Proof of reserves shows, at best, that specified crypto assets sat in specified wallets or accounts at one moment. It does not show what the business owes, whether the assets were borrowed, or whether they are still there today. That is also the PCAOB’s position: in a March 8, 2023 investor advisory, its Office of the Investor Advocate staff wrote that proof-of-reserve engagements “are not audits”, are not performed under PCAOB auditing standards and are not subject to PCAOB inspection, even when a PCAOB-registered firm does the work.
Last checked November 9, 2026, against the PCAOB advisory and the SEC investor publications linked below.
What the PCAOB and the SEC say
Three U.S. publications from 2023 set out how regulators describe these reports. None of them is a rule; each says what its authors think investors should watch for.
| Date | Source | Key points |
|---|---|---|
| March 8, 2023 | PCAOB Office of the Investor Advocate, investor advisory | Proof-of-reserve reports are “inherently limited”. Procedures likely do not cover liabilities, holders’ rights or borrowed assets. They give no assurance about internal controls, governance or what happens after the report date. Staff views, “not a rule, policy, or statement of the Board”. |
| March 23, 2023 | SEC investor alert on crypto asset securities | Calls proof of reserves a voluntary, point-in-time method. It may not show what management did between snapshots, does not tell customers whether they “stand in line” behind other creditors, and is not as rigorous as a financial statement audit. |
| July 27, 2023 | SEC investor bulletin on alternatives to audits | Proof-of-reserves, valuation and calculation reports are not audit reports as the PCAOB and SEC define them, may come from unregistered firms, and may fall outside PCAOB standards and inspection. Describing them as equal or superior to an audit is a red flag. |
The same day as that bulletin, the SEC’s Chief Accountant published a statement aimed at accounting firms that do this work. It says non-audit arrangements are “neither as rigorous nor as comprehensive as a financial statement audit” and suggests a firm consider withdrawing if a client misrepresents what the firm did.
Read the scope before the total
A report may cover selected assets, selected accounts or a particular population of customer balances. The SEC alert lists what management typically decides: which wallets are examined, how often, which standard and level of assurance apply, who the provider is, and whether and how results are published.
Find the date, the entities covered, the asset types and the method. A large number is difficult to interpret without knowing which obligations it is supposed to support.
Also distinguish a live dashboard from an independent report. A dashboard can be useful for visibility, but the source and validation of its inputs matter.
Which kind of report are you reading?
The label on a report matters less than the engagement behind it. The PCAOB advisory names three levels that proof-of-reserve work can aim for: reasonable assurance, limited assurance, or none at all in an agreed-upon-procedures engagement.
| Report type | Who sets the work | What the reader gets | What it can still miss |
|---|---|---|---|
| Financial statement audit under PCAOB standards | Auditing standards; registered firm, subject to PCAOB inspection | An opinion on a complete set of financial statements, assets and liabilities | Events after the balance-sheet date |
| Proof-of-reserves report aiming at reasonable assurance | Management and the provider choose the standard and scope | An opinion on a specific assertion, such as holdings at a date | Liabilities, borrowed assets and anything outside the chosen scope |
| Limited-assurance report | Same, with less work | A negative statement (“nothing came to our attention”) | As above, with lower confidence |
| Agreed-upon procedures | Management chooses the procedures, according to the PCAOB advisory | Factual findings only; no view on whether the procedures were enough | The adequacy of reserves and the company’s financial stability |
| Customer inclusion check (Merkle tree or similar) | The exchange publishes the data | Confirmation that your balance appears in the dataset | Whether every other liability is in it, and whether assets are unencumbered |
| Live wallet dashboard | The exchange | Addresses and on-chain balances | Who else has a claim on those coins and what is owed off-chain |
A quick test from the SEC bulletin: an audit report under PCAOB standards is titled “Report of Independent Registered Public Accounting Firm” and states that the audit was conducted under PCAOB standards. A report that does not say so is not that kind of audit, whatever else it is called.
Assets are only one side of the question
A business can hold substantial assets and also owe substantial amounts. To assess whether assets meet obligations, you need a reliable view of both.
The PCAOB advisory makes the borrowing point directly: if the assets were borrowed at the time of the engagement, investors “would not know based on the PoR Report”. Evidence of control over an address does not, by itself, establish unencumbered ownership of everything at that address.
A worked example
The figures below are invented to show the arithmetic; they describe no real company.
| Step | Figure |
|---|---|
| Customer balances included in the published liability list | 10,000 BTC |
| Coins in the wallets the report examined, at the snapshot | 10,500 BTC |
| Headline reserve ratio (10,500 / 10,000) | 105% |
| Coins in those wallets that were borrowed from a lender and are due back | 1,500 BTC |
| All obligations that rank against those coins (10,000 + 1,500) | 11,500 BTC |
| Ratio against all obligations (10,500 / 11,500) | about 91% |
| Customer balances left out of the liability list, such as a product outside scope | 800 BTC |
| Ratio once those are added (10,500 / 12,300) | about 85% |
Nothing in the headline figure was false. The 105% simply answered a narrower question than “can every customer be paid”. The loan and the excluded balances sit outside a report that looks only at selected wallets and a selected customer list, which is the gap both the PCAOB and the SEC describe.
A snapshot does not establish future availability
Assets can move after the measurement date. They can be lent, pledged or otherwise become unavailable under arrangements the snapshot does not reveal. The PCAOB advisory notes that the reports give no assurance about whether assets “were used, lent, or otherwise became unavailable” after issuance.
The shorter the time between a report and your decision, the fresher the observation may be, but freshness does not expand the report’s scope. A current narrow report is still narrow.
Ask whether the process is periodic, continuous or tied to a one-time event. Then inspect what happens between observations rather than assuming the latest result applies indefinitely.
Customer inclusion checks have a limited purpose
Some reserve systems let a customer verify that a representation of their balance appears in a published dataset. That can answer an inclusion question for that record.
It does not independently prove that every liability was included, that the assets are free of claims or that the business has effective controls. Those are separate assertions requiring separate evidence.
Do not enter private keys or recovery phrases into a verification tool. A legitimate reserve-inclusion check should not need control over your self-custody wallet; our wallet explainer covers what the keys actually control.
Use the report as one piece of evidence
For a custody service, reserve information belongs alongside withdrawal terms, the account agreement, operational access and the identity of the organization holding assets. If a regulated bank or trust company is involved, our guide to what a banking partner means explains who holds what.
For a stablecoin, also examine the issuer’s redemption process and backing structure. Our stablecoin peg explainer describes why market price and access can diverge from a stated target value.
A careful reading can still make a reserve report useful. It helps you know which questions have evidence behind them and which remain unanswered.
