and come back to the rest afterwards. Step 1: Secure what is left (first 30 minutes) Assume the compromised wallet is permanently compromised. If an attacker has your seed phrase, your private key, or a signature-approval you granted to a malicious contract, changing your password does nothing. There is no way to "clean" a wallet whose key is known to someone else. The only safe move is to abandon it. Create a new wallet with a brand-new seed phrase. Ideally on a different device, and ideally a hardware wallet. Do not reuse the old seed, do not "derive a new account" from the same seed, and do not restore the old wallet anywhere. Move remaining assets out. Transfer whatever is left in the compromised wallet to the new one. Send the native gas token last, and be aware that some drainers automatically sweep incoming funds. If a small test transfer disappears instantly, stop and get help rather than feeding the attacker gas. Revoke token approvals. Many thefts do not involve a stolen key at all. They involve a token approval you signed, which lets a contract spend your tokens indefinitely. Revoke them using a reputable tool such as Revoke.cash or the Etherscan token approval checker . Do this for every chain you have used, not just the one where the loss occurred. Lock down the surrounding accounts. Change the password on the email address tied to your exchange accounts, enable app-based two-factor authentication (not SMS), and remove any browser extension you do not recognise. If a support agent, "wallet validator" or remote-desktop session was involved, treat the whole device as untrusted and stop using it for crypto. Freeze the account side. If the theft touched a centralised exchange account, log in and disable withdrawals, revoke API keys, and terminate all active sessions. Do not skip the approvals step because "the wallet is empty anyway". Approvals persist across chains and across new deposits, and victims are frequently drained a second time weeks later by the same open permission. Step 2: Preserve the evidence now, before it disappears This is the step victims most often get wrong, and it is the one that determines whether anything can be done later. Scam websites go offline. Telegram and WhatsApp accounts get deleted. "Support agents" block you. Exchanges retain records, but you need to ask for them while your account is still open. Capture everything today, even the parts that feel embarrassing or irrelevant. Collect and save, in one folder, with the date on each item: Transaction hashes. The full hash of every unauthorised transaction, copied as text, not just a screenshot. These are the backbone of any trace. Wallet addresses. Your address, the destination address the funds went to, and any intermediate address you can see on the block explorer. Amounts, tokens, chains and timestamps. Record the value in EUR at the time of the transaction as well as the token amount. Screenshots of the block explorer pages showing the transactions, taken while the pages are live. The platform URL. The exact domain of the website, app or "investment platform" involved, including any variant spelling. Screenshot the homepage, your account dashboard and your supposed balance before it is taken down. Full chat logs. Export, do not screenshot selectively: WhatsApp, Telegram, Signal, Instagram, LinkedIn, dating apps, Discord. Include usernames, phone numbers and profile photos. Emails with full headers. Headers contain routing information that screenshots destroy. Exchange statements. Download your full transaction and withdrawal history from every exchange involved, plus any deposit addresses you were given. Bank records. If you sent fiat by card or transfer, save the statements, the beneficiary name, IBAN and reference. A written timeline. Plain text, in order: when you were first contacted, what you were told, what you clicked or signed, when you noticed the loss. Write it today while your memory is accurate. Do not contact the thief. Do not tell them you are investigating, do not threaten legal action, and do not send a "test" payment to see whether they respond. Every warning you give them accelerates the laundering and costs you leverage. Step 3: Report it (same day) A police report is not optional paperwork. Exchanges will generally only freeze funds or disclose account holder information on the instruction of law enforcement or a court. Without a case number, a compliance team has no legal basis to act on your request, however sympathetic they are. The Cyprus Police. File a report in person at your local station and ask that it be referred to the Office for Combating Cybercrime. Bring the evidence folder from Step 2 in printed and digital form, and ask for the case reference number in writing. Contact details are on the Cyprus Police website . MOKAS, the Cyprus FIU. The Unit for Combating Money Laundering is the financial intelligence unit that handles suspicious transaction reporting and international asset-freezing cooperation. It is normally engaged through the police or through your lawyer or a regulated entity rather than by a direct victim complaint, but where laundering through Cypriot or EU accounts is involved, its involvement is what makes cross-border freezing possible. Ask the investigating officer explicitly whether the matter has been referred. The exchange or platform. Open a support ticket immediately with the destination address, transaction hashes and your police reference. Use the words "unauthorised transaction" and "request for account freeze". Keep the ticket number. Your bank or card issuer. If fiat left your account in the last days, call the fraud line rather than emailing. Some card payments can be charged back, and some SEPA transfers can be recalled, but only within tight windows. CySEC, if the platform claimed to be a licensed Cyprus investment firm or crypto-asset service provider. You can check registers and file a complaint through the Cyprus Securities and Exchange Commission . A false claim of regulation is itself evidence. Report abroad where relevant. If you are resident elsewhere in the EU, report to your national police as well. Cross-border cases are routinely coordinated between member states. If the scam followed a pattern you recognise (a fake trading platform, a romance-led investment, a fake support agent, a giveaway or an airdrop drainer), name that pattern explicitly in the report; investigators triage faster when the mechanism is clear. Step 4: Start a trace while the trail is short A police report on its own says "money was taken from me". A traced report says "the money moved through these seven addresses and 62% of it arrived at a named, regulated exchange at 04:11 on Tuesday". Those are very different documents. The second one gives an officer something to