Proof-of-Reserves Audit: In-Depth Analysis, Technical Methods, and Future Outlook for Practitioners

The rapid growth of the crypto-asset ecosystem has compelled regulatory authorities to develop stronger frameworks to safeguard both market integrity and the security of client assets. The new proof-of-reserves (PoR) audit approach shaped by the Capital Markets Board’s (CMB) Principle Decision i-SPK.35/B.2 (08/05/2025) aims to reliably demonstrate the actual reserve consistency of crypto-asset service providers (CASPs).

This article presents regulatory requirements and technical nuances in audit practices for practitioners, while also offering a roadmap in light of EU regulations and forward-looking projections.

1. Regulatory Framework and Overview of Obligations

The relevant Principle Decision of the CMB makes proof-of-reserves audits mandatory under the Communiqué. Accordingly, every CASP must:

• Conduct reserve audits on a quarterly basis,

• Provide auditors with necessary records, information, disclosures, and wallet access details,

• Submit audit reports to the board of directors and then to the CMB,

• Transparently publish reserve amounts on their website.

In addition, ISA 500, ISA 520, and ISA 530 standards apply by analogy.

The audit scope covers crypto assets representing at least 80% of client holdings and all liquid reserves of the platform.

2. Wallet Infrastructures, Custody Models, and Access Controls

The most critical stage of the reserve audit is verifying whether the crypto assets included in the audit scope are actually held in wallets controlled by the CASP.

Accordingly, the CASP must provide:

• Wallet types (cold / hot),

• Distributed ledger networks (BTC, ETH, AVAX, etc.),

• Wallet infrastructure,

• Access control mechanisms,

• Wallet addresses,

• Information about custodians (if any),

• Bank account details for liquid reserves.

3. Calculation of the Reserve Coverage Ratio and Reporting Requirements

The reporting tables are defined by the CMB in Annexes 1, 2, and 3. These tables include:

• Amount of client assets,

• Amount of assets held by the CASP,

• Current values,

• Reserve coverage ratio (B/A),

• Liquid reserve ratio (C/D).

If the reserve coverage ratio falls below 100%, the auditor must immediately notify the CMB.

4. Comparative Analysis with EU Practices

The European Union, under MiCA (Markets in Crypto Assets Regulation), has established a detailed framework for proof-of-reserves, asset segregation, and protection of client funds. Under MiCA:

• Client assets must be segregated from company assets,

• Reserve assets must be regularly reported,

• Custodians face additional operational risk obligations,

• Technical and operational security criteria are integrated with the EU Cybersecurity Act.

Türkiye’s CMB regulation is more detailed than MiCA in certain technical aspects; particularly the wallet verification processes, atomic-clock-based timestamp comparison, and the 80% coverage rule are unique practices.

5. Technical Guidance: Tools and Methods Auditors Must Use in Wallet Verification

The “wallet verification” process defined in the CMB principle decision is the most critical technical component of the audit. This section provides a practical guide for practitioners regarding the required tools, verification techniques, and methodological approaches.

5.1 Purpose of Verification

Wallet verification must answer two key questions:

1. Are the wallet addresses provided by the CASP truly owned/controlled by the CASP?

2. Are the assets in these wallets verifiable on the distributed ledger as of the audit date?

5.2 Categories of Tools Available to Auditors

A. Full Node Infrastructure

• Bitcoin Core (mainnet, non-pruned),

• Ethereum Geth Node,

• AvalancheGo,

• Solana validator/light node,

• TRON FullNode API.

B. Blockchain Explorer API Integrations

• Etherscan API,

• Blockchair API,

• Solscan API,

• BTC RPC Explorer (self-hosted),

• AVAX Snowtrace API.

C. Cryptographic Tools

• OpenSSL (RSA/Ed25519 verification),

• btcrecover, bitcoinlib, eth-keyfile-tools,

• libsodium-based signature libraries.

D. On-chain Data Archiving

• Encrypted IPFS archives,

• SHA-256 hash logging,

• Timestamping (RFC 3339 / ISO 8601 or NTP atomic clock).

These tools provide:

• Wallet balances,

• Transaction history,

• Token movements,

• Block timestamps,

• Smart-contract compatibility.

B. Direct Node or RPC Querying

For more reliable and manipulation-resistant verification, auditors can use:

• Bitcoin Core Node,

• Geth (Ethereum),

• AvalancheGo (AVAX),

• Cardano Node.

Sample RPC commands:

• eth_getBalance

• eth_call

• getutxos

• getaddressinfo

• getblockchaininfo

C. Cryptographic Message Signing (Proof-of-Control)

The strongest method of verifying wallet ownership.

• BTC: signmessage / verifymessage

• ETH: EIP-191 signing

• SOL/AVAX: Ed25519 signature verification

Process:
The auditor provides a random message, the CASP signs it, and the auditor verifies it.

This is cryptographic proof of control.

D. Physical Verification for Hardware Wallets

For Ledger, Trezor, SafePal:

• Physical access to the device,

• Check that the address on the screen matches the CASP-declared address,

• Perform signing test if possible.

