Jérémy Stevance on Building the Digital Assets Audit Department at Deloitte

[00:00:00] Umar: This is Jeremy Stevance, Digital Assets Manager at Deloitte France. 

[00:00:04] Umar: For the past four years, Jeremy has helped build the auditing department for digital assets at Deloitte France, now servicing companies like Binance, Crypto.com or Circle where they help with monthly proof of reserves for their Euro stablecoin.

[00:00:21] Umar: Jeremy, how can you gain assurance that the client has disclosed all their wallet addresses?

[00:00:27] Jeremy: That is the $1million answer.

[00:00:31] Jeremy: The first thing very important that we say to every audit team is that it's linked to the Representation Letter. We add a specific paragraph where the client confirms that he shared to us the completeness of the wallet. 

[00:00:44] Umar: And what are the auditor's responsibilities when the client uses a crypto subledger? 

[00:00:49] Jeremy: If my client say, okay, I use this sub-ledger.

[00:00:52] Jeremy: Do I know it? But do we ensure that the data that it provide is clear? Of course, if they use a subledger with comfort relating to SOC/ISO report, we'll feel more comfortable.

[00:01:04] Umar: Welcome to The Accountant Quits podcast, where we help accounting and finance professionals learn how to manage a business using crypto.

[00:01:13] Umar: Deloitte has developed Coinia, a proprietary tool where Deloitte can see a hundred percent of hundreds of thousands of transactions and reconcile them to their client's books.

[00:01:23] Umar: In this episode with Jeremy, we discussed the challenges of auditing digital assets from proving completeness to verifying ownership,

[00:01:31] Umar: How to audit crypto exchanges in the absence of confirmation letters.

[00:01:37] Umar: Why SOC and ISO reports are critical when clients rely on subledgers.

[00:01:42] Umar: The growing need for traditional auditors to build expertise in digital assets and more.

[00:01:49] Umar: Jeremy, what are the prerequisites for accepting new audit engagements?

[00:01:53] Jeremy: The thing that we ask really quickly when we discover that our clients use blockchain technology. We ask very quickly on the... 

[00:02:06] Umar: Jeremy, welcome and thanks for making the time to be here. 

[00:02:11] Jeremy: Thank you very much. Thank you very much to having me today. It's a pleasure to be here. 

[00:02:14] Umar: Jeremy, I want to start with the meat of the episode today, which is around crypto audit. So previously at Deloitte you were working, I mean, you were auditing financial services companies, and like I mentioned, four years ago, you moved into their digital assets team and ever since you've been building this department.

[00:02:35] Umar: Later during the episode, I'll ask you to share your story of transitioning into the digital assets department. But I wanna start the episode today on the challenges in auditing crypto companies. And one of the first challenge that I have is on relying on block explorers.

[00:02:53] Umar: So for the listeners, less familiar.

[00:02:56] Umar: A block explorer is basically like the search engine for the blockchain. Anyone can view information about transactions, wallet addresses, block numbers on a specific blockchain. So these tools are used by accountants to reconcile their crypto balances, but auditors do not rely on block explorers.

[00:03:14] Umar: When auditors provide an audit opinion on the financial statements of a company, they need to obtain their, in their audit evidence from independent sources, right? So usually the auditors would host their own node or maybe, have access to a third party data provider like Moralis, Alchemy, Infura, are like some of the popular names, of the industry.

[00:03:37] Umar: I know , I'm giving a lot of context, but, I think it's important to give this to the listeners that auditors also use audit assertions when they devise their audit procedures.

[00:03:50] Umar: Audit assertions what they are, and they are simply claims that establish whether or not financial statements are true and fairly, represented.

[00:04:00] Umar: Now, the current challenge I'm describing, it pertains to completeness. That's like one of the audit assertion that auditors would use. So how can the auditor independently prove that all on chain transactions have been recorded by the client? So Jeremy, I want to ask you starting with this completeness assertion.

[00:04:22] Umar: Could you walk us through the challenges to query blockchain data as an auditor? 

[00:04:27] Jeremy: Yeah. That's a great question. A big, major challenge as a blockchain auditor, and as you said, it's an assertion that is very, very important for us regarding that. As a big audit firm as Deloitte, that is a multinational audit firm.

[00:04:44] Jeremy: We have our own tool for now, for more than four years. They started to develop it, be before that I joined, and create the blockchain team with my, the partner. So we have our own tool named Coinia. So today, Deloitte have its own node on different blockchain, Ethereum, Solana, et cetera, to provide, to have their own data.

[00:05:06] Jeremy: That's the first thing that we, we develop when we started to develop the methodology of the audits on the blockchain transaction. And to ensure the completeness, as you said.

[00:05:16] Jeremy: We help them a lot also to implement new blockchain technology, blockchain ecosystem. We help them to implement Tezos.

[00:05:24] Jeremy: It's less used blockchain today, but in 21, 22, have some transaction from our clients on that. So it was very important to have the, this blockchain on this tool.

[00:05:34] Jeremy: But it's a tool that we develop with person that work on that every day with fees on that, et cetera, et cetera. So not every firm can add and develop this kind of tool.

[00:05:45] Jeremy: And as you said previously, that's a challenge for everyone. You talk about third party provider like Moralis, Alchemy, and you're right. That if you need, you cannot have your own nodes. You need to have a third party provider. And so as we, as an auditor, we share trust. We guarantee trust for stakeholders.

[00:06:06] Jeremy: We need to have trust on these third party stakeholders. That the data that they provide is well, and the compliance is okay on that. So that's on this matter that we will check on these different sources. If there's, for example the source as reliable with, for example, SOC or ISO report can be very important for us regarding that.

[00:06:28] Jeremy: It's truly very important, I think for audit firm to first ensure that the data that they receive from the third party provider is complete and it's share of trust for the client. So that's quite bit difficult for every audit firm, accounting firm.

[00:06:45] Jeremy: Not everyone can develop these kind of tools because, in my opinion, because it can be very not useful and not the cost will be bigger than the reward.

[00:06:56] Jeremy: So we can have several suggestion on that. Maybe one firm can, one of several firm can develop it and propose the services to other audit firm as a, an external provider of service.

[00:07:09] Jeremy: So when you have a client on that, that have, and you don't have the tool, maybe you can use an external auditor that have the expertise on that to cover this kind of work. But that's a big challenge as a big firm, it's quite more easier because we have this tool, even if we pay because it's developed in the US so we, we reverse fees on, on the US part.

[00:07:30] Jeremy: But more challenging for smaller, company to have, a third party, that we can. 

[00:07:36] Umar: Jeremy, I've got two follow up questions. So during the course of the episode today, I also want like probably the smaller audit firms to understand how to start to audit digital assets.

[00:07:49] Umar: Now when you say, yeah, not everyone can actually set up this infrastructure and it's expensive, it's time consuming, but you can also have access to these third party data providers, but then you have to get assurance about the completeness of their data. So you would request like a SOC report or an ISO report.

[00:08:10] Umar: So, maybe a smaller audit firm, they don't have the expertise to set all the nodes in house. Would that be the go-to solution to just use like a third party data provider, but then get assurance about using like one of the SOC reports or ISO reports that they may have? 

[00:08:27] Jeremy: Yeah. Okay. I think a small firm, if the small firm wants to audit a client like that he can, but it'll be time consuming and cost consuming, I would say, if you want to invest in that he definitely can.

[00:08:41] Jeremy: I think the most important part is to have discussion with the third party provider about the data, about how they can be sure that they have the completeness of the data. What are the process in this data provider that ensure that you will have the completeness of the data and at this stage of discussion, normally this kind of provider will talk about SOC and ISO reports.

[00:09:03] Jeremy: I also have another third party data provider that is named Kaiko, for example that have the same, the same business model that we talk about, Alchemy, et cetera.

[00:09:13] Jeremy: They provide data from blockchain with their own nodes but also more analysis. We talk a lot with them and we know for sure that for example, for them all the ISO and SOC report are okay and available from this one. So when you have more trust on this one, you can use this data provider.

[00:09:33] Jeremy: We can always add more processes in order to be sure that the data is completeness. If you want to use several data source, for example, but it can be more cost consuming, for example. So it's very important to have discussion to, to understand, well, what is your data provider? And to ensure that.

[00:09:52] Jeremy: When you have that, it's the most important part because then it just, uh, I would say dashboard that highlights your transaction to date and highlight you table transaction flow, et cetera, et cetera. That can be more easier to develop .

[00:10:09] Jeremy: So if the firm wants you to go and invest and go 100% yes. That's the reason that some, maybe one or two firm audit firm that developed this tool can easily also provide these services to over firm that are not specialized in web3 ecosystem, but say, oh, this client started to buy Bitcoin.

[00:10:29] Jeremy: And it just one client, I don't need to have this kind of tool, I don't need to develop it. So please be my expert on that, to give me comfort on the competitiveness of transaction, on the valuation of the Bitcoin that I own, et cetera, et cetera. That basically what we do at Deloitte today, we don't talk, so much today, but every client in France, because I'm from Deloitte France every client that use blockchain technology, we are the expert for the auditors.

[00:10:57] Jeremy: And we review with our tools that thanks to our nodes, we are reviewing all the blockchain transaction. We are validating the valuation, the completeness, the reality of all this transaction, and also checking on different check on the AML/CFT also to give trust and assurance to auditor that okay, on this part of the financial statement, it's okay.

[00:11:20] Umar: So my second follow up question was, today, if like another Deloitte from another jurisdiction in the world, they wanna start offering crypto auditing services, they could rely on the expertise of like a Deloitte France, a Deloitte US who already have the technical knowledge or the infrastructure of hosting these nodes in house.

[00:11:41] Jeremy: That's a great question. And it depends. It depends because we, we are of a center of expertise in France, but we have several other, in UK in Germany, in Spain, in Italy, Netherlands, for example. They have their own expertise, so they don't need, if there's an audit clients, they don't need, to ask for Deloitte France.

[00:12:00] Jeremy: But for example, we already performed some mission audit, mission review from smart contract also for Luxembourg clients, Belgium clients, because they didn't have expertise. That's the strongest part of big group big international group is that if you're an expert somewhere, you can use it on another country if they really need it just at this moment.

[00:12:21] Umar: . Now, the other assertion, , apart from completeness is about ownership. So how does the auditor prove that the client has control over the wallet addresses that they see they own? So a common approach for approving ownership is for the client to sign a message using like their private key that controls the specific wallet or to perform a small transaction to like an address specified by the auditor.

[00:12:47] Umar: But what if the client has like a thousand wallet addresses? Could you walk us through how you prove ownership on all the wallets that the client say they own? 

[00:12:59] Jeremy: Yeah that's a very difficult and tricky question. If there is thousand wallets. You say, you said it true that this signing message is the standard.

[00:13:11] Jeremy: Today, it's the things that we need to process in order to ensure the ownership and to be sure 100%. But we had the case, to be honest, that we had client that was not comfortable about signing message, just about that. This is the same process, but sometimes just the client say, no, we don't want to do this.

[00:13:29] Jeremy: Why? Because this client just, were not so aware about web3 technology. Just as a reminder, my kind of clients that I have in audits, can be pure player web3, but also traditional client that just buy some Bitcoin just to diversify the cash that they had. So when we talk about signing message, et cetera, they were just a little bit scared that the risk of the that the Bitcoin can be go away, et cetera.

[00:13:56] Jeremy: So they didn't want, so we needed first to have another procedure to ensure that. For this client, for example, we went on site, and see that the client really have the hardware.

[00:14:09] Jeremy: It was a hot wallet. We checked the hardware, they connected to the dedicated platform. We saw they buy Bitcoin and they, like as you said previously, they started, simulate transaction and at the end, didn't validate the transaction. But we have the very great comfort that, okay, all the transaction process, they did it.

[00:14:30] Jeremy: And we are very comfort that it was just one push button to okay and so to, to validate the transaction. So we have very great comfort on that. 

[00:14:40] Jeremy: Now, there is another challenge that, to be honest, I don't see a lot that if there is a lots of wallets that you have. As I said previously, my clients are traditional, more traditional client that have 1, 2, 3, 4, 10 maybe wallets.

[00:14:57] Jeremy: So it's kind of easy. And also the client that we had on the web3 ecosystem have not so much wallet also. So, but if I want to answer your great question first we need to check if we can check the full ownership of all this wallets. If it's not possible in term of human capability, we need to perform an, I would say an in depth analysis on the wallet and, you know, define different kind of groups of these wallets. Okay. We have the exhaustivity, we'll talk later about how can we have exhaustivity of the wallet, but we have the exhaustivity of the 1000 wallets.

[00:15:36] Jeremy: Okay? We need, with our tool to analyze what are these wallets, what are the transaction they perform, what are the balance that had to define what are the very important wallet that we need to check, because it's very important for the activity and for the continuity of the activity.

[00:15:51] Jeremy: And then maybe another category and maybe other categories. That's okay. It's a wallet that have no transaction or no balances, et cetera. And so we will prioritize on the biggest, I say the biggest, but we will perform, for example, a sample size to, to have to define the number of wallet that we will need to check.

[00:16:14] Jeremy: But with this definition of population, we will ensure that, okay, this, if in 1000 we have 100 wallet data, very important, because if we are not sure there's a risk on the activity and the continuity, we need to know this one. And if 100, we need to do that, unfortunately. But it can help to reduce a little bit the figures 

[00:16:37] Umar: and how can you gain assurance that the client has disclosed all their wallets that they should have, like they didn't forget to account for one? 

[00:16:46] Jeremy: Yeah. That is the $1 million answer. That's very important because it's great to, to perform work and to work hours and hours to say, okay, this is the valuation, et cetera. But if you are, you don't have the completeness of the list of the wallet that they have. The work is kind of useless because missing parts.

[00:17:05] Jeremy: To be honest, that's a tricky part because the client, if they don't want to highlight some wallets, it's kind of easy for them.

[00:17:13] Jeremy: But we, the first thing very important that we say to every audit team is that it's linked to the representation letter, we add a specific paragraph where the client confirms that he shared to us the completeness of the wallets of all the wallets.

[00:17:30] Jeremy: Thanks to that. All the responsibility on that is on the client. For example, after we audit some transaction and we discover one month or years later that they were, their missing transaction is the fault of the client because it didn't share the exhaustivity of the wallet.

[00:17:49] Jeremy: But also, because it's just, I would say too easy just to say, okay, we write paragraph on the representation later, and now it's the fault of the client, so let's continue. We also perform on chain analysis with the wallet that we received just to analyze, not also just the transaction, but also the, I would say the pattern or if there is some transaction, then implying other wallet that we may think that it can be the client, for example.

[00:18:16] Jeremy: It's quite difficult and but it's very, it's a deep analysis in order to see if there's some patterns or things that can imply the client on missing some wallets.

[00:18:29] Umar: Before we continue, let's take a quick commercial break from our sponsor. If you're serious about running your business using crypto, you need tools built for crypto.

[00:18:39] Umar: One of my favorite apps, and yes, one that I use multiple times a month is Request Finance. This app has been a game changer in how I invoice my clients and receive stablecoins and crypto directly in my wallet.

[00:18:53] Umar: But hey, there's so much more to it.

[00:18:56] Umar: Request Finance is the all in, all-in-one platform for crypto operations, accounts payable, accounts receivable expenses, and even accounting.

[00:19:06] Umar: Plus they've got a killer multi-payee off-ramp to over 190 countries, meaning you can pay someone with crypto and they get fiat in their bank account.

[00:19:17] Umar: Request Finance connects to over 20 blockchain networks, including Ethereum, Solana, Base, Arbitrum, Near, and more.

[00:19:26] Umar: Here are some features that I love. Batch payments using your preferred wallet of choice, a single dashboard to track all invoices with real time updates. All invoices contain the transaction hash for easy audits.

[00:19:42] Umar: But hey, don't take my word for it. Try it that for yourself. Head over to requestfinance/partners/theaccountantquits and get two months for free with all the pro account features.

[00:19:55] Umar: Join 3000 finance leaders today using Request Finance and make crypto operations simpler, compliant, and less stressful.

[00:20:07] Umar: Great. So to summarize, the client will be providing the auditor with a representation letter asserting that they did actually disclose a hundred percent of their wallets to the auditor. Now, in your experience, what are, maybe from the companies you've audited, what are some good practices for management now to document the creation of a new wallet?

[00:20:30] Umar: Because for example, like, if you open a new bank account, those would be typically approved and recorded in board minutes. But with wallets being so easy to create, how should companies build similar governance and documentation? 

[00:20:44] Jeremy: That's the thing that we ask, really quickly. When we discover that a client use blockchain technology, we ask very quickly on the internal control process review.

[00:20:54] Jeremy: That they develop a process and controls related to that to ensure that who is the creator, who is the reviewer, who is performing the transaction, et cetera, et cetera, to ensure as bank accounts as different type of process in the company that's the creation of blockchain accounts, is very clear for every person with each person have their own roles and responsibility.

[00:21:17] Jeremy: It's one of the first recommendation that we say every time that we talk with a new client, say, okay. But you know, and we, I saw with clients that sometimes some procedure were not written.

[00:21:29] Jeremy: And we discovered that thanks to blockchain transaction, because everything is written on blockchain. So it was very easy for us to find that and to highlight to the management that there is an issue on that and thanks to that, so a year later they were processed, they were controls and everything were much better.

[00:21:46] Umar: Thanks sharing. Now, challenge number three, I have, at least for today, this is a non exhaustive list, is on, auditing data from crypto exchanges.

[00:21:56] Umar: So a lot of companies, of course, use centralized exchanges like the Binance, Coinbase, Kraken of the world, and unline banks, these exchanges, they don't typically provide like audit style confirmation letters.

[00:22:08] Umar: So the auditors would have to rely on APIs to access the client balances and transactions. How do you approach auditing crypto exchanges in practice?

[00:22:19] Umar: Do you lean more on a controls based procedures or is it primarily a substantive testing approach? 

[00:22:26] Jeremy: That's also a very important question. You're right on that, to a quick answer. It's both the control based procedure and substantive testing. I will go deeper on that later, but just as you mentioned, confirmation letters is very difficult because it's not processed on the centralized exchange.

[00:22:43] Jeremy: As anecdotes, we, I already received one confirmation from one centralized exchange that everyone knows it was we were quite surprising, to be honest. But we are not sure that next year we'll have it also. But yes, it's not process that is performed today.

[00:22:58] Jeremy: It's not an obligation, I would say. But, as a European country and with MiCA, we know that these actors, these centralized exchanges will need to report to regulators a lot of data every month. So we have hope that this kind of reports that they perform for to the regulators will help to build a practice of process to send to us confirmation, to auditors.

[00:23:23] Jeremy: But it's in the near future, I hope, but it's not the case still. But, as we told previously, you talk about control based procedure and substantive testing, and I said both. To be honest, I can, if I have a client that use from Binance, I know Binance, I want to say on the first thing that says, okay, it's Binance

[00:23:42] Jeremy: It can be, it's can be okay, but we need to document it on our paperwork that yes, it's okay. So we need to perform a control based procedure, notably on the IT side. We need to, we talk a lot with the, with IT teams to review the API connectivity, for example, if it's relevant. If we talk about API, sometimes it's not API sometimes some client just use the data that they download on, on Binance.

[00:24:08] Jeremy: And also we review the first and second level. We talked previously that the procedure and control that, that put in place on that. So the design implementation and the operating effectiveness. So sometimes automated controls that we need to be sure that it's relevant. Okay the API is extracting data that they will use in the tools or how they can ensure that there are the completeness of the data, but with that it's not sufficient for us.

[00:24:37] Jeremy: We also performing some substantive testing, like of course analytical review to understand the activities this year of the client. Compared to, for example, previous year? And also test of details. I think it's this in English also, to ensure the test or transaction to ensure the reality and the valuation of this kind of transaction.

[00:24:58] Jeremy: Also, we use so some test tools internally to define that, how many transaction we need to check. And then we also perform the traditional banking procedure. But we have centralized exchange also. We've, uh, checked the control, check the balances but it's at the end.

[00:25:16] Jeremy: It's when we check that we ensure that the data that provide from Binance over centralized exchange, it's correct. But there are a lot of step before and we've all other sometimes, stakeholders like IT audits team.

[00:25:30] Umar: When you say you check the operating effectiveness of controls, that's for the exchange, right?

[00:25:36] Umar: Is it easy to like, just like how do you get in touch with like a Binance or like any other exchange? Like you cannot just reach out to them, they won't reply. Right? 

[00:25:45] Jeremy: Okay. When I talk about the operating effectiveness, I talk about the client that put the controls to ensure that the API they extract the data, all the manual extraction is correct, and and there's the completeness of all the data.

[00:25:58] Jeremy: It's not relating to Binance is more difficult than that if you're right, that we don't talk about Binance when we have a client that just extract with an API once or two, two years.

[00:26:09] Umar: Jeremy, the next topic I'd like to go through is around accepting and audit engagement and some of the prerequisites that you'll have to determine.

[00:26:18] Umar: Obviously, like we've been talking about, auditing crypto is complex, so. There are certain preconditions for the auditors to assess whether they have the right expertise in house, whether they need to bring in further specialists, the different risk involved. Now in your view, what are the factors that auditors should consider before they take a client that hold crypto assets?

[00:26:40] Umar: Maybe some of the questions that they'll have to ask you, you mentioned one earlier around what is, like, for example, their documentation process when they create like new wallets. So what are some of the questions that you would typically be asking at the start of the audit before you even accept the engagement?

[00:27:00] Jeremy: Yeah it's true that we talk a little bit before on that.

[00:27:04] Jeremy: We talk about accepting the auditor so we don't start a mission. We don't accept already. First, it's the basic question and we talk a little bit about that. Do we have the expertise. Just basically basic question. If I'm used to have, I don't know, traditional clients, and today we, I have a client that say, oh, I diversify my, my bank accounts and I buy some Bitcoin.

[00:27:30] Jeremy: Two, I have the expertise. No. Okay. At Deloitte, so it's quite an easy question. If I don't have it, do we know another firm that can have this expertise and can delegate it in order to accept the mission and delegate it to this part, this specific part to the, to, to another audit firm that's very important. Before that, uh, I need to to ask myself, do I want to develop this expertise?

[00:27:57] Jeremy: And we talked about that previously. I need a tool. I need a data provider that I can trust it. Do I want to some client, some audit firm will say, yes, some audit firm will say no. If so, do I know another firm? And if not I would say the answer is just basically no, it's too specific. I don't need to know what the procedure, the control that put in place, et cetera.

[00:28:22] Jeremy: I don't, I just say on basic, on the first scale, do I have the expertise or can I delegate it? If it's not, I can have trust, I can share trust on the specific to, on the specific accounts, on the balance sheet and the financial statement. So I cannot accept the mission. 

[00:28:40] Umar: Now, Jeremy, you started working with Deloitte since 2016, and at the time you were auditing banks and other companies in the financial services industry.

[00:28:50] Umar: In September, 2021, you moved to their digital assets department. You've played a key role in servicing major clients, like I mentioned in the intro, like Circle, LVMH, Societe Generale, Binance and more. You've been working under the supervision of Marie-Line Ricard, the Partner at Deloitte. And can you share your story of building this digital assets department at Deloitte France?

[00:29:16] Jeremy: I talked with some person that said, oh, you are so lucky to be here, to have this position, et cetera. First before to explain how we develop it, how I joined the team is I create my, my own luck, I would say, because I am.

[00:29:30] Jeremy: I was very passionate about this technology of course personally first. When Marie-Line Ricard come in at Deloitte to develop the team, I directly contact her and share it to her a report that I created to, to highlight what are the different use cases that you have can have on blockchain technology.

[00:29:48] Jeremy: Because DeFi for me, at this stage in 2021, was very important for me because, as you said previously, my client clients were banks and financial institutions. So when I discover blockchain technology, oh, I go deeper in the blockchain ecosystem and I discover DeFi was wow. It's amazing. It's what my clients are doing, but everyone can use the services and propose the services.

[00:30:10] Jeremy: So I create my own luck to highlight to her that I'm very passionate and I want to work with her to develop it. It was also the great moment because I was, you know, in France I have my French CPA and it was the moment that I wrote my, my thesis to obtain it.

[00:30:28] Jeremy: And so the first thing that we had on our roadmap when we started this team was to develop a methodology to audit blockchain transaction on a French perspective, because we had some guideline, I would say from the global, so when I say global, I say US, but we needed to implement it in France and to adapt it to the specificities of France.

[00:30:52] Jeremy: That's basic thing. But for example, on IFRS, you can book your crypto on an inventory account. It's not the case in France. We have a dedicated account in the cash section. So this kind of things need to be updated and so that was the first thing that we developed the methodology.

[00:31:12] Jeremy: How can we audit our clients? We already start the discussion with acceptance, with the review of procedure and controls, the completeness, et cetera, all these things. What the question that we ask, we had in 2021. It was the great, the best time because it was during, you know, this previous, I would say bull run in 2021 when a lot of clients also corporation started to be, to invest or to develop NFTs, et cetera.

[00:31:39] Jeremy: So we started to have a lot of mission on audits on this one, on this part, we also started to, we needed to develop our brand, I would say, or what's the perception of the market in France that, okay. Deloite now is not just a financial firm, it's also technological on blockchain technology. So we needed to develop our brand in this ecosystem.

[00:32:03] Jeremy: And we could still continue today and thanks to that we also started to develop other kind of mission, which are assurance missions. When I say assurance mission is when we share trust to the client, but it's not a financial audit. We can talk about, for example, the proof of reserve that we perform for Circle, but also for other stablecoin project in France.

[00:32:23] Jeremy: We can talk about the audit readiness, now we have the methodology and we audit clients, and we recommend them, but some clients are not ready for audit and need to implement process controls relating to blockchain technology because they are pure players and that they don't use to know the, you know, the habits of auditors.

[00:32:42] Jeremy: So they ask us for help. And also we help the other teams in at Deloite think about cybersecurity, for example, to develop also their practice on blockchain sites. So we help them a lot. Thanks to that we had great brand. I think about Crypto.com or Binance that we perform the cybersecurity audits.

[00:33:02] Jeremy: And thanks to that we continue to develop it and develop on the, I would say, consulting part. So I make this creation on that because it's not on the audit part, but we thanks that we help client to, you know, define their strategy and how can they use blockchain technology. We help a public financial institution in France to define their five years roadmap on that.

[00:33:26] Jeremy: And we also have recently the city of Cannes, it's a city in the south of France. Some people already know that because know this city because it's where the ETHcc, eight, I guess now seven maybe . So it's one of the first use cases that we proposed during our, uh, when we defend the strategy, it's that you need a festival in your city because you are used to a festival in your city from real estate, cinema, et cetera.

[00:33:50] Jeremy: You need to have a blockchain event. And so the first use case was to have the ETHcc in Cannes and they continue to develop it and we help them to put the strategy in place. You can now pay with your crypto in Cannes for example, et cetera, et cetera.

[00:34:05] Umar: Can I interrupt you? So I want to go from through some of these use cases and clients that you work with.

[00:34:12] Umar: You were just talking about ETHcc. Maybe we can stay on each ETHcc and then we'll move on to Circle. So for example, ETHcc it was their seventh or eighth year. They were organizing this. Could you go maybe through how you help them specifically, like for in the city of Cannes, because I saw like a lot of vendors then in the city, like hotels, restaurants, were accepting payments in crypto.

[00:34:37] Umar: Was the work tied to that or was it tied to something else? 

[00:34:41] Jeremy: The point for us is that we held the city of Cannes. So we present our strategy, the strategy for the city, for the mayor, for all the, this public institution. We don't really, we talk with the ETHcc organization that helped to develop the ETHcc since it started because it represent, Ethereum France and is in the Ethereum Foundation. But we didn't work directly with them. They, I, as you say, they organize it for years and years, so they don't need us.

[00:35:12] Jeremy: Cannes needed us to define a strategy.

[00:35:14] Jeremy: They said, okay, we are a city and we want to use blockchain technology and to understand, well, how can we use blockchain technology? But I don't know really what is this technology. So we help them to, first we started to understand, well, what is Cannes, how it's working inside, what are their problems and how can blockchain technology can help them on that?

[00:35:35] Jeremy: And the first use cases that we define was to okay, you want to highlight that Cannes is a technologic city so you need to have an event in Cannes and so they started to talk with ETHcc by themself to, in order to implement it in Cannes.

[00:35:53] Jeremy: So we never really worked directly with ETHcc. We never signed a contract with them. It's was, it was with the city of Cannes in order to ensure that they put those strategy in place. 

[00:36:05] Umar: And moving on maybe to Circle, so could you, maybe explain the work that you do regarding proof of reserves, but even like, how does a proof of reserve exercise actually even work?

[00:36:18] Umar: Just for the listeners to understand. 

[00:36:21] Jeremy: Yes, you're right. That's a tricky word I would say because some people have a different definition of proof of reserve. For us, the proof of reserve for Circle is to ensure that all the reserve that they have for the activity of issuing stablecoin are completeness.

[00:36:36] Jeremy: They have the completeness and it's real. The reserve that they have is real in order to ensure the parity with the dollar. So every, it's every quarter I guess we perform this proof of reserve. The first thing is to receive from the Circle, to say, okay at this day.

[00:36:54] Jeremy: I have this amount of stable coin circulation, this amount of cash position, et cetera, in bank accounts in my different banks in order to ensure that I am well collateralized for my activity. And this is this paper that we are challenging, So we are, we will use our tool, as I say, Coinia that will go directly on the blockchain to check the supply of the USDC or the EURC also, in order to validate the amount of, the number of stablecoin that's circulate.

[00:37:30] Jeremy: And we will perform and we say it's more traditional work, I would say we, we check the balances of the bank accounts, the position that they may have on the on T-Bills, et cetera, et cetera, to ensure that the valuation of the reserve are correct, are real, and that they cover the, the stablecoin. 

[00:37:48] Jeremy: And we issue every month or every quarter a report that explain all the work that we perform and if it's okay for us or not.

[00:37:56] Jeremy: Basically it's that. But there is another tricky work that we need to perform now that is MiCA, MiCA implied that the USDC that are using by European clients need to be in the European countries. So now Circle cannot have 100% reserve in the US. And perform an activity in France and in Europe basically.

[00:38:20] Jeremy: And deploy USDC and et cetera. So we need now to also reviewing the process and control that they put in place and of the rebalancing process. So now they have two reserve on the US for the US and world clients and in France and for the European clients. And suddenly we are reviewing the models and the effectiveness of the models and if it's relevant and they have the correct amount of reserve in France for the European clients.

[00:38:51] Jeremy: That's also another work that we need to perform in order to ensure that the reserve are well imply for the European clients. 

[00:38:57] Umar: Great. Thanks for sharing. Now I want to move on, Jeremy, with the adoption of crypto in France, but not specifically by retail, more for enterprises because that's the focus of The Accountant Quits podcast.

[00:39:12] Umar: Yeah. So I saw that Deloitte France has contributed to the report published by ADAN on the adoption of digital assets from retail and corporates. And for the listeners, what is ADAN, it's basically a French nonprofit it's translate to, if you want to know, Association for the Development of Digital Assets in English, which aims to support and, and educate companies in the web3 space.

[00:39:37] Umar: Now, based on this report, what are still like some of the hurdles that enterprises are facing for the adoption of web3 crypto in general in France, and maybe what changes in regulation, banking, anything would make it easier for French enterprises to build web3 businesses because you are at the heart of like, everything, all the new developments of crypto in France.

[00:40:04] Jeremy: Yes. That was a very, that was a very great work that we perform. And very interesting because we also present it in the French Ministry of Technology and also we present it in the French Ministry of Finance and recently in London for financial institution.

[00:40:18] Jeremy: It's a very important reports notably for public institution that are well aware that it's very important for them. As we, we talked previously, you said previously, yes. It's, uh, about the adoption in the industry. We just talk about the industry. Just so you know, it's based on quantitative, qualitative data.

[00:40:36] Jeremy: Quantitative that we have with a survey and qualitative things to interview with more than 80 actors that we interview.

[00:40:43] Jeremy: And these actor are in France, in UK, in Germany, Belgium, Italy, and Netherlands. So basically the major figures that we highlight, 70% of the industry that we, we ask said that they wanted to hire this year.

[00:41:00] Jeremy: Of course, developers remain high in demand, but now due to MiCA, the compliance roles are also growing into the second role that they want to employ.

[00:41:12] Jeremy: Relating to MiCA, it's a major topic in Europe. We ask them about the perception that they have about MiCA, and we divide the answer with the pure player.

[00:41:24] Jeremy: When I said pure player, it's the company that develop the web3 use cases and the traditional firms that develop a web3 branch. I'm talking about banks, public institutions, LVMH, et cetera, et cetera. And it's quite the opposite.

[00:41:40] Jeremy: For the pure player, almost, more or less 80% said that the perception of MiCA is neutral or negative, but for the traditional, it's the opposite.

[00:41:50] Jeremy: 80% say it's positive or natural. So it highlight that MiCA is great for big institution to have trust on and have a comfort on this ecosystem. But it's very difficult for the pure player to see the future and to ensure that the innovation and the position will be still here in the next years.

[00:42:12] Jeremy: Another major point in this study is the financing. Europe is good. Notably at small funding grounds, but not big ones. We already know that. But thanks to that, thanks to this study, we have now data.

[00:42:27] Jeremy: For example, for fundraising, more than 1 million Euros, 55% of the funds from, for the web3 ecosystem, come from the US and overall the fundings in Europe for the web3 ecosystem, it's 47% of the fundings are from the US.

[00:42:47] Jeremy: So it highlights that we are really dependent on the US relating to the fundings. Even if we are in Europe and it's something that we want to, a bell that we want to ring okay, we need to develop that to have more fundings for in this ecosystem, for, from Europe. So the report is in French, of course, but it's also in English.

[00:43:09] Jeremy: It, as I said, it's combined quantitative data, well visualized, with infographic and qualitative input. So, I highly recommend it you to, to download it. 

[00:43:18] Umar: I'll share the link of the report in the show notes as well. I'm just looking at the time.

[00:43:22] Umar: I've got a last question I want to ask you, Jeremy, but maybe even before that, a follow up on what we are just discussing, what are some of the crypto friendly banks in France? If you can name a few.

[00:43:33] Umar: It's also about if a company would be transferring funds from like a crypto exchange to like that bank, they would not freeze your account or they would not close your account, you know?

[00:43:45] Jeremy: Yeah. That's a very important point and with ADAN the non-profit association, they work a lot on that because it's still an issue in France and I think in other countries that, okay, maybe Societe Generale is have its own subsidiary and developed stable coin.

[00:44:00] Jeremy: But yes, if you are, if your client, and if you send money from Binance you may have problems or a question, et cetera. So it's still an issue to date. 

[00:44:10] Umar: Now the last question, Jeremy, before we wrap up is around subledgers. So a lot of the listeners are using subledgers, subledgers, like I'll just mention some names like Cryptio, TRES Finance, the list is very long, but could you explain what would be the auditor's responsibilities in the event their client is using a sub-ledger because they're using all this to collect, process the data from the blockchain before they export it to like their accounting software.

[00:44:43] Umar: I think in France, you use PennyLane. So what would you be requesting from your client if they're using like a subledger? 

[00:44:52] Jeremy: The first thing is the data reliable? Can I use it? We still understand it is the first thing. If my client say, okay, I use this subledger do I know it, do do we ensure that the data that it provides is clear and we are going back to the previous answer with the SOC/ISO report, et cetera, will not go deeper in that because we already to talk about that.

[00:45:13] Jeremy: It's the same logic and we also have the same logic when a client develop a private blockchain, okay, you develop a private blockchain. I have to think about JP Morgan. It's not our client, but everyone hear about JP Morgan that developed his own private blockchain. Okay, that's great. But your private blockchain develop create data that you're using in accounting, but how can be sure that this data is okay.

[00:45:34] Jeremy: So we need to be sure can be IT audit et cetera, et cetera. So when a client is using a subledger, I need to be sure what is this subledger? Is can be reliable or not. You talk about Cryptio, Bitwave, this kind of tool that we already hear or some clients already using it.

[00:45:52] Jeremy: Bitwave is a partner of Deloitte. We talk with them a lot. So of course if they use a subledger with comfort relating to SOC, ISO report we will feel more comfortable than another tools that we don't know where it's come from. And if this tool we don't know, we need to perform more work on that.

[00:46:13] Umar: Perfect. Thanks for sharing. Jeremy, I'm looking at the time. It's probably time to wrap up the episode. I wanted to have you today, Jeremy because the, the whole point of The Accountant Quits podcast, it's to inspire, prepare, educate accountants for a large part of them coming from web2 into web3.

[00:46:32] Umar: So having someone like you Jeremy who were, you were auditing like traditional financial companies and now you transition, I mean, four years ago you transition into their digital assets department.

[00:46:44] Umar: I think like those stories are always good for people contemplating about transitioning as well into the web3 industry. So thanks a lot for, coming in today Jeremy.

[00:46:55] Umar: I maybe as closing thoughts if there was something that you'd like to share with the listeners about maybe for those contemplating like a career in the web3 industry or how would you summarize this episode today?

[00:47:10] Jeremy: First, thank you very much to having me today. Very good to talk with you and I hope it'll help some as you say accountant or auditor that want to go deeper in the web3 ecosystem to understand, well, what is going on in this wonderful ecosystem.

[00:47:24] Jeremy: And it's a thing that this ecosystem is wonderful for a lot of people as accountant and auditor, because we learn every day and every day on different topics, technically, humanly in term of brands you know, many, I talk with many a lot of accountants and auditors that join the space because there are new questions every day.

[00:47:47] Jeremy: How to book NFTs, how to book stablecoins, the valuation, tax impact, et cetera. So also in this ecosystem, there's still much work that remains to ensure the consistentency of accounting standard, for example, or how company will book the all this transaction. I talked previously with the IFRS that need to continue to, to evolve on that. So, uh, I look forward to seeing this evolution positively and so for all people that hear us and that in the web3, web2 ecosystem continue to learn a lot, in order to, help to develop this ecosystem and this accounting and audit part.

[00:48:27] Umar: Perfect. Thanks for sharing Jeremy 

[00:48:30] Umar: On this podcast, I usually like to ask to the guests before they leave. It's like a tradition on this podcast for their favorite quote or maxim? 

[00:48:39] Jeremy: Yes. It's remind me that as I said previously, that a quote that, I think it's Alan Kay, it's a computer science pioneer.

[00:48:47] Jeremy: The quote is, the best way to predict the future is to create or invent it. So I think I like this quote because that's the, that's so basic, but it's so true and it's definitely what is happening in the blockchain and web3 ecosystem. We are developing it together, with our own expertise.

[00:49:05] Jeremy: Actually we are talking about accounting and auditing, but there are other expertise that we need. And thanks to together we are developing it, I hope with a brighter future for this ecosystem. 

[00:49:17] Umar: Thank you. That's a great quote. 

[00:49:19] Jeremy: Thank you very much. 

[00:49:20] Umar: If people want to reach out to you, Jeremy, if they want to learn more about the work that you're currently doing at Deloitte, how should they do so?

[00:49:29] Jeremy: They can follow me on LinkedIn, very professional first. I also have a Telegram that I can maybe share so if there are any questions I think it's the most, uh, relevant, social network for that.

[00:49:41] Umar: Sounds good. 

[00:49:42] Umar: Well, thanks a lot for your time today, Jeremy. It was great recording. And we'll be in touch.

[00:49:48] Jeremy: Yes, definitely. Yes, definitely. Thank you again.