How Crypto Source-of-Funds Audits Work: From Wallet to Bank Approval

A complete walk-through of how crypto source-of-funds audits work, from wallet ownership verification to bank-side approval.

alt.co Team

May 21, 2026

A crypto source-of-funds audit reconstructs the on-chain history of a wallet, attributes every counterparty, and produces a compliance file that a private bank or auditor can sign off. It combines blockchain forensics tools (Chainalysis, Elliptic, TRM Labs, Lukka), a documented chain of custody, KYC and AML checks, and a written narrative anchored to the on-chain evidence. For HNW investors converting Bitcoin, Ethereum, USDC, or other digital assets to fiat, this audit is the document that turns crypto wealth into a bank-acceptable proof of funds.

Source-of-Funds Audit Stage	Auditor Output for the Bank
Wallet ownership verification	Satoshi test or message signature with TXID record
On-chain history reconstruction	Chronological audit trail of every inbound transaction
Counterparty attribution	Mapping to exchanges, OTC desks, mining pools, P2P
KYC and source-of-funds narrative	Written reconstruction supported by bank statements, trade history
Source-of-funds (SOF)	Long-term wealth context (mining era, salary, business sale)

What Is a Crypto Source-of-Funds Audit

A crypto source-of-funds audit is a structured investigation into how a client acquired the digital assets they hold today. The auditor takes the wallet inventory provided by the client, traces every inbound transaction through the distributed ledger, attributes the counterparty for each one, and reconciles the on-chain evidence with off-chain documentation such as bank statements, exchange trade history, mining receipts, or business sale agreements. The output is a compliance file the private bank or financial intermediary can rely on to approve onboarding.

The audit answers two questions banks always ask. First, is the wallet genuinely controlled by the client? This is settled through a Satoshi test or message signature, where the client signs a unique message from the wallet without moving funds. Second, where did the assets actually come from? This is settled through the on-chain history, attribution of counterparties, and reconciliation with off-chain proof. Without both answers, no Swiss private bank under FINMA supervision will accept a fiat settlement above the AML threshold.

The 6 Steps of a Source-of-Funds Audit

Most reputable crypto source-of-funds audits follow the same six-step process, regardless of the auditor or jurisdiction.

Wallet inventory: the client lists every address under their control, including hot wallets, cold storage, hardware devices, and any custodian-held position.
Ownership verification: the auditor runs a Satoshi test or message signature on each wallet to confirm control, with the TXID and signed message recorded in the file.
On-chain reconstruction: every inbound transaction is traced back to its source, with timestamps, fiat-equivalent value, and counterparty attribution.
Counterparty attribution: each source is mapped to an exchange, OTC desk, mining pool, peer-to-peer transaction, or flagged if linked to a mixer, tumbler, dark web market, or sanctioned address.
Reconciliation with off-chain documents: bank statements, exchange CSV exports, mining pool payouts, salary slips, or business sale agreements are matched to the on-chain inflows.
Final report and attestation: a written narrative is produced, and accompanied by a forensics report from Chainalysis.

The depth of each step depends on the volume and complexity of the wallet. A single Bitcoin wallet with three exchange inflows can be cleared in a few days. A multi-chain portfolio with DeFi exposure, with lots of activity can take several weeks. Our note on the 7 documents banks require for a crypto cash-out details what off-chain proof to prepare in advance.

Tools Auditors Use to Trace Blockchain History

Auditors rely on a combination of blockchain forensics platforms to reconstruct wallet history and produce attribution at scale. Five tools dominate the institutional audit market.

Chainalysis: the largest provider, used by FinCEN, FBI, Europol, and most tier-one banks. Strong on Bitcoin, Ethereum, and major stablecoins.
Elliptic: deep coverage on smart contract risk, DeFi protocols, NFTs, and cross-chain bridges.
TRM Labs: strong in sanctions screening and counter-terrorism financing, used by central banks and law enforcement.
Lukka: focused on accounting-grade attestation, frequently chosen when a financial intermediary needs an external auditor sign-off in line with PCAOB or FATF expectations.
CipherTrace (Mastercard): integrated with the Travel Rule and VASP-to-VASP messaging.

Each tool produces address attribution, transaction graphs, and a risk score that feeds the audit. For a complete picture of how these tools support compliance, see our deep dive on blockchain forensics reports for private banks.

Source of Funds vs Source of Wealth: What Auditors Verify

Auditors and banks distinguish between source of funds (SOF) and source of wealth (SOW). The two questions are related but answered differently and both must be documented.

How do you prove the legitimate origin of crypto funds?

The legitimate origin of crypto funds is proven through a combination of on-chain audit trail and off-chain documentation. On-chain, the auditor traces every inbound transaction back to its source (exchange, mining, OTC desk, peer-to-peer) and attributes counterparties using forensics tools. Off-chain, the client provides bank statements, exchange CSV exports, tax filings, mining receipts, or business sale agreements that match the on-chain inflows.

Source of funds focuses on the specific assets being converted: where these particular Bitcoins, ETH, or USDC came from, and through which steps. Source of wealth is broader: how the client built the overall fortune over years or decades, including non-crypto income, business activities, inheritance, or salary. A bank reviewing a USD 5M Bitcoin sale will want both: a clean SOF audit on the wallet, and an SOW narrative showing the client had the means and time to accumulate this position. We explain the distinction in detail in our note on source of wealth vs source of funds.

