Achieving SOC 2 for a Digital Asset Operation

The AICPA has not issued a new SOC 2 version for 2026, and the five trust services criteria are the same ones introduced in 2017. What changed is around the edges, mostly through the 2022 description criteria. Meanwhile 89.6 percent of SOC reports now include subservice providers, up from 82 percent, and reliance on internal audit has fallen to 5.2 percent. The framework is stable. What a digital asset operation can actually prove with it is the part worth examining.

The Nine-to-Fourteen-Month Path

The sequence is unforgiving and mostly fixed. Readiness assessment and scoping runs four to eight weeks. Gap remediation and control implementation takes eight to sixteen weeks, with three to six months of it finishing before formal fieldwork starts. An optional Type I adds four to eight weeks for a point-in-time opinion on design.

Then the irreducible part: a Type II observation period of at least six months, commonly twelve for a first examination, followed by four to eight weeks to issue the report. Total is nine to fourteen months, and no amount of spending compresses the observation window. An operation that needs a report for a mandate in two quarters cannot have one.

Evidence for the asset-specific controls is reasonably well established by now: hardware security module audit logs, signing ceremony documentation, key rotation records, quorum approval records, and reconciliation across on-chain data, exchange APIs, custodian reports and the subledger.

Sampling Works Until the Population Is Two

Here is the structural limit, and the reason not to read a Type II as a general endorsement.

SOC 2 operates by sampling. An auditor selects items from a population, perhaps twenty-five of five hundred access changes, and infers that the control functioned. That method is excellent for high-frequency, low-consequence activity. Access reviews, onboarding, ticketing and patch management have populations in the hundreds, so a sample means something.

The controls carrying nearly all of the risk have populations in the single digits. A key generation ceremony happens once or twice a year. A signing quorum change, an upgrade authority rotation, the addition of a new whitelisted withdrawal destination: each is rare by design, because rarity is itself a control. You cannot sample a population of two.

For a rare control to be tested for operating effectiveness, it has to occur inside the observation window. If no ceremony took place during the period, the report says nothing about whether the ceremony process works, regardless of the engagement being a Type II. Coverage of the single most consequential control is design-only, and nothing on the opinion page flags that.

So the assurance profile inverts the risk profile. It is strongest where frequency is high and consequence is low, and weakest where frequency is low and consequence is total. The practical question for an allocator is narrow and almost never asked: did a key ceremony occur within the reporting period, and was it tested?

The Criterion Most Operations Leave Out

Security is mandatory in every engagement. Availability, confidentiality, processing integrity and privacy are elective, and the common scope is security plus availability because it is cheaper and faster.

Processing integrity is the one that matters here. Security asks whether the perimeter held. Processing integrity asks whether an authorized instruction became the correct transaction, for the correct amount, to the correct address, which is the only step in the chain that is irreversible. An operation holding client assets and processing financial data should scope all five, and the ones that scope two are producing a report that is nearly silent on the risk the client actually bears.

Key generation and management, cold storage procedures and transfer authorization are the scope items that carry the weight. If they are excluded, the report is weak evidence whatever the opinion says.

Read the Report Backwards

Start with scope, not the opinion, because an unqualified opinion over a narrow scope is worth less than a qualified opinion over a broad one.

Then the subservice method. With 89.6 percent of reports now including third parties, almost every digital asset operation faces the carve-out question, and carve-out is the norm. A fund relying on a custodian, an exchange, a node provider and a screening vendor ends up reading four reports with four observation windows that do not align. The periods between them are not covered by anyone's assurance, and that gap is invisible unless the dates are laid side by side.

Then exceptions: the description, the number of instances, and management's response, because one remediated exception is a different fact from a recurring failure in a central control.

Then the complementary user entity controls, which is where responsibility quietly transfers. The clean opinion is conditional on the reader performing the listed customer controls, typically managing access, safeguarding credentials and reviewing transfer confirmations. Most readers skip that section, which means they have accepted obligations they have not implemented, and gaps there are theirs rather than the provider's.

The opinion last.

What It Does Not Say, and What Is Tightening

A clean report is not a safety guarantee. It covers neither excluded controls nor future performance, and it says nothing about theft, insolvency or market loss. SOC 2 is also not qualified custodian status, and the two are routinely conflated in marketing material. Reports are usually available under a non-disclosure agreement, and refusal to share even the opinion page is itself a diligence finding.

The direction of travel is genuinely better. Mandatory disclosure of the risk assessment process means the operator has to state what it decided to worry about, which is the closest thing in the framework to answering whether the controls were the right ones. Falling reliance on internal audit means more independent testing. Emphasis on system boundaries pushes back against vaguely drawn descriptions. For an operation starting now, the sensible plan is to scope all five criteria, schedule a key ceremony inside the observation window on purpose, and align the window with the subservice providers already relied on.

For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.

‍