Stablecoin Attestation Scorecard

What the matrix says

The regulatory map already exists: seven jurisdictions with live stablecoin frameworks, each demanding independent verification on its own cadence under its own standard. What that map does not show is practice, and practice is where the differences live. This scorecard reads the published verification layer of nine tokens the way an examiner would read workpapers: who signed, under which standard, at what assurance level, over what subject matter, with which exclusions, how long after the fact, and whether the liability side of the peg is in scope at all. The method is inherited from the attestation research this site already carries: every cell is an observation with a quote and a dated source, or it is absent and says what was searched. Nothing is graded. Structure, not conduct.

The standard-shopping pattern

Two standards families dominate the filled cells, and the split is not random. Five of the seven dollar-token rows invoke “attestation standards established by the American Institute of Certified Public Accountants,” the AICPA family that includes AT-C 205 examinations: Circle, the three Paxos tokens, and First Digital, with Ripple's RLUSD citing the same family through its documentation. Tether stands alone on ISAE 3000 (Revised), the international assurance standard, with quarterly opinions whose file names carry the standard in the title. Neither choice is wrong, and that is the point: the choice is available. An issuer picks its practitioner, its standards family, and, within wide bounds, its criteria. Tether's opinion language, as surfaced verbatim in indexed text, says its reserves report is fairly presented “in accordance with the criteria, including Management's Key Accounting Policies, set out therein.” The criteria the opinion measures against are, in part, management's own. That is permitted by the standard, disclosed by the report, and invisible in every headline that says “attested.”

The jurisdictional mismatch cells make the shopping visible from the other side. First Digital is a Hong Kong issuer with a Hong Kong trust custodian, publishing under a United States standards family. Tether is an El Salvador issuer publishing under the international family. Circle operates under a French e-money license passported across the EU while its examinations run under AICPA standards. No regulator chose these pairings; issuers did, before most of the regimes existed, and the frameworks now arriving (the GENIUS Act's PCAOB-registered monthly examinations, MiCA's own audit demands) will collide with them rather than inherit them.

The scope-exclusion pattern

Every report type in the matrix is point-in-time, and several rows carry stated exclusions that reward reading. Tether's stream, per the indexed line-by-line coverage, separates assured financial figures from “certain additional notes” and “states that those notes are outside the assurance scope.” Paxos publishes, for PYUSD, two documents a month and says so plainly: an attestation, and a self-reported composition report about which its own page states “these reports have not been subjected to independent review.” The composition detail readers actually circulate is often the unexamined document. PAXG's bar-level allocation lookup, the most granular transparency artifact in the whole matrix, excludes by its own statement every token held through a custodial exchange, which is most of them. None of this is concealment; all of it is stated. The pattern is that the stated boundaries sit one click deeper than the claim, and the claim is what travels.

The lag distribution

Where both dates are stated, the distance between the as-of instant and publication runs about a month. Tether's most recent quarter: as of June 30, 2026, released July 31, 2026, a 31-day lag, both dates stated. First Digital's January 2026 report was released February 19, 2026. Paxos's timing is described in third-party coverage as two to three weeks after month-end, with no specific 2026 report dates surfacing in indexed text. Circle states its as-of instants to the minute (11:59 pm UTC, twice monthly) and, in everything indexed this session, nowhere states when the report itself was published, so its lag is unstatable from public text. RLUSD's February 27 figures appear in coverage dated March 31, about a month by press dates rather than by any stated schedule. A holder reading any of these reports is always reading the past, and in four of nine rows the size of the delay is itself not stated.

The honest floor, per report type

The framework work on this site keeps returning to one discipline: after reading the evidence, write the one sentence you can safely say, and the sentences you cannot. Applied to each report type in this matrix:

After an examination (Circle, the Paxos tokens, First Digital, at the dates evidenced): a practitioner tested management's assertion that reserves equaled or exceeded tokens at the stated instants and concluded it was fairly stated, in all material respects, against the report's criteria. You cannot say: anything about the days between instants, anything the criteria exclude, anything about custody control or encumbrance beyond what the criteria test, or anything about tomorrow.

