Why Audits Matter for Bitcoin Custody
When an institution places bitcoin with a custodian, the institution is trusting that custodian's people, systems, and procedures. An audit is how that trust is made checkable by someone other than the custodian's own staff. A reputable independent assessment lets a risk or compliance team rely on evidence rather than assurances when deciding whether a custodian's operations are sound.
SOC 2 is the assessment that institutions ask for most often, because it speaks directly to operational security and is widely understood across financial services. Understanding what a SOC 2 report proves, and what it does not, is a core part of custodian diligence and sits alongside questions about regulatory standing covered in what a qualified custodian is.
SOC 1 vs SOC 2
The SOC suite, defined by the AICPA, contains several report types aimed at different audiences. Two matter most for custody diligence.
| Report | What it covers | Relevance to custody |
|---|---|---|
| SOC 1 | Controls at a service organization that are relevant to a client's internal control over financial reporting. | Matters when the custodian's processing affects the client's financial statements. Narrower than SOC 2 for security purposes. |
| SOC 2 | Controls relevant to the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. | The primary report for assessing a custodian's operational and security posture. |
A third report, SOC 3, is a short general-use summary of a SOC 2 examination that a custodian can publish without restriction. A SOC 3 is useful for a first impression, but it lacks the detail (scope, control descriptions, test results, and exceptions) that real diligence requires, so it is no substitute for the full SOC 2 report.
Type I vs Type II
Within SOC 2, the distinction between Type I and Type II determines how much assurance the report actually provides.
- Type I assesses whether the custodian's controls are suitably designed as of a single date. It answers "are the right controls in place on paper?"
- Type II tests whether those controls operated effectively across a period, usually six to twelve months. It answers "did the controls actually work, day after day, throughout the period?"
Type II is the stronger evidence. A control can be well designed and still fail in practice if staff bypass it, if it is not monitored, or if it breaks under load. Type II catches the gap between design and operation. For custody diligence, a Type II report covering a recent, full period is the standard worth asking for.
The AICPA Trust Services Criteria
A SOC 2 report is organized around the Trust Services Criteria. There are five categories, and a custodian chooses which ones its report covers. Security is mandatory; the other four are included based on what the service involves.
| Criterion | What it addresses |
|---|---|
| Security | Protection of systems and data against unauthorized access, the common baseline included in every SOC 2. Often called the "common criteria." |
| Availability | Whether the system is available for operation and use as committed, relevant to a custodian's uptime and withdrawal access. |
| Processing Integrity | Whether system processing is complete, valid, accurate, timely, and authorized, relevant to transaction handling. |
| Confidentiality | Protection of information designated as confidential, relevant to client data and key-handling procedures. |
| Privacy | Handling of personal information in line with the entity's privacy commitments, relevant where the custodian processes personal data. |
Because the custodian selects the criteria, the scope of two SOC 2 reports can differ widely. A report covering only Security is far narrower than one covering Security, Availability, Processing Integrity, and Confidentiality. The first question a reader should ask is not "is the opinion clean?" but "which criteria were in scope, and which systems?"
What a SOC 2 Report Does and Does Not Prove
A SOC 2 report makes a precise claim, and that claim is often stretched beyond what it can support.
What It Proves
A SOC 2 Type II report provides independent evidence that, over the report period and within the stated scope, the custodian's controls were designed appropriately and operated effectively against the selected Trust Services Criteria. That is meaningful: it speaks to access control, change management, monitoring, incident response, and the operational discipline that keeps a custody system from being compromised through carelessness.
What It Does Not Prove
A SOC 2 report does not verify solvency or reserves. It does not confirm that the custodian holds enough bitcoin to cover what clients are owed. A custodian could pass a SOC 2 examination cleanly and still be short of assets, because reserve adequacy is simply not what the report examines. Confirming that the assets exist and match liabilities is the job of proof of reserves, a separate cryptographic exercise that attests to holdings recorded on the blockchain rather than to internal controls.
The two assessments are complementary. SOC 2 tells an institution that the custodian runs a tight operation, while proof of reserves uses cryptographic evidence tied to the custodian's Bitcoin addresses to show the bitcoin is actually there. A custodian that offers one but not the other has answered only half the diligence question.
How ISO 27001 Compares
Custodians often cite ISO 27001 alongside, or instead of, SOC 2. The two are related but answer different questions, and conflating them weakens diligence.
ISO 27001 is an international standard for an information security management system, the set of policies and processes by which an organization manages security risk. Certification means an accredited body has confirmed the organization runs a management system that conforms to the standard. It is a certification against a fixed specification, renewed on a multi-year cycle with periodic surveillance audits.
SOC 2 works as an attestation rather than a certification. A CPA firm reports on controls mapped to the Trust Services Criteria and, in a Type II report, tests whether they operated over a defined period. The deliverable is a detailed report with control descriptions, test procedures, and exceptions, so the reader sees the underlying evidence rather than a single pass-or-fail mark.
| Dimension | SOC 2 | ISO 27001 |
|---|---|---|
| Nature | Attestation report by a CPA firm | Certification against an international standard |
| Output | Detailed report with control tests and exceptions | Certificate confirming conformance |
| Focus | Whether specific controls operated against the Trust Services Criteria | Whether an information security management system exists and conforms |
| Time dimension | Type II tests operation over a period | Confirms the management system at audit, with surveillance over the cycle |
Neither replaces the other. ISO 27001 confirms a governance system is in place; a SOC 2 Type II shows the specific controls inside that system actually ran. An institution that wants both governance assurance and operational evidence asks for both.
