On The Brink with Castle Island - Greg Genega (KPMG) on Crypto Auditing (EP.634)

Episode Date: June 18, 2025

Wyatt is joined by Greg Genega, Digital Asset and Blockchain leader at KPMG, for a conversation on the state of crypto auditing. In this episode:  How KPMG works with crypto companies and protocols Relevant new innovations in the crypto space What to look out for as a new founder

Wyatt here, and on today's episode of On the Brink, I was joined by Greg Janega of KPMG. Greg discussed the firm's extensive involvement in the industry and the work they continue to do with companies in the space. Without further ado, I hope you enjoy my conversation with Greg. Matt Walsh and Nick Carter are partners at Castle Island Ventures. All of these expressed by them or the guests on this podcast are solely their opinions and do not reflect the opinions of Castle Island Ventures. Guests and host may maintain positions in the assets discussed in this podcast. You should not treat any opinion expressed by anyone on this podcast as a specific inducement

to make a particular investment or follow a particular strategy, but only as an expression of their personal opinion. This podcast is for informational purposes only. Brought down by bad mortgage investments, Lehman, which has 25,000 employees, will be liquidated. The federal government loans American International Group, AIG, $85 billion. This is a different kind of market, and the Fed is asleep. The federal government is stepping it to stabilize Fannie Mae and Freddie Mac, the two mortgage giants that have been threatened by the housing crisis. The Bank of England has pumped 75 billion pounds more to British.

and Zaling Economy with a new round of quantitative easing. You print a couple trillion dollars and all of a sudden people started to worry. So out of this worry, we have something called the Bitcoin. Greg Janega from KPMG, thank you for joining us on the podcast today. Thanks for having me. Glad to be here. I'd love to kick off before diving in with personal background. If you don't mind, tell us a bit more about yourself and what you're up to these days. Well, first and foremost, I'm an avid fan and listener of On the Brink and very excited to be with you today.

Thank you. I have to do the disclaimer. Thoughts and opinions I expressed with you today are my own and not representative of KPMG's views more broadly as a firm. Nothing I say today should be considered financial, tax, audit, accounting, or legal advice. We did ours in the intro, so now we're even. There you go. We're good. So your question in terms of how I personally became interested in crypto. So my entire 20-year career has always been in IT technology, servers, secure, networks, data center infrastructure, etc. So I've always been a techie at heart. Then about nine years ago, I got really into personal investing and did a lot to educate myself, write a lot of books, came across the concept of diversification and alternative assets, and somehow I stumbled upon Bitcoin.

I actually don't remember exactly where. And at first, like many others, I didn't really understand it. So I went deep down that rabbit hole, kept asking why. Next thing you know, I'm teaching myself about the merits of Austrian economics. economics and like many others who go so deep, they basically never come out of that rabbit hole and they're hooked for life. This was exacerbated in 2020 during DeFi summer with the magic of interacting with protocols like AVE and Uniswap. And eventually I made the switch to work full-time in crypto almost exactly three years ago when I joined KPMD in their innovation

function as a technical blockchain subject matter expert. So you had a deep interest in crypto and joined KPMG on the back of that interest, to be clear. Exactly. And can you speak to KPMG's history of being active in the crypto space over that time window and beyond? Actually, as far back as 2017, KPMG became one of the first public accounting firms to audit digital assets held by public companies. We pioneered tools and methodologies for digital asset audits, including becoming a founding member of the AICPA's digital assets working group.

And that went to overdrive in 2020 when a large audit client originated the Bitcoin Treasury strategy, and we have served them every step of the way since then. And that opened the floodgates. We onboarded many clients in the crypto space in the years following that. Funds, ETF issuers, infrastructure companies, Bitcoin miners, a major stablecoin issuer, and some of the largest operators of Ethereum and Salamma validators, and many more. You touched on a lot of interesting topics. Obviously, the reserve strategy is topical. In that respect today, how are you in the firm involved in the industry? And feel free to take that any direction that makes sense. Obviously, you've touched on a number of interesting categories.

Well, we've been quite busy. So we work closely with regulatory and standard setting entities, such as the AICPA, FASB, the SEC, etc., where we discussed the digital asset landscape. We became one of the first approved firms to provide attestation services to the node operator a Risk Standard Industry Forum, and we were actually looking into other types of crypto industry standards engagements as well. We've done deal advisory work for some of the largest M&A activities you've seen over the last year in the crypto space. We've completed risk assessment work for a major payments company launching a stable coin, compliance work for some of the spot ETFs, and we recently started issuing examination reports for issued stable coins and their related reserves as of a few

