BBW24 - Day 2 - KEYNOTE Auditing the Future: Navigating the Complexities of Digital Asset Compliance

I I you know I'm an I'm an auditor as you heard uh so I'm a partner and I lead uh Grand Thorton's uh digital asset blockchain web three practice I I want to talk a little bit about uh my personal journey to blockchain crypto what our firm is doing some of the challenges and complexities we're seeing um and you know I know this this conference more about you know technology and Innovation right so you'd say what's what's an accountant do here but uh uh believe it or not I mean many companies in this space require regulation um regulation uh requires Audits and and accounting services so I mean we're like a n i don't want to say we a necessary evil we're like a an elementary part of the success of uh blockchain based companies and and and digital assets so uh how how how do I get to crypto blockchain right so my personal story is back in 20 2014 when we decided to onboard our very first crypto audit client company based here in Boston I'm based in New York but I I serve I serve uh clients all over the country and I have a number of clients here in Boston I always enjoy being here and uh so back in 2014 when we onboarded our first crypto audit client um our you know leader said oh who can who can lead us work um so they looked at me and said Marcus you're the banking guy you're it and I was like me I mean I at that time I all I knew about crypto blockchain was what you read in the in the newspaper and as you can imagine 2014 what was written about blockchain and crypto was not positive right it was like the nefarious use cases and the the Silk Road and everything so I I really had to get uh with in a year from Zero to Hero and uh it was a very interesting and exciting time um we looked around in the firm and said look what what who who are the right people to involve and how can we handle it so our risk management team early on um made a decision that if we if you're going to work in a space that we would maintain and use our own fully synchronized forensic nodes right so we do not we do not use block explorers we do not Outsource or use third parties um we maintain noes for the blockchains that we support right in the I I think we currently support about like 40 different blockchains um you know all the major types and erc20 are easily replicated right so we could stand up notes in over time on erc20 basis I remember like the the Ripple note was was quite a monster because that takes a lot of um space and it took us quite a while to to stand it up but what's interesting is I mean the the numbers of chains that we're supporting is also driven by market and client Demand right if we have clients that say oh we're adopting a or b or c right we start working on a or b or c and then many times we work directly with the developers right so in the case of Ripple we worked hand inand with the Ripple folks and and noes which is you know really interesting and exciting and we also um alert clients you know in the early days right clients they just adopted new chains and tokens and sometimes we read read about in the news uh and said wait a minute with the UDS right we have to make sure we can audit it so we have to establish a process you have to give us at least two or three weeks time that we can do the research and say is the blockchain auditable and I mean there was like a time in I think 2017 or 18 when privacy coins became very popular uh and we said look if you adopt if you adopt if you adopt privacy coins with the Privacy feature switched on then it's it's game over for us because they have a Vanishing Trail right audit is all about audit evidence and trails if there's no Trail then right you can always argue with materiality right if if it's like just a gimmick right some some companies adopt uh you know coins just to say oh we have 300 400 500 coins and uh you know we work with like some of the largest uh exchanges and crypto companies in the world right and you look at their business you say oh we're listing four 500 coins or whatever and then you look at the trade and the revenue trade volume and the revenue that are generating 70 80 7 I mean 70 80% of of the revenue and the activity is Bitcoin e and and stable coins right so um I mean I'm I'm excited about some altcoin projects right I mean eth has a lot of the ethereum blockchain has a lot of benefits um but do you really need like hundreds of coins and tokens that nobody is really interested but and it's like when when the engineers right get excited and and and and in a driving seat right um of course they want to have always the the latest most accessible most excite exciting information but again as an accountant and auditor right I have to sometimes um warn clients to say look we have to work hand inand to make sure we can audit it we've always been successful in in in coming to a solution right when when certain clients adopted privacy coins they then agreed to not um switch the Privacy feature on that we could get the trail right and sometimes um doing onchain audits can be challenging right the amount of data you need to process um it can be can be challenging but it's also you know exciting because you work together with different people right so our blockchain infrastructures house with our forensic Technology Group um we don't just use we don't just use um our notes for audit purposes we also use it for forensic forensic investigation right I mean what was got was gotten quite popular in the aftermath of 2022 is is Discovery right or I mean we've had like divorce cases where where one of the divorcing parties was hiding assets from the spouse and the spouse said I know I know my partner has uh has some digital assd I just don't know where