send, a specific counterparty to contact, and a legal target for a freezing request. This is the single biggest thing that changes the outcome of a case. Blockchain forensics works because the ledger is public and permanent. The transactions cannot be deleted. What a trace does is turn that raw data into attribution: clustering the addresses that belong to the same actor, following funds through swaps, bridges and chain hops, and identifying the point at which stolen value touches a regulated service that knows its customer. Be realistic about the odds Nobody honest can promise you your money back. Recovery is a genuine possibility in some situations and close to impossible in others, and you deserve to know which one you are in before you spend anything. Recovery is realistic when: the funds land at a regulated exchange with real KYC obligations; you act within hours or days rather than months; the amount is large enough to justify legal action; the destination sits in a jurisdiction whose authorities and service providers cooperate; or the platform that took your money still has identifiable corporate and banking infrastructure. Recovery is unlikely when: the funds were passed through mixers or converted into privacy coins; the trail ends in a jurisdiction that does not respond to mutual legal assistance requests; the theft happened months or years ago and the funds have already been cashed out; or the sums involved are too small to support cross-border litigation. In those cases a trace still has value (for insurance, for a tax loss position, for a criminal complaint, or to rule out throwing good money after bad), but it is not a route to getting the coins back, and we will say so. Warning: the second scam is aimed at you right now Within days of a theft, sometimes within hours, victims are approached by "recovery agents", "blockchain investigators" and "cyber units" who claim they can retrieve the stolen funds. They find victims through public complaint forums, social media comments, leaked victim lists sold between fraud groups, and search ads placed against phrases like "recover stolen crypto". Being scammed a second time is common enough that regulators treat it as its own category of fraud; see the general guidance on cryptocurrency fraud from the U.S. Federal Trade Commission . Treat all of the following as disqualifying: An upfront fee paid in cryptocurrency, gift cards or to a personal account. A guarantee of recovery, or a specific percentage promised before any analysis has been done. A request for your seed phrase, private key, or remote access to your device. No legitimate investigator ever needs any of these. Unsolicited contact: they messaged you, you did not go looking for them. Claims of being able to "hack the blockchain", reverse a transaction, or work through a private contact inside an exchange or a police force. "Release fees", "tax payments", "compliance deposits" or "unlocking costs" demanded after they claim to have found the money. This is the same structure as the original scam. No verifiable legal entity, registration number, physical address or named professionals. A genuine firm will scope the work, quote for the analysis rather than for a promised outcome, tell you when the case is not worth pursuing, and produce a report you can hand to police or to a court. What a professional trace actually involves If you decide to take that route, this is what the work looks like at Ondology Labs, so you can judge it against anyone else you speak to. Intake and triage. We take your addresses, hashes and timeline and give you an early, blunt read on whether the funds are still traceable and whether the case is worth pursuing. If it is not, you hear that first. Tracing and clustering. We follow the funds across wallets, chains, swaps and bridges, and group addresses under common control to separate the thief's infrastructure from ordinary counterparties. Attribution. We identify where value reaches services that hold customer identity data (exchanges, payment processors, custodians) and flag the specific points where a freeze or a disclosure request can bite. Reporting. You get a written, court-ready report: methodology, evidence, exhibits and conclusions, structured so that police, a regulator, a bank compliance team or a lawyer can act on it without needing to redo the analysis. Support afterwards. We work alongside your lawyer and the investigating officers, respond to follow-up questions from exchanges, and can give expert evidence where proceedings require it. Ondology Labs is a blockchain forensics and auditing firm based in Cyprus, and our forensic work is built to the same evidentiary standard as our audit work, because a report that cannot survive scrutiny is worth nothing to you. How Ondology Labs can help: If your crypto has been stolen, start with our crypto asset recovery service for an honest assessment of whether the funds can still be traced, backed by blockchain forensics and court-ready reporting across Cyprus, Greece and the EU. Secure your remaining wallets and file your police report first, then bring us the evidence. Related reading: What blockchain forensics is and how it works . Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # How to Read a Proof of Reserves Report | Ondology Labs URL: https://ondologylabs.com/blog/how-to-read-proof-of-reserves-report Description: How to read a proof of reserves report: the questions to ask, what a Merkle tree proves, and why a report without liabilities proves nothing at all. ← Back to Blog How to Read a Proof of Reserves Report (And Spot a Meaningless One) By Panayiotis Kattides · July 30, 2026 · Updated September 21, 2026 Proof of reserves explained for the people who actually have to rely on it: customers choosing an exchange, boards approving a custodian, and counterparties doing due diligence on someone else's balance sheet. Key takeaways Assets alone prove nothing. A meaningful proof of reserves pairs on-chain assets with a commitment to customer liabilities. Wallet control must be demonstrated cryptographically, by signing, not by pointing at rich addresses. Every attestation is a snapshot; check the date, the scope, and what was excluded. An attestation is not an audit. Check who signed it and what standard they signed under. Almost every large crypto platform now publishes something called proof of reserves. Very few of those publications prove what the name implies. The usual artefact is a dashboard showing wallet balances, a large percentage figure, and a logo. That is a statement about assets. Solvency is a comparison between two numbers, and the second number, what the platform owes its customers, is the one most commonly missing, unverified, or quietly supplied by the platform itself. This guide is about reading