PCAOB staff warns investors (and auditors) about proof of crypto reserve reports

On March 8, 2023, the Public Company Accounting Oversight Board’s (PCAOB) Office of the Investor Advocate issued an Investor Advisory warning investors to “exercise extreme caution” when relying on proof of reserve reports (PoR Reports) that are frequently prepared by third-party firms on behalf of various crypto companies.

While directed at investors, the PCAOB’s warning should also be heeded by firms that prepare such reports and crypto entities that provide such reports to their customers.

Background

Certain companies, including PCAOB-registered public accounting firms, have issued and continue to issue PoR Reports to certain crypto entities (eg, crypto exchanges, stablecoin issuers). These reports provide a snapshot of a custodial company’s assets and liabilities and are often used to show that a crypto company providing custody services possesses assets that are equal to or greater than customer deposits. A crypto company may engage an accounting firm to issue a PoR Report in an attempt to reassure its customers concerning, for example, the availability of digital assets in the event that some or all of the customers decide to withdraw their assets (eg, if there is a run on a crypto exchange or stablecoin issuer). Although accounting firms are often engaged to provide PoR Reports, these reports do not constitute an audit of a crypto company’s assets or liabilities.

In a January 2023 letter to PCAOB Chair Erica Williams, Senators Elizabeth Warren (D-MA) and Ron Wyden (D-OR) expressed concern that PoR Reports are misunderstood by investors and may be misused by some crypto companies. In their letter, the senators noted that proof of reserve examinations performed by accounting firms “fall significantly short of real audits” and are not subject to PCAOB auditing standards. Further, the senators noted that some crypto companies have publicly “touted” PoR Reports as audits and questioned whether some accounting firms that provided such reports “were acting as ‘crypto industry cheerleaders.’”

In light of these concerns, Senators Warren and Wyden urged the PCAOB to take action – pursuant to PCAOB rules 3100 and 3200 – against PCAOB-registered firms that provide PoR Reports or audit services to crypto companies, regardless of whether the crypto companies are public issuers or broker dealers subject to public, reportable audits and thereby subject to PCAOB jurisdiction. The senators’ letter suggested that if an audit firm is registered with the PCAOB, any audit it performs must conform with PCOAB standards not just audits of public issuers or broker-dealers and as such, work done by PCAOB registered firms for crypto companies is subject to PCAOB auditing standards.

PCAOB staff investor advisory

Echoing the concerns expressed by Senators Warren and Wyden, the PCAOB’s Office of the Investor Advocate issued the Advisory “because of concerns that investors and others may place undue reliance” on PoR Reports. While noting that these reports “are not within the PCAOB’s oversight authority,” the Advisory warns investors that PoR Reports “do not provide any meaningful assurance to investors or the public.”

The Advisory notes that, in general, PoR Reports only purport to provide an asset verification at a particular moment in time. Further, the Advisory warns that PoR Reports are also subject to significant limitations based on the procedures performed. For example, “the procedures undertaken likely do not address the crypto entity’s liabilities, the rights and obligations of the digital asset holders, or whether the assets have been borrowed by the crypto entity . . .” As a result, a PoR Report cannot provide any assurance about whether the assets of a company are sufficient to meet customer withdrawal demands.

Moreover, the actual procedures performed by an accounting firm to derive a PoR Report may have been directed by the management of the crypto entity, not the provider of the report. Under these circumstances, the PoR Report provides “only factual findings of the outcome of the procedures performed, and there is no representation as to the sufficiency of such procedures.” These types of PoR Reports do not assess the adequacy of the “reserves” or the financial stability of the crypto entity or the validity of management’s assertion(s).

In addition, PoR Reports “provide no assurance regarding the effectiveness of internal controls or of governance of the crypto entity.”

In sum, the Advisory warns that proof of reserve examinations “are not equivalent [to] or more rigorous than an audit, and they are not conducted in accordance with PCAOB auditing standards.” Accordingly, “customers should exercise extreme caution when relying on them to conclude that there are sufficient assets to meet customer liabilities.” (Emphasis in original).

Takeaways – customers, accounting firms and crypto entities should tread carefully

Customers

The Advisory is a stark and direct warning to customers of crypto entities that PoR Reports and exams should not be relied upon as proof of a crypto company’s stability or ability to meet customer withdrawal demands. Customers should pay attention to the limitations of PoR Reports and evaluate what additional steps might be necessary to safeguard their assets.

Accounting firms and other providers of PoR reports

Because PoR Reports can be inaccurately portrayed as “audits” or other evidence of financial stability by crypto companies or others, accounting firms providing such reports face risks in the event that legal or enforcement proceedings result if the crypto company for which it performed the work develops issues. Firms providing PoR Reports and services should carefully consider their disclosures concerning such engagements. Firms should consider disclosing on the face of any such reports the limitations of the engagement and should also specify limitations related to the use of any report.

Crypto entities

Inaccurate disclosures concerning PoR Reports could expose a crypto entity to government enforcement actions, particularly by the Securities and Exchange Commission and Department of Justice. In addition, inaccurate disclosures create the risk for private litigation. Crypto companies that obtain and publish PoR Reports should therefore carefully consider their public statements and disclosures concerning such reports or similar work performed by third-party firms, including accounting firms. In particular, crypto entities should include disclosures regarding limitations and caveats as to the scope and use of such reports.

If you have any questions regarding the PCAOB Investor Advisory or potential ways to reinforce your disclosures, please contact any of the authors or your DLA Piper relationship attorney.