Stablecoin Issuer Audit & Reserve Attestation: AICPA Practice Aid Implementation
Two Frameworks Landed Within Weeks of Each Other
On 25 August 2026, the AICPA released its updated digital-assets practice aid with a new chapter dedicated to stablecoin issuers: recognition of the obligations created by issued tokens, and considerations for the reserve assets backing them. Weeks later, the OCC’s final GENIUS Act rule locked in the prudential side — definitions like reserve asset value, examination cycles, and concentration limits.
For issuers and their auditors, the combined message is a two-track expectation that replaces the old world of voluntary monthly AUP snapshots:
- Monthly reserve examinations producing an opinion-level result, performed by a registered public accounting firm, with CEO/CFO certification on every report.
- Annual independent examinations of the controls supporting stablecoin operations — plus, above $50 billion outstanding, full audited GAAP financial statements under PCAOB standards, alongside the OCC’s own full-scope examinations on at least a 12-month cycle.
This guide translates both layers into procedures: what gets recognized, what gets tested, what evidence to assemble, and where the AICPA criteria and the GENIUS/OCC requirements diverge in practice.
For the market context on attestation types, pair with Stablecoin Reserve Attestation vs Financial Audits and DeFi Smart Contract Auditing Standards.
Track 1: The Monthly Reserve Examination
The single biggest shift is the move from agreed-upon procedures to examination. What issuers publish today are generally AUP reports: factual findings, no assurance, no opinion. The GENIUS Act framework requires a monthly examination of each reserve report by a registered public accounting firm — an engagement that, under AICPA AT-C Section 205, expresses an opinion providing reasonable assurance.
| Feature | Legacy AUP snapshot | GENIUS monthly examination |
|---|---|---|
| Assurance level | None — findings only | Opinion-level (reasonable assurance track) |
| Frequency | Voluntary, often monthly | Mandatory monthly, on the composition report |
| Firm | Any engaged CPA firm | Registered public accounting firm |
| Management accountability | Varies | CEO/CFO certify accuracy to the regulator each month; knowing false certification carries criminal exposure under 18 U.S.C. 1350(c) |
| Publication | Issuer website, ad hoc | Public monthly reserve composition report |
Operational consequences are severe and underappreciated. Monthly opinion work means a monthly close discipline for reserves: cut-off procedures at each reporting timestamp, custodian evidence pulled on schedule, and a certification memo signed before publication — every month, without the year-end ramp-up cycle auditors are used to. Firms that treat this as twelve mini-audits with the same staffing model will miss deadlines by month three. Build the evidence pack as a standing monthly binder (more below), and calendar it into the same close machinery as Month-End Close — because that is functionally what it is.
Note the open item the OCC flagged for comment: the precise assurance standard and engagement form remain subject to final rulemaking detail. Until that lands, design to the examination standard — it is the only posture that cannot be caught short.
Track 2: Annual Controls Examination and Supervisory Oversight
Parallel to the monthly cycle runs the annual layer:
- Independent examinations of controls supporting stablecoin operations — issuance and redemption workflows, key and wallet management, reconciliation controls, and IT general controls over the reserve reporting pipeline. Design these to the same walkthrough-and-sample discipline as SOX 404: documented design, evidence of operation, deficiency aggregation.
- Above $50 billion outstanding: annual audited GAAP financial statements under PCAOB standards.
- OCC supervision: full-scope examinations at least once per 12-month period, with an extended 18-to-24-month cycle available only to qualifying issuers.
The control examination is where most issuers will actually fail first — not on the math of reserves, but on undocumented issuance processes, shared admin keys, and reconciliation breaks nobody investigated. Map controls to NIST CSF 2.0 and PCI DSS 4.0 where payment rails overlap, and reuse the evidence across frameworks rather than building three binders.
Recognition: Obligations for Issued Tokens, Assets for Reserves
The AICPA chapter’s core accounting message splits the balance sheet in two:
Token obligations. Issued tokens that entitle holders to redemption create a liability, measured consistently with the redemption promise — typically the outstanding token count at the redemption value, with disclosure of terms, rights, and any conditions that could alter settlement. Work that changes the obligation (burns, freezes, blacklists, chain splits affecting specific tokens) must flow through the rollforward with support, not as plug adjustments.
Reserve assets. Considerations mirror a financial-asset audit with crypto-specific twists: existence confirmed to custodian records and on-chain positions; rights established through account titling, segregation, and absence of encumbrance; valuation tied to observable sources by asset class (cash, Treasury bills, demand deposits, repos). The OCC layer adds prudential constraints on top of GAAP measurement: reserves must be segregated, identifiable, and custodied at eligible institutions; the final rule defines reserve asset value as fair value net of associated liabilities, tested at least one-to-one against outstanding issuance; and concentration rules cap bank deposits — generally no more than 40% of reserve assets, excluding government exposures, centrally cleared repos, and qualifying custodians under ongoing due diligence.