rather than producing. If you want to know what a rigorous engagement involves on the inside, our proof of reserves attestation service sets out the methodology. What follows is the other half: how to evaluate a report that someone else has published, and how to tell assurance from marketing. Assets Alone Prove Nothing Start with the arithmetic, because everything else follows from it. A reserve ratio is reserves divided by liabilities. If a platform publishes only the numerator, it has published a number with no denominator and no meaning. Consider a platform showing 100,000 BTC in verified cold storage. Impressive, until you ask what customers are owed. If the answer is 95,000 BTC, the platform is over-collateralised. If it is 130,000 BTC, the same wallets now describe a hole. The on-chain figure did not change. Only the half nobody published did. So the first question is not "how much do they hold" but "against what". When you open any attestation, look for an explicit total customer liability, expressed per asset rather than as a single blended dollar figure. Blending matters: a platform can be 150% covered in stablecoins and 70% covered in a token it lent out, and the aggregate USD ratio will hide that. Reserves and liabilities should be compared asset by asset, or the comparison is cosmetic. Proving Wallet Control Must Be Cryptographic The asset side has its own failure mode. A list of addresses is not evidence of ownership. Anyone can point at a wallet on a block explorer and call it theirs, and blockchains have no concept of a name attached to an address. Control has to be demonstrated, and there are only two credible ways to do it. The first is a signed challenge message: the verifier supplies a phrase, the platform signs it with the private keys controlling each reserve address, and the signature verifies against that address. The second is a nominal transfer executed on the verifier's instruction, at a moment and amount the verifier chooses. Both prove possession of keys. Neither can be produced by someone who has merely borrowed sight of a wallet. When you read a report, look for language describing how control was established. "Management provided a list of wallet addresses" is an assertion the verifier accepted. "Control of each address was demonstrated by signature over a challenge message specified by us" is proof. If the report is silent on the point, treat the addresses as unproven, and ask whether any address was excluded because control could not be shown. A report that excludes nothing has often tested nothing. Merkle Trees and How a Customer Verifies Inclusion The liability side has a genuine problem: a platform cannot publish every customer balance without destroying customer privacy. The standard solution is a Merkle tree, and it is worth understanding because it is the one part of proof of reserves that individual users can check themselves. The construction is simple. Every customer's account balance is hashed into a leaf. Pairs of leaves are hashed together into parent nodes, then pairs of parents into their parents, until a single hash remains at the top. That top value is the Merkle root, and the platform publishes it alongside the attestation. Change any single balance anywhere in the tree, and the root changes completely. Here is how a customer performs the check in practice: Retrieve your own proof. Log in and find the proof of reserves or verification section. The platform should give you a record ID, your balance as it was included at the snapshot, and a short list of sibling hashes, your Merkle path. Recompute the leaf. Hash your own record using the algorithm the platform documents. If the result does not match the leaf they gave you, your balance was recorded as something other than what you hold. Walk the path upward. Combine your leaf with each sibling hash in turn, in the specified order, hashing at each level. This takes about twenty steps even for a platform with a million customers. Compare to the published root. If your final hash equals the root the auditor attested to, your balance was inside the total that was verified. If it does not, it was not. Most platforms provide an in-browser tool for this. Prefer the ones that also publish an open-source verifier you can run yourself, since a check performed entirely by the party being checked is not much of a check. Reputable implementations publish the hashing scheme in enough detail that a third party can reimplement it. Now the crucial limitation. A Merkle proof shows that your balance was included. It says nothing about whether everyone else's was. A platform can omit a class of accounts, or insert a leaf with a negative balance to shrink the total, and every individual proof will still verify. This is why the tree has to be built or independently tested by the verifier from the complete ledger, with controls testing around ledger completeness, rather than accepted as a finished output from the platform. If a report describes a Merkle root but says nothing about how the leaves were sourced and tested, the cryptography is decorating an unaudited number. The Snapshot Problem Every attestation describes a moment. That moment is the weakness anyone determined to game the process will attack. If the snapshot time is known in advance, assets can be borrowed shortly before it and returned shortly after. The wallets are genuinely controlled, the signatures genuinely verify, and the report is genuinely accurate about a position that existed for a few hours. Related-party transfers between affiliated entities produce the same effect without any external lender at all. Three things reduce this risk, and you can check for all of them: Unannounced or verifier-selected timing. The platform should not choose the block height it is measured at. Investigation of large inbound movements. A competent verifier looks at what arrived in the reserve wallets shortly before the snapshot and where it went afterwards. Large round-number inflows immediately before a snapshot are the signature to look for, and any credible report addresses them. An unbroken series. This is the single strongest signal available to a non-specialist reader. Window dressing one snapshot is feasible. Window dressing every snapshot, on a published schedule, for eight consecutive quarters, requires sustaining the deception continuously, which is a different order of difficulty. So look at the archive before you look at the latest report. A platform with three years of quarterly attestations, including through bad quarters, is telling you something a first-time publisher cannot. Watch for gaps. A missed period, a change of verifier without explanation, or a quiet shift from monthly to annual publication is worth more attention than the current ratio. Who Signed