Guides / Glossary / Proof of reserves
Glossary

Proof of reserves: what it shows and what it does not

A report by a custodian or exchange showing assets it controls at one point in time. It is not an audit.

Education only

Definition. A report by a custodian or exchange showing assets it controls at one point in time. It is not an audit and may not show matching liabilities.

How it works

A proof of reserves usually has two parts. First, the provider shows that it controls certain bitcoin addresses, for example by signing a message with the keys or publishing the addresses so anyone can check the balances on chain. Second, some providers publish a way for customers to check that their balance was included in a total of customer liabilities, often using a Merkle tree so individual balances stay private. A third party, sometimes an accounting firm, may perform agreed procedures on the data.

Why it matters for a company

It sounds reassuring, and it can be useful, but the limits matter. The PCAOB, which oversees auditors of US public companies, has warned investors to be cautious with proof of reserve reports. Its advisory makes several points worth carrying into any due diligence: such reports are not audits, they describe a single point in time, they may not cover liabilities at all, and they generally say nothing about the effectiveness of internal controls.

A provider could borrow bitcoin for the snapshot, or have liabilities that are not in the published total. Assets shown on chain also do not prove that customers have legal title to them in an insolvency. For a company deciding where to hold its treasury, proof of reserves is one data point next to the customer agreement, the insolvency terms, regulatory status, controls reports such as SOC 1 or SOC 2, and audited financial statements.

The same ideas run the other way. When a company's own auditor asks for evidence that the company controls its bitcoin, a signed message from the company's keys, using a standard such as BIP 322, can show control of specific addresses without moving funds.

Example only, fictional. A finance director reads a provider's proof of reserves and notes three gaps for the board: the date is three months old, liabilities are self reported, and the accountant's report is an agreed upon procedures engagement rather than an audit.

Common mistakes

Sources

Primary sources only. Each link was checked on 9 November 2026. Rules change, so confirm the current version with your adviser.

  1. PCAOBInvestor advisory: exercise caution with third party verification and proof of reserve reports
  2. AICPA and CIMASystem and Organization Controls: the SOC suite of services
  3. Bitcoin BIPsBIP 322: Generic signed message format (proof of funds, multisig)
  4. PCAOBSpotlight: Observations and reminders on audits involving crypto assets (June 2023, PDF)
Education, not advice.

This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.

Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.

Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.