How to verify a stablecoin claim and custody arrangement

What to take away

This is a reading exercise, not investment advice. It does not predict price, promise redemption, or replace a lawyer, an accountant or a tax professional.

Fix the asset identity first

Start with the contract address, not the ticker. Two tokens can share a symbol, and a fake one usually carries the same name as the real one.

In practice you will most often be checking one of four assets: USDC, issued by Circle; USDT, issued by Tether; PYUSD, issued by Paxos Trust Company for PayPal; and Dai, issued by Sky, formerly MakerDAO. Each issuer publishes its own contract addresses. A token carrying one of those names on a network the issuer does not list is a different token wearing the same label.

Take the contract from the issuer's verified documentation and compare it against the wallet or exchange listing. A ticker is a label, not an identifier.

For an Ethereum-based token the address should match on the issuer's page and on a public block explorer such as Etherscan, which also shows when the contract was deployed and what functions it exposes. If the two addresses differ, stop and treat the holding as unverified.

Find out what you actually hold

The terms tell you whether you have a direct claim on the issuer or a claim on a platform's ledger. Those are different things when something goes wrong.

Ask what the issuer is licensed as, because that is what the claim rests on. In the United States, the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act) sets a federal framework for payment stablecoin issuers and provides a state or federal supervisory pathway, while money transmission itself is licensed state by state. New York requires a NYDFS BitLicense to conduct virtual currency business with New Yorkers, and in the European Union issuers of asset-referenced and e-money tokens fall under MiCA. A peg tells you the price; the licence tells you who can be held to the claim.

Look for who may redeem, whether an account and identity review is required, and whether retail holders can redeem directly. Check minimums and maximums, the currency and bank locations supported, and whether the issuer can suspend, delay, freeze or refuse a redemption. Note the governing law and forum for disputes, and how holders are treated if the issuer fails.

Holding a token on a platform often creates a claim against that platform's internal ledger rather than a direct relationship with the issuer.

Read the reserve report for what it omits

Capture the report date, the outstanding supply, the reserve total, and the asset classes. Capture the maturities, the custodians, the valuation basis, and the examiner. Capture the management signers.

The report should name three things: the accounting firm that signed it, the standard the firm applied, and the custodian holding the reserves. Circle, Tether and Paxos each publish their current report on their own site, so you can pull the document instead of a screenshot. The signing firm is named on the cover — Deloitte for Circle's reports, BDO for Tether's. If the firm, the standard or the custodian is missing, record it as unresolved instead of assuming the arrangement is sound.

Then run the arithmetic yourself:

Reported reserve value / reported token liability

A ratio above one answers very little. It does not tell you about liquidity, encumbrance, whether the issuer can actually reach the assets on a Friday afternoon, or liabilities sitting outside the report's scope.

Tell an attestation from an audit

Accountant-signed documents are not interchangeable. Identify which one you are reading.

The engagement types are defined by the standards the firm works under. Under the AICPA attestation standards, AT-C 205 covers an examination, AT-C 210 covers a review and AT-C 215 covers an agreed-upon procedures engagement. Internationally, the general counterpart is ISAE 3000. Controls at a service organization such as a custodian are reported under ISAE 3402 or, in the United States, as a SOC 1 or SOC 2 report. An examination ends in an opinion, a review gives limited assurance, and agreed-upon procedures gives no opinion at all, only the procedures the parties agreed on and the factual findings.

Read the subject matter, the criteria, the date, the exclusions and the opinion. The opinion is where the limits are stated.

Map the custody chain

The 2025 interagency crypto-asset safekeeping statement, issued by the Office of the Comptroller of the Currency, the Federal Reserve and the FDIC, sets out the categories bank examiners look at:

Draw two chains and keep them separate.

Issuer -> reserve custodian -> reserve account

Holder -> wallet or platform -> key custodian -> sub-custodian -> network address

The company holding the reserves and the company holding the keys are frequently not the same. Ask about both.

Ask who can move the money

For third-party custody, work through the controls. Who generates and stores the keys? Are assets held in omnibus addresses or separate ones? How are customer entitlements recorded?

The names you are most likely to meet are licensed trust companies. Coinbase Custody Trust Company is chartered by the New York Department of Financial Services, BitGo Trust Company is chartered in South Dakota, and Anchorage Digital Bank holds a national trust bank charter from the OCC. Each is a separate legal entity from the exchange or app in front of it, and the entity named in your terms is the one to look up.

What approvals are needed to sign a withdrawal, and which staff or systems can change a destination address? How are backups protected and tested?

Is a sub-custodian involved, and what happens during a key compromise? Can the provider show a complete reconciliation of assets to customers?

For self-custody, document several key details. These include where the device came from and how you verified the software. Also record your backup method and a recovery test you have actually run. Finally, note your signing review and your inheritance plan. Write none of the secret itself into that file.

Test the redemption path

Build a worked example of a direct redemption and fill in what the terms actually say.

Field	Finding

The fields worth filling are the ones the terms actually answer:

If you cannot redeem directly, record the secondary-market exit instead. Selling on an exchange is not issuer redemption, and the price you get is set by whoever is buying.

Check the transfer controls

Confirm the platform supports the exact contract on the exact network. USDC, USDT and PYUSD each exist on more than one chain, including Ethereum and Solana, and each chain has its own contract address. Two networks can carry a token with the same name and no bridge between them.

Check address allowlists, time locks, multifactor controls, and memo requirements. Also check how the fee is calculated, the confirmation count, and manual review for withdrawals.

Send a small test amount first where that is reasonable, and confirm the recipient has credited it before sending the rest. Malware can swap an address after you copy it, so read the full destination on the signing device or a trusted display.

List the administrative powers

Find out whether these actors can do any of the following:

On the largest tokens these powers are not theoretical. The USDC and USDT contracts include blacklist functions, and Circle and Tether have both frozen addresses. Read the contract's published function list or the issuer's documentation and note which of these powers the token you hold actually has.

These powers exist for compliance and incident response. They also concentrate control in whoever holds them. Identify that party and the approval process behind each power.

Write a dated conclusion

Summarize what you verified, what remains unresolved, the date on every source, and the conditions that would make you stop.

Do not treat an intact peg as a conclusion. Stop if the contract identity, the issuer, the redemption path, the reserve scope, the custodian or the key control is still materially unclear.

Common questions

Is an attestation the same as an audit?

No. They are different engagements with different levels of work behind them. Read the engagement type, the criteria, the scope, the date and the opinion before you rely on the document.

Can every holder redeem directly with the issuer?

No. Eligibility, onboarding, minimums, jurisdiction and the channel you hold through can all restrict direct redemption. If you cannot redeem, your exit is the secondary market.

Does self-custody remove counterparty risk?

No. It removes the platform from the chain, but issuer, contract, network, bridge and market risks all remain. You have changed who you depend on, not whether you depend on anyone.

Should I photograph my seed phrase for the file?

No. Never put recovery secrets into ordinary evidence files or cloud photo storage. Keep the verification record and the secret completely apart.