right it's not it's not the most uh um it's certainly an exciting story but it's not the most exciting work to do but just to give you an idea how broad uh the offerings are right we're also not just an audit firm we offer like a broad variety of of of services in the space Right started with audit uh of course Tax Services is always a need um and we also do risk advisory in outsourced co-sourced um we've done a number of uh you know Consulting Services right when before the be I don't want to get into accounting standards right but now we're moving towards a fair value standard for digital asset which was a long long way coming uh but before before the fastp finally moved on that point uh any company that wanted to go public um had to put their their their assets on a cost basis and impairment basis right so a lot of companies in the past exchanges they had recorded their ass on a fair value basis and then as they were looking to register with the SEC they had to reverse it and put it on a cost basis so we did a couple of those project with some prominent crypto exchanges uh that we helped them figuring out uh what's what the cost basis should be and if there's impairment um again similar with with reg with with um regulation that needs to evolve I'm glad we we finally had the move um on the on the accounting standards because if you if you look at like some of those crypto Banks right I don't want to name names but basically where you could deposit your crypto you you you could earn 8 10% they then lend it out um to earn to earn the the the the rewards that you um that they didn't distribute to you um the accounting for that was like really lopsided um you had to you had the cost basis method on the asset side right so you you hold all those assets uh price let's say Bitcoin right price of Bitcoin goes up locked in nothing happens price of Bitcoin goes down you have to write it down you have to mark impairment on the liability side of deposits right they were Fair valued meaning your deposits were Fair valued right price of Bitcoin goes up liability goes up price Bitcoin do liability goes down that meant um the more successful the company was the more negative equity had right I mean from an analyst perspective it just doesn't make sense and that's why I'm like glad that we finally had some movements in in on the accounting side by the accounting standards set so so um another aspect I want to I want to cover is um right I mean we work with like a broad variety of of of of different clients like exchanges uh custodians trading platforms etc etc uh stable coin issuers uh what was really surprising to colleagues at our firm who you know know about blockchain right they you oh on a blockchain everything is written everything is is is traceable uh when we started working with exchanges and they they realized um at an exchange 90% of the transactions are not written on a blockchain right I mean you have a a crypto exchange that has customers right customer a trades with customer B you have a book entry on the inhouse system that doesn't hit the blockchain right the blockchain is hit when you uh need to go outside you say somebody is transferring assets out or trans Assets in or you need to interact with a with a you know liquidity provider right but um that also necessitated that when you have companies where a lot of activity depends on an internal it system that you have to have solid um it controls in place right uh so taking a step back startup companies often times uh a very business focus right of course right I mean you have a business your business person you know you focus on the business bring in more customers uh increase the revenue become profitable and like accounting controls often times an afterthought but these companies as they're getting money transmitter licenses from the various States uh that comes with an audit requirement right you have to submit audited financial statements within 30 days of the year end uh then they come and say hey uh um from xyc we need an audit and then you engage with those companies you realize often times they're not audit ready the startups right so for companies and businesses that are startups it's important um to make sure you consider you know controls accounting Finance um very very crucial because we've we've had instances right as I said on an exchange like 90% of the transactions run on an inhouse system system if you have issues on that on on it General controls you may not be able to audit and get comfortable Revenue I mean we we've always been able to find a path um to get comfortable but we've we've had like some some interesting experiences right so for entrepreneurs it's really important that you keep in mind if there's an audit requirement or regulatory requirement make sure you have adequate controls you work with the right people and often times it's to um engaged like a a consulting firm that can help you get audit ready right because oftentimes when somebody comes with a with an audit I mean we said look you don't need an audit you need somebody who helps you get audit ready because otherwise um that audit will be not a good experience for for you another good experience for us uh what what we also do as part of our um curriculum right when we say when our risk management team and I think we were like the first top 10 firm of the large firms that got into the crypto audit space I think back then everybody says yeah we're happy to consult but we don't want to do the audits too risky um part of part of that was not just having our notes maintaining our notes but also that we have annual training right that we train our people um that they understand what is blockchain how does it work how do you audit existence ownership and how do you