Stablecoin reserves and attestations explained

What are stablecoin reserves?

A fiat-backed stablecoin is only as good as the pile of assets behind it. When a customer redeems tokens, the issuer pays out of those reserves. Three questions decide whether they are enough:

• Size: are reserves at least equal to tokens outstanding?
• Quality: can they be turned into cash quickly without loss? Cash and Treasury bills that mature in weeks qualify; long bonds, loans or crypto are riskier.
• Location: are they held apart from the issuer's own money, at institutions that will not freeze them?

Regulators now write these questions into rules. New York's financial regulator, in 2022 guidance, requires reserves worth at least the face value of all tokens at the end of every business day, limits them to short-term Treasuries, Treasury-backed reverse repos, and capped amounts of government money market funds and insured deposits, and requires them to be segregated from the issuer's own assets. The US GENIUS Act sets a similar one-to-one list nationally; see the GENIUS Act explained.

How is an attestation different from an audit?

Accountants offer several kinds of report, and stablecoin marketing does not always say which one it has. The table sets out the main differences.

The criteria matter. In March 2025 the American Institute of CPAs published 2025 Criteria for Stablecoin Reporting for asset-backed, fiat-pegged tokens, which lets issuers present tokens outstanding and the assets available to redeem them, and lets accountants attest to that presentation. Circle says its monthly USDC reports follow AICPA attestation standards. Tether's reports have used ISAE 3000, an international assurance standard; BDO Italia's opinion on Tether's September 2025 figures says the report is not the company's financial statements.

Why did regulators warn about proof-of-reserve reports?

Some crypto firms publish "proof of reserves" reports to reassure customers. In March 2023 the US Public Company Accounting Oversight Board (PCAOB), which oversees auditors of public companies, issued an investor advisory. Its points apply to any reserve snapshot:

• Such engagements are not audits and are not done under PCAOB auditing standards.
• They describe a single moment and say nothing about whether assets were later moved, lent or frozen.
• They may not look at liabilities, or at whether the assets were borrowed for the day.
• They give no assurance on internal controls or governance, and there are no uniform standards.

History shows why this matters. In October 2021 the CFTC fined Tether $41 million. It found that, while Tether claimed every token was backed by dollars, it had enough fiat reserves on only 27.6% of days in a 26-month sample from 2016 to 2018, and had kept some reserves with unregulated parties and in non-fiat products.

What do new US rules require?

The GENIUS Act, signed in July 2025, turns several of these checks into law for US payment stablecoin issuers. According to the House Financial Services Committee's section-by-section summary, issuers must:

1. Hold one-to-one reserves in US currency, insured deposits, short-term Treasuries, short-term repos and reverse repos, or money market funds.

2. Publish reserve composition monthly on their website.

3. Have those reports examined monthly by an independent registered public accounting firm.

4. Certify the reports: the CEO and CFO sign monthly certifications to the regulator.

5. Get a full audit if large: issuers above $50 billion outstanding need annual audited financial statements.

The Act takes effect at the earlier of 18 months after enactment or 120 days after regulators issue final rules, so practice is still catching up. In the EU, stablecoin issuers fall under MiCA; see MiCA explained.

How should you read a reserve report?

A five-minute read of any report answers most of the questions above. Check the report date, the accounting firm and the standard used, whether reserves exceed tokens outstanding, what the reserves are made of, and whether any of them are loans, long-dated bonds or crypto. Then compare the date with today: a quarterly snapshot can be three months old.

Tether's Q2 2026 report, for example, lists about $187.75 billion of assets against about $183.64 billion of liabilities as of 30 June 2026. We walk through it alongside Circle's reports in USDT vs USDC.

What mistakes do readers make with stablecoin attestations?

• Calling an attestation an audit. It checks a specific statement; an audit covers the whole company.
• Ignoring the date. A report on 30 June says little about 30 September.
• Looking only at the total. A 2% buffer can vanish if part of the reserves is risky.
• Skipping the liabilities. Reserves mean little without knowing what the issuer owes.
• Trusting a logo. Check the firm's name in the actual report and the standard it used.