Reserve Audit

A reserve audit is an independent examination, by a qualified auditor, of the assets that a financial business holds to back what it owes to customers. It is most often discussed for fiat-backed stablecoin issuers, but the same idea applies to e-money institutions, payment firms that hold customer funds, crypto custodians and exchanges. A reserve audit seeks to confirm that the reserves exist, belong to the business or are held for customers, are correctly valued and are sufficient to meet the claims of token holders or account holders.

The term is used loosely in the crypto industry, where firms have sometimes described narrower reports as audits. In the strict sense, an audit follows auditing standards, covers a period rather than a single date and usually forms part of, or sits alongside, an audit of the company's financial statements. It provides more assurance than a reserve attestation, which reports on a management statement at a point in time, and it differs from cryptographic proof of reserves.

An auditor reviewing reserves typically tests several areas:

• Existence. Confirming balances directly with banks, custodians and fund managers, and checking securities holdings against custody records.
• Rights and obligations. Establishing that the reserves are owned by the issuer or held on trust for customers, and identifying any pledges, liens or lending of assets.
• Valuation. Testing the valuation of securities, deposits and other assets, including the treatment of accrued interest and any impairment.
• Completeness of liabilities. Checking that all tokens or customer balances outstanding are captured, including tokens on every blockchain and pending mints and redemptions.
• Controls. Assessing the processes that govern minting, redemption, reconciliation, custody and investment of reserves, often through a separate report on internal controls.

For most regulated firms, reserves are examined within the annual audit of the company's financial statements by an independent auditor, which results in an auditor's report on the whole entity. This covers the reserves, but also the issuer's other assets, liabilities, revenues and risks, such as whether it can continue as a going concern. A stand-alone reserve audit focuses on the reserve portfolio and the matching liabilities, and may be required more often than once a year.

For payment and e-money firms in the United Kingdom, safeguarding arrangements are subject to a specific annual audit by an external auditor, separate from the financial statement audit, because customer money must be protected through safeguarding rather than deposit insurance. This is a reserve audit in substance, focused on whether customer funds were properly segregated and reconciled throughout the year.

Stablecoin laws increasingly require audits in addition to frequent attestations. Under the European Union's MiCA, issuers of asset-referenced tokens must have their reserves independently audited on a regular basis and publish the results, and e-money token issuers are subject to e-money safeguarding and audit rules. US federal stablecoin legislation enacted in 2025 combines monthly reserve reporting with audited financial statements for larger issuers. Regulators in Singapore, Hong Kong and elsewhere similarly require audited reserves for licensed issuers. Supervisors such as the NYDFS also review reserve management directly.

During the early growth of the stablecoin market, few issuers published full audits of their reserves. Reasons given included the difficulty of finding major audit firms willing to take crypto clients, the novelty of auditing on-chain liabilities and the cost of continuous assurance. Many issuers relied instead on attestations or unaudited disclosures, which drew criticism from regulators and analysts and contributed to doubts about whether certain tokens were fully backed. The collapse of several crypto firms whose customer assets turned out to be missing reinforced calls for proper audits of stablecoin reserves and customer funds.

Even a full audit has limits. It provides reasonable, not absolute, assurance and relies on samples and confirmations. It covers a past period and cannot guarantee that reserves remain adequate afterwards. Audits may not fully capture risks such as sudden illiquidity of reserve assets, the failure of a bank holding deposits, or legal uncertainty over whether token holders have priority in insolvency. For these reasons, users and regulators look at audit results together with rules on eligible reserve assets, custody, redemption rights and frequent disclosure.