A crypto custody controls audit assesses whether a business protects digital assets, authorises transactions correctly, maintains reliable wallet records and reconciles on-chain activity with internal books and customer entitlements.
The auditor does not need to possess private keys or seed phrases. Unnecessary access would create additional risk. Instead, the auditor evaluates processes, configurations, logs, approvals and independently observable evidence to determine whether custody controls are properly designed and operating effectively.
This guide approaches custody as a compliance and operational-control subject. It does not replace a financial statement audit, penetration test, legal review or smart-contract code audit.
What is a crypto custody controls audit?
A crypto custody controls audit is an evidence-based review of how a business receives, holds, transfers, records and recovers digital assets. It tests controls intended to reduce unauthorised transfers, key loss, internal fraud, inaccurate records, asset commingling, weak segregation of duties and third-party failure.
The broader crypto compliance audit guide explains the overall assurance method. Custody fieldwork applies that method across the asset lifecycle: receive, identify, hold, move, reconcile, recover and retire.
ICAEW's Considerations for Auditing Cryptocurrencies discusses wallet types, key management, safeguarding, third-party custodians, blockchain-data extraction and evidence of ownership or control. Although aimed mainly at financial audits, it offers useful questions for custody control reviews.
How to audit crypto custody controls
An effective digital asset custody audit follows eight steps:
-
Define the custody model, systems, entities, assets and audit boundary.
-
Reconcile the approved wallet inventory to independent records.
-
Test the private-key lifecycle from generation to retirement.
-
Review transaction initiation, approval, signing and broadcast controls.
-
Reconcile on-chain balances and activity to internal customer records.
-
Assess third-party custodians, technology providers and user controls.
-
Test incidents, recovery arrangements and operational resilience.
-
Extend testing to DeFi and smart-contract administration where relevant.
The audit scope and sample should reflect the custody model, transaction risk, asset value, change history and applicable obligations.
1. Define the custody model and audit boundary
Start by documenting how assets are held and who can move them. The custody model may include:
-
Hot, warm and cold wallets
-
Multi-signature or multiparty computation arrangements
-
Third-party custodians and sub-custodians
-
Omnibus wallets supported by customer subledgers
-
Segregated or assigned addresses
-
Exchange, staking, lending or protocol accounts
-
Smart-contract-controlled assets
-
Emergency and disaster-recovery wallets
Identify the legal entities, customer terms, chains, assets, wallet technologies, administrators, vendors and locations involved. Clarify whether the firm holds customer assets, owns treasury assets, provides technology to another party or combines these roles.
Follow actual access and responsibility when setting the boundary. A third party may hold the keys while the firm still controls withdrawal instructions, customer entitlements and reconciliations.
2. Test wallet inventory and ownership records
A complete, approved wallet inventory is a foundation control. For each wallet or address, it should identify its purpose, relevant legal entity or customer relationship, chain, asset, custody method, environment, status, access model and responsible team.
Reconcile the wallet inventory
Compare the official inventory with independent sources such as node data, custody platforms, transaction systems, accounting records, blockchain explorers and vendor reports. Look for active addresses missing from the inventory and recorded addresses with unexplained balances or inactivity.
Test wallet additions, changes and retirements. New wallets should receive approval, secure setup, monitoring coverage and record updates before use. Retired wallets should remain subject to an approved monitoring and closure process.
Verify control without exposing secrets
Depending on the objective, evidence may include a signed message, controlled low-value transaction, custodian confirmation, address derivation record or observed key ceremony. The method must avoid exposing credentials or creating unsafe asset movements.
Public blockchain data can demonstrate activity and balances, but it does not automatically prove legal ownership or exclusive control. Combine on-chain evidence with contracts, governance, key arrangements and internal records.
3. Audit the private-key lifecycle
A private key audit should cover the full lifecycle rather than storage alone.
Key generation
Confirm that keys or shares are generated in an approved environment using authorised devices and methods. Review role separation, ceremony records and controls designed to prevent or detect unauthorised copying. Records should identify participants and key references without revealing secret material.
