Proof of Reserves vs a Financial-Statement Audit

A proof-of-reserves report answers one narrow question — "do the on-chain assets cover customer balances at this instant?" — and is routinely presented as if it answered a much bigger one: "is this entity solvent and fairly stated?" Those are different questions, with different scope, different performers, and different levels of assurance. This guide draws the line precisely: what a PoR procedure actually covers, the limitations the SEC has flagged, and why an audit and a PoR are complementary rather than interchangeable.

What separates the two

• A PoR is limited-scope and point-in-time: on-chain assets against a representation of customer liabilities. An audit is a comprehensive examination of the financial statements ending in an opinion.
• A PoR often provides no assurance and can be issued by non-registered firms or third parties; a financial-statement audit can only be done by a registered firm.
• A PoR generally excludes off-chain liabilities, debts, related-party obligations, and internal controls — so it is not a solvency proof.
• Its limitations are structural: a point-in-time snapshot (the borrow-for-the-snapshot risk), no universal Merkle-tree standard, and total dependence on the performing firm.
• The SEC has explicitly cautioned investors that alternatives to financial-statement audits are not equivalent.
• The two are complementary: the audit is the foundation; the PoR adds customer-facing transparency on custodied assets.

What proof of reserves actually is

A PoR procedure takes a snapshot of the on-chain assets an entity controls and compares it against a representation of customer liabilities, usually via a Merkle-tree commitment so an individual user can verify their balance is included. That is its entire scope: inclusion, and a point-in-time asset position.

It typically does not cover:

• off-chain liabilities, loans, or related-party obligations;
• the entity's internal controls or governance;
• the completeness of the liability set;
• the overall financial position of the company.

So a clean PoR does not establish that the entity is solvent on a full-balance-sheet basis. It establishes a much narrower thing.

What a financial-statement audit is

A financial-statement audit is a comprehensive examination of the financial statements by a registered accounting firm under professional standards, resulting in an opinion. It addresses assertions across the whole entity — existence, completeness, rights and obligations, valuation, presentation — including liabilities and going concern. It can only be performed by a registered firm. A PoR, valuation, or calculation report, by contrast, may be provided by a registered firm, an unregistered firm, or another third party, and often provides no assurance as to the reliability of the information.

The limitations to state plainly

This is why the SEC has cautioned investors that alternatives to financial-statement audits, including reserve and calculation reports, are not equivalent and should be treated with care.

Use both, and be precise

The right posture is not "PoR or audit" but both, accurately labelled:

• Financial-statement audit — the foundation for regulatory credibility and a complete view of the entity.
• Proof of reserves — a customer-facing transparency layer for custodied assets, between audit periods.

The failure mode is using PoR as a substitute for an audit, or describing a no-assurance PoR as if it were an opinion. Precision about what each report assures is itself a trust signal (see crypto audit readiness and auditing crypto existence and ownership). The same on-chain ledger a PoR samples is also the auditor's corroborating evidence — see blockchain as audit evidence.

Side-by-side comparison: what each report does and does not cover

This table illustrates why the two serve different audiences: the audit answers the regulatory and institutional question ("is this entity's financial position fairly stated?"), while the PoR answers the individual customer question ("is my balance included in the reserve?"). Both questions are legitimate. Conflating the answers is the error.

Practical guidance

1. Never present PoR as an audit — state its scope and assurance level explicitly.
2. Read the engagement wording — "no assurance" means no assurance.
3. Check who performed it — registered firm vs third party changes its weight.
4. Treat PoR as point-in-time — pair it with frequency and with an audit for the full picture.
5. Maintain full books for the audit regardless — PoR does not reduce that obligation.
6. Disclose liabilities separately — PoR does not cover them.

How vendor tools support reserves and audit data

Cryptio and Ledgible maintain the wallet inventory, balances, and reconciled ledger that both a reserves exercise and a financial-statement audit draw on. Confirm the tool produces an auditable, complete wallet set with a reconciled ledger — PoR and audit are only as good as the completeness of the underlying records, which is the part a tool should guarantee.

Where Wag3s fits

Wag3s Ledger keeps a complete, reconciled multi-chain wallet inventory and ledger — the substrate a financial-statement audit tests and a reserves exercise samples. It supplies the underlying records so a company can support both exercises correctly and describe each accurately; it does not itself issue a PoR opinion or perform the audit, both of which remain the work of the firm engaged. See the Ledger product page and the Wag3s for accountants page.

Further reading

• Crypto Audit Readiness
• Auditing Crypto Existence and Ownership
• Auditing Crypto Fair Value
• The FEC for Crypto in France
• Crypto Audit Trail and Piste d'Audit Fiable
• Multi-Chain Reconciliation

Sources

• SEC Office of Investor Education and Advocacy & Office of the Chief Accountant — Investors in the Crypto Asset Markets Should Exercise Caution With Alternatives to Financial Statement Audits: proof-of-reserves reports are not equivalent to financial-statement audits, may be issued by registered or unregistered firms or third parties, often provide no assurance, and exclude liability information; it is a red flag to portray them as equivalent or superior.
• AICPA & CIMA — Accounting for and Auditing of Digital Assets practice aid (non-authoritative): the assertions a financial-statement audit addresses for digital assets (existence, rights and obligations, completeness, valuation) — the comprehensive scope a PoR does not cover.
• Proof-of-reserves limitations are a matter of practice, not a single audit standard: a point-in-time snapshot (borrow-for-the-snapshot risk), off-chain liabilities excluded, no universal Merkle-tree methodology, and dependence on the performing firm's expertise and independence.