It An attestation is only as good as the party standing behind it, and that party should be independent, professionally regulated, and named. Check whether the signer is a licensed accounting firm subject to professional standards and disciplinary oversight (in Cyprus, that means licensed by ICPAC ) or a consultancy with no such obligations. Check whether the firm is named at all, or whether the report is self-published with a vendor's dashboard embedded. Check the engagement letter description: an attestation performed under a recognised assurance standard carries obligations that a "report of factual findings" prepared to the client's specification does not. Independence deserves a moment of thought too. A verifier who is also a large shareholder, a lender, or a commercial partner of the platform is not independent, however competent. Reports rarely volunteer this, so it is a fair question to ask directly. Attestation Is Not an Audit This distinction is routinely blurred in marketing and it matters enormously. A proof of reserves attestation is narrow and deep: it addresses specified assets and specified customer liabilities at a point in time. A financial statement audit is broad: it covers the whole entity, including revenue, expenses, related-party transactions, off-balance-sheet obligations and going concern. The two answer different questions. Proof of reserves can be run quarterly or monthly; a full audit cannot. The practical consequence is the honest limitation of the entire exercise. Proof of reserves is not a solvency guarantee. It cannot see debts that never touch the customer ledger: a loan from an affiliate, an undisclosed guarantee, a legal judgment, a commitment to a related entity. It says nothing about whether the business is profitable or whether its operating costs exceed its revenue. A platform can pass a reserves attestation cleanly on Monday and fail for reasons entirely outside its scope on Friday. That is not an argument against proof of reserves. It is an argument for reading it as what it is: strong evidence about one specific and important question, published frequently, rather than a clean bill of health. Treat a report that claims more than that as a warning in itself. Any verifier worth trusting states the limitations plainly in the document. The Checklist: Twelve Questions to Ask of Any Attestation Take these to any published report, or send them to a platform that has not published one. The answers, or the absence of them, will tell you most of what you need to know. Are liabilities stated at all? If the report shows only wallet balances, it is a balance disclosure, not proof of reserves. Stop here. Are reserves and liabilities compared asset by asset? A single blended ratio can conceal a serious shortfall in one asset behind a surplus in another. How was wallet control proven? Signed challenge message or verifier-instructed transfer. Not a list of addresses supplied by management. Were any addresses excluded, and why? Exclusions are a sign the verifier actually tested something. Where did the liability ledger come from, and was it tested for completeness? This is the question that separates real engagements from theatre. Is a Merkle root published, and can you verify your own inclusion? Ideally with an open-source verifier you can run independently. Who chose the snapshot time? Verifier-selected or unannounced timing is materially stronger than a date the platform announced weeks earlier. Were large pre-snapshot inflows investigated? The report should say so explicitly. Is there a series, and is it unbroken? Check the archive for gaps, cadence changes, and changes of verifier. Who signed it, and are they licensed and independent? A named, regulated, independent firm, or not. What is in scope, and what is out? Assets held with third-party custodians, staked, or lent out carry counterparty risk and should be identified separately rather than counted at face value. What limitations does the report itself disclose? A report that names its own blind spots is more trustworthy than one that does not. Silence here is the loudest signal in the document. A platform that can answer all twelve is doing serious work. A platform that answers three and calls the result proof of reserves is relying on the phrase rather than the practice. Why This Is Becoming a Regulatory Question Until recently, publishing reserves was voluntary and reputational. In the EU it is turning into evidence. The Markets in Crypto-Assets Regulation does not use the phrase "proof of reserves", but it requires crypto-asset service providers to segregate and safeguard client assets and imposes specific reserve and reporting obligations on token issuers. A recurring, independently signed reserves attestation is the practical way to evidence compliance with obligations of that shape, which is why the standard of what counts as credible is rising, and why the closing MiCA transition window has pushed a number of platforms to publish for the first time. The reader's advantage in this environment is simple. The gap between platforms that can withstand the twelve questions above and platforms that cannot is wide, visible, and free to check. How Ondology Labs can help: We perform independent proof of reserves attestations for exchanges, custodians, stablecoin issuers, and funds, verifying cryptographic wallet control, establishing customer liabilities, and publishing reports written to be read by the people above rather than filed. We also provide broader blockchain auditing for firms that need the full picture, and counterparty reviews for boards assessing someone else's attestation. Related reading: MiCA's closing transition window · Inside the CoinDCX $44M hack · Best crypto accounting tools compared . · How auditors verify crypto wallet ownership Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # AML Audit Readiness for Crypto Firms in Cyprus | Ondology Labs URL: https://ondologylabs.com/blog/aml-audit-readiness-crypto-cyprus Description: AML audit readiness for crypto firms in Cyprus: what an AML audit tests, the files a reviewer will pull, and how to prepare before CySEC asks. ← Back to Blog AML Audit Readiness for Crypto Firms in Cyprus: The Gaps We Find Most By Panayiotis Kattides · August 5, 2026 · Updated September 21, 2026 Most crypto firms in Cyprus do not fail an AML review because a control is missing. They fail because a control exists on paper, was never tuned to the business, and cannot be evidenced when someone asks. Key takeaways Firms rarely fail an AML review for a missing control. They fail because a control exists on paper, was never tuned to the business, and cannot be evidenced. The most common gaps: generic risk assessments, untuned monitoring rules, untested sanctions screening, and Travel