E. Verification in Multisig Wallets

Auditors must verify:

• redeemScript,

• Threshold (M of N),

• Public keys,

• Signatory list,

• Script hash consistency with blockchain.

5.3 Audit Techniques

STEP 1 — Obtain Full Wallet Inventory from CASP

CASP must provide:

• All hot wallet addresses,

• All cold wallet addresses,

• Multisig structures (M/N),

• Private key management policy,

• Access control lists,

• Custodian account / sub-wallet IDs (if relevant),

• Wallet infrastructure details (HSM, MPC, hardware wallet, etc.)

Auditor verifies completeness and consistency, hashes the list with SHA-256, timestamps it.

STEP 2 — Proof-of-Control

A. Cryptographic Message Signing Test

Random message:

CPATURK-PoR-Audit-<timestamp>-<nonce>

Auditor verifies signature using:

• verifymessage (BTC)

• personal_sign (ETH)

• Ed25519 verification (AVAX / SOL)

Failed signature → wallet not controlled by CASP.

B. Optional: Micro-Transfer Test

A small transfer (e.g., 0.000001 BTC) provides stronger proof.

STEP 3 — Node-Based Balance Verification

Balances are verified using three sources:

1. CASP-reported balance,

2. Auditor’s node output,

3. Explorer API output.

Consistency across the three is required.

STEP 4 — Two-Date (T and T–1) Verification

Auditor uses block height to retrieve the historical wallet state:

eth_getBalance(address, blockNumber)

Ensures no back-dated manipulation.

STEP 5 — Multisig Structure Verification

Checks:

• redeemScript,

• M/N threshold,

• Signatory list,

• Script hash (P2SH).

STEP 6 — Cold Wallet Verification

A. Physical Verification

Address displayed on device must match the declared address.

B. Offline Message Signing

Performed on device; verified offline.

C. No access to seed/private key

Presenting this would be a security breach.

STEP 7 — On-chain Analysis (Anomaly Detection)

Auditor performs heuristic blockchain analysis to detect:

• Suspicious transfers,

• Hidden addresses,

• Clustering patterns,

• Mixer/bridge activity.

Tools include:

• Chainalysis Reactor,

• Elliptic Lens,

• Crystal Blockchain,

• Breadcrumbs API (open source).

STEP 8 — Verification of Liquid Reserves

Includes review of:

• Bank statements,

• SWIFT messages,

• Custodian reports,

• API balance confirmations,

• Transaction logs.

STEP 9 — Valuation (Pricing) Verification

Auditor checks pricing sources:

• CoinMarketCap API,

• CryptoCompare API,

• Binance avgPrice,

• Coinbase Spot,

• Gate.io / Bybit support prices.

Prices must be timestamped, close to audit moment, independent.

STEP 10 — Creation of Full Audit Trail

Archive must contain:

• RPC outputs,

• Node logs,

• Explorer screenshots,

• Transaction IDs,

• SHA-256 hashed raw data,

• Atomic clock timestamps,

• Software version information.

5.4 Record Retention Requirements

According to the CMB, all verification data must be retained with:

• Screenshots,

• Hash values,

• RPC dumps,

• Explorer URL logs,

• Atomic-clock timestamps.

6. Future Outlook: Evolution of Reserve Audits

A. Zero-Knowledge Proof (ZKP)-Based Audits

Currently piloted in the EU.

• Enhances client privacy,

• Enables PoR without disclosing individual wallet details.

Expected to be adopted in Türkiye in the medium term.

B. Real-Time Reserve Monitoring

“Real-time PoR dashboards” may become mandatory for large platforms.

C. RegTech Automation

Expected developments include API-based audit automation:

• Automatic balances,

• Automatic valuation,

• Real-time alerts,

• AI-driven anomaly detection.

Conclusion: CPATURK’s Innovative Approach and Market Impact

CPATURK Independent Audit & Advisory has developed an innovative approach to proof-of-reserves auditing that combines full regulatory compliance with advanced technical verification capabilities.
CPATURK has built and continues to enhance its own internal audit framework that fully integrates node-to-node querying, RPC automation systems, and blockchain explorers.
By standardizing cryptographic signing tests, the firm delivers a high level of accuracy across the sector.

CPATURK’s international regulatory literacy provides a competitive advantage to clients that require simultaneous alignment with both MiCA and CMB regulations.
With atomic-clock-stamped data retention, API logging, and real-time verification systems, the firm not only meets but exceeds the standards set by the Capital Markets Board of Türkiye.

The most pressing needs of crypto-asset service providers—

•  technical audit expertise,
• regulatory compliance capability,
• reserve audit process design,
• operational guidance—

are addressed by CPATURK through a holistic approach.

In conclusion, proof-of-reserves auditing is not merely a technical verification process; it is a critical mechanism for institutional trust, market stability, and the protection of client assets.

The innovative methodology that CPATURK has developed—and continues to invest in—delivers unique value to the industry by ensuring that this process is carried out in full alignment with both Turkish and international standards.