months ago. This is on top of the fact that we continue to invest in our tools and our technology processes, specifically our patented and proprietary chain fusion tool, which allows us to utilize on-chain data in audit evidence. There's a structured and managed approach that's needed when dealing with on-chain data in audits, and that is where our tool chain fusion comes in. That's quite a scope. I think a lot of people can get lost in the types of activity that everyone sees in the scheme of crypto companies being investment in payments, but you forget about all the other needs there. What sorts of firms are you working with when it comes to C-5, D-5 funds? You have a lot of structures in the ecosystem. So really all kinds of firms and sizes. And we've done from billion

dollar funds and billion-dollar acquisitions all the way down to helping small Dow's with some tax work related to their tokens. So we've done complicated tax works and tax work involving chain mergers, token migrations, protocol upgrades, and other types of on-chain M&A work. At the end of the day, there are a variety of regulatory and legal needs to operate companies and participate in certain transactions in the United States, whether it's folks needing help with tax or audit, or they need help with their money transmitter licenses, building out risk controls, sock reports, AML KYC programs, applying for bank charters, IP ownership and transfer issues, or other matters.

That's interesting, especially in the scope of DAOs, I think we've seen the playbook being written in terms of how DAO should operate in real time. If you're able to share, what's an interesting story or engagement you've had with a DAO or protocol? Let's think. Interesting story with a DAO or protocol. Well, one fun example was actually a tax engagement we did for a few venture capital funds when DYDX, a popular perpetuals platform, was migrating from Ethereum to Cosmos. that could have had some pretty large tax consequences if not managed properly. So we did some work to help that. These migrations are going to be interesting for you guys and for everyone beyond

who is involved in those activities. How do you view the broader stack of services for crypto firms? I imagine that the clients that you're working with, they work with a host of other participants in other parts of the industry. So obviously they need financial audits. They also need smart contract audits. there's traditional cybersecurity. Where do you guys see yourself sitting and how does your role evolve in the industry's

progression? The question. So for one thing, I'd say when an independent public accounting firm uses the term audit, it has a very specific definition and it doesn't always align with what the crypto industry calls an audit in the terms of something like a smart contract audit, as you mentioned. So we're definitely quite involved in the cybersecurity space more broadly as a firm, things like traditional pen testing and vulnerability assessments, governance engagements with actually Gen AI governance being a really hot one these days. I'd say the closest type of

engagement we do that overlaps cybersecurity and crypto revolves maybe around private key and custody management, things like assessing or advising on key custody, key ceremonies. Regarding smart contract analysis, we occasionally do those types of activities for certain audit procedures for firms, for example, that recognize material revenue from smart contracts. There's also a level of smart contract analysis that is required in order for us to perform examinations for issued stable coins and related reserves, like I mentioned before. That being said, we've done the risk and opportunity analysis and providing things like external smart contract attestations. It's a service we haven't invested in to date, but maybe one day.

That's a nice segue since it sounds like there are a lot of ways that you're acting with the firms you work with. How is the attitude towards auditing of crypto firms you've engaged with evolved? Well, audits are imperative for responsible capital formation in U.S. markets, and these crypto firms know that they owe it to their investors and stakeholders to provide financial statements that can be relied on and that they have internal controls over financial reporting that operates effectively for them. So we're in the business of providing high quality audits that comply with our professional standards that stand the test of time. And we perform a robust client acceptance process for all new audit clients, not just crypto companies.

As I mentioned earlier, we're proud to provide audit services to many of the leading companies in the industry, and we're keen to work with many more. So our services to the crypto industry will continue to evolve as the industry evolves and the legal and regulatory picture becomes increasingly clearer. And maybe touch on that with a little bit more depth. How is your firm and the crypto-facing audit industry evolved to date? At saying our firm has evolved because our clients needs change over time, and as do the regulations. The technology gets more advanced, new chains, and L2s are popping up all the time that our clients are engaging with. So we need to make sure that we're adapting alongside that. Another great example is that regulation is evolving.

The Genius Act, for example, if it makes it all the way into signed law, that requires monthly attestations by public accounting firms for dollar-pegged payment staple coins. And we're ahead of the game on that, And it's because of how active we are both with listening to our client's needs, as well as engaging with entity such as the AICPA. And what's been the AICPA's approach towards crypto, both in the past and fast forward to today? I'd say that AICPA deserves a ton of credit for its efforts to advance the conversation and provide guidance on accounting and auditing matters that affect the crypto industry more broadly.

Back in 2018, the AICPA launched the first annual blockchain and accounting symposium, convening blockchain and digital assets subject matter experts from CPA firms, technology companies, and consulting entities. The AICPA also established its digital assets working group in 2019 to develop an accounting and auditing guides in the digital assets area. It's a realm that we've been involved with. It's published a popular practice aid on accounting for an auditing of digital assets, and they've hosted a series of webcast.