After an ISAE 3000 reasonable-assurance report(Tether): the same sentence, with one addition worth saying aloud: the criteria include management's own key accounting policies, so the sentence is “fairly stated against the rules the report defines,” and reading those rules is part of reading the report. You cannot say “audited”; the issuer's own coverage of its separate KPMG engagement draws exactly that line.

After an AUP report (none evidenced in the current matrix, common in the wider registry): a practitioner performed the procedures management chose and reported findings. There is no opinion. The sentence you can say is only a list of procedures and results; any sentence containing “therefore” is yours, not the practitioner's.

After a self-reported or oracle-published figure(the PYUSD composition report by its own description, the BUIDL on-chain “attestations”): the issuer's systems published a number, and a delivery mechanism may guarantee the number arrived intact. Nobody outside the operator tested anything. The sentence you can say is about publication, not about backing.

After an annual fund audit (BUIDL's PwC appointment, OUSG's asserted audit): an auditor opined on financial statements for a period ended months ago. You cannot say anything about whether today's on-chain token supply corresponds to fund shares, and in neither bridge row does any indexed text state that any third party performs that reconciliation at all.

The three most uncomfortable cells

One: RLUSD's engagement type is absent. Ripple publishes monthly reports by a named practitioner under a named standards family, and nothing indexed states whether the engagement is an examination, a review, or agreed-upon procedures. Those are different assurance levels with different sentences a holder can say afterward, and for a token whose regulator lists it on a pre-approved greenlist, the level is the single most important fact about the report. It may be stated inside the PDF; it is stated nowhere a search index reaches.

Two: OUSG's auditor has no name in anything indexed. The fund states it is audited annually with results provided to investors. Its administrator is named, its daily reporting is described in detail, and the auditor, the party whose opinion the whole structure leans on, is unnamed in every page and article this compilation could reach. For the scorecard's method that is one absent cell; for a prospective holder it is the difference between evidence and reassurance.

Three: BUIDL's “attestations” are oracle publications. The word that means a practitioner's examination in every stablecoin row means, in the largest tokenized fund's row, data published on-chain by oracle infrastructure: valuation, composition, custody, and freshness, per the announcement's own list. The fund has a real auditor for a real annual audit; the daily artifact carrying the assurance-flavored name has no practitioner behind it, and no indexed text states that anyone reconciles token supply to share records. Two evidence regimes, one vocabulary.

Did any scope narrow year over year?

No narrowing was verified. One third-party profile claims Paxos “no longer proactively provides monthly reserve reports for USDP”; no issuer-language text confirms it, so the matrix records it as an unresolved conflict rather than a finding. What the year actually shows is churn at the practitioner layer and one genuine widening: Paxos moved from WithumSmith+Brown to KPMG at a stated February 28, 2025 boundary across all three tokens; Ripple moved RLUSD to Deloitte at the August 2025 report, with the predecessor never named in anything indexed; and Tether added a first full financial-statement audit, KPMG US over FY2025 with an unqualified opinion, alongside its continuing quarterly ISAE stream, while coverage noted its excess reserves halved “as disclosure standards shift.” More assurance and less comparability arrived in the same twelve months.

What this version cannot see

This compilation was produced from an environment whose network blocks issuer domains, so no primary PDF was opened; every filled cell is an indexed-text observation, and the schema records that channel on every field. That limitation cut in one direction: wherever a fact would only exist inside the document, the cell is absent rather than recalled from memory, which is why a matrix about attestation reports contains nine absences including two of its most load-bearing cells. Version 1.1 is the same schema with the documents opened. The registry on this site and the assurance-gap analysis in the missing-layer article carry the wider dataset this scorecard now gives a practice layer to.

Independent work, not affiliated with, sponsored by, or endorsed by any employer. Informational only; not financial, tax, or professional advice, and not an assurance conclusion. No statement here asserts wrongdoing by any named firm; the subject is the structure of published evidence, not conduct.