Cryptocurrency custody assurance

Anyone doing business of any magnitude has to rely on other parties – which means trusting somebody else to deliver what they say they will. The more complex the work delegated and the more money and reputation at stake, the stronger this trust has to be. Cryptocurrency custody solutions are services where transparency and trust in the (virtual asset) service provider are of key importance because digital assets are easily lost forever when the corresponding private keys are not sufficiently protected.

Providers of cryptocurrency custody solutions are service organisations, offering secure storage solutions for cryptocurrencies. These services are developed and operated for institutional and private investors. The main objective is to ensure the availability, confidentiality and integrity of the private key(s) used by the clients to access the cryptocurrencies as well as the correctness of relevant (financial) transactions during the entire lifecycle.

Cryptocurrency custody providers use sophisticated technology, processes and controls in order to protect their clients’ private keys during key generation and operations. Clients of cryptocurrency custody providers are generally not able to transparently assess independently whether their private keys and thus their funds are adequately protected during the entire key lifecycle. This missing element of transparency can result in a lack of trust.

You might ask yourself how this lack of transparency might be adequately addressed? This is where an experienced and knowledgeable auditor can give support through an independent attestation.

An auditor can perform an independent attestation of the cryptocurrency custody provider’s IT environment, processes and controls against a defined control framework. The auditor assesses whether relevant risks are mitigated through adequate key controls, and that these controls are adequately designed and implemented at a specific point in time (scope 1 assurance engagement) or operated effectively over a defined period of time (scope 2 assurance engagement). The independent auditor will subsequently release an attestation detailing among other things the control framework, the assurance procedures performed, corresponding results and the conclusion. In the case of the Bitcoin Suisse Vault, this attestation was part of the audit report resulting from the pioneering work done between Bitcoin Suisse, its subsidiary Swiss Crypto Vault and PwC.

Further, the independent assurance report contains a conclusion with an assurance that can be either limited (framed in a negative sense, i.e.: “Based on the procedures performed, nothing came to our attention to indicate that the management assertion on XYZ is materially misstated.”) or reasonable (framed in a positive sense, i.e.: “Based on the procedures performed, in our conclusion, the management assertion on XYZ is reasonably stated.”).

In general, independent assurance reports regarding cryptocurrency custody providers and their services will address the following areas tailored to the specific needs and circumstances of the individual provider (virtual asset service provider (VASP)):

• Governance
• Key generation including key ceremony runbook
• Key management
• Transaction authorisation/signing
• Logical access management
• Change management
• Backup and recovery as well as IT disaster recovery
• Environmental/physical security
• Vulnerability management

Engaging an independent auditor as a cryptocurrency solution provider is not only an option but has increasingly become a necessity as they provide the transparency required by all involved stakeholders.