Blockchain Audit Frequently Asked Questions (FAQ)
Expert Answers to Common Questions on Statutory Audits, MiCA, CASPs and Digital Assets
The blockchain and digital asset industry continues to evolve rapidly. As Crypto-Asset Service Providers (CASPs), fintech companies and blockchain businesses grow, directors, finance teams and investors frequently ask how statutory audits apply to their organisations.
Below we answer some of the most common questions we receive regarding blockchain audits, MiCA, financial reporting and digital asset assurance.
General Questions
What is a blockchain audit?
A blockchain audit, in the context of statutory financial reporting, is an independent audit of a company's financial statements where the business operates within the blockchain or digital asset sector. The audit is performed in accordance with International Standards on Auditing (ISA) and considers the unique accounting, governance and technology risks associated with blockchain businesses.
What is a Crypto-Asset Service Provider (CASP)?
A Crypto-Asset Service Provider (CASP) is an entity authorised to provide one or more regulated crypto-asset services under the EU Markets in Crypto-Assets Regulation (MiCA), such as custody, exchange, trading platform operation, portfolio management or crypto-asset transfer services.
Does MiCA require a statutory audit?
MiCA itself establishes regulatory requirements for authorised CASPs. Whether a company requires a statutory audit depends on the applicable legal and financial reporting requirements, including Cyprus company law and other relevant legislation.
Why should I choose an auditor with blockchain expertise?
Blockchain businesses involve specialised accounting, technology and governance considerations that differ significantly from traditional industries. An auditor familiar with digital assets can better understand your business model, identify relevant risks and perform an efficient, risk-focused statutory audit.
Financial Reporting
Which accounting standards apply to crypto-assets?
Financial statements are generally prepared using the applicable financial reporting framework adopted by the entity, such as IFRS Accounting Standards. There is currently no standalone IFRS Accounting Standard dedicated exclusively to crypto-assets.
How are crypto-assets valued?
The valuation methodology depends on the characteristics of the asset, the applicable accounting framework and management's accounting policies. Auditors evaluate whether the chosen methodology is appropriate and consistently applied.
How are customer crypto-assets accounted for?
This depends on the contractual arrangements, the rights and obligations of the parties and the applicable accounting framework. Assets held on behalf of customers are not necessarily accounted for in the same manner as company-owned assets.
Are stablecoins accounted for differently?
Potentially. The accounting treatment depends on the legal and economic characteristics of the particular stablecoin and the entity's purpose for holding or issuing it.
Audit Procedures
How do auditors verify crypto-assets?
Auditors obtain evidence from a combination of sources, which may include blockchain records, accounting records, contracts, custody confirmations, reconciliations and management documentation. The procedures performed depend on the circumstances of each engagement.
Can blockchain transactions be independently verified?
Public blockchain transactions can often be observed using blockchain explorers and other tools. However, blockchain records are only one source of audit evidence and do not, on their own, establish legal ownership or appropriate financial statement presentation.
Do auditors need access to our private keys?
No. Auditors do not require possession of private keys. Audit procedures are designed to obtain sufficient appropriate evidence without compromising the security of digital assets.
Do auditors test our smart contracts?
A statutory financial statement audit is not a smart contract audit. However, auditors may seek to understand how smart contracts affect financial reporting where relevant to the financial statements.
Governance
What governance arrangements should a CASP have?
Appropriate governance depends on the size and complexity of the organisation but generally includes effective board oversight, documented policies, segregation of duties, internal controls, risk management and reliable financial reporting processes.
Are internal controls important for small blockchain businesses?
Yes. Every organisation should establish internal controls proportionate to its size and operational risks. Good governance supports accurate financial reporting and facilitates the statutory audit.
Why are wallet reconciliations important?
Wallet reconciliations help ensure that blockchain balances agree with accounting records, enabling management to identify discrepancies promptly and prepare reliable financial statements.
What documents should directors maintain?
Typical documentation includes:
Technology
Is a statutory audit the same as a cybersecurity audit?
