Cryptocurrency Exchange & Custody Auditing Flashcards
6 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Cryptocurrency Exchange & Custody Auditing flashcards as text
Which U.S. regulatory framework most directly governs the custody of cryptocurrency assets for institutional investors?
Answer: SEC Qualified Custodian requirements under the Investment Advisers Act
The SEC's Qualified Custodian rules under the Investment Advisers Act require registered investment advisers to hold client assets with a qualified custodian, directly governing institutional crypto custody arrangements.
An auditor is reviewing an exchange's key generation ceremony. Which finding would be the most significant control deficiency?
Answer: Private keys were generated on an internet-connected machine
Generating private keys on an internet-connected machine exposes them to potential remote compromise at the most critical moment — the point of creation.
What does a 'travel rule' compliance audit at a cryptocurrency exchange primarily examine?
Answer: Whether required originator and beneficiary information is transmitted with qualifying virtual asset transfers
The FATF Travel Rule requires Virtual Asset Service Providers (VASPs) to pass along originator and beneficiary identifying information with transfers above a threshold, and compliance audits verify this data is being collected and transmitted.
An exchange audit finds that the exchange has no formal incident response plan for a private key compromise event. Under which risk category should this finding be classified?
Answer: Operational risk
The absence of a private key compromise incident response plan is an operational risk, as it represents a gap in internal processes and controls that could lead to financial loss from a security event.
When auditing withdrawal controls at a cryptocurrency exchange, which practice best mitigates the risk of insider theft?
Answer: Requiring multi-party approval and time-delayed execution for large withdrawals
Multi-party approval combined with time delays for large withdrawals ensures that no single insider can immediately move large sums, providing both detection opportunity and a second authorization layer.
Which blockchain-specific audit evidence is most useful for verifying the completeness of reported exchange deposit activity?
Answer: On-chain transaction history of all known exchange deposit wallet addresses
The immutable on-chain transaction history of deposit addresses provides a complete, independently verifiable record of every deposit received, making it the most reliable source for completeness testing.