Going Public as a Digital Asset Company: Six Factors CFOs and Auditors Must Address

Taking a digital asset company to a US public market is no longer a theoretical exercise. IPO activity in the sector is picking up, and with it comes a set of accounting, audit, and governance obligations that most private crypto firms are simply not built to handle on day one. BDO has outlined six areas where preparation can make or break the process. For CFOs, audit committees, and the accounting firms advising them, the details matter as much as the headline.

Why the IPO Bar Is Higher for Digital Asset Companies

Traditional IPO readiness frameworks assume companies already operate with quarterly close cycles, mature internal controls, and established audit relationships. Many digital asset firms do not. They are frequently young, fast-growing, and built around technical infrastructure rather than financial reporting infrastructure. The gap between where most crypto companies operate and where the SEC expects public companies to be is significant, and closing it takes longer than most leadership teams anticipate.

The accounting complexity is real. Crypto financial statements prepared under US GAAP must reflect current standards including ASC 350-60, which requires companies to carry certain crypto assets at fair value with changes recognised in net income each period. That is a departure from the indefinite-lived intangible asset model that applied before, and it has direct implications for earnings volatility, EPS calculations, and how analysts will read the numbers. Companies that have not already adopted ASC 350-60 and stress-tested its impact on their reported figures are starting from a material disadvantage.

The Six Critical Factors

1. Financial Reporting Fit for Public Markets

Public company financial reporting is a different discipline. SEC requirements introduce quarterly filings, accelerated year-end deadlines, segment reporting, earnings per share disclosures, detailed revenue recognition notes, and a full Management's Discussion and Analysis section. For a private crypto firm accustomed to annual or ad hoc auditor engagement, the operational shift is substantial.

In-house accounting expertise becomes non-negotiable. Teams need to be fluent in the technical accounting rules that apply specifically to digital assets, including how to classify holdings, how to measure and disclose fair value, and how to handle situations where market data is thin or token structures are novel. The gap in qualified talent is a real constraint, and companies that underinvest here tend to surface audit findings late in the process when remediation is most expensive.

For accounting firms advising these clients, this is also a staffing and skills question. Engagements that touch crypto financial statements under US GAAP now require practitioners who understand not just the standard but the underlying technology well enough to evaluate management's assertions about asset classification, custody, and valuation inputs.

2. Internal Controls and SOX Compliance

Section 404 of the Sarbanes-Oxley Act is where many digital asset companies face their steepest climb. The requirement for an external auditor's opinion on internal controls over financial reporting, under Section 404(b), means that control gaps do not stay internal. A material weakness identified and disclosed publicly can damage investor confidence, trigger remediation requirements, and extend the timeline to a clean audit opinion.

Digital asset companies tend to move fast and deprioritise formalised controls in their early years. That works in a private context. It does not work under PCAOB standards. Controls over digital asset custody, private key management, transaction reconciliation, and valuation inputs are all areas where auditors will probe, and where gaps are likely to exist if controls have not been purpose-built for a public company environment.

The practical advice here is to begin the SOX readiness assessment early, well before the filing window. Identify control owners, document processes, and test for design and operating effectiveness before external auditors do. Companies that treat SOX as an IPO checklist item rather than a foundational build tend to find themselves in remediation cycles that push timelines and costs upward.

3. Regulatory and Compliance Obligations

Going public does not reduce regulatory obligations — it layers on new ones. Digital asset companies must maintain KYC and AML programmes that meet the same standards expected of traditional financial institutions, alongside the SEC-specific requirements that come with public company status.

Board structure is a concrete requirement. Both the NYSE and NASDAQ mandate independent directors, audit committees, and compensation committees. Proxy statements, Form 4 filings for insider transactions, and Form 8-K disclosures for material events become recurring obligations. Insider trading policies, whistleblower programmes, and investor relations protocols all need to be in place and demonstrably operational, not just documented.

Companies that invest early in integrated governance and compliance systems tend to reach SEC readiness faster and with fewer late-stage surprises. The systems question is also relevant for accounting firms helping clients manage ongoing obligations post-IPO, where the volume and cadence of required disclosures demands process discipline rather than reactive reporting.

4. Data Governance and a Single Source of Truth

This factor is where crypto companies face a challenge that traditional IPO candidates do not. Digital asset businesses typically pull data from multiple sources: trading platforms, blockchain networks, custody providers, and financial ledgers. These systems often do not talk to each other natively, and the data they produce is not always consistent in format, timing, or completeness.

For crypto financial statements to be auditable, the underlying data must be complete, accurate, accessible, and traceable. Valuations, transaction histories, and custody records all need to reconcile to a single authoritative source. High-quality data also enables the kind of financial modelling and performance metrics that public market investors expect. Poor data quality, by contrast, drives up audit costs and creates the kind of credibility questions that are very hard to walk back once they surface in a filing review.

The recommendation is to consolidate data architecture before entering the IPO process. That means establishing a unified data model that integrates across all operational systems and produces outputs that auditors can rely on without extensive manual intervention. For CFOs, this is not an IT project that can be delegated and forgotten. It is a financial reporting infrastructure decision with direct audit implications.

