Proof of reserves audits in Cyprus

A proof of reserves engagement independently verifies that the crypto assets a custodian holds are sufficient to cover what it owes its customers. It has two halves that must both be done: proving control of the reserve wallets on-chain, and establishing the total customer liability from the internal ledger. Only the two together demonstrate solvency — a wallet balance on its own proves nothing about what is owed against it.

No, and the distinction matters. A proof of reserves engagement is a targeted attestation about assets and customer liabilities at a point in time. A financial statement audit is a much broader opinion covering the whole entity — revenue, expenses, going concern, related parties, and off-balance-sheet obligations. Proof of reserves is faster and more frequent; a full audit is deeper. Most crypto businesses eventually need both, and we provide each.

Through cryptographic proof rather than assertion. We have you sign a challenge message with the private keys controlling each reserve address, or move a nominal amount on our instruction, so that control is demonstrated rather than claimed. Addresses you merely name to us — including ones you might have borrowed sight of — do not count as reserves.

With a Merkle tree. Each customer balance is hashed into a tree whose root we publish alongside the attestation. Any customer can then check that their own balance was included in the total we verified, using a proof unique to them, without seeing anyone else's data. We test the tree construction ourselves rather than taking the output on trust, because a Merkle proof is only as good as the completeness of the leaves fed into it.

Proof of reserves is a snapshot. It shows the position at a moment, and it cannot by itself rule out assets borrowed shortly before that moment and returned after, nor liabilities kept outside the ledger we were given. We mitigate this with unannounced timing, control testing over the liability ledger, and recurring attestations rather than a single one — and we state the residual limitations plainly in the report, because an attestation that overclaims is worse than none.

Quarterly is the emerging norm for exchanges and custodians, and monthly is increasingly expected of stablecoin issuers. A single one-off attestation has limited assurance value — the credibility comes from an unbroken series, published on a schedule you commit to in advance and keep to even in a bad quarter.

MiCA does not use the phrase "proof of reserves", but it imposes obligations that proof of reserves is the practical way to evidence: crypto-asset service providers must segregate and safeguard client assets, and asset-referenced and e-money token issuers face specific reserve, custody, and reporting requirements. For a CASP authorised in Cyprus under CySEC supervision, a recurring reserves attestation is a direct way to demonstrate that client assets are held as claimed.

Bitcoin, Ethereum and the major EVM chains, and the other principal networks, together with the stablecoins and tokens issued on them. We handle multi-signature and MPC custody arrangements, and assets held with third-party custodians or deployed into staking and lending — though the latter carry counterparty risk we identify separately rather than counting at face value.

For a first engagement, typically a few weeks from scoping to report, with most of that spent establishing the liability side and testing the controls around it. Once the methodology is agreed and the data pipeline is in place, recurring attestations run substantially faster.