XRP Exchange Proof of Reserves Checklist: Score the Evidence, Not the Slogan

By XORA · Published 2026-10-05

TL;DR: A reserve dashboard is only one of five things an XRP holder should inspect. This 100-point checklist gives 50 points to assets and liabilities together, then scores custody separation, withdrawal evidence and disclosure quality, because an asset-only snapshot cannot establish that customers can all be paid.

A score is a decision aid, not a safety guarantee. The practical rule is simple: if a platform cannot show the evidence, do not fill in the gaps with confidence.

Why a reserve number is not enough

An exchange may publish a large wallet balance, a glossy PDF or a green “100% backed” badge. None answers the complete question: are the assets controlled by the exchange at a stated time, and do they cover every customer claim at that same time? The Public Company Accounting Oversight Board’s 2023 investor advisory makes the limitation unusually clear. Proof-of-reserves reports are not audits, may only verify an asset type at one moment, and may not address liabilities, borrowed assets, controls or governance.

That distinction is not academic. In March 2024, the U.S. Department of Justice said FTX’s founder had stolen more than $8 billion of customers’ money. The point is not that every venue is FTX. It is that custody claims must be tested with more than a marketing statement.

The method below deliberately does not rank exchanges. It lets a holder assess a specific exchange report, on a specific date, for XRP. A score can change the next time the provider updates its report, changes its legal terms or pauses withdrawals.

The XORA 100-point evidence score

Start at zero. Award points only where you can open a primary document, complete the named verification or observe the stated control. Do not award partial points for a claim without a dated document. The weighting puts half the score on the core solvency question: assets plus liabilities.

Step 1: make the assets claim specific, 25 points

“We hold reserves” is not a testable statement. A stronger report identifies the snapshot date, the asset scope and how asset control was established. For XRP, ask whether XRP is expressly in scope. A company may publish a proof covering selected assets but not every product, account type, margin balance, affiliate or jurisdiction.

Best case: the report lists controlled on-chain addresses, explains ownership verification and ties the total to the provider’s report. If an exchange offers a Merkle-tree process, use it. Kraken, for example, documents a customer process to confirm a Merkle leaf and its path to the shared root for the relevant review date. That is useful evidence of inclusion, not a substitute for the remaining four categories.

Subtract no points because addresses are in cold storage or because you cannot personally audit a multi-signature setup. Instead, ask what the evidence actually proves. On-chain balances can demonstrate an address balance. They cannot, by themselves, prove the exchange owns the keys, has not borrowed the assets for the snapshot, or owes less than it holds.

Step 2: demand the liabilities denominator, 25 points

The essential calculation is:

Reserve coverage = verified in-scope assets ÷ verified in-scope customer liabilities × 100

For the full 25 points, the numerator and denominator need the same snapshot time, the same asset scope and a stated treatment of negative balances, loans, margin, earn products and affiliate obligations. A 105% assets figure is not meaningful if the liabilities figure excludes an entire account class. A 100% ratio also says nothing about the firm’s corporate debts; it only tests the stated customer liability set.

Read the provider’s procedure, not only its conclusion. The PCAOB warns that management can determine procedures in an agreed-upon-procedures engagement. Look for the provider name, engagement type, exact procedures and exceptions. “Attestation” and “audit” are not interchangeable words.

Step 3: score custody design, 20 points

Reserve math is weaker when legal and operational custody are vague. New York’s Department of Financial Services, in its updated 2025 custody guidance, says regulated virtual-currency entities should separately account for and segregate customer assets, maintain records that identify customer ownership and be ready to reconcile records against on-chain activity. Those are regulatory expectations for DFS-regulated entities, not a universal endorsement of any exchange. They are still a useful benchmark for questions to ask elsewhere.

Look for three separate pieces of evidence: a customer agreement describing beneficial ownership and treatment in insolvency; a policy separating customer assets from company assets; and a plain-language explanation of reconciliations, key management and third-party custody. A company can be technically sophisticated and still score poorly if it will not state who controls assets, how often records reconcile or what happens in a wind-down.

Do not confuse an insurance headline with full coverage. Check the named policy, covered asset type, policy limit, exclusions, jurisdiction and whether it protects every customer balance. If those facts are absent, it is not evidence