value it right so on an annual basis uh we host a in-house design training um that gives all of our first of all the people in the audit space are required to attend it and also gives all of our other people the opportunity who are interested to attend learn about it and and and and get involved we have that upcoming uh actually in in September right we do one live session and it's going to be a recorded session but as we also work uh with other me right gr Thorn is an international member fir right I'm I'm a partner principle with the US firm and uh we have member firms in other countries that are tied in uh via network of of global global member firms all use the same brand use the same technology uh various member firms have gotten involved with crypto right it's like the spaces that the the countries jurisdictions that you can imagine United Arab Emirates for example is a hot hot Marketplace um UK Ireland is very active Malta um our our colleagues in Cypress for example are very active like some of our leaders leaders from our Cypress firm are involved with the the University of um Nikos nikosia uh which was one of the first uh education institutions that established a blockchain lab and what's really interesting um to learn from them they have developed an nft pricing platform because we've been always struggling over the lot I mean nfts are not that that had a topic anymore but for a while as everybody know right nfts was all the rage when you had like the Saturday Night Live show with Elon Musk and all the the other guys making skits about nfts um we were always struggling how do you how do you value an nft right they're unique I cannot just say oh one nft is like the other but they created a uh EV valuation platform like an algorithm that kind of like um Compares similar priced assets and then adjusts them for a price so it's really interesting to see what some of our colleagues and other members in other in other countries are doing um we support those member firms through our notes right like the onchain testing we can we can help them do that right they can Outsource that to us because kind of like a global Center of Excellence Excellence we also um go out and do training with the member firms we have like a couple of uh upcoming uh trainings coming up right so we we're going to do training with um our friends in a in a Caribbean islands that have um an active engagement with uh crypto UAE uh is another area that have reached out for help and support from a training perspective so I think it's it's it's important um that you are in the space as an accountant advisor you have to make sure sure your people are aware what it is how it works and and and are able to be con conversal and and and comfortable with that right another thing that we do is um we've always we're also doing a lot of internal education and you can imagine like back in 2014 a lot of people said Oh You Touch you doing crypto I don't think it's a good idea right so we also always still have a lot of uh internal uh education convincing to do um but we also oftentimes engage with Regulators uh we've met for example with the SEC uh we've had sessions with the OCC when Brian Brooks was the was the head of the OCC at the time uh finra um you know any anybody who's interested in in in speaking to us I mean I had I had the the the honor in 2019 or 2020 the sec's cryptos SAR had asked me if I if I would be interested in speaking on a on a stable coin um panel discussion uh with the FSB so there was like a a a a virtual meeting right but it was like people from all over the world there was like there were like three panels was one two were like practitioners like companies and there was like Academia lawyers and accountant so I was on the on the accounting ones it was really interesting um to see back in 2019 when Banking and Financial Services Regulators here in the US were still hesitant and we're believing you know crypto is just a fed that's going to go away to see how how regulators and central banks in other countries already picked it up and you know and evaluate The Good The Goods the positive and the negatives right um I mean back then we talked about you know what if there's a run on the bank and and all the stable coin Reserves kep the bank what what what could be the outcome right and there was also at the time when Facebook meta was was considering to launched their own stable coin right it was also an interesting dep uh uh topic right you can imagine like a company like Facebook with a customer inbuilt customer base of three billion launching like a product like that um and it would buy let's say treasury bonds as reserves I mean they would have a significant influence over I don't want to say fiscal policy but they would wield a lot of power right there's always considerations like that in the in the political regulatory Arena that also drives development and and and the thinking um I also just want to talk about a little bit about how we um how we go about auditing um digital assets because you know you can't just go in a vault count them as as you all know right so we have developed um a methodology back in 2014 and I think like most of the larger firms are using that now um I mean the the existence testing is fairly simple right um we get like the uh the identifiers and then we look at look them up on our own notes yeah they exist right it's the same thing if you say uh you talk to somebody on a phone and say hey I have a I have a a dollar bill here um and I have to say you know how do I know you you own that bill hold the bill right you can read the serial number you could probably look up the serial number say yeah the dollar bill exists but how do I know that you own that crypto asset uh that you claim your own right