Rule exception handling. Alert volume is not evidence of diligence; documented decisions on alerts are. An independent audit tests controls on real files, which is also exactly what a supervisor will do. We review AML frameworks at crypto exchanges, CASPs, custodians and payment firms, and the findings repeat. Not because compliance teams are careless. The people we meet are usually stretched, competent and aware of at least half of what we are about to write down. The gaps repeat because they are structural. They come from frameworks assembled quickly during authorisation, vendor tooling deployed with default settings, and a business that changed faster than its documentation. This is a readiness checklist rather than a description of what an audit covers. If you want the latter, it is set out on our AML compliance audit page. What follows is the shortlist of things to go and look at yourself, this week, before someone external looks at them for you. The Supervisory Backdrop, Briefly Crypto-asset service providers in Cyprus are supervised by the Cyprus Securities and Exchange Commission and are obliged entities under Cyprus AML law implementing the EU directives. MiCA brought CASPs into a harmonised EU authorisation regime, which means your AML framework is now assessed as a component of a supervised firm rather than as a voluntary standard, a change of posture more than a change of rules. Our note on the MiCA transition window covers that shift in more detail. Layered on top is the EU AML package: a directly applicable AML Regulation that narrows the national discretion firms have been reading around, and AMLA, the new EU-level authority that will push supervisory expectations toward a common standard. The Transfer of Funds Regulation extends the Travel Rule to crypto transfers. Suspicious transaction reports go to MOKAS, the Cyprus financial intelligence unit. Parts of this are still bedding in. Where supervisory expectation has not settled, we say so rather than presenting one reading as settled law, and you should take the same approach in your own documentation. A stated interpretation with reasoning behind it is defensible. Silence is not. Gap 1: A Risk Assessment About Crypto Businesses in General The business-wide risk assessment is where most reviews start, and it is where the tone of the whole engagement gets set. The common failure is a document that describes a generic crypto business: the standard threat typologies, the standard geographic risk categories, the standard conclusion that residual risk is medium. What good looks like: the assessment names your actual products, your actual customer segments, your real onboarding jurisdictions in volume order, and the specific chains and asset types you support. It explains why a risk is rated as it is, with reference to your own data. It is dated, approved at board level, and revisited when you launch something new, not annually by calendar reflex. If a reader who has never met you could not describe your business after reading it, it is not your risk assessment. Gap 2: Monitoring Rules Nobody Tuned Transaction monitoring is usually bought, deployed with the vendor's starter rule set, and left. Two years later the customer base has shifted, the product set has doubled, and the thresholds are still whatever the implementation consultant typed in. What good looks like: a documented mapping from each risk identified in your risk assessment to the rule or rules intended to detect it, so coverage gaps become visible. Thresholds justified against your own distribution of customer behaviour, not against a market average. A record of every tuning decision: what changed, why, who approved it, what the before-and-after alert volumes were. Above-the-line and below-the-line testing when thresholds move. Crypto AML controls that were never calibrated to the book they monitor are, functionally, an expensive log. Gap 3: Treating Alert Volume as Evidence of Diligence This one is worth stating bluntly. A backlog of thousands of open alerts is not proof that you are monitoring carefully. It is proof that you are generating output nobody is consuming. We have seen firms present alert counts as a compliance metric while the average alert had been open for months and dispositions read, in full, "reviewed, no action". What good looks like: alert volume that a team of your size can actually clear, with an ageing report the compliance officer sees weekly. Dispositions that record what was checked and what the reviewer concluded, in enough detail that a second person could reach the same conclusion from the file. Quality assurance sampling of closed alerts. A defined escalation path with named roles. If the backlog is genuinely unmanageable, the honest fix is tuning plus resourcing, documented as a decision, not quiet accumulation. Gap 4: Sanctions Screening Nobody Has Tested Almost every firm screens. Far fewer can tell us what their fuzzy-matching threshold is set to, who set it, or what it does with transliterated names, name order reversal, or common regional spelling variants. And a large number screen at onboarding only, so a customer who was clean in 2024 is still clean in your system today regardless of what has happened since. What good looks like: documented list coverage and refresh frequency, including which lists and from what source. Match-threshold settings that have been tested with a deliberate set of known-difficult names, with the results kept. Rescreening of the entire existing book on list updates, on a schedule you can evidence. Screening that reaches counterparties and beneficial owners, not customers alone. A false-positive process that does not quietly train staff to clear everything. The European Banking Authority guidelines on internal policies and controls in this area are a useful reference point even where they are not directly binding on you. Gap 5: Travel Rule Exception Handling Travel Rule compliance for crypto is the gap that has moved fastest and is understood least evenly. Most firms have the happy path working: an in-scope transfer to a counterparty on the same messaging network, with complete originator and beneficiary data, goes through fine. That is not where the risk sits. The risk sits in the exceptions, and there are three that come up constantly: The counterparty who does not respond. You sent the required information. Nothing came back. What is your policy: hold, release, release and flag? For how long? Who decides? Is the decision recorded per transfer or is it an unwritten desk convention? The self-hosted wallet transfer. There is no counterparty institution to exchange data with. What verification do you perform on the claimed ownership, at what value, and how is the outcome recorded? What blockchain analytics screening