Crypto audits for blockchain companies in Cyprus

In almost all cases, yes — and not because it is good practice. A company registered in Cyprus is required to prepare annual financial statements, have them audited by a licensed audit firm, and file them with the Registrar of Companies alongside its tax return. The obligation attaches to the company, not to what the company does. Running a crypto exchange, a Web3 product, a DAO treasury, or a token issuer does not exempt you from it. What being a blockchain business changes is not whether you are audited but what the audit has to examine: the obligation is ordinary, the evidence is not. That gap is why crypto-native companies in Cyprus routinely struggle to close an audit on time. If you hold a CySEC authorisation as a crypto-asset service provider, the audit sits alongside your supervisory obligations rather than replacing them — your AML framework and client-asset safeguarding are reviewed separately. Exemptions in Cyprus are narrow and change, so we confirm your exact filing position and deadlines with CYAUSE at scoping rather than leaving you to assume them.

If the entity is a Cyprus-registered company, the filing obligation is the same as for any other company. What differs is the evidence: treasury held in multi-signature wallets, protocol revenue arriving on-chain without invoices, contributor payments made in tokens, and governance decisions recorded on-chain rather than in board minutes. Those are all auditable, but only by a team that can read them. We see this structure often and scope for it directly.

CYAUSE Audit Services Ltd does, as the ICPAC-licensed audit office. In Cyprus a statutory audit opinion can only be issued by a licensed audit firm, so the partnership is structured accordingly: CYAUSE carries the audit responsibility and the licence, and Ondology Labs provides the blockchain examination that produces audit evidence over the digital-asset balances. You engage one team and receive one set of audited financial statements.

Because the evidence lives somewhere a conventional audit programme does not look. A bank balance is confirmed by writing to the bank. A wallet balance has no one to write to — it is confirmed by proving control of a private key and reading the chain. Auditors without that capability tend to rely on management-prepared schedules, which is precisely the assertion an audit is supposed to test independently.

Proving control of every reported wallet by cryptographic signature or a nominal transfer on our instruction, reading balances directly from the chain at the reporting date, reconciling on-chain movement to the ledger, separating internal transfers from genuine economic events, and identifying connected addresses that suggest related-party transactions. Anything we cannot verify is reported as unverified rather than assumed.

IFRS as adopted in the EU is the usual framework for Cyprus entities, and it is what most digital-asset businesses here report under. The accounting treatment of crypto assets under IFRS is not always intuitive, particularly on classification and measurement, so we agree the treatment and its basis early rather than at the reporting date.

Scope and level of assurance. A proof of reserves engagement is a targeted attestation about assets and customer liabilities at a point in time. A financial statement audit is an opinion on the whole entity — revenue, expenses, going concern, related parties, and disclosures — issued under statutory audit standards. Many businesses need both: reserves attestations frequently for customers, and an annual audit for regulators, banks, and investors.

An audited set of financial statements is one part of what a supervised firm has to produce, and it is the part this engagement delivers. It does not by itself evidence your AML framework or your client-asset safeguarding, which are separate reviews. Confirm your specific filing obligations with your own compliance function or counsel; we scope the audit around what you are actually required to file.

The wallet and exchange account list, ledger and accounting system exports, custody documentation, and the prior year financial statements. Timelines depend far more on the state of your records than on the audit itself: a business whose on-chain activity is already reconciled moves quickly, while one reconciling for the first time should expect that work to dominate the timetable.

Not straight away, and it is better to say so than to start and stall. Reconciliation is a prerequisite, not part of the audit — an auditor cannot both prepare the underlying records and issue an independent opinion on them. Where the gap is significant we will tell you at scoping and set out what has to happen first.

The statutory audit is delivered through CYAUSE as a Cyprus-licensed audit firm, so it fits Cyprus-registered entities and their group reporting most directly. For entities audited elsewhere, we are frequently engaged by the incumbent auditor to perform the digital-asset examination and provide evidence they can rely on. That works well and is a common arrangement.