Attestation, Audit, or Proof of Reserves: What Each One Proves About a Backed Token

A backed token is a promise. The issuer says there is an ounce of gold, or a dollar, behind every token. You cannot walk into the vault. So you rely on a report.

Issuers use several words for these reports: audit, attestation, assurance, proof of reserves. They are not the same thing. Here is what each one covers, in plain terms, with real examples.

The short version

Kind of proof	Who does it	What it checks	Biggest limit
Financial statement audit	An independent audit firm	The whole company: what it owns and what it owes	Not offered on the PAXG or XAUT reserve pages, and slow
Attestation or assurance report on reserves	An independent accounting firm	Management’s claim that reserves matched tokens on a date	One claim, one date
“Proof of reserves” or agreed-upon procedures	An accounting firm or another service provider	Whatever steps the company chose	In agreed-upon procedures, the company picks the steps
On-chain reserve feed	A data network	It relays a reserve number on a schedule	The number comes from someone else

1. A full audit

An audit of financial statements looks at the whole business. That includes debts. It matters because reserves can be real and still be owed to someone else.

Neither Paxos’s PAXG pages nor Tether Gold’s reports page offers audited financial statements for the issuer. When an issuer says “audited,” read the document and see what kind of report it is.

Here is a real case. Paxos’s PAXG product page says the gold is “audited monthly.” Its transparency page describes the same work more exactly: monthly attestation reports from KPMG LLP, done under attestation standards from the American Institute of Certified Public Accountants. That is a recognized professional standard. It is a different kind of work from auditing a company’s books.

2. An attestation or assurance report on reserves

Both large gold tokens, PAXG and XAUT, use this kind. Management states a claim, such as “on this date we held at least one ounce for every token.” An independent accountant examines that claim and reports on it.

Two examples:

• PAXG. Paxos publishes a report every month. Reports posted since February 28, 2025 come from KPMG LLP. Earlier reports came from WithumSmith+Brown.
• XAUT. Tether Gold publishes a reserves report every quarter. Management prepares it. An accounting firm in the BDO network then issues its own report under international standards for a “reasonable assurance” engagement. Tether’s page names BDO Italia, and the most recent signed opinions come from BDO Advisory Services S.r.l. in Milan. The latest report on Tether’s site, as of June 30, 2026, showed 707,747.139 ounces held by the custodian against 707,747.09 tokens minted.

Tether Gold’s page is direct about the limits. It says the reports “are not financial statements.” It says BDO’s work is limited to the reserves report and to the gold held on a specific date.

What this kind of report does well: an outside firm, working under professional standards, checked the number. What it leaves out: everything that is not the number, and every day that is not the report date.

3. “Proof of reserves” reports

This label covers a wide range of work, and some of it is thin. The PCAOB warning below is not limited to the thin kind. It says reserve reports that claim reasonable or limited assurance are also not done under PCAOB standards, or under any uniform standard.

The Public Company Accounting Oversight Board (PCAOB), which oversees audits of US public companies, published an investor advisory on March 8, 2023. Its Office of the Investor Advocate wrote it. The page says it gives that office’s views, not necessarily the Board’s. Its main points:

• Proof-of-reserve reports are not audits. The PCAOB does not oversee them.
• They show a single point in time. They say nothing about the next day.
• They likely do not address what the company owes, the rights of token holders, or whether the assets were borrowed to make the reserves look bigger.
• They give no assurance about the company’s controls or governance.
• In an “agreed-upon procedures” engagement, the company decides what gets checked.

The advisory says customers should use “extreme caution” before relying on such a report to conclude there are enough assets to cover what is owed to them.

4. On-chain reserve feeds

Some tokens publish a reserve number on a blockchain, updated on a schedule, so that software can read it. Chainlink’s Proof of Reserve feeds are one example.

A feed does not inspect a vault. It relays a number from somewhere. For assets held off the blockchain, such as gold or dollars, Chainlink’s documentation lists three places that number can come from:

• A third party, such as an auditor or accounting firm, that verifies reserves.
• The custodian, meaning the bank or custodian that holds the assets, which reports the number directly.
• The issuer itself, through an API the issuer hosts. Chainlink’s documentation marks this type with a warning. It says self-reported data “carries additional risks” and that Chainlink Labs is not responsible for its accuracy.

So the useful question is not “does this token have a reserve feed?” It is “who supplies the number?”

What no reserve report tells you

• Whether the backing is pledged. Gold can sit in the vault and still secure someone else’s loan. Only a look at the company’s debts would show that.
• What happened between reports. A quarterly report leaves about 90 days uncovered. A monthly one leaves about 30.
• Your legal claim. Tether Gold’s disclosure document says each token represents ownership of gold on a specific bar. Paxos says that if you own PAXG, you own the underlying gold. Those are the issuers’ own statements. Whether they hold up if an issuer fails depends on the terms and on the law where the issuer sits.
• Whether you can redeem. A report can confirm the gold exists. It does not say you are allowed to go and get it. See PAXG vs. XAUT for how much redemption rules differ.
• Whether a regulator stands behind it. Registration is not a seal of approval. Tether Gold’s own disclosure document says its registration with El Salvador’s digital assets commission “does not imply certification” of the token’s quality or the issuer’s solvency.

Seven questions to ask about any backed token

1. What kind of report is it? Read the first page of the report, not the marketing page.
2. Who signed it? Is it an accounting firm you can look up?
3. How often is it published, and how old is the latest one?
4. Does it cover only the reserves, or the company’s debts too?
5. Who picked what was checked: the accountant’s standards, or the company?
6. If there is an on-chain feed, who supplies the number?
7. Can you, in your country, actually redeem? For what, with what minimum, and at what fee?

A token that answers all seven in public documents has done more than most.