And then on the attestation side, actually just a couple months ago back in March, The AICPA published the 2025 criteria for Stablecoin reporting, specific to asset-backed Fiat-Peged tokens, which provides a common framework for stablecoin issuers to disclose information about outstanding stable coins and the availability of assets backing them. Also, the AICPA is working on developing criteria for controls supporting stablecoin operations as well. So they've been a lot. They've always been very curious and very easy to work with. Yeah, it's great to hear about the Stablecoin focus. You touch on innovation a little bit. Do you feel that currently you and the firm are able to keep pace with the innovation that we've

seen in the space? There's a lot happening every day, obviously. And do you think the technologies and systems in place to analyze the range of what you see in the market are there? Definitely. I would say we know what it takes to serve market leaders and continue to make significant investments in tools, data, and human capital to serve our clients. Our clients are always engaging in new chains, more complex transactions, DFI, and as a result, our processes, tools, and technologies, they're constantly expanding. There are always going to be new chains and new fields you need to be on top of. How has your work with crypto companies evolved in the face of regulatory shifts that we've seen?

So one way our work evolves is when new guidance is issued, for example, from entities such as FASB or the SEC. So when there are a new standard set, both our clients and our cells have to stay on top of that to verify if our clients are compliant with those new requirements. We also monitor other regulatory shifts closely and the impact both how we think about client acceptance as well as risk assessment and other audit procedures we perform with our clients. Are you seeing an uptick in crypto-related needs for your more traditional clients speaking on the clients? You mentioned earlier, you're seeing incorporation of stable coins, treasury strategies

or Bitcoin holdings. How is that impacting what you're being asked for from your traditional clients? Great question. So I definitely say there's an uptick in curiosity. and enthusiasm across the board. Part of my job is to provide insights to our many audit clients, even those that are not native to the crypto industry, about what disruptors we're seeing in technology and the corporate finance function more broadly. So I've been talking to CFOs, CFOs, CFOs, controllers, tax directors, etc.,

for years about the developments, implications, and benefits of blockchain technology with a big focus on stable coins. So one example of that, how the largest ERP platforms are in corporates, operating stable coins, how the world's leading payments providers are leading into stable coins. It's really starting to click for people as an option they should consider for payments and cross-border remittances. As you might guess, the largest amount of active interest is coming from the FinTech, asset management, and banking industries. So there's definitely been major moves of some of these entities have already made in the space, but I expect the big unlock

is going to come when there is fully legislated stable coin and market structure laws. Banks are very risk-averse just like us, just like public accounting firms, and many are still waiting to see what happens with advancing legislation. All of that being said, while we are definitely seeing a large increase in activity, I'd still say most of our traditional clients have not meaningfully engaged in the ecosystem yet. And as the old adage goes, we're still early. Yeah, we're still early. How have attitudes evolved in this respect? Because I probably imagine that the actual strategic moves to integrating crypto workflows don't mirror where the attitude stand. There's usually a lag there. Are you seeing attitudes evolving in that respect among those traditional clients,

or do you still see a post-FTX creator of sorts? Do people view stablecoins marketly different from crypto these days, speaking of stable coins? So I find that people don't know what they don't know. When we schedule these sessions with our many audit clients to see what topics they want to hear about, blockchain and crypto and digital assets, it's generally not high on that list. But when we do make our way into talking about it, it's always one of the best received topics. And again, they just don't know what they don't know. Regarding what you mentioned about that post-FTX creator there, I'd say we're almost fully past the post-FTX at this point where it would really put a damper on the attitude towards

blockchain for a while. Even during that really grueling bearer market, we actually continue to invest in our capabilities because we believe in the promise and ethos of the technology along with our clients. we didn't abandon them during all of that and they didn't abandon us and growth across the board is picking up, and interest again is picking up especially with the regulatory changes here. Regarding how people differentiate and conflate crypto to blockchain, to Bitcoin, to stablecoins, we still have a long ways to go, I'd say, before the masses are educated on those nuances, but it is heading in the right direction.

That's good to hear about the subject matter interest when you guys are touching on that. What are the blockers or potential unlocks to some of those parties that you mentioned to launching crypto-powered products or workflows? Especially for more of the traditional companies, first they would need a real business need. So what does crypto or blockchain solve for them? Most eyes are on efficiencies gain through disintermediation of the transfer of assets. And I'd say most large entities in the asset management area are actively looking at this narrative of real-world asset tokenization.

It's also hard to ignore everything that the payments giants are doing in this space and how that could innovate on settlement and payments. Very cool. When it comes to these use cases, payments being a chief one, how do you feel about permission versus public blockchains? Yeah, I get that question a lot. So this is definitely a Greg opinion, not necessarily a firm opinion here. So I want to be sure to clarify that. But I personally believe there are a lot of powerful attributes that are inherent in blockchain technology. But I think the most important attribute that gives these systems value is censorship resistance.

