Custody Audit

Overview

What does Custody Audit mean?

A custody audit evaluates whether asset holdings, records, controls, keys, segregation, and client obligations are accurately maintained within a defined scope.

How it works in practice

A custody audit examines whether digital assets under a service's control are safeguarded, correctly recorded and attributable to entitled owners. Procedures may cover wallet ownership evidence, key-generation controls, access approvals, reconciliations, segregation, transaction sampling, incident logs and third-party dependencies. Auditors must define the audit's scope and date: a snapshot of on-chain assets is not a complete examination of liabilities, hidden encumbrances or future withdrawal ability. Evidence may include signed messages, controlled key demonstrations and independent accounting records.

Further operational details

Implementation of Custody Audit should map evaluation of whether asset holdings, records, controls, keys, segregation, and client obligations are accurately maintained within a defined scope to the applicable entity, product, customer, transaction, and jurisdictional scope. Material changes affecting the Custody Audit context and whether asset holdings, records, and controls should trigger reassessment instead of silent reuse of an outdated conclusion.

A custody audit examines how an organization safeguards and accounts for assets held for itself or clients. Scope may include ownership records, wallet balances, bank accounts, key management, approvals, reconciliations, segregation, transfers, access logs, and incident procedures.

Limits and common misunderstandings

An exchange can prove control over public addresses without proving that customer balances are fully backed. Conversely, publishing private key details or sensitive recovery material to demonstrate control creates unacceptable security exposure.

Related glossary terms

Custody; Off-Chain; Address Token Mismatch