applies before release? The transfer arriving with information missing or obviously implausible. A beneficiary name of "customer" is missing information wearing a hat. What happens next, and does anything feed back into the customer's risk rating or into your view of that counterparty? What good looks like: a written exception matrix covering each case, with a decision, an owner, a time limit, and a record. Counterparty due diligence performed before you start exchanging data with another provider, not after. Periodic sampling of failed and held transfers to check the policy is what actually happened. And a straightforward acknowledgement in your documentation where market practice is still consolidating. This is an area where interoperability between messaging solutions remains imperfect, and pretending otherwise reads worse than describing your workaround. Gap 6: Analytics Scores With No Decision Attached Blockchain analytics is now an expected control, and most firms have a provider. The gap is that the risk score arrives on a dashboard and stops there. There is no documented threshold at which a score changes an outcome, no escalation trigger, and no record of what the score was at the time a decision was made. What good looks like: a written policy stating the score bands, what each band requires, and who can override, with overrides logged and reviewed. Scores captured and retained at the point of decision, because providers reclassify addresses over time and a screenshot from last year will not reconstruct itself. Periodic reassessment of exposure for existing customers, not just at deposit. And an independent check, at least occasionally, that what your tooling reports matches what the chain shows; that is a core part of what we do in blockchain auditing engagements, and it is the one control most firms have never had verified by anyone other than the vendor selling it. Gap 7: Training That Trains Nobody in Particular Annual e-learning with a multiple-choice quiz produces a completion certificate. It does not produce a support agent who recognises a structuring pattern, or an onboarding analyst who knows when source of wealth evidence is inadequate rather than merely absent. What good looks like: role-specific content. Onboarding staff get due diligence and escalation. Monitoring analysts get typologies drawn from your own closed cases and your own chains. Senior management gets governance and personal exposure. Board members get enough to challenge what they are shown. Training records that log content and role, not just attendance. And at least one internal case study a year built from something that actually happened at your firm. Gap 8: The Documentation Mismatch, in Both Directions The last gap is the one that turns manageable findings into serious ones, and it runs two ways. In one direction, the procedure describes a control nobody performs: a quarterly review that stopped happening in 2024, a second-line check that was dropped when someone left. That reads to a supervisor as a control failure plus a governance failure, because nobody noticed. In the other, the control is performed diligently and never evidenced. The analyst genuinely checked three things; the file records none of them. Unevidenced work is, for review purposes, indistinguishable from work not done, and arguing otherwise during an inspection is a losing position. What good looks like: a periodic walkthrough where the person who performs each control reads the procedure describing it and confirms line by line that this is what they do. Version-controlled documents with owners and review dates. Case file templates that capture the reasoning, not just the outcome. Where a control has lapsed, a dated record of the decision and the compensating measure. A documented, remediated gap is a far better finding than a live undisclosed one. A Realistic Sequence You cannot fix all eight at once, and firms that try tend to produce a lot of new documents and very little changed behaviour. In our experience the order that works is: risk assessment first, because everything else should trace back to it; then monitoring coverage and alert backlog, because those are the ones a supervisor can quantify in an afternoon; then Travel Rule exception handling and sanctions testing; then analytics thresholds, training and documentation, which are cheaper to close once the substance underneath is right. Two honest caveats. First, an independent audit is not regulatory approval. We are not a regulator and cannot bind one. An audit is an opinion on the controls tested, on the evidence seen, at the time it was seen. CySEC, MOKAS and any other authority reach their own conclusions and may weigh things differently. Second, your obligations continue in full regardless, between reviews, after a clean report, and in every period outside the sample. Sampling means an unqualified report is evidence that a competent independent party tested the framework and set out what it found. It is not proof that nothing was missed. The reason to do any of this early is unglamorous but real. A gap you find yourself is a remediation plan. The same gap found during supervision is a finding, with a timetable you did not set. The FATF standards on virtual assets that sit underneath the EU framework have not moved much in substance; what has moved is how closely anyone is checking. How Ondology Labs can help: We run independent AML compliance audits for crypto exchanges, CASPs, custodians and payment firms in Cyprus and across the EU, testing the controls you actually operate, on real case files, with on-chain exposure verified independently. Findings come ranked and evidenced, with a remediation plan you can sequence. Related reading: MiCA's closing transition window · The EU privacy token ban and what it signals for Cyprus . · CASP audit requirements under MiCA in Cyprus Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection --- # Choosing a Crypto Expert Witness: A Guide for Lawyers | Ondology Labs URL: https://ondologylabs.com/blog/choosing-crypto-expert-witness Description: What lawyers should look for in a crypto expert witness: credentials, methodology, independence, and the report qualities that survive cross-examination. ← Back to Blog What Lawyers Should Look For in a Crypto Expert Witness By Panayiotis Kattides · August 9, 2026 · Updated September 2, 2026 Blockchain data is public and rarely disputed. What gets attacked is the reasoning laid over it, and that is where the choice of expert decides the value of the evidence. Key takeaways Blockchain data is rarely disputed; the reasoning laid over it is. The expert defends the reasoning. Test independence first: an expert who has advocated for your side elsewhere is a liability under cross-examination. A crypto expert