Storage and access
Determine whether suitable hardware, encryption and physical safeguards protect keys or shares. Test role-based access, approvals, periodic reviews and privileged-activity logs. Most importantly, identify whether one person could gain unilateral control despite the stated policy.
Backup and recovery
Check whether backups are encrypted, geographically or logically separated and protected against common-cause failure. Recovery conditions and authorised participants should be defined. Inspect evidence that recovery has been tested safely and that exceptions were resolved.
Rotation, compromise and retirement
Review triggers for staff changes, suspected compromise, technology changes and incidents. The firm should be able to move assets securely and update inventories, allowlists and monitoring. Old keys or shares should be destroyed or rendered unusable through controlled procedures.
Auditors should review configurations, ceremonies, access records, logs and controlled tests. Secret key material should never be copied into audit workpapers.
4. Test transaction approval and signing controls
Where proportionate, transaction controls should separate initiation, approval, signing, broadcast and recording. Multi-signature technology can support segregation, but shared credentials or weak recovery settings may defeat the intended control.
Test whether:
-
Approval thresholds reflect transaction value and risk
-
Signers are authorised and current
-
Destination addresses and networks are independently verified
-
Address allowlist changes require controlled approval
-
Business purpose and customer entitlement are established
-
High-value, unusual and emergency transactions receive suitable review
-
Rejected and failed transactions are handled consistently
-
On-chain execution matches the approved instruction
Sample routine, high-value, unusual, manual and emergency transactions. Trace each one from its source instruction through approval, signature, broadcast, blockchain confirmation and ledger posting.
Also ask what approvers can see when signing. A secure device provides little protection if it displays incomplete information or staff approve a hash without verifying the amount, network and destination.
5. Audit on-chain and off-chain reconciliations
Many custodians use omnibus wallets while recording individual customer balances in an internal ledger. Therefore, auditors must test the relationships among blockchain activity, wallet balances, internal transactions, customer entitlements, fees and accounting records.
Procedures may include:
-
Reconciling wallet addresses to the approved inventory
-
Reconciling on-chain balances to custody or subledger balances
-
Tracing deposits and withdrawals across cut-off periods
-
Investigating pending, failed, replaced or unsupported transactions
-
Testing network fees, staking rewards, airdrops and forks
-
Inspecting suspense accounts and unreconciled differences
-
Confirming coverage for every relevant chain and asset
Define confirmation rules and timestamps. Broadcast, block inclusion, the firm's confirmation threshold and customer-ledger posting occur at different stages. A report can appear balanced while omitting a newly introduced token or wallet, so test population completeness as well as mathematical accuracy.
6. Review third-party custodians and outsourced technology
Outsourcing changes the control environment; it does not remove the firm's responsibilities. Assess:
-
Initial and periodic due diligence
-
Regulatory status and contractual arrangements
-
Asset segregation or commingling
-
Access and instruction controls
-
Sub-custodians and concentration risk
-
Incident notification and service levels
-
Business continuity and exit planning
-
Information and audit rights
-
Independent assurance reports and customer reconciliations
Read assurance reports carefully. Confirm the service, control period, exceptions, complementary user controls and subservice organisations covered. A report may exclude a new product, location or blockchain used by the firm.
Where the custodian provides APIs, test access, authentication, change control and data completeness. Reconcile custodian records to internal and independent on-chain sources where possible.
7. Test incidents, recovery and operational resilience
Review actual incidents and exercises involving key compromise, lost access, vendor outages, signing-device failures, chain reorganisations, incorrect addresses or reconciliation-feed failures.
For selected events, inspect detection, containment, decision authority, asset movement, customer impact, regulatory assessment, evidence preservation and lessons learned. Determine whether emergency access bypassed normal segregation and whether an independent post-event review took place.
Recovery tests should show that authorised personnel can restore access and reconstruct accurate records within defined tolerances without exposing secrets or putting production assets at unnecessary risk.