so that's the that's the ownership test and for that we develop like a message signing uh approach that we say Hey you use the private key to sign a message you give it to us we look it up and say Yes uh and we give you the message right it could be like it's a beautiful in Quincy right and then you code it you send it to us we look it up yet yes that's the message we told we asked you to sign and that is a way that doesn't require moving assets um making them hot because like one of the uh um maybe also success story we had over the years is uh we started working with a very large crypto exchange and their their their prior um firm they work with like a small smaller firm they were not able to audit the the assets that the company held in In Cold Storage they basically said oh you have to make them hot that we can audit them right a lot of firms that don't have like their own note uh technology or don't use block explorers they often times ask companies to move assets right around uh which would be like a last resort for us if if if everything else fails but um we then were able to run our message signing approach with those assets were in cold storage and they didn't have to make the assets hot because if they would have gone from coold Storage to to to um to had the uh it would have caused like a market reaction that would have moved prices because such a large amount of assets that they hold um that would have not been a good a good approach right so that's like one of the early success stories we had with our approach methodology when when companies um don't self- custody and custody with third- party provider we cannot use the message signing uh approach unless the custodian keeps the Assets in segregated assets uh segregated addresses and we can um and and our client you know holds keys that they can sign the message let's assume that's not the case they sitting like in commingle addresses at a custodian um then you send a confirmation but the confirmation by itself is no longer sufficient right um if it's uh a qualified custodian nowadays they they pretty much all have uh service auditor reports right so basically a report that like an auditor issu said yep the company has controls in place that safeguards the assets then you can rely on that on those reports if that's not the case then you have to perform additional steps and often times we do like roll forward and other tests um in order to get comfortable um I'm I'm a member of the aicpa digital asset working group I mean we have a number of our colleagues on the digital asset working group I'm on the audit side we have colleagues on the accounting side and uh there is like um an audit an accounting practice Aid out there on digital asset that the first one was issued a couple years ago but the latest um update was just issued earlier this year and we're currently wrapping up and soon to be published uh an an aicpa practice Aid on stable coin Reserve ass estation there also something that works on mining and uh but if you look at that guide that's out there it's also say right um sending a confirmation by itself is not sufficient you have to take a step further and it comes to some extent from what happened at wireart in Germany I don't know if you're familiar with wireart it was like a very large uh payment company um in Germany and uh uh the audit send the confirmation to a bank in the in the Philippines uh for 2 billion and it turns out there was a a fake confirmation the bank didn't have those assets right ever since uh there's like the move say look just sending and relying on a confirmation is not sufficient you have to get more support or more evidence that you get get comfortable with that so some of the challenges that we encountered um is now I want to talk about the regulatory space right when you work with when you work with companies uh specifically companies they want to go public right I I talked about the lack of accounting Clarity in the past now we have finally the fast make the fast be making movements but in the past there was no clear uh Accounting Standards right a company going public um where you don't have clear guidance um for an audit firm that's a big risk taking just a leap of faith and then later something the the SEC disagrees you have a lot of you know you potentially have invest the lwuit right so so most accounting firms will ask their client to pre-clear positions right so um there's still a lot of uh pre pre- clearances going on uh with the SEC so that you basically as the accounting firm and the and a client they they they approach the SEC with certain matters they want to get clarity on and then the SEC uh considers it after a few weeks to get back to you with their position that you have Clarity how to treat it right um I'm hopeful that we're going to see regulatory certainty because as you all know the SEC is currently um regulating by enforcement I think some of the uh uh lawsuits like with ripple or with coinbase are moving forward and hopefully reaching a concluding stage soon but it would be nice if we saw legislators get together and you know reach across the aisle the much talked about um uh approach and and come up with meaningful meaningful regulation right I think everybody realizes after 2022 um this is not the wild west we need regulation people's assets are at stake and yes it's a new technology and it's a technology but still if you handle people's assets um there needs to be some clarity and and regulation supervision that something like 2022 doesn't happen again so I mean I'm hopeful that we're going to see that and uh thank you very much for having me and I mean I'll be around if if if anybody has any questions would like to talk to me thank thank you very much for having me thank you