With public blockchains, the fact that all you need is an internet connection and you have access to a global financial system with no biases and no counterparty risk, that's a very powerful and valuable thing. Public blockchains, I feel, are effectively public goods. And when you talk about permission blockchains, you're effectively removing that very key attribute of censorship resistance right out of the gate. And maybe that calls it to question the value proposition of the system compared to a traditional centralized system based on your typical servers, databases, APIs, etc. Now, that being said, there are some popular permission to blockchains used by some of the world's largest banks and asset managers that I would actually say are a resounding success,

and I would agree they're providing an important and valuable service. But I think this was because a result of regulatory entities historically calling into question if public blockchains instills safety and sound as concerns in the banking sector. You take that and combine with the fact that it's also really difficult and expensive to create a new system of network, servers, databases, to execute financial transactions across. And the software underpinning the Ethereum blockchain, that's tried, true and tested for executing low settlement financial transactions. And since that software can be effectively copy, fit for purpose, and ran in a permission environment, that might be a much easier, less complicated option than creating a parallel and alternate

financial system that you have to get industry players to agree on. So long story short, I think they both have a time in place depending on the facts and circumstances, but public blockchains are resoundingly more imperative systems. Yeah, it's a great point. It's not easy to stand up a blockchain, both to get it working and then to actually get the flywheel going. I think that's a lot of why you see these token incentive methods employed. Granted, it's potentially different scope since, like you said, that was maybe a personal view, but how does this impact your guy's job? KPMG's role, the permission versus public blockchain dichotomy.

Well, auditing ledgers is our thing. Permission to our public. They have different tradeoffs and efficiencies and how we audit them. They have slightly different processes that we might utilize, but they're structured pretty well. And for the public chains, we have our proprietary set of tools for that. And even for the permission chains, we always have a way to get and correlate that data and their internal controls and such. And in a similar vein, how about when it comes to permissioned or KYC'd assets on chain versus

permissionlessly transferable ones? I like where you're heading with this question. So we're actually seeing a lot of recent innovations more broadly in the crypto space, such as with uniswob v4 transfer hooks and Solana token extensions as part of the token 2022 standard. So for those that don't know, these are effectively smart contracts. that exist on public permissionless chains that allow for KYC processes and procedures that won't need to comply with before something like a transfer function or any smart contract can be called on that asset.

And I think that's a super elegant way to address KIC concerns while still keeping that base settlement layer of a public blockchain permission list. And on top of this, there's also a lot of ZK or zero knowledge-based proofs that can be combined with these methods to instill more privacy alongside those KOC controls. So as the value of tokenization and tokenized real world assets keeps growing, I think these advancements are a really logical place to build those solutions upon. Yeah, it's exciting to see crypto become somewhat natively compliant, having those technologies in place to just make these transfers more comfortable for real institutional grade users.

Are there any frequent flags that come up when specifically auditing crypto companies or anything to highlight in that regard? I don't know if I would necessarily characterize these as flags, but I could think of a few issues that we think are important to work through. So how a client is able to demonstrate existence and rights to digital assets when they are held with a third party, particularly when the third party does not have something like a sock report that provides assurance over its internal controls. That's a really important issue to work through. Also, the client's own internal controls over financial reporting, particularly those that address the completeness and accuracy of financial

information, related party transactions, particularly given the pseudonymous nature, of many blockchains. And of course, we always see the company that has too many spreadsheets. I have a colleague that I said before that often the digital assets aren't the riski as part of the audit, but rather a client's use of spreadsheets because of all the things that can go wrong with them without robust controls. That makes sense. I buy it 100%. Greg, it's been great learning about you and the firm's involvement in thoughtful directions. In closing, I want to ask, what guidance would you give to founders just getting started, building crypto businesses.

Early on, I'd say most of the focus needs to be on building something that has product market fit, something where you're providing a product or service that others find valuable and worth paying for. And once you have that idea, maybe a prototype, MVP, et cetera, then I think it's important that companies start thinking real early about the various challenges they can run into that could threaten their business, hinder growth, or instill too much risk. I think companies should be sure to document everything that they can. in a secure fashion, focus on things like sock-ready IT security, bulletproof KYC and AML

processes and sanctions controls, and of course, don't cheap out on private key control and custody. So the earlier that companies can start thinking about these things, the easier it's going to get down the line when they become a larger focus as a scalar business. We'll leave it there. Well, Greg, thank you for coming on and sharing you and the firm's insights. It's been great to hear about it. Yeah, it's been a pleasure. Thanks so much for having me.

I appreciate us for fun. Thanks for listening to another episode of On the Brink with Castle Island. To find out more about Castle Island, visit castle island.Vicc. To listen to all of our podcast episodes, please go to On the Brink dashpodcast.com or just click on the tab in our website. Thanks for listening.