VARA Reserve Assets audits must address how client assets were safeguarded throughout the review period. A balance confirmed on one reporting date cannot, by itself, establish compliance across that period.
VARA’s Reserve Assets Audit Report circular of 6 October 2026 clarifies its minimum expectations following a thematic review of reports submitted in 2025. It connects existing rulebook obligations with seven minimum audit checks and more specific reporting expectations.
For a virtual asset service provider (VASP), the practical task is to make the relevant records available and ensure the engagement covers each required item. Appointing an auditor does not reduce the responsibilities of the VASP, its Board, Senior Executive Officer or control functions.
What must Reserve Assets cover?
Company Rulebook VI.E requires Reserve Assets equivalent to 100% of liabilities owed to clients in respect of all VA Activities, maintained at all times. The assets must match those liabilities one-to-one in the same Virtual Asset.
The circular asks auditors to confirm coverage throughout the review period. The report should explain its sampling methodology, including how samples were selected across that period. A VASP should therefore prepare records that allow the auditor to test coverage over time, rather than supplying only a closing balance.
Can another asset cover the same value?
The same-asset requirement is specific. Holding another Virtual Asset with an equivalent market value does not satisfy the circular’s audit test. For example, an equal value of another token does not establish one-to-one coverage of a client liability denominated in bitcoin.
That distinction affects how management prepares its records. A consolidated valuation may help explain overall balances, but the audit must be able to connect each relevant client liability with Reserve Assets of the corresponding type.
Which wallets and custody arrangements are in scope?
The minimum scope covers all wallets holding Client VAs, including hot, warm and cold wallets. It also covers assets held through wallet infrastructure providers and with third-party custodians. Those examples do not limit the scope.
The auditor should assess segregation from the VASP’s proprietary and operational Virtual Assets, identify any commingling and confirm whether the VASP maintained control over all relevant wallets during the period. Each wallet’s custody arrangement should be described, including whether it involves a licensed third-party custodian or a self-custody solution using a wallet technology provider.
Compliance and Risk Management Rulebook V.B.3 requires separate wallets for Client VAs and the label ‘Client VA Wallet’ in the VASP’s books and records. A practical wallet inventory should connect those records with the custody arrangements and evidence of control, including changes during the period.
What if Client VAs were lent or pledged?
The seventh minimum audit check addresses any rehypothecation, lending, pledging or other use of Client VAs during the review period. If such use occurred, the report should explain the arrangements and identify the assets affected. Omitting this question leaves a gap even if the other audit checks are covered.
This reporting requirement does not itself authorise the use of client assets. Rule V.B.4 permits rehypothecation only where the client has given explicit prior consent conferring discretionary authority and the VASP has the appropriate VARA authorisation and licences for all relevant activities. Client consent alone is therefore insufficient.
What evidence should support daily reconciliation?
Under Company Rulebook VI.E.3, Reserve Assets must be reconciled daily and independently audited at least every six months. The audit reports must be included in the subsequent quarterly report to VARA. The circular clarifies the audit expectations; it does not replace this existing frequency requirement.
Compliance and Risk Management Rulebook V.D.1 also requires accurate daily reconciliation of each client’s Virtual Assets, including complete individual client credit and debit ledger balances. The circular expects the auditor to obtain and review evidence demonstrating that reconciliation worked effectively.
Management representations alone should not be relied upon as sufficient audit evidence where independent evidence is reasonably available. A management confirmation should not replace accessible evidence of the process being tested.
What must the audit report conclude?
For every minimum scope item, the report should explain the procedures performed, evidence obtained, sampling methodology, reliance on third parties and any scope limitations. It should give a clear conclusion, distinguishing compliance from exceptions, limitations and matters that could not be independently verified.
The basis for each conclusion should be documented. Findings should explain how exceptions are addressed, including whether the audit firm performed follow-up work or whether the VASP will manage them through its internal compliance and remediation framework. This allows management to identify what remains unresolved after the report is issued.
What should a VASP prepare before the audit?
Records covering the review period
Prepare client liability and Reserve Assets records that can be matched by Virtual Asset. Make daily reconciliations and the underlying client ledgers available for the auditor’s sampling across the period.
Wallet and asset use records
Compile the complete wallet inventory, custody arrangements, segregation records and evidence of control. Identify any use of Client VAs and the relevant arrangements, affected assets, client consents and authorisations.
An agreed scope and reporting process
Check that the engagement covers all seven minimum items. Identify evidence held by third parties early and agree how limitations, exceptions and follow-up responsibilities will appear in the report. Reflect unresolved issues in compliance policies and corporate governance records where appropriate.
Key takeaway
Reserve Assets audits require evidence across the period, matched to client liabilities in the same Virtual Asset.
- Every relevant wallet and any use of Client VAs must be covered.
- The report should reach a supported conclusion for each scope item.
- Responsibility for safeguarding remains with the VASP.
Frequently asked questions
How often are VARA Reserve Assets audits required?
Company Rulebook VI.E.3 requires an independent third-party audit at least every six months. The report forms part of the subsequent quarterly submission to VARA.
Is a year end wallet balance enough?
A balance at one date does not demonstrate compliance throughout the review period. The circular calls for period-wide coverage and sampling across that period.
Are wallets operated through external providers covered?
Yes. The scope includes assets held through wallet infrastructure providers and third-party custodians, alongside the VASP’s other wallets holding Client VAs.
Does client consent alone permit rehypothecation?
No. Rule V.B.4 also requires the VASP to hold the appropriate VARA authorisations and licences for the relevant activities.
Can management representations replace independent evidence?
They should not be relied upon alone as sufficient audit evidence where independent evidence is reasonably available. The report should explain the evidence obtained and the basis for each conclusion.
Official sources
Virtual Assets Regulatory Authority (VARA)
VARA Rulebooks
- Company Rulebook — VI.E Reserve Assets.
- Compliance and Risk Management Rulebook — V.B Treatment of Client VAs.
- Compliance and Risk Management Rulebook — Part V Client Virtual Assets Rules, including V.A and V.D.
Legal support for VARA audit preparation
BLegal provides VARA regulatory support on client asset safeguarding obligations, compliance policies, corporate governance and commercial contracts supporting custody arrangements. We help businesses connect their operating arrangements with the relevant legal requirements.
If you are preparing an audit engagement or addressing findings, contact BLegal to discuss the legal scope and supporting documentation for your business.
Last reviewed: 27 October 2026
Disclaimer. This article is provided for general information only and does not constitute legal or regulatory advice. The applicable framework depends on the specific token, activities, entity structure and jurisdictions involved. Regulatory requirements and interpretations may change. Businesses should obtain advice based on their particular circumstances before making structuring, licensing or commercial decisions.