What auditors ask for on stablecoin balances

Finance teams preparing for their first audit with stablecoin balances usually brace for questions about the asset itself. Those are not the hard ones. A public ledger makes existence trivially verifiable: the auditor reads the balance at a block height and it either agrees or it does not.

The difficult questions are the ones a bank confirmation normally answers silently. Who controls this address? Is this every address? Who can move the funds? Those have no on-chain answer, and they are where fieldwork time goes.

Here is what gets asked, in the order it usually comes up.

Existence: the easy one

The auditor will independently verify balances against the chain rather than relying on a report you produce. Expect them to ask for every address and to read it themselves.

What makes this go smoothly:

Give a block height, not a date. Chains produce blocks continuously, so "the balance on 31 December" is ambiguous. A block number identifies one verifiable state that anyone can reproduce exactly.

Provide a complete address list in a stable format. Address, chain, purpose, and the date it was first used. A spreadsheet is fine; what matters is that it is the list of record rather than assembled for the audit.

Name the token by contract address. "USDC" is a display symbol and symbols can be set to anything. The contract address is what identifies the asset, and it differs on every chain.

Ownership: the question a bank confirmation usually answers

This is where first-time audits slow down. With a bank account, the confirmation comes directly from the institution and establishes that the account belongs to the company. There is no equivalent third party for a self-custodial address.

Auditors generally accept a signed message: the company signs an agreed string with the private key controlling the address, and the auditor verifies the signature against the address. It demonstrates control at a point in time without moving funds.

Prepare for follow-ups. Signing proves control now, not throughout the period. Expect questions about whether the same parties controlled the address at the balance sheet date, and have your signer roster and any changes to it documented with dates. We cover the mechanics in how to prove a wallet belongs to your company.

Completeness: the hardest one

Existence proves the addresses you disclosed hold what you said. Completeness asks whether there are addresses you did not disclose.

This is genuinely hard to evidence, because anyone can create an address without recording it anywhere. The auditor cannot prove a negative, so they will test your process for generating and recording addresses instead.

What helps:

A single documented process for address creation, with a named owner and a record of every address issued.

Evidence that funds entered and left through known addresses. Tracing movements between your recorded addresses and showing no unexplained external flows.

Management representation, which will be requested in writing regardless of everything else.

If addresses were created ad hoc by engineers during the period, say so early and reconstruct the list properly. It is a far smaller problem raised in planning than discovered in fieldwork.

Classification and measurement

Expect to be asked where the balance sits and why. Because US GAAP has no stablecoin-specific guidance, the answer is a reasoned position rather than a rule citation, and the auditor is testing the reasoning.

Have a memo ready covering: the classification you adopted, the analysis against the ASC 305 cash equivalents definition and the ASC 350-60 scope criteria, why the alternatives were rejected, and confirmation that treatment is consistent across periods and tokens. The underlying analysis is in where stablecoins go on the balance sheet.

Two follow-ups are near-certain. If you classified as a financial asset, expect questions on the expected credit loss assessment and what issuer information you relied on. If you classified as an intangible, expect questions about intraperiod price movements and whether any impairment indicator arose, since impairment under ASC 350-30 cannot be reversed.

The FASB's August 2026 proposal on cash equivalents may also come up, since it is open for comment until 19 November 2026. Knowing whether your holdings would meet its three attributes is worth doing before you are asked.

Controls over key management

This is the area where auditors have become noticeably more demanding, and reasonably so: whoever controls the keys controls the assets.

Expect questions on:

Who holds signing authority, by name and role, and how that maps to addresses.

What the threshold is, and whether it is enforced technically or by policy. Enforced-by-contract is materially stronger evidence than a documented procedure, because a policy can be overridden and a smart account threshold cannot.

Segregation of duties. Whether the person who can add a signer is also a signer, and whether one individual can both change a vendor address and release a payment.

Joiner and leaver process. What happens to signing authority when someone leaves. An ex-employee who is still a signer is a finding.

Recovery. What happens if a signer loses access, and whether that path could be abused to bypass the threshold.

A smart account helps here because the rules are inspectable on-chain. An auditor can read the account's configuration directly rather than relying on your description of it. On Plaitr, balances sit in a self-custodial Squads smart account with the threshold enforced in the contract and signing from wallets your team controls; the architecture is documented in security and control.

Transactions and cut-off

Standard testing, with two on-chain wrinkles.

Cut-off needs a block height. A transaction that settled near midnight belongs to whichever period the block falls in, and the block is the authoritative record.

Gross and net amounts can differ. Network fees mean the amount received may be less than sent. Record both so the difference is identifiable as a fee rather than reading as an unexplained variance.

Sampled transactions will need the full record: hash, both addresses mapped to counterparties, invoice reference, and approval evidence. The mechanics are covered in three-way match when the payment settles on-chain.

FAQ

How do auditors confirm a stablecoin balance?

By reading it from the blockchain directly at a specified block height, rather than relying on a report from management. Provide the complete address list with chains and token contract addresses, and give a block number rather than a date so the balance is reproducible.

How do you prove to an auditor that you own a wallet?

The standard evidence is a signed message: sign an agreed string with the private key controlling the address and let the auditor verify the signature against the address. No funds move. Expect follow-up questions about who controlled the address during the period, so keep a dated signer roster.

What do auditors ask about completeness of crypto holdings?

Whether undisclosed addresses exist. Since that cannot be proven directly, they test the process: how addresses are created, who authorises them, how they are recorded, and whether fund movements trace cleanly between known addresses. A written management representation will also be requested.

Will auditors question our stablecoin classification?

Yes, because US GAAP has no stablecoin-specific guidance and the classification is a judgment. Have a memo covering your analysis against ASC 305 and the ASC 350-60 scope criteria, why alternatives were rejected, and evidence of consistent application.

What key management controls do auditors expect?

A documented signer roster mapped to addresses, a threshold ideally enforced technically rather than by policy, segregation between changing payment details and releasing payments, a joiner and leaver process covering signing authority, and a recovery path that cannot be used to bypass the threshold.

What should you do next?

Before fieldwork, assemble four things: the complete address list with block heights, signed-message evidence for each address, your classification memo, and the signer roster with dated changes. Those four cover most of what gets asked.

Plaitr keeps the signing threshold in the smart account and posts every transaction to the ledger as it settles, so the audit file is a byproduct of how the money moved. See auto accounting.

This article describes audit practice and is not accounting advice.