Safeguarding customers' crypto

Why does safeguarding raise a balance sheet question?

When customers deposit crypto with a platform, the platform usually holds the private keys, often in shared wallets. Customers see a balance in their account, but what they own depends on the platform's terms and the law of the country concerned. IFRS has no standard specifically for crypto held for others, so the platform applies the general principle that an entity recognises an asset it controls: the present ability to direct its use and obtain the benefits from it, and to prevent others from doing so. See crypto assets and fintech accounting.

How does a platform decide whether it controls customers' crypto?

The evidence includes:

• Legal terms: whether the customer agreement says customers keep ownership, or transfers title to the platform;
• Rights of use: whether the platform may lend, stake, pledge, sell or rehypothecate the crypto for its own benefit;
• Insolvency protection: whether customers' crypto would be returned to them if the platform failed, or whether they would be unsecured creditors;
• Segregation: whether customers' crypto is held separately from the platform's own, in wallets or records that identify each customer's holding; and
• Who bears price changes: whether the customer gains and loses from movements in value.

A platform that can use the crypto as its own and leaves customers exposed in insolvency usually controls it. A custodian that holds crypto in segregated, bankruptcy-remote arrangements and cannot use it usually does not. Regulation matters: the EU's Markets in Crypto-Assets Regulation, MiCA, requires crypto-asset service providers to keep clients' crypto segregated and protected from their creditors.

Safeguarding: the same holdings, two outcomes

An exchange holds crypto worth US$ 2,000 thousand for its customers and 300 thousand of its own. Consider two versions of its terms. In the first, customers keep legal ownership, their crypto is held in segregated wallets that the exchange cannot use, and local law protects it in an insolvency. In the second, the terms allow the exchange to lend and pledge customers' crypto, and customers would rank as unsecured creditors if the exchange failed.

In the first version, the exchange does not control the customers' crypto, so its balance sheet shows only its own 300 thousand, and it discloses the 2,000 thousand it holds for customers and the related risks. In the second, it controls the customers' crypto, so it recognises the 2,000 thousand as its own asset, measured under its policy for crypto, and a liability of 2,000 thousand to return equivalent crypto to customers. The liability is an obligation to deliver crypto, not cash, and is commonly measured at the crypto's current fair value; if the asset is measured at cost, the mismatch is explained or reduced by choosing a fair value model where one is available.

How are hacks and losses accounted for?

If crypto held for customers is stolen and the platform is obliged, by its terms or by a public commitment that creates a constructive obligation, to make customers whole, it recognises a provision under IAS 37 for the expected cost. For example, if 50 thousand of crypto is stolen from customers' segregated wallets and the exchange announces it will replace it, it recognises a 50 thousand provision and expense, even though the crypto was never on its balance sheet. Insurance recoveries are recognised separately, only when virtually certain. See IAS 37 provisions.

How are custody and trading fees recognised?

Custody fees for holding customers' crypto are recognised over time as the custody service is provided. Trading fees are recognised when the trade is executed. Where the platform also lends customers' crypto or stakes it and keeps part of the rewards, that use is itself strong evidence that the platform controls the crypto. See IFRS 15 revenue.

What should be disclosed?

Platforms disclose the amount and types of crypto held for customers, whether it is on or off the balance sheet and why, how it is held and protected, and concentrations of risk, such as reliance on a single custodian or wallet provider. Because the judgement can change a platform's balance sheet by many times its own equity, it is usually one of the significant judgements in the accounts.

How does US GAAP differ?

From 2022, SEC Staff Accounting Bulletin 121 required SEC filers that safeguarded crypto for others to recognise a liability and a matching asset at fair value, whether or not they controlled the crypto. SAB 122, published in January 2025, rescinded it: platforms now assess whether to recognise a liability for the risk of loss under the contingencies guidance in ASC 450-20, applied retrospectively for annual periods beginning after 15 December 2024. As a result, many US platforms removed customers' crypto they do not control from their balance sheets, bringing practice closer to the control-based IFRS analysis. See IAS 37 and ASC 450 compared. Crypto a platform holds as its own falls under the fair value rules of ASU 2023-08 unless industry guidance, such as for broker-dealers, already applies; see ASU 2023-08 crypto assets.

This guide is general information. It is not tax or legal advice for your situation.