Professional Standards
How the Work Is Performed
Statutes say an attestation must happen; professional standards say what an attestation is. This page covers the standards layer: the engagement the U.S. framework requires, the criteria written for it, the assurance levels a reader has to tell apart, and the limits of what any reserve report can establish. Descriptive throughout — the standards themselves control.
The examination engagement (AT-C 205)
An examination under AT-C section 205 of the AICPA's attestation standards is the highest-assurance engagement in the attestation family. The practitioner plans and performs procedures to obtain reasonable assurance, then expresses an opinion on whether the subject matter — or management's assertion about it — is fairly stated, in all material respects, against identified criteria. Three parts of that sentence carry the weight: reasonable assurance (high, not absolute), opinion (an affirmative conclusion, not just findings), and criteria (the benchmark the opinion measures against, which the report must identify).
For reserve engagements, the subject matter is typically an issuer's assertion that reserves equaled or exceeded outstanding tokens at a stated instant, presented in a stated composition. The GENIUS Act requires this examination-level engagement monthly, performed by a PCAOB-registered public accounting firm, with executive certification of the underlying reserve reports.
— AICPA Statements on Standards for Attestation Engagements, AT-C § 205; GENIUS Act § 4(a)(10), Pub. L. 119-27 · GENIUS Act, S. 1582 (Congress.gov) · retrieved 2026-08-29
The criteria written for this work
An examination needs suitable criteria, and the AICPA has published them for this domain: the 2025 Criteria for Stablecoin Reporting: Specific to Asset-Backed Fiat-Pegged Tokens. Part I establishes presentation and disclosure criteria — consistent reporting on tokens outstanding and the assets backing them, including token population, reserve composition, redemption terms, custody arrangements, and risks affecting redeemability. Part II, added in early 2026, covers controls supporting token operations: the token lifecycle, reserve asset management, vendor oversight, and information technology.
The criteria are designed to meet the standards' definition of suitable criteria for reasonable-assurance examinations, and the AICPA has urged the OCC to leverage them in the GENIUS Act rulemaking. Why criteria authorship matters to a reader: a report against published standards-body criteria and a report against criteria the issuer's own management defined are both permitted engagements — but they answer different questions, and the criteria section of any report is where that difference lives.
— AICPA 2025 Criteria for Stablecoin Reporting, Parts I–II · AICPA & CIMA: Stablecoin Reporting Criteria · retrieved 2026-08-29
— AICPA comment to the OCC (May 2026) · AICPA & CIMA news release · retrieved 2026-08-29
Examination, review, agreed-upon procedures
The attestation family has three engagement types, and they license different sentences afterward:
| Engagement | Standard | Assurance | The report ends in |
|---|---|---|---|
| Examination | AT-C 205 / ISAE 3000 (reasonable) | Reasonable | An opinion that the subject matter is fairly stated against the criteria |
| Review | AT-C 210 / ISAE 3000 (limited) | Limited | A negative-form conclusion: nothing came to attention indicating material misstatement |
| Agreed-upon procedures | AT-C 215 / ISRS 4400 | None expressed | Factual findings from the agreed procedures — no opinion, no conclusion |
All three get called "attestations" in ordinary usage, and none of them is an audit — an audit covers historical financial statements in their entirety under auditing standards, a different engagement with a different scope. A report's title does not settle which engagement produced it; the presence or absence of an opinion paragraph does. Reading that paragraph, and the criteria section next to it, is the fastest reliable way to know what a reserve report is actually saying.
— AT-C §§ 205, 210, 215; ISAE 3000 (Revised); ISRS 4400 · Glossary: engagement types · retrieved 2026-08-29
What a reserve report does — and does not — establish
Performed well, a reserve examination establishes that reserve assets existed, in the stated composition, at the stated moment, measured against identified criteria, with an independent practitioner's opinion behind the statement. That is a real and valuable property.
It does not, by itself, establish that the assets are liquid enough to meet a redemption wave, that they could be sold at their marked values, that the liability side is complete, that the holder has an enforceable legal claim on the specific assets, or anything about any moment other than the snapshot instant. Point-in-time backing, criteria-bounded measurement, and snapshot timing are limits inherent to the engagement — which is why the statutes layer redemption rights, custody segregation, and bankruptcy remoteness on top of the attestation requirement rather than relying on it alone. A reader who wants the full picture reads the report's opinion paragraph, its criteria section, and the statute's structural protections together.
— AT-C § 205 (engagement scope); GENIUS Act §§ 4, 11 (structural protections) · Public Law 119-27 (GovInfo) · retrieved 2026-08-29
Descriptive reference; not professional advice and not an assurance opinion. The standards and instruments cited control. See the legislative map for what each framework requires and the glossary for term definitions.