No. A statutory audit focuses on the financial statements. Auditors obtain an understanding of technology controls relevant to financial reporting but do not provide an opinion on the effectiveness of an organisation's cybersecurity programme.
Do auditors review our IT systems?
Auditors consider information systems relevant to financial reporting. The extent of this work depends on the nature of the organisation and the assessed audit risks.
Does using blockchain eliminate fraud risk?
No. Although blockchain technology provides transparency, fraud may still occur through unauthorised access, manipulation of accounting records, management override of controls or other means.
Revenue and Operations
How is staking income recognised?
The accounting treatment depends on the facts and circumstances of the arrangement, including the contractual rights, the applicable accounting framework and management's accounting policies.
What is the difference between principal and agent?
Some CASPs provide services as principals, while others act as intermediaries. Determining the correct presentation of revenue requires careful analysis of the contractual arrangements and the applicable accounting requirements.
What is Proof of Reserves?
Proof of Reserves is generally a process intended to demonstrate the existence of certain crypto-assets at a point in time. It is not equivalent to a statutory financial statement audit.
Does Proof of Reserves replace a statutory audit?
No. Proof of Reserves and statutory audits have different objectives. A statutory audit considers the financial statements as a whole, including assets, liabilities, revenue, disclosures, governance and accounting policies.
Working with an Auditor
When should we appoint an auditor?
Organisations benefit from engaging with an auditor well before the financial year-end, particularly where the business has complex digital asset activities or is preparing for its first statutory audit.
How can we prepare for our first audit?
Good preparation includes maintaining complete accounting records, performing regular reconciliations, documenting accounting policies, organising supporting documentation and establishing appropriate internal controls.
Will the audit interrupt our business?
Careful planning, organised documentation and regular communication with the audit team help minimise disruption during the engagement.
How long does a statutory audit take?
The duration depends on factors such as the size of the organisation, the complexity of its operations, the quality of accounting records and the timeliness of management's responses.
What happens if auditors identify weaknesses?
Where significant deficiencies relevant to the audit are identified, auditors communicate these to management or those charged with governance in accordance with professional standards. Addressing such observations can strengthen governance and improve financial reporting.
Choosing the Right Auditor
Why should we choose CYAUSE Audit Services?
Our team combines expertise in:
-
International Standards on Auditing (ISA);
-
IFRS Accounting Standards;
-
blockchain technology;
-
digital asset accounting;
-
corporate governance;
-
financial reporting;
-
internal controls; and
-
Crypto-Asset Service Providers operating under the MiCA framework.
We understand the challenges facing digital asset businesses and provide independent statutory audits tailored to the risks associated with blockchain operations.
Can you also advise on accounting matters?
Where consistent with our independence obligations, we assist clients in understanding financial reporting requirements, preparing for the statutory audit and strengthening governance arrangements.
Do you work with international clients?
Yes. Subject to applicable legal, professional and independence requirements, we support organisations with cross-border operations and international digital asset activities.
Contact Our Blockchain Audit Specialists
Blockchain businesses require auditors who understand both traditional financial reporting and the unique characteristics of digital assets.
Whether your organisation is a newly authorised Crypto-Asset Service Provider, an established cryptocurrency exchange or a technology company holding digital assets, MKGG provides independent statutory audit services supported by specialist expertise in blockchain technology, MiCA, IFRS Accounting Standards and corporate governance.
If you would like to discuss your statutory audit requirements or learn more about our blockchain audit services, our experienced team would be pleased to assist.
Related Resources
You may also find the following guides helpful:
-
Blockchain Audit Services in Cyprus
-
Statutory Audit of Cyprus CASPs
-
MiCA, CySEC and Financial Reporting Requirements
-
Auditing Crypto-Assets under International Standards on Auditing
-
Accounting for Crypto-Assets under IFRS
-
Wallet Verification and Digital Asset Custody
-
Internal Controls for Blockchain Businesses
-
Revenue Recognition under IFRS 15
-
Preparing Your CASP for Its First Statutory Audit
-
Proof of Reserves vs Statutory Audit
-
Cybersecurity and IT General Controls
-
Board Responsibilities and Corporate Governance
-
Industries We Serve