Proof of reserves (PoR) is a set of procedures for documenting a custodian’s reserves at a particular time. Depending on the method, it can include address-control and customer-balance checks. The report’s exact scope matters. Proof of one part is neither an audit of the whole business nor a guarantee of solvency, the ability to cover all its liabilities.
A high percentage on an exchange’s website may reassure Jane. Before relying on it, she should find the snapshot date, the legal entities covered — the particular companies in a group — and the assets and accounts included. PoR is not a uniform certification with the same scope at every provider. Kraken, for example, specifies the assets and product balances its method includes. Such a report does not automatically cover every debt across a corporate group. Read the result alongside both what was checked and what was left out. [1] [3]
A custodian can sign a verification message with an address’s key to demonstrate current control of that key. Bitcoin’s public chain then lets someone check the corresponding balance. The signature alone does not establish legal ownership, reveal pledges or show that the coins were not borrowed just for the check. It also cannot prove exclusive possession of a key that may have another copy. Jane gains evidence about control of selected assets, not a complete account of their legal and economic position. An address list without proof of control says even less. [1] [3]
Imagine customer-balance records linked in a Merkle tree. This structure turns data into cryptographic fingerprints and combines them into a shared root, a fingerprint of the whole included dataset. Jane receives information that lets her verify her corresponding balance belongs to it without needing the complete list of other customers. Useful as that is, it proves inclusion, not completeness. Successfully checking Jane’s record does not by itself verify all other accounts and all company debts. [3]
Trading on credit can produce negative customer balances. Simply subtracting them from other people’s positive balances could make the exchange’s reported debt to customers look smaller. In a 2022 article, Kraken describes excluding them from its PoR method at the time because of this risk. That is not a universal rule for every report. Jane should read how the particular review handles loans, margin trading and netting, meaning the offsetting of claims and debts. A simple total may not tell her what the business really owes. [4]
Our example, not exchange figures: a custodian reports 110 BTC in reserves against 100 BTC of included liabilities, the amount the dataset says it owes. The ratio is 110%. If the report leaves out another 40 BTC of debt, the same reserves must cover a total of 140 BTC. Coverage is then about 78.6%. Liabilities form the denominator, the bottom of the fraction. A calculation based on an incomplete dataset can be arithmetically correct yet misleading. Jane needs to know not just the reserves on top, but what went into the bottom. [2]
PoR captures a particular moment. Afterwards funds may move, new loans may arise or access to keys may be lost. More frequent snapshots provide more checkpoints, but do not close this gap by themselves: conditions can still change between them. Even a high reserve ratio does not tell Jane how quickly she can withdraw or which contractual restrictions apply. She should read reserve reports alongside the service terms and evidence of actual availability, rather than treating them as a substitute. [1] [3]
The PCAOB Investor Advocate, an investor-protection office within the US audit overseer, highlighted PoR limitations in March 2023. Offices of the US securities regulator, the SEC, also addressed them in July 2023. A reserve report is not a financial statement audit, which examines a broader financial picture. A provider’s registration alone does not put this engagement under PCAOB auditing standards or inspection. Jane should read the procedures actually performed and the report’s conclusion; a familiar logo does not expand the scope of the work. [1] [2]
Jane starts with the verified method for the particular report, its date, published root and her leaf identifier — the record’s identifier in the tree. She compares the right asset and balance at the snapshot time; a later trade may not appear in it. She then follows the provider’s procedure to check the path from her record to the common root. A mismatch calls for investigation, not dismissal. A successful result is a partial check with a clear meaning: this record is included. Excluded accounts and other limitations still need reading, because the check alone does not establish completeness of reserves or liabilities. [3]
For the clearest picture, read this entry together with Counterparty risk, Collateral, Liabilities, Self-custody. The reverse links also lead from Custodial Exchange, Bank Bitcoin custody, Counterparty risk, Liabilities.