✔️Checklist of Activities

1. General & Scoping

1a. Determine the Entities & Platforms In-Scope

• Diagram of Key Platform Databases Mapped to Underlying Custodial Arrangements

• Strategy for Demonstrating Segregation of Customer Databases & Underlying Assets to Attest Providers

• Determination of In-Scope Platforms

1b. Determine the Customer Liabilities & Assets In-Scope

• Description of Each Platform Liability Type

• ‘Balance Sheet’ of Platform Liabilities mapped to Underlying Collateral Assets

• Strategy to Demonstrate No Additional “Claims” (Liabilities) on Identified Collateral Assets

• Finalization of In-Scope Asset/Liability Pairs for the Proof of Reserves

1c. Determining the 'Snapshot Time'

• Determine a specific point in time for the Proof of Reserves snapshot

• Determine Reporting “Cadence” (i.e. monthly, quarterly, semi-annually)

• Strongly Encouraged: Develop a system whereby historical balance snapshots can be extracted from the system.

1d. Creating an Architecture Diagram

• Provide an overview diagram of the underlying database architecture, databases, and tables that are instrumental in generating the Customer Liability Extract Data.

• Illustrate the general wallet/private key architecture through a comprehensive diagram.

---

2. Creating the Customer Liability Extract (CLE) Summary

2a. Overview of the CLE

• Be 100% confident in your CLE, as it will be “sealed” with a Merkle Root Hash. Perform a Test Run (or multiple) with and without your attestation provider

• The CLE format should be TXT, CSV, or Excel formats

• Read the next sections to learn how to approach each CLE component

2b. Aggregating & Segregating Customer Liabilities

• Decision on how to present customer liabilities on the platform: Either aggregated into one total balance (per asset) or segregated by liability types like Margin and Spot Account (or combo).

• Report Example (w/ Column Headers) reflecting the in-scope asset/liability pairs and the formatting of customer liabilities

2c. Creating the Hashed User IDs

• Determine a Methodology for Creating a Unique Hashed User ID for each customer

• Generate a unique 'Hashed User ID' for each customer (before the extraction of the CLE).

2d. Script(s) to Extract Customer Liability Extract (CLE)

• Create a CLE extraction script(s)

• Ensure the script(s)’ logic considers includes/excludes the appropriate accounts and customer liabilities

• Provide the script(s) to you attest provider

2e. Formatting the Customer Liability Extract (CLE)

• Modify the formatting of the Customer Liability Extract according to the guidelines notes above

2f. Preparing for the Attestation Observation

• Perform an internal test run

• Perform an observation “Test Run” with the attestation provider

• Execute the observation “Production” run with the attestation provider, for which the CLE output will be the input for the Merkle Tree Generator

---

3. Merkle Tree Generation & Customer Verification

3a. Generating the Merkle Tree

• In collaboration with the attestation provider, agree to a Merkle Tree Generator to be used for the Proof of Reserves.

3b. Dataset Padding

• Determine if “Padding” is desired to be added to the dataset

• If so, determine the total desired number of records and determine the amount of “padded” records are to be added

• If so, determine the distribution of strategy of the “padded” records

3c. Recalculating the Merkle Tree

• Recommended: Inspect and understand the logic of the Merkle Tree Generator

• Recommended: Re-create the Merkle Tree using the Merkle Tree Generator and ensure the Merkle Root Hash matches the output ascertained by the attest provider.

3d. Verifying a User ID in the Merkle Tree

• Create an easily accessible "Proof of Reserves" section on your platform, ensuring users can readily locate and copy their Hashed User IDs for each PoR audit

• Embed or provide a direct link to The Network Firm's independent PoR widget for seamless balance verification.

---

4. Proving Ownership & Balances of Your Assets

4a. Compiling a List of your Assets

• Compile a list of custodial arrangements and the availability of the balance information

4b. Proving On-Chain Assets

Extracting Balance Information

• Determine if Community or Attestation Provider Tools Exist to pull Historical Balance Information

  • If yes, the attestation provider can extract the balances after the snapshot date

  • If not, the attestation provider may have to observe the balances with Management as of the snapshot date/time

• If necessary, determine if the proposed tools accommodate to a large number of addresses

Proving Ownership of Addresses/Wallets

• Determine a “Proof of Ownership” strategy for each in-scope addresses

  • If Digital Signature Method, sign a message provided by the attestation provider for each in-scope addresses

  • If Send to Self method, execute a transaction with an amount provided by the attestation provider for each in-scope address

• Provide a List (Excel, CSV, or TXT) to your attestation provider with the corresponding digital signature or transaction hashes for verification.

4c. Proving "Off-Chain" Assets

For each of the custodial arrangements:

• Identify the most feasible approach to extract balances and prove ownership of the off-chain assets

• Execute account observations with the attestation provider, if needed

• Notify counterparties or custodians and request to send statements directly to attestation provider

• Provide the appropriate accounts statements, or alternative method of providing the balance information to the attestation provider

---

5. Attestation Reporting & Level of Disclosure

• Draft Procedures (w/ the help of your attestation provider, if desired)

• Discussing the Procedures w/ your attestation provider

• Making Key Presentation/Disclosure Considerations for Contentious Items