The accounting treatment that flows from this data, whether under the FASB fair value model or for companies with cross-border operations that also navigate the question of IFRS and FASB crypto accounting divergence, depends entirely on the quality and completeness of the underlying records.

5. Cybersecurity Controls and SEC Incident Disclosure

The SEC's cybersecurity disclosure rules require public companies to file a Form 8-K within four business days of determining that a cybersecurity incident is material to the registrant's operations. For a digital asset company operating in a 24/7 environment where token valuations fluctuate continuously, assessing materiality in real time is genuinely difficult. The window is compressed, the stakes are high, and the technical complexity of a blockchain-based breach is often greater than that of a conventional network intrusion.

Boards and CISOs now carry explicit responsibility under these rules. For digital asset companies, where all transactions, assets, and wallets exist in digital form, a successful attack can affect both the balance sheet directly and the disclosed value of holdings simultaneously. That dual exposure makes cybersecurity governance not just an IT concern but a financial reporting concern.

IPO preparation should include establishing a documented incident response framework with clear materiality assessment criteria, defined escalation paths, and pre-drafted disclosure templates. Waiting until after an incident to build this infrastructure is not a viable position for a public company.

6. Talent Acquisition and Executive Compensation Disclosure

The moment a company files for an IPO, its executive compensation becomes public. That transparency creates a poaching risk at exactly the point when retention is most critical. Digital asset companies compete for a narrow pool of professionals with combined expertise in tokenisation, blockchain architecture, cybersecurity, and financial compliance. Losing key people during the IPO process can disrupt the filing timeline and raise questions about operational continuity.

Compensation benchmarking before filing is a practical step. Understanding where the company sits relative to industry peers allows leadership to structure packages that are competitive enough to retain talent through the transition and beyond. Some companies are using equity award plans to align incentives with long-term performance, which also serves as a retention mechanism during the volatility that can follow a public listing.

Accounting and Audit Implications: A Structured View

What Accounting Firms and CFOs Should Prioritise Now

The common thread across all six factors is lead time. Most digital asset companies that run into problems during an IPO process do so because they underestimated how long it takes to build the financial reporting, control, and governance infrastructure that public markets require. The accounting and audit work is not a final-stage sprint — it is a multi-year build.

For accounting firms, the opportunity is to engage early as a readiness adviser rather than arriving at the engagement as a year-end auditor. Clients who are considering a public listing in the next two to three years need to hear now about the SOX readiness timeline, the ASC 350-60 adoption implications for their reported figures, and the data architecture changes required to produce auditable crypto financial statements.

For CFOs inside digital asset companies, the six factors map directly to functional ownership: financial reporting, internal controls, compliance, data, cybersecurity, and talent. Each of those functions needs a named owner, a gap assessment, and a remediation plan before the IPO window opens. Given the current pace of SEC activity around crypto rules, the regulatory environment itself may shift during the preparation period, which is an additional reason to build flexibility into the programme rather than treating it as a fixed checklist.

Frequently Asked Questions

How does ASC 350-60 change the financial statements of a digital asset company preparing for an IPO?

ASC 350-60 requires companies to measure certain crypto assets at fair value each reporting period, with changes flowing through net income. For IPO candidates, this means earnings will reflect unrealised gains and losses on digital asset holdings, which can increase reported income volatility and affect EPS figures that public market analysts use to value the company. Management's Discussion and Analysis sections will need to explain this volatility clearly to investors.

What does SOX Section 404(b) require from a digital asset company going public?

Section 404(b) requires an external auditor to issue a public opinion on the company's internal controls over financial reporting. For digital asset companies, this means auditors will test controls over areas such as private key management, digital asset custody, transaction reconciliation, and valuation processes. A material weakness identified at this stage is disclosed publicly and can delay the IPO or reduce investor confidence.

Why is data governance treated as an IPO readiness factor rather than just an IT issue?

Because auditable crypto financial statements depend on data that is complete, consistent, and traceable to source. Digital asset companies typically operate across multiple trading platforms, custody providers, and blockchain networks that produce data in different formats. Without a unified data model, auditors cannot efficiently verify the figures that appear in filings, which drives up audit costs and increases the risk of restatement.

What are the SEC's cybersecurity disclosure requirements for digital asset companies that go public?

Under rules the SEC adopted in 2023, public companies must file a Form 8-K within four business days of determining that a cybersecurity incident is material to their operations. For digital asset companies where a breach can affect token valuations and custodied assets simultaneously, establishing a documented materiality assessment process and a pre-defined escalation path before listing is an essential part of IPO preparation.

How should an accounting firm structure its advisory engagement for a digital asset IPO client?

The engagement should start well before the filing window, ideally eighteen to twenty-four months out. The early phase should focus on a gap assessment against SEC reporting requirements, ASC 350-60 adoption review, a SOX 404 readiness assessment, and a review of the client's data architecture and controls over crypto financial statements. Aligning with PCAOB expectations early reduces the risk of late-stage findings that compress the IPO timeline.

Source: BDO Insights