Attestation requirements

(a) Attestation (1) In general Not later than 30 days after the effective date of this section, and monthly thereafter, each digital exchange and each digital custodian shall obtain from an independent auditing firm an attestation that the applicable entity has proof of reserves, which shall be accompanied by appropriate evidence demonstrating proof of those reserves, as described further in subsection (b). (2) Inability to obtain services of auditing firm (A) In general A digital exchange or digital custodian may contract with, or otherwise obtain the services of, a disinterested third party to carry out the responsibilities of an independent auditing firm under paragraph (1) only if the digital exchange or digital custodian is unable to contract with, or otherwise obtain the services of, an independent auditing firm to carry out those responsibilities. (B) Applicability If a digital exchange or digital custodian contracts with, or otherwise obtains the services of, a disinterested third party as described in subparagraph (A), that third party shall be subject to the requirements of this section to the same extent as an independent auditing firm carrying out the responsibilities described in paragraph (1). (3) Industry standard (A) Solicitation of standard Not later than 90 days after the date of enactment of this Act, the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants shall jointly issue a request for public comment soliciting proposals from the digital asset industry regarding a standard for the attestations required under this section. (B) Establishment of advisory committee After the expiration of the 90-day period described in subparagraph (A), the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants shall establish an advisory committee that shall be comprised of the entities that submit proposals under that subparagraph. (C) Creation of standard The advisory committee established under subparagraph (B) shall— (i) create a proposed standard for the purposes described in subparagraph (A); and (ii) submit to the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants the proposed standard described in clause (i) for approval of the proposed standard by those entities. (D) Approval of standard (i) In general Not later than 18 months after the date of enactment of this Act, the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants shall jointly approve a proposed standard submitted to those entities under subparagraph (C). (ii) Extension of deadline If, as of the date that is 18 months after the date of enactment of this Act, the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants have not issued a joint approval described in clause (i), the 18-month deadline described in that clause with respect to that approval shall be extended by consecutive 180-day periods until the date on which those entities issue such an approval. (b) Reports (1) In general An auditing firm that prepares an attestation under subsection (a) with respect to an entity shall, after making the attestation, submit to the Under Secretary a report that addresses the following with respect to the entity: (A) Cryptographic proof of possession or control over keys that are capable of effectuating the transfer, change of control, or movement of a chain of assets that are owned by a person other than that entity, such as a customer of the entity. (B) Verification of cryptographic proof of reserves of the entity. (C) (i) Verification of cryptographic proof of the liabilities of the entity. (ii) For the purposes of clause (i), cryptographic proof means a cryptographically verifiable attestation using a Merkle tree structure, a zero-knowledge proof, or another similar mechanism that can prove— (I) the existence of the applicable liabilities; and (II) that the applicable liabilities are the legal responsibility of the entity that is the subject of the report. (2) Public availability The Under Secretary, through the Office, shall make each report received under paragraph (1) available to the public, which shall include, in addition to the material described in subparagraphs (A), (B), and (C) of that paragraph— (A) the name of the entity for which the attestation that is the subject of the report was performed; and (B) the name of the auditing firm that made the attestation described in subparagraph (A) of this paragraph. (c) Enforcement (1) Civil penalties (A) In general With respect to an entity that is subject to the requirements under subsection (a) and fails to satisfy those requirements, the Under Secretary, through the Office, shall, subject to subparagraph (B), impose a civil penalty on the entity as follows: (i) If that failure is the only such failure by the entity during the most recent 24-month period, the amount of the penalty shall be the greater of the following: (I) 25 cents per user or customer of the entity (as applicable), as of the date on which the penalty is imposed. (II) 2.5 basis points of the total assets under management by the entity, as of the date on which the penalty is imposed. (ii) If the entity has 1 additional such failure during the most recent 24-month period, the amount of the penalty shall be the greater of the following: (I) 55 cents per user or customer of the entity (as applicable), as of the date on which the penalty is imposed. (II) 5.5 basis points of the total assets under management by the entity, as of the date on which the penalty is imposed. (iii) If the entity has more than 1 additional such failure during the most recent 24-month period, the amount of the penalty shall be the greater of the following: (I) 90 cents per user or customer of the entity (as applicable), as of the date on which the penalty is imposed. (II) 9 basis points of the total assets under management by the entity, as of the date on which the penalty is imposed. (B) Limitation The Under Secretary, through the Office, may not impose a penalty on an entity under subparagraph (A) if the imposition of that penalty would cause the total amount of penalties imposed on that entity under that subparagraph for the year in which the penalty would be imposed to exceed the lesser of the following: (i) $1 per user or customer of the entity (as applicable), as of the date on which the penalty would be imposed. (ii) 10 basis points of the total assets under management by the entity, as of the date on which the penalty would be imposed. (2) Publication The Under Secretary, through the Office, shall make publicly available, with respect to the most recent 24-month period, the name of each entity that is subject to the requirements under subsection (a) and has failed to satisfy those requirements. (3) Appeals (A) In general The Under Secretary shall establish a process through which an entity on which a penalty is imposed under paragraph (1) may appeal that penalty. (B) Waiver of penalty The Under Secretary shall waive a penalty imposed under paragraph (1) if the Under Secretary determines in an appeal brought under subparagraph (A) of this paragraph that the reason that the Under Secretary did not receive a report under subsection (b)(1) is because of an action or omission by an auditing firm and not the entity on which the Under Secretary imposed the penalty. (C) Pause in payment An entity on which the Under Secretary imposes a penalty under paragraph (1) shall not be required to pay that penalty during the period in which an appeal brought by the entity under this paragraph is pending. (d) Effective date This section shall take effect on the date on which the Public Company Accounting Oversight Board and the American Institute of Certified Public Accountants jointly approve, under subsection (a)(3), an industry standard for the attestations required under this section.