Introduction to a Crypto fund audit
We recently signed off on a crypto fund audit. I had a number of people approach me and ask about the main challenges I experienced during the process. Therefore, I thought it would be useful to put together a short write-up in order to express my views on the matter, the risks and uncertainties I encountered along the way and what were the considerations in my audit approach.

Background
Gibraltar is positioning itself as an industry leader generally in the funds space, particularly since Brexit.
In addition, Gibraltar is the only jurisdiction with direct access to the UK market, i.e. the largest financial services market in the whole of Europe.

With regards to private crypto funds, this applies much in the same way. According to the 3rd Annual Global Crypto hedge fund report produced by PwC in 2021, Gibraltar is home to 9% of the world’s Crypto funds. Given our small nation, I would say this is quite an achievement and with the crypto funds space only set to grow (estimated by PwC to have grown from $2bn last year to $3.8bn this year), this appears to only be the beginning.

Setting up Private Crypto Funds
Gibraltar legislation allows for the set-up of private crypto funds as long as they register with the GFSC as a small AIFM (self-managed). They are designed for a small group of closely related individuals (maximum of 50) and only require 1 Director. It can be set up as a Gibraltar Private Limited Company, a Unit trust or a Gibraltar Liability Partnership.
The process usually involves the engagement of a lawyer or similar, who sets up the fund and creates the Prospectus document.
There is also a Code of conduct specifically for crypto funds produced by the GFIA.

Whilst there is no requirement for a private crypto fund audit, many key players in the industry have found it useful to obtain one.

The challenges in a crypto fund audit
The main audit challenges of a crypto fund audit were the following:

No Accounting standard for cryptocurrencies:
The number one problem is that there is no accounting standard specific for cryptocurrency, meaning it is necessary to apply a principles based approach using the current accounting standards available.
Depending on the accounting standard applied, the classification and measurement techniques will vary. This can lead to manipulation of results.
In order to apply a standard appropriately, we need to understand the facts and circumstances of the transactions. A typical question is whether the fund looks to hold positions for the long term, or if it trades at high frequency, or perhaps both?
It can also go one step further, where some entities hold leverage or other derivative positions.
PwC produced a useful report in December 2019 on how to account for crypto transactions.
The infant nature of the industry
This brings about another myriad of issues, ranging from inadequacy of current management information and other software and accounting systems, to the receipt of third party confirmations from certain involved parties. There can be difficulty in obtaining confirmation on balances, for the following reasons:
1. Some exchanges are unregulated and are under no obligation to provide this;
2. Some exchanges have access to archived information on their databases with cut-off times which are not in line with CET. Given there is no market closure, (unlike in the traditional markets), this can pose a problem;
3. There may be low/no coin liquidity in certain instances and therefore, determining an active market may not be as clear cut; and
4. Some derivative products within exchanges, across cryptocurrencies and across exchanges can have varying levels of complexity in calculating contract values.
Ownership of Assets
Due to the nature of some wallets, it is not always easy to confirm the ownership of a particular wallet to its owner. A similar concept to bearer shares in the past.
Fraud Risk
Fraud is a key risk inherent within all businesses.
When an entity trades on its own account, from my experience, there is usually only one email login for access to the exchange. A single email account represents one user.
This means that a single user has absolute control over all funds on that exchange. In certain instances, controls can be implemented at the exchange level, where dual signatory is required on withdrawals, however, there are many exchanges which do not have this feature.
Therefore, a single user has the ability to withdraw funds without the appropriate authorisation approval processes. This is different to the controls that can be implemented by banks.
Management Override
Management override of controls is also an inherent risk in each entity.
On private crypto funds, some of the risks can be on the calculation and valuation policy of the crypto assets and in the application of the appropriate accounting standard.
There are many other areas where management override can occur and this can vary significantly from entity to entity.
Summary & Conclusion
Just like with every other audit, it is necessary to understand the entity, its nature and operations, the risks, and the associated controls, so that the right testing approach can be employed. Every entity will be different, but a large number of the key risks and themes will likely remain for the foreseeable future.

The cryptocurrency market has come a long way, and Gibraltar has done an amazing job as a jurisdiction in assisting in the maturity of the market, however, I believe there is still a long way to go. Owners of Private funds, their employees, as well as all other service providers involved (such as exchanges custodians, accountants, lawyers and administrators), are continuously learning and improving their service offering, which again is helping in the maturity of the market.

We look forward to seeing how the industry will develop and if/when an accounting standard focussing on cryptocurrencies is published.

Final Remarks
TAG Consultancy have a diverse team of people with experience in both accounting for and auditing of crypto related entities.

If you would like any further information on how we can assist, you may contact us here.