A Bitcoin balance may look safe on a hardware wallet or an exchange. Yet an audit asks a harder question: can you prove who held rights, control and access on the reporting date?
For Cold storage vs exchange custody: Audit defensibility UK, cold storage can give stronger proof of key control. Exchange custody can give better day-to-day records. Neither option proves ownership by itself.
Auditors test five claims, not just a bitcoin balance
A UK audit tests existence, rights, control, completeness and valuation. It asks if Bitcoin existed on the reporting date. It also asks who owned it, who could move it, and whether records are complete.
The audit also needs a sound sterling value. Think of it like proving ownership of a car. A photo of the car is not enough. You also need the logbook, payment trail and date-specific value.
Existence needs date-specific evidence
Existence evidence must show the balance at the relevant date. A current balance alone does not prove a past balance. For self-custody, retain the wallet address, UTXOs, transaction hashes and a read-only balance capture.
For an exchange, keep a dated statement and CSV export. A CSV is a spreadsheet file with the raw account data. It is usually stronger than a screenshot because it can be checked.
Date-specific records are essential.
Rights are different from key control
Rights evidence links Bitcoin to the person or company making the claim. Key control only shows who can move Bitcoin. It does not always show who owns it.
Keep trade confirmations, bank-payment records and KYC records. KYC means identity checks done by an exchange. Keep invoices, board minutes and source-of-funds notes where they apply.
A seed phrase is like a house key. Holding it may let you enter. It does not prove you own the house.
Completeness means tracing every movement
Completeness means your ledger records every purchase, sale, fee, transfer and reward. Your tax work must match those records. This includes transfers between wallets that do not change beneficial ownership.
Beneficial ownership means the person or firm entitled to the Bitcoin. That can differ from the person holding the keys. This difference often matters for companies and families.
Choose records that link each event from bank payment to final wallet.
Comparison table: evidence strength and real limits
Cold storage is usually stronger for proving direct key control. Exchange custody is usually stronger for routine exports and time-stamped operating records. Your choice should depend on the audit claim you need to prove.
| Audit test | Cold storage / self-custody | Exchange custody | Decision point |
|---|
| Control of Bitcoin | Strong with a signed message and key rules | Indirect through account access and contract | Choose cold reserves for long-term holdings |
| Transaction records | You must create and retain them | CSV exports often exist, but quality varies | Choose exchange only if exports reconcile |
| Balance-date proof | On-chain address and dated capture | Statement plus account access evidence | Keep both for 5 to 6 years, or longer if needed |
| Insolvency exposure | No exchange creditor exposure, but key-loss risk | Depends on terms, segregation and provider estate | Check the contract before funding |
| Typical hardware cost | Roughly £60 to £220 for established devices | Usually no device cost, but fees apply | Cost is small beside poor evidence |
A hardware wallet holds credentials needed to approve a transaction. Those credentials stay off an internet-connected computer. The device is not a proof-of-ownership machine.
For an HMRC review, the strongest file joins one acquisition record to one transaction hash. It also joins one wallet or exchange account, one ledger entry and one sterling valuation. A missing link is where questions begin.
Evidence matrix for your working papers
Create one line for each material holding. Put rights, control, approval, completeness and valuation evidence beside that line. This gives your accountant or auditor a clear trail.
- Rights: Keep the purchase confirmation, bank payment, KYC identity and contract or invoice.
- Control: Keep a signed message, wallet governance log or named exchange access record.
- Approvals: Keep director approval, a dual-signature log or transfer approval.
- Completeness: Keep a CSV export and blockchain-to-ledger reconciliation.
- Valuation: Keep a dated GBP price source and the calculation used.
Records beat screenshots in an HMRC review
Keep CSV exports, statements, transaction hashes, GBP values, fees and wallet destinations. Keep them for every material event. Retain normal Self Assessment records for at least five years after the 31 January deadline.
Screenshots can support a file, but they are weak on their own. They can miss account details, timestamps or the full transaction history. Use them only beside source records.
For most meaningful UK holdings, use cold storage for reserves and an exchange only for a capped operating balance. That choice works only when both sides reconcile monthly. If you cannot document wallet ownership or restore access, cold storage loses its audit edge. Build one evidence file before moving a large balance.
Cold storage: strong control, hard recovery duties
Cold storage suits long-term Bitcoin holdings with protected keys and tested recovery. It also needs wallet movements that reconcile to your books. It becomes weak when seed phrases are shared informally.
It also fails when ownership records are missing. The most common mistake is treating a hardware wallet as the whole evidence file. It proves far less than many holders expect.
Pros of self-custody evidence
Cold storage can link an address to a signed message and an on-chain balance. It also avoids reliance on an exchange staying solvent or allowing withdrawals.
A signed message is a cryptographic proof made with a wallet key. It can show control of an address. It still cannot prove the legal owner behind that address.
💡You may be interested in
A hardware wallet can support direct control evidence. Pair it with a documented wallet register and tested recovery process. It cannot replace purchase records or Bitcoin tax reconciliation.
- Keeps long-term private-key approval away from an internet-connected device.
- Supports a documented wallet inventory for company and personal holdings.
- Allows controlled recovery testing without an exchange account.
View options on Amazon →Cons and audit failure points
Self-custody does not prove rights automatically. It fails when family members, former directors or others retain seed access. It also fails when you cannot trace the original purchase to the wallet.