Common Triggers and Red Flags in Crypto Audits

Several patterns will trigger a deeper audit or a refusal at the bank level. Understanding them in advance helps the client and the financial intermediary structure the file properly.

Dark web or darknet market history: even indirect exposure (one or two hops away) creates a red flag and requires a written explanation.
Sanctioned counterparty: any address matching OFAC, EU, or UN sanctions lists at the date of the transaction is an immediate stop on the file.
Rapid layering: many small transfers between unhosted wallets in a short period of time, often a sign of obfuscation rather than legitimate use.
Custody gaps: assets that disappear from a custodian and reappear in another address without a clear chain of custody.
Inconsistent SOW: a wallet holding assets that exceed what the client's declared income and history can plausibly explain.
Tax filing gaps: missing crypto declarations in past tax returns can trigger a fiscal audit alongside the bank-driven SOF review.

None of these triggers are automatic disqualifications. They simply require more documentation, more time, and sometimes a third-party attestation. A clean explanation supported by on-chain evidence and off-chain documents will pass even when the wallet has historical high frequency trading or DeFi activity.

How Long a Source-of-Funds Audit Takes and What to Prepare

The duration of a crypto source-of-funds audit depends on three factors: the number of wallets, the complexity of the on-chain history, and the quality of the off-chain documentation provided by the client. Typical timelines fall into three brackets.

Simple wallet, clean activity: 3 to 5 business days. Single chain, a handful of inflows from regulated exchanges, full off-chain proof available.
Mid-complexity wallet: 2 to 4 weeks. Multi-chain portfolio, some peer-to-peer history, some DeFi exposure, mixed off-chain documentation.
Complex wallet: 1 to 3 months. Multiple wallets across cold storage and hardware devices, MEV bot or algo trading flows, cross-border tax considerations.

To shorten the process, clients should prepare the following documents before engaging the auditor:

Wallet inventory with public addresses and approximate first acquisition date.
Bank statements for the period the wallet was being funded.
Exchange CSV exports (Coinbase, Kraken, Binance, Bitstamp) showing every fiat deposit, trade, and withdrawal.
Mining pool payouts if applicable, with pool name and miner address.
Tax filings of past three to seven years declaring crypto holdings or capital gains.
Business sale agreements, salary slips, inheritance documents to support the SOW narrative.

For institutional investors and HNW clients, we recommend running the audit through a VQF-supervised intermediary that will coordinate the forensics tool, the off-chain reconciliation, and the bank-side compliance review in one workflow. This avoids back-and-forth between three different parties and reduces the time from wallet to bank approval. See our explanation of how a VQF-supervised crypto broker handles compliance end-to-end.

Frequently Asked Questions

How does a crypto audit actually work?

A crypto audit reconstructs the on-chain history of every wallet under client control, attributes each counterparty using tools such as Chainalysis or Elliptic, and reconciles the on-chain inflows with off-chain documents like bank statements and exchange exports. The output is a compliance file with an audit trail, a risk score, and a written source-of-funds narrative the bank or auditor can rely on.

What is a Proof-of-Reserves audit?

A Proof-of-Reserves (PoR) audit verifies that a custodian or exchange holds the digital assets it claims to hold on behalf of clients. The auditor uses Merkle tree cryptographic proof, on-chain wallet attestation, and reconciliation with internal liability records. PoR is widely used in the industry to give clients and regulators confidence that assets are not rehypothecated or missing.

What triggers a crypto tax audit?

Crypto tax audits are typically triggered by undeclared exchange-to-bank flows, large fiat settlements without prior tax declarations, mismatches between exchange-reported data and personal filings, residency changes, or referrals from foreign tax authorities. Switzerland, the United States, and most EU countries now receive automated reporting from major exchanges under DAC8 and equivalent frameworks.

How long does a crypto source-of-funds audit take?

A simple wallet audit takes 3 to 5 business days. A mid-complexity multi-chain wallet takes 2 to 4 weeks. Complex audits with DeFi exposure, or cross-border tax angles take 1 to 3 months. Quality of off-chain documentation provided by the client (bank statements, exchange exports, tax filings) is the single largest driver of total duration.

Get Your Source-of-Funds Audit Through a Swiss VQF-Supervised Intermediary

alt.co is a regulated financial intermediary headquartered in Geneva, supervised by the VQF under the Swiss AMLA, audited by BDO SA. We coordinate end-to-end source-of-funds audits combining Chainalysis, Elliptic, TRM Labs, and Lukka with off-chain reconciliation and bank-side review. Our clients hold positions ranging from USD 25,000 to USD 100M and above in Bitcoin, Ethereum, USDC, and other major digital assets.

Submit a confidential compliance review to find out more.

Need help with your crypto compliance?

Book a free consultation with our Swiss-regulated compliance team.

alt.co is a Geneva-based, Swiss-regulated financial intermediary (Altcoinomy SA) supervised by VQF and audited by BDO SA. We help crypto holders access private banking in Switzerland and Monaco.

Our Services·Book a Free Consultation·FAQ