SOC 2 for Crypto Companies: What It Covers and Misses

By the Guardian team Updated November 2026 5 min read

Quick answer. No. A SOC 2 is a CPA’s report on the controls a company puts in scope. It does not test contract code, and covers keys, signing and onchain monitoring only if scoped. Add audits, pentests and key reviews.

Watch: SOC 2 for Crypto Companies: What It Covers and Misses 1:43

Video transcript

Is a SOC 2 enough to trust a crypto custodian or exchange? No. It tests the controls a company puts in scope, not its code.

A SOC 2 is a licensed CPA's report against the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Management picks which are in scope.

A Type 1 shows controls were well designed on one date. Only a Type 2 shows they worked over a period.

Even in scope, a SOC 2 tests controls, not code. Smart contract logic, key ceremonies, signing interfaces and onchain monitoring fall through most easily.

Resolv's March 2026 loss shows both halves. Per Chainalysis, an attacker reached a privileged signing key, and the contract enforced no maximum mint. One is access, the other is contract logic.

Firms close the gap layer by layer: a smart contract audit, offchain pentests of apps and signing services, a key management review, and onchain monitoring.

Reading a vendor's SOC 2? Confirm it is a Type 2, the signing service is named, and check exceptions and carved-out vendors. Then ask for separate evidence on contracts, keys and monitoring.

Guardian does not issue SOC 2 reports, a licensed CPA firm does. Guardian prepares the controls and evidence, and its assurance pilot covers much of what SOC 2 leaves open.

Read the full guide for the complete buyer checklist, or talk to Guardian about covering what your SOC 2 leaves out.

When a bank vets a crypto custodian or exchange, a SOC 2 report is one thing it may review, under 2023 US interagency guidance.

The report is only as useful as its scope. In crypto, much of the risk sits in contract code, keys and signing.

This guide covers SOC 2 alone: what it tests, where crypto risk falls outside it, and how to read one. For how it compares with ISO 27001, NIST CSF 2.0 and CCSS, see our security standards comparison.

What SOC 2 Tests

A SOC 2 is an attestation report signed by a licensed CPA. The CPA tests against the AICPA’s 2017 Trust Services Criteria, with revised points of focus from 2022.

The criteria span five categories:

Security
Availability
Processing integrity
Confidentiality
Privacy

A report can cover one category or all five, the AICPA’s Amy Pawlicki said in April 2026. Management picks them when it scopes the work.

On October 26, 2026, the AICPA’s Assurance Services Executive Committee posted exposure drafts of proposed 2027 criteria. They are proposals only; the 2017 criteria still apply.

Type 1 and Type 2

Report	What the CPA gives an opinion on	Timing
Type 1	The system description and the design of its controls	As of a specified date
Type 2	The same, plus whether controls operated effectively	Throughout a specified period

A Type 1 shows controls were well designed on one date. Only a Type 2 shows they worked over time.

How the attestation runs

Scope: management picks the system, the categories and the period.
Description: management writes the system description and a written assertion about it.
Examination: the CPA evaluates the description and the controls against the criteria.
Report: the CPA’s opinion, as of a date (Type 1) or over the period (Type 2).

What It Misses in Crypto

A SOC 2 tests the controls in management’s system description. What the description leaves out, the report does not cover.

Even in scope, it tests controls, not code. Four crypto risks fall through most easily.

Risk	What a SOC 2 can see	What it can miss
Smart contract logic	Change approval around a deployment	Whether the deployed code is correct
Key ceremonies	A ceremony in scope and in the period	Ceremonies outside the description
Signing interfaces	Who may sign, and their access	Whether signers can read what they sign
Onchain monitoring	Monitoring of systems in scope	Contracts, roles and multisigs left out

Resolv’s March 2026 loss shows both halves. Per Chainalysis, an attacker reached a privileged signing key in Resolv’s AWS KMS environment.

Then the contract did the rest: it enforced no maximum mint. The first is an access question; the second is contract logic.

For the signing side, see our guide to signing interface security.

Scoping a Crypto SOC 2

If you are the company, draw the boundary where funds can move. Put these in the system description:

Key generation, storage, signing and recovery: HSM, MPC or multisig.
Key ceremonies, held inside the period so the CPA can test them.
The pipeline that deploys and upgrades contracts.
Admin and multisig operations, including the signing interface.
Onchain monitoring and incident response.

Pick categories that match what clients rely on: availability for a trading venue, processing integrity for transaction processing.

Vendors: carve-out or inclusive

Crypto stacks lean on vendors: a cloud, a wallet or MPC provider, a custodian. A SOC 2 treats each as a subservice organization.

Carve-out: the vendor is excluded; its controls are described, not tested.
Inclusive: the CPA tests both organizations, and the opinion covers both.
CSOCs: controls the carved-out vendor is expected to have.
CUECs: controls the customer is expected to run.

If your wallet provider is carved out, your keys may sit outside your SOC 2. Ask for the provider’s own report.

Closing the Gap

Firms close the gap with assurance built for each layer. Each leaves evidence a buyer can check.

Gap	Assurance	Evidence to ask for
Contract logic	Smart contract audit	Report, fix review, deployed code match
Apps, APIs, signing services	Offchain pentests	Report with retest
Keys	Key management review	Ceremony records, quorum and recovery map
Live contracts and roles	Onchain monitoring	Alert rules, response times, drills

Our audit vs pentest guide explains which covers what. For keys, see private key management.

Buyer Checklist

Reading a crypto vendor’s SOC 2? Check:

Type 2, and when the period ended.
The systems in the description. Is the signing service named?
Which of the five categories are covered.
Exceptions in the test results, and management’s response.
Carved-out vendors, and their own reports.
The CUECs you must run yourself.
The CPA firm, and whether the timeline was realistic.
Separate evidence for contracts, keys and monitoring.

Why the timeline? The AICPA has flagged quick-turn SOC engagements as a risk, and in May 2026 told peer reviewers to look closer at SOC 2 timelines.

How Guardian Helps

Guardian does not issue SOC 2 reports. A licensed CPA firm does; Guardian prepares the controls and the evidence the CPA tests.

Its Regulatory & Compliance service maps artifacts, such as a pentest with its retest or a signer inventory read from the chain, to the provisions they answer, SOC 2 included.

The Digital Asset Assurance Pilot covers much of what SOC 2 leaves open:

An architecture assessment that covers custody and key ceremony.
A smart contract audit of the contracts in scope.
Offchain pentests of the consoles, APIs and signing services that can reach your keys.

Guardian’s own SOC 2 Type II is underway, with an auditor engaged.

Frequently Asked Questions

Is a SOC 2 report enough to trust a crypto custodian or exchange?

No. It shows that the controls in scope were designed, and for a Type 2 operated, as described. It does not test smart contract code. Ask what the description covers, and for audits, pentests and key management evidence alongside it.

Does SOC 2 cover smart contracts?

Not their logic. A SOC 2 can test the approval and change process around a deployment if it is in scope. Whether the code itself is correct is a question for a smart contract audit.

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 reports on the system description and the design of controls as of a specified date. A Type 2 adds an opinion on whether those controls operated effectively throughout a specified period.

What is a carve-out in a SOC 2 report?

A method that excludes a vendor, such as a cloud or wallet provider, from the report. Its controls are described but not tested, so you need that vendor’s own report to cover it.

Sources

Cover what your SOC 2 leaves out

Guardian tests the contracts, keys and signing services a SOC 2 rarely reaches, and hands your CPA and your buyers evidence they can trace.

Talk to Guardian Explore the assurance pilot