This works well in theory, but recovery testing often gets skipped. A lost seed phrase can mean a permanent loss. A shared seed phrase can make control hard to prove.
Choose cold storage for long-term reserves, low transaction volume and monthly reconciliation. Avoid it if you cannot manage a seed phrase. Avoid it if you need casual, undocumented access.
Choose this if: You are a long-term UK Bitcoin holder or business. You need clear ownership records, two-person approval and tested recovery.
Exchange custody: useful records, creditor risk remains
Exchange custody suits an active operating balance with reliable exports. The provider must also pass due diligence. Financial Conduct Authority registration does not guarantee Bitcoin returns during an insolvency.
An exchange account is like money held with a firm, not cash in your own safe. The contract decides many rights if the firm fails. Read its custody and insolvency terms before you fund it.
Pros of exchange custody records
A well-run exchange can produce timestamps, trade reports, fee lines and account identifiers quickly. This reduces missing data from frequent trades. It can make tax work easier.
Export records at least monthly. Save statements before closing an account or changing providers. Old data may become harder to obtain after a dispute.
Regular exports reduce avoidable gaps.
Limits of proof of reserves
Proof of reserves may show an exchange controls some on-chain assets. It may not show all liabilities. It may not show client allocation, lending, pledging or sub-custody arrangements.
Most custody guides mention proof of reserves. They rarely explain that assets and customer claims are different things. A reserve report does not settle creditor treatment if an exchange fails.
Choose exchange custody for a limited trading or settlement float. You need regular CSV records and terms you understand. Avoid strategic reserves where a freeze would cause material harm.
Choose this if: You need frequent execution and can cap the balance. Export records monthly and document why the provider is acceptable.
A hybrid model is usually the best audit choice
A hybrid model is often the most defensible practical choice. Keep reserves in cold storage. Keep a small hot or warm float for trading or payments.
This separates long-term protection from daily activity. It also creates a clearer record of transfers between the two. Each transfer needs approval, a transaction hash and a ledger entry.
A defensible hybrid custody flow
1. Cold reserve
Named wallets, key register, recovery test
2. Approved transfer
Dual approval, limit check, transaction hash
3. Exchange float
CSV export, daily balance check, monthly reconciliation
Controls that make the model credible
Keep a wallet register for each address. Record its purpose, legal owner, device location, approvers and last reconciliation date. Do not record the seed phrase in that register.
A company should set a transfer limit. Above that limit, require two named approvers. Keep evidence of both approvals with the transaction record.
Clear rules matter more than a costly device.
A short working-paper example
A useful working paper might state: “At 31 March, Company A held 1.20 BTC at address X. The on-chain balance was checked on 1 April. The address linked to a Coinbase withdrawal on 10 January. Two directors approved it. It reconciled to the general ledger.”
This example links date, balance, source, approval and accounts. That is the audit trail that an exchange statement or wallet screenshot alone may lack. Use the same format for each material holding.
Which custody choice reduces your audit risk?
Choose cold storage for strategic reserves when you can prove rights, control and recovery. Choose an exchange for a restricted operating balance with complete exports. Choose a hybrid structure when you need both holding and regular activity.
Neither route fits neatly when ownership is disputed. The same applies to trusts, near-insolvent companies or shared key control. Seek UK legal and accounting advice before moving Bitcoin in those cases.
The direct recommendation
For most long-term UK Bitcoin holders with meaningful balances, use documented cold storage for reserves. Keep a tightly capped exchange float only where needed. This is the clearest balance of direct control and usable records.
Do not choose cold storage if no one can restore it safely. Do not choose exchange custody for funds you cannot afford to freeze. Audit strength depends on evidence, not the brand of wallet.
What most custody guides leave out about evidence
An on-chain address can show that Bitcoin moved. It cannot tell HMRC who was entitled to it. An exchange statement cannot prove assets were separate from creditors.
A common case involves a director using a personal exchange account for company Bitcoin. The trades may be clear, but company ownership is not. Board minutes, payment records and wallet records then become vital.
This comparison matters less for very small personal holdings. It matters less when no audit, insurance, business accounts or third-party review is expected. It cannot replace advice from a UK solicitor, regulated financial adviser or qualified accountant. Seek advice if ownership is disputed, assets sit in a trust or company, or insolvency risk is material.
Choose the simpler arrangement if your holding is small and personal. Use formal advice where legal ownership or creditor risk is unclear.
Questions & answers
Does cold storage pass an HMRC audit?
Cold storage can support an HMRC review. Back it with acquisition evidence, wallet records, transaction hashes and tax calculations.
Are exchange statements enough for bitcoin tax?
No. Keep CSV exports, trade confirmations, bank records, wallet transfers and GBP values for each disposal.
Does proof of reserves protect my bitcoin?
No. It may show assets, but not liabilities, client segregation or creditor treatment.
How long should I keep UK crypto tax records?
Keep normal Self Assessment records for at least five years after the 31 January filing deadline. This applies where the normal rule applies.
Should a company keep bitcoin on a hardware wallet?
Usually, keep long-term company reserves in documented cold storage. Use dual approvals, recovery rules and a succession plan.
Related sources
These articles can help you explore the topic in more depth:
