Proof of Reserves and Fund Safety: What to Ask a Crypto Payment Provider

There is a moment in every payment that businesses rarely think about. Between the customer paying and the money reaching your bank, your funds sit with someone else. A provider holds them, converts them, and forwards them on. For that short window, you are trusting a company you may know very little about.

For most of the history of card payments, that trust was underwritten by banks and decades of regulation, so nobody asked questions. In crypto, the question is fair and worth asking out loud: while my money is with this provider, how safe is it, and how would I know?

This is where the phrase “proof of reserves” enters the conversation. Let’s unpack what it actually means, where it helps, where it falls short, and what you should really be asking.

What proof of reserves is

Proof of reserves (PoR) is an attestation that a company holds enough assets to cover what it owes its users. It became prominent after several crypto firms collapsed having quietly lent out or lost customer funds. A PoR is meant to answer one question: are the assets actually there?

It usually works by cryptographic snapshot. The provider proves, often with a third-party auditor or an on-chain method, that the reserves on one side match the liabilities on the other at a point in time.

It is a useful signal. But it is not the whole story, and treating it as a complete guarantee is a mistake.

Where proof of reserves falls short

PoR has real limits, and a careful buyer should know them.

It is a snapshot, not a film. A reserve proof shows a moment. It says little about what happens the day after the snapshot is taken.

It usually shows assets, not liabilities in full. Proving you hold assets is easier than proving the complete, honest picture of what you owe. A proof that covers only one side is weaker than it looks.

It does not equal regulation. A company can publish a reserve proof and still operate without a license, without safeguarding rules, and without anyone empowered to step in if it fails. PoR is something a firm chooses to do. Regulation is something it is held to.

That last point is the one that matters most for a business choosing where to route its payments.

The stronger signal: licensing and safeguarding

For a payment provider specifically, the more meaningful question is not “did you publish a snapshot” but “what regime are you held to, and what does it require of you.”

In the EU, that regime now has teeth. A provider operating under the Markets in Crypto-Assets framework (MiCA) is authorized and supervised, with obligations around how it handles client assets. We wrote about why this is becoming a baseline expectation in why EU-licensed crypto payment providers are becoming a market requirement, and about the risk of using an unlicensed one in how MiCA reshapes vendor risk for EU businesses.

For context on where we stand: CoinGate operates as UAB Decentralized, authorized as a Crypto-Asset Service Provider under MiCA by the Bank of Lithuania (authorization code LB002323), and separately licensed as a Payment Institution (LB002324). That is a public, verifiable status, supervised by a regulator, which is a different kind of assurance than a self-published snapshot.

The questions actually worth asking a provider

Skip “do you have proof of reserves” as your only question. Ask these instead.

• Are you licensed, and by whom? A named regulator and an authorization code you can verify beats any marketing claim.
• How do you handle client funds while they are with you? You want to understand safeguarding and segregation, not just a promise.
• What compliance runs on transactions? AML screening and real-time wallet checks protect you from receiving tainted funds, not just the provider.
• What records and reporting do I get? Full traceability and exportable history matter when an auditor asks.
• What happens if you fail? A regulated entity sits inside a framework that contemplates this. An unregulated one may not.

If you are running this evaluation properly, our CFO’s guide to evaluating a crypto payment provider and the guide to running a compliant crypto operation go deeper on the operational side.

Your money spends a short, invisible window in your provider’s hands, and you are right to ask how safe it is there. Proof of reserves is a helpful signal but a partial one, a snapshot that says nothing about regulation. The stronger assurance is a verifiable license and the safeguarding obligations that come with it. So ask the harder questions, and prefer a provider who is supervised over one who simply publishes a number.

Thinking about where your payments actually sit, and who is accountable for them? Start with us.

FAQ

Is proof of reserves enough to trust a crypto provider?

No. It is a useful point-in-time signal about assets, but it is not a substitute for being licensed and supervised. Treat it as one input, not the answer.

What is better than proof of reserves?

For a payment provider, a verifiable license from a named regulator, with the safeguarding and reporting obligations that come with it. Regulation is enforced. A reserve snapshot is voluntary.

Is CoinGate regulated?

Yes. CoinGate operates as UAB Decentralized, authorized as a Crypto-Asset Service Provider under MiCA by the Bank of Lithuania (LB002323) and licensed as a Payment Institution (LB002324). Both can be verified.

What should I ask before routing payments through a provider?

Ask who licenses them, how they handle your funds in transit, what compliance runs on transactions, what records you receive, and what happens if they fail.