8. Include DeFi and smart-contract administration where relevant
If the firm interacts with DeFi protocols or controls smart contracts, extend the audit to protocol due diligence, approved contract addresses, admin keys, upgrade rights, pause functions, token allowances, transaction simulation, bridges, oracles and governance decisions.
The FATF's Seventh Targeted Update on Virtual Assets and VASPs, published on 16 July 2026, identifies continuing challenges involving DeFi arrangements and risks linked to peer-to-peer transactions through unhosted wallets. These observations do not prescribe a firm's exact custody controls, but they support a documented, risk-based assessment.
Practical crypto custody audit programme
| Control objective | Example audit procedure | Evidence | Warning sign |
|---|---|---|---|
| Establish wallet completeness | Reconcile inventory to on-chain activity and operational systems | Inventory, addresses, node or vendor data | Active wallet missing from approved records |
| Confirm access governance | Sample joiners, movers, leavers and access reviews | Approvals, role mapping and access logs | Former staff or excessive privileges remain |
| Test signing controls | Trace selected transactions from request to confirmation | Instruction, approvals, signing log and transaction hash | Execution differs from the approved instruction |
| Assess key resilience | Observe or inspect a controlled recovery exercise | Recovery plan, participants and test results | Recovery is untested or depends on one person |
| Verify customer records | Reconcile wallet activity to customer subledgers | On-chain data, subledger and exception reports | Unresolved or unexplained differences |
| Challenge third-party reliance | Evaluate assurance scope and user controls | Contract, due diligence and assurance report | Critical service or blockchain is excluded |
| Test change governance | Trace a new wallet, chain or signing rule into use | Risk review, test, approval and deployment records | Unapproved or untested change |
| Validate incident response | Reperform the event timeline and verify actions | Incident logs, decisions and post-event review | Emergency access bypass is not reviewed |
Hypothetical example: weak multi-signature independence
A custodian requires two of three authorised signers for treasury transfers. Sampled transactions contain two approvals and the configuration appears correct. However, two signer accounts can be recovered by the same administrator, who can reset both credentials.
The cryptographic threshold works, but the wider access design allows one person to undermine segregation. Management separates recovery authority, adds independent approval and monitors reset events. Closure testing includes a configuration inspection and controlled recovery test.
This example shows why auditors must examine the complete process around multi-signature or multiparty technology rather than relying on the product label.
Frequently asked questions
What does a crypto custody controls audit examine?
It examines wallet inventories, ownership evidence, key management, access, transaction signing, reconciliations, third parties, incidents, resilience and relevant DeFi or smart-contract controls.
Does an auditor need access to private keys?
Normally, no. Auditors should avoid possessing or exposing secret material. Evidence can come from controlled demonstrations, configuration, logs, signed messages, approved test transactions and independent records.
Is a multi-signature wallet automatically a strong control?
No. Its strength depends on threshold configuration, signer independence, credential recovery, device security, approval information and monitoring. Shared administrators or recovery material may weaken segregation.
How can an auditor verify that a business controls a wallet?
Evidence may include a controlled signed message or transaction, custodian confirmation, key-ceremony records and consistent internal and on-chain records. However, public balances alone do not prove legal ownership or exclusive control.
What should be reconciled in crypto custody?
Depending on the model, a firm may reconcile approved wallets, on-chain transactions and balances, custody-platform records, internal subledgers, customer entitlements, fees and accounting records.
Can a third-party assurance report replace custody testing?
Not automatically. It must cover the relevant service, period and controls. The firm must also implement complementary user controls, assess exceptions and test its own instructions, records and reconciliations.
Strengthen your digital asset control-testing knowledge
Custody assurance combines governance, cryptographic operations, recordkeeping, third-party oversight and compliance risk. Effective auditors translate that knowledge into safe, reproducible tests.
The Crypto Compliance Audit and Testing for Internal Control Teams course can help you develop practical knowledge of custody controls, compliance auditing, blockchain analytics, operational resilience, DeFi risk and smart-contract governance.
Build the skills to test digital asset controls with greater confidence. Explore the course today.