report must state methodology, data sources, assumptions and limits, and stay inside the expert's competence. Attribution is the soft spot: an address is not an identity without an off-chain anchor. Crypto now appears in disputes that have nothing to do with crypto: civil fraud and asset tracing, insolvency, financial remedy proceedings, regulatory enforcement, prosecution and defence. In most of them the instructing lawyer must make a technical judgement they are not equipped to make, which expert to rely on, and whether the report in front of them will hold. This piece takes that judgement from both directions: how to test a prospective crypto expert witness before you instruct, and how to test an opposing expert's report once it lands. Procedural requirements for expert evidence vary by forum: the form of any declaration, whether permission is needed, what must be disclosed about instructions, whether experts meet before the hearing. Confirm those locally. What follows is about substance, which travels. What Actually Qualifies Someone as a Blockchain Expert Witness The market is full of people who describe themselves as crypto experts. Few have produced analytical work that anyone adversarial has examined. Three things are commonly offered as credentials, and none of them is one on its own. "Years in crypto." Trading since 2013, running a node, or working at an exchange shows familiarity with an industry. It does not show the ability to reconstruct a transaction history, document the method used, and defend each inferential step under cross-examination. A vendor tool certification. It shows the candidate can operate the software. It says nothing about whether they understand what the software is inferring or where its heuristics fail. An expert whose opinion is whatever the tool displayed is an expert whose opinion collapses the moment someone asks how the tool reached it. Publications and conference appearances. Useful context, weak evidence. Ask about the analytical work instead. What does qualify someone is demonstrable analytical work on chain and an articulable methodology. Can they explain, without the software in front of them, how they establish that a set of addresses is under common control, and what would falsify that conclusion? Have they worked the chains your matter involves? Bitcoin's UTXO model and account-based chains raise genuinely different analytical problems, and fluency in one does not transfer. Have they been cross-examined, and what happened? An expert whose method has never been tested is an unknown quantity, whatever the CV says. Accountancy or audit qualification adds a second layer, because valuation and reconciliation questions arrive alongside the tracing ones; our own work sits under ICPAC licensing for that reason. Test Independence First Test independence first, not last, because everything else is worthless without it. An expert instructed by one party still owes an overriding duty to the tribunal, above any duty to the party paying the fee. That is not a formality. It is the reason the evidence is weighed at all rather than treated as advocacy. The single clearest warning sign An expert who indicates what their conclusion will be before they have seen the evidence. If a candidate tells you on the scoping call that they can show the defendant controlled the wallet, or that the funds are recoverable, and they have not yet reviewed the chain data, decline. You are not buying an opinion. You are buying a liability that opposing counsel will find. Ask how the expert has handled a case where the data did not support the instructing party's position. A candid answer describes telling the client early and privately, in time for the legal team to decide how to proceed. A candidate who says it has never happened has either not done much work or is not telling you the truth. Related tests: does any part of the fee depend on outcome or recovered assets, and is the same firm running conflicting work, a contingent recovery mandate, say, while also offering to opine on the same transfers? What a Crypto Expert Report Must Contain A report that holds up is one another competent expert could pick up and reproduce. The components are unglamorous and they are the whole game. Instructions and questions , reproduced, so the scope of the opinion is unambiguous and nothing has been answered that was not asked. Documented methodology. Chains, tools, data providers, block heights or snapshot dates, and each analytical step, in enough detail to be repeated. Transaction schedules exhibited, not summarised. Chain of custody. How each item was obtained, when, by whom, and how it has been preserved. On-chain data is verifiable at source; the report should record what a third party needs to verify it independently. Fact separated from opinion. "Address A sent 40 ETH to Address B at block 21,431,908" is observed fact. "Address B is controlled by the second defendant" is opinion resting on inference. A report that blurs the two will be taken apart line by line. Assumptions and limitations. Every point where the trail could not be resolved, where attribution rests on inference, and where an alternative explanation remains open, stated by the expert, before opposing counsel states it. Declaration of qualifications, independence, and the duty owed to the tribunal, in whatever form the forum requires. The Four Soft Spots in Crypto Evidence Overreaching in crypto reports concentrates in four places. Know them and you can read any report, yours or theirs, with the right scepticism. Address clustering. Grouping addresses into a single controlled cluster relies on heuristics, most commonly common-input ownership and change-output identification. These are probabilistic inferences about behaviour, not proofs of control, and they are weakened by exchange batching, CoinJoin-style constructions, and unusual wallet software. A report should state which heuristics were applied and how confident each conclusion is. One that presents a cluster as a fact has skipped the step that matters. Attribution to a named person or entity. The most common overreach in the field. On-chain data can show that an address behaves as part of a cluster and that value reached a named exchange. It cannot, by itself, show who held the keys when a transaction was signed. Attribution to a person almost always depends on off-chain corroboration: KYC records obtained through disclosure or a third-party order, device evidence, correspondence, an admission. Where a report attributes a wallet to a defendant, find the off-chain link. If it is a commercial dataset label, ask how and when that label was derived; vendor attribution databases are investigative leads, not evidence of identity. Mixers and bridges. Different problems, often treated as