Penetration Testing and Key-Ceremony Audits
SOC 2 and ISO 27001 assess the control environment broadly. Two more targeted assessments speak directly to the risks unique to bitcoin custody, and a strong custodian uses them to feed evidence into the broader reports.
Penetration Testing
A penetration test is an authorized, simulated attack against the custodian's systems by independent security testers. It surfaces vulnerabilities that a review of the control environment might not, because it attacks the system the way a real adversary would. For a custodian, regular third-party penetration testing of both internet-facing and internal systems is a baseline expectation, and the results often appear as evidence supporting the security criterion in a SOC 2 examination.
Key-Ceremony Audits
The single most sensitive operation in any custody system is the generation, backup, and use of the private keys that control client bitcoin, much of it held in offline cold storage. A key ceremony is the formal, scripted procedure for these events, performed under controlled conditions with multiple witnesses and a documented record. An independent audit of a key ceremony checks that keys are generated with proper entropy (unpredictable randomness) (unpredictable randomness) (unpredictable randomness) (unpredictable randomness) (unpredictable randomness), that no single person ever has unilateral access, that backups are handled correctly, and that the whole procedure matches its written policy. Because key handling is where a custody failure does the most damage, evidence of audited key ceremonies is among the most valuable assurances a custodian can provide.
How an Institution Should Read a Custodian's SOC 2
A clean auditor's opinion at the front of a report is the part most people read and the part that tells them least. The substance is in the scope, the period, and the exceptions. The checklist below is what diligence on a SOC 2 report actually looks like.
- Scope. Which systems, locations, and Trust Services Criteria does the report cover? A report scoped to a marketing system, or covering only Security, says little about the custody platform itself. Confirm the in-scope systems include the ones that hold and move keys.
- Report period. What dates does the examination cover, and how recently did it end? A Type II report covering a period that ended eighteen months ago describes a custodian that may have changed substantially since. Ask for the most recent report and confirm continuous coverage between periods.
- Type. Is it Type I or Type II? Prefer Type II for operational assurance, and treat a Type I as a starting point only.
- Exceptions. The exceptions (sometimes called deviations or findings) are the controls the auditor found did not operate as intended. The exceptions section is frequently the most informative part of the report. Read what failed, how the custodian responded, and whether the failure touched key handling or access control.
- Complementary user-entity controls. SOC 2 reports list controls the report assumes the client (the institution) operates on its own side. These are responsibilities transferred to the institution; confirm they are actually being met.
- Subservice organizations. Check whether parts of the system are operated by third parties and whether those parts are carved out of the report or included. A carve-out is a gap in assurance the institution must cover separately.
The aim is not to confirm the custodian has a report but to understand exactly what the report does and does not assure, and to pair it with proof of reserves and the policy-engine and governance controls that complete the picture, such as those described in what a policy engine is.
The Limits of Audit-Based Assurance
Audits are evidence, not proof of perfection. A SOC 2 examination tests a sample of control activity, not every event, so it reduces uncertainty rather than eliminating it. It looks backward over a past period; it cannot attest to what happens after the period closes. Its scope is chosen by the custodian, so a narrow scope can produce a clean report that covers little of what matters.
These limits are reasons to read carefully, not reasons to dismiss the assessment. The right posture for an institution is to treat audits as one layer in a defense-in-depth diligence process: regulatory standing, SOC 2 Type II with a recent full period and appropriate scope, proof of reserves for solvency, audited key ceremonies for the most sensitive operation, and an understanding of the custody architecture itself. The strongest assurance comes from independent evidence on each distinct question, read for what it actually says.
For institutions weighing whether to rely on a third-party custodian at all, this layered reading also clarifies a structural alternative. Self-custody with multisig changes which questions even need answering, because there is no custodian whose controls require attesting. The trade-offs between the two paths are set out in how businesses and institutions take custody of Bitcoin.
This article is educational and does not constitute legal, audit, or compliance advice. Report types, criteria, and standards evolve; confirm specifics with the custodian and its auditor before relying on any assessment.
Frequently Asked Questions
What is the difference between SOC 1 and SOC 2?
SOC 1 reports on controls relevant to a client's financial reporting. SOC 2 reports on controls relevant to security, availability, processing integrity, confidentiality, and privacy, the five Trust Services Criteria defined by the AICPA. For evaluating a Bitcoin custodian's operational security, SOC 2 is the relevant report.
What is the difference between a SOC 2 Type I and Type II report?
A Type I report assesses whether controls are suitably designed at a single point in time. A Type II report tests whether those controls operated effectively over a period, typically six to twelve months. Type II is the stronger assurance because it measures controls in operation, not just on paper.
Does a SOC 2 report prove a custodian holds my bitcoin?
No. A SOC 2 report attests that internal controls operated effectively over a period. It does not verify that the custodian holds sufficient bitcoin to cover client balances. Solvency is the job of proof of reserves, a separate cryptographic exercise. SOC 2 and proof of reserves answer different questions.
How does ISO 27001 differ from SOC 2?
ISO 27001 is a certification against an international standard for an information security management system. SOC 2 is an attestation report by a CPA firm on controls mapped to the Trust Services Criteria. ISO 27001 confirms a management system exists; a SOC 2 Type II tests whether specific controls operated over time. They overlap but are not interchangeable.
How should an institution read a custodian's SOC 2 report?
Read the scope (which systems and criteria are covered), the report period, and the auditor's exceptions. A clean opinion on a narrow scope, or a stale period, tells an institution little. The exceptions section, where the auditor lists controls that did not operate as intended, is often the most informative part of the report.