Crypto audit support for auditors and their clients

Specialist help with the digital-asset part of a financial statement audit, provided to whoever is running that audit. A conventional audit programme confirms a bank balance by writing to the bank. A wallet has nobody to write to: its balance is confirmed by proving control of a private key and reading the chain. Crypto audit support means we perform that examination, verifying wallet control, reading balances at the reporting date, reconciling on-chain activity to the ledger, and identifying connected addresses, and we hand the results to the auditor as documented working papers. The auditor keeps the engagement, applies their own judgement to our work, and issues the opinion.

No, and this service exists precisely so you do not have to. Your auditor keeps the engagement, the relationship, and the opinion. We are brought in for the digital-asset areas only: the wallet verification, on-chain balances, and reconciliation work that a generalist audit team cannot perform itself. Most companies that come to us are not unhappy with their auditor. They are stuck, because the audit cannot close until someone evidences the crypto balances, and nobody on the engagement can.

Under one of two models, agreed at scoping. Either the audit firm engages us directly and uses our work as an auditor's expert under ISA 620, which gives them the most direct control over our procedures, or the company engages us and our output is made available to the auditor as evidence they evaluate under ISA 500. Both are ordinary, well-understood arrangements. In either case the auditor decides what to rely on and remains responsible for the opinion; our job is to make that reliance defensible by documenting exactly what we tested and how.

Working papers you can put on the file. For each area: the procedures performed, the wallets and accounts covered, the blocks and records tested against, the results, and an explicit list of anything we could not verify. Wallet control is evidenced by cryptographic signature or a nominal transfer performed on instruction, never by accepting a screenshot. Balances are read from the chain and are independently re-performable by anyone who wants to check. You review the work, challenge it where you need to, and decide what it supports.

Yes. Some firms bring us in for a single awkward engagement; others use us as their standing digital-asset specialists across a portfolio. Each engagement is scoped and priced on its own, information is never shared between clients, and we are comfortable operating quietly in the background of your client relationship. We do not compete for the audit: we are not the signing firm on your engagement and we do not want to be.

Our work is built to be relied on under them. Auditing standards let an auditor use the work of an expert, but they require the auditor to evaluate the expert's competence, objectivity, and methods. So we document all three: who did the work and their qualifications, the basis of our independence from the audited entity, and a methodology section that sets out each procedure in enough detail to be re-performed. The standards judgement always remains the auditor's, which is exactly how it should be.

Never private keys, and we will not accept them if offered. Control of a wallet is proven by the holder signing a message we specify, or moving a nominal amount on our instruction, both of which demonstrate key control without disclosing anything. Beyond that we work from read-only material: address lists, exchange account exports, custody statements, and ledger extracts. Chain data itself is public; we read it directly rather than asking anyone for it.

Wallet control for every reported address, balances at the reporting date read directly from the chain, reconciliation of on-chain movement to the accounting ledger, separation of internal transfers from genuine economic events across bridges and swaps, and clustering of connected addresses that indicate related-party transactions. We cover the major chains and the usual custody arrangements: hot and cold wallets, multi-signature, MPC, and third-party custodians. Anything that cannot be verified is reported as unverified rather than assumed.

No. The chain is the same from anywhere, and this work is performed remotely against public data and the records you provide, so we support audits under any jurisdiction's statutory framework. We are based in Cyprus and know the Cyprus and wider EU reporting environment first-hand, which helps where the engagement is local, but audit firms and companies elsewhere engage us on the same basis.

At planning, not at the deadline. Involving us early means the wallet list is agreed before fieldwork, control verification is scheduled rather than improvised, and reconciliation gaps surface while there is still time to fix them. We do take engagements that are already stuck at year-end, and unsticking them is common work for us, but the same audit costs less and closes faster when the digital-asset scope is set at the start.

The fixing is a separate engagement, and keeping it separate protects the audit. If your on-chain activity has never been reconciled to your books, start with our transaction reconciliation service, which gets the records audit-ready. Where we act as the auditor's expert on evidence, we are careful about independence: the roles of preparing records and evidencing them are kept distinct, and we agree the boundaries with the auditor in writing at scoping.

By who signs the opinion. Our financial statement audit service is the whole engagement: a statutory audit delivered together with CYAUSE Audit Services Ltd, our ICPAC-licensed audit partner, who issues the opinion while we evidence the chain. Crypto audit support is for every other arrangement: you already have an auditor, or you are the auditor, and what is needed is the digital-asset expertise inside an engagement that belongs to someone else. If you do not yet have an auditor and need the full audit, the financial statement audit page is the right place to start.