one. A mixer or privacy protocol is designed to break the link between input and output; frequently no reliable path through exists, and the honest finding is that the trail ends there. Timing-and-amount correlation across a mixer can be legitimate analysis, but it is inference with a stated confidence, never a traced hop. Bridges are more tractable: a cross-chain transfer typically leaves a lock or burn event and a corresponding mint or release, but the correspondence must be evidenced transaction by transaction, not assumed because the amounts look similar. Inference at unresolved hops. Some reports bridge a gap with language like "the funds were then transferred to" when what is meant is "an equivalent amount later appeared at." Watch the verbs. Each unresolved hop should be flagged, with the assumption used and its effect on the conclusion. A single unflagged hop can carry the entire chain of reasoning. Questions to Put to a Prospective Expert What is your duty when the on-chain evidence contradicts the case of the party instructing you, and when has that happened? Describe a matter where your methodology was challenged. What was put to you, and what did you concede? Which chains, protocols and asset types have you analysed in instructed work, and which are outside your expertise? How do you establish common control over a set of addresses, and what would cause you to withdraw that conclusion? What do you rely on for attribution beyond commercial dataset labels, and how do you express attribution confidence? How do you handle a transfer into a mixer? When would you decline to trace through it? Which tools and data sources do you use, and can you reach the same result through an independent source? Could another competent expert reproduce your analysis from your report alone? Show me an anonymised example. How do you record chain of custody over material we provide and over data you collect yourself? What is your fee basis, and does any part of it depend on the outcome or on recovered assets? Do you or your firm have any relationship with the parties, their advisers, or any platform involved? Run a conflict check before we go further. Can you meet the timetable (report deadline, expert meeting, hearing window), and are you available to give oral evidence on those dates? Questions to Probe an Opposing Report Use these when reviewing the other side's report, preparing cross-examination, or briefing your own expert to respond. Most productive challenges to blockchain evidence come from the same short list. Is the methodology set out in enough detail that an independent expert could reproduce the result? If not, the conclusions are assertions. Are the transaction schedules exhibited, with hashes, timestamps and block heights, or only summarised in narrative? Which statements are observed fact and which are opinion? Mark them up. The proportion is often revealing. What clustering heuristics were applied, and are their known failure modes acknowledged? On what basis is each wallet attributed to a person or entity: off-chain corroboration, or only a vendor label? Where the report says funds "were transferred to" a destination, does the data show a traced path or a correlation of timing and value? How were mixers and unresolved hops handled, and is each break in the chain disclosed? For cross-chain movement, is each bridge transaction matched on both sides, or inferred from amount and timing? Does the report treat off-chain movements inside an exchange as if they were on-chain transfers? Are assumptions and limitations stated at all? A crypto report with no limitations section is not a careful report. Do the conclusions exceed the questions the expert was instructed to answer? Does the expert opine outside their expertise, on legal characterisation, intention, or a party's state of mind? Are the data sources and date of analysis identified, and can the work be re-run today against the same chain state? Is there an independence declaration, and does the fee arrangement or a prior relationship undermine it? Practical Matters Before and After Instruction Run the conflict check first, with the full party list including corporate vehicles and any exchange or custodian in the picture. Then write a letter of instruction that asks answerable questions. "Trace the stolen funds" is not answerable; "identify the destination of the 312 BTC transferred from the addresses at Schedule 2 between 3 and 9 March 2025, and state whether any part reached an identifiable service" is. Ambiguous instructions produce reports that miss the issue and hand the other side a line of attack about scope. Agree scope, fee basis and deadline in writing before analysis starts, and give the expert the full timetable, not only the report date. Urgent applications run to a different rhythm: a focused analysis for a freezing application, then a fuller report later. Where each side has an expert, expect expert discussions and a joint statement. In crypto cases the technical gap narrows sharply at that stage, because both experts are reading the same public ledger; what remains in dispute is usually attribution and the confidence attached to inferences, which is exactly what should reach the hearing. By then the work that decides the outcome is months old. An expert with a documented method, stated assumptions and limitations disclosed on the face of the report is a hard target. One defending an undocumented method for the first time under questioning is not. Watch, too, for the expert who argues the client's case from the witness box. It reads as partiality and costs more than the point being defended. How Ondology Labs Can Help We are a blockchain forensics and auditing firm in Cyprus providing blockchain forensics and tracing , crypto asset recovery , and independent expert witness reports and court support for legal teams in Cyprus, Greece and across the EU. We accept single joint expert appointments, take part in expert meetings and joint statements, and attend to be cross-examined. Where a finding rests on inference rather than proof, we say so in the report, before opposing counsel does. Related reading: Blockchain forensics in Cyprus and Greece . Written by Panayiotis Kattides Co-Founder & CTO, Ondology Labs Panayiotis co-founded Ondology Labs and leads its technical work from Nicosia, Cyprus. A data scientist by background with more than five years in cryptocurrency, he builds the analytics behind the firm's tracing and audit engagements, including clustering, risk scoring, and cross-chain transaction analysis, and works on financial crime detection for legal teams and digital-asset businesses. MSc in Data Science and Analytics ISO/TC 307 Technical Committee Member 5+ years in cryptocurrency AI, machine learning & financial crime detection