How Auditors Test Existence, Rights, and Obligations
The streamlined Chapter 5 logic (existence, rights, obligations) applied to an issuer looks like this in fieldwork:
- Supply completeness. Reconcile total outstanding tokens across every supported chain and contract to the reported supply figure. Untracked side chains and un-migrated legacy contracts are the classic understatement.
- Custodian confirmation. Direct confirmations of cash, deposits, and securities positions as of the reporting timestamp — not screenshots forwarded by the client. Include money-market and repo counterparties, and confirm segregation (titled to the issuer for the reserve purpose, not commingled with operating cash).
- Encumbrance and restriction search. Pledged, lent, or rehypothecated reserve assets fail the segregated-and-available test. Review custody agreements, lending programs, and lien searches; any yield-enhancement activity on reserve assets gets documented and dispositioned, not ignored.
- Fair value sourcing. Treasury bills to published curves; deposits at par subject to cap and insurance analysis; repos to counterparty and collateral terms. Stale marks on volatile collateral are findings, not differences of opinion.
- Cutoff at the timestamp. Reserve balances and token supply measured at the same instant — intraday issuance and redemption queues reconciled, not netted away. Test a sample of redemptions around cutoff for timing games.
- Subsequent events to report date. Post-timestamp reserve movements, custodian changes, enforcement actions, or depegs evaluated for disclosure or adjustment before the opinion date — the same discipline as Subsequent Events.
The Monthly Evidence Pack (Build Once, Repeat Twelve Times)
| Section | Contents | Source owner |
|---|---|---|
| Supply rollforward | Opening supply + mints − burns = closing, by chain and contract | Engineering + finance |
| Custodian packet | Statements, confirmations, segregation attestations, insurance/coverage notes | Treasury |
| Investment schedule | Holdings by asset class with fair-value sources and vintage | Treasury + valuation |
| Reconciliation | Reserve asset value vs outstanding tokens at 1:1, with bridge for timing items | Controller |
| Control outputs | Approval logs for mints/burns, key-ceremony records, reconciliation sign-offs | Operations |
| Certification memo | CEO/CFO support pack tying every reported number to evidence above | Controller + counsel |
Version-freeze the pack monthly, retain change logs, and pre-agree the delivery calendar with the examining firm — late custodian confirmations are the number-one cause of missed monthly deadlines. File per Record Retention and PBC standards; the examining firm will sample from it twelve times a year.
GENIUS/OCC vs AICPA: Where Each Layer Bites
| Question | Regulatory layer (GENIUS + OCC) | Professional layer (AICPA) |
|---|---|---|
| What must be true? | Eligible segregated reserves ≥ outstanding issuance; monthly public reports; certifications | Obligations recognized per GAAP; reserves measured and disclosed per standards |
| Who checks? | Registered/PCAOB-registered firm examinations; OCC full-scope exams | Engagement performed under attestation/auditing standards with defined assurance |
| How often? | Monthly reports + exams; annual audited statements above $50B | Per-engagement period; practice aid guides application of existing standards |
| What hurts? | Counterparty visibility, enforcement, criminal exposure for false certification | Qualified/adverse opinions, restatement risk, diligence findings |
Design compliance to satisfy both columns in one workflow: the regulatory calendar sets the deadlines, the professional standards set the meaning of the opinion. Where rulemaking is still open (exact examination form and assurance level), build to the stricter reading — examination-grade evidence with certification-ready support — and you cannot be wrong-footed either way.
FAQ
Do small issuers face the same monthly examination burden?
The monthly report-and-examine cadence applies to permitted issuers as a class; effort scales with complexity (chains, custodians, asset classes), not just size. Lean issuers with plain-vanilla T-bill reserves and clean key processes will find the monthly cycle far cheaper than complex ones — simplicity is a compliance strategy.
Can last month’s examination be rolled forward?
No — each monthly report needs its own examination procedures and evidence. Trend analytics and unchanged-control reliance can make repeat months efficient, but cutoff testing, confirmations, and supply tie-outs are re-performed every cycle.
Where do private keys fit in the control examination?
Key generation, custody (HSM vs hot wallet splits), ceremony documentation, and personnel controls are core to both existence assertions and the controls examination. Undocumented key handling is a finding regardless of how clean the reserve math is.
Next Steps
- Stand up the monthly evidence pack template now — supply rollforward, custodian packet, valuation schedule, reconciliation, certification memo — and run a dry month before the next attestation deadline.
- Map every reserve asset class to its eligibility, segregation, and valuation treatment under both GAAP and the OCC rule, and calendar the open rulemaking items for re-assessment.
- Engage the examining firm on scope, timing, and reliance before Q4 — the firms qualified to do this work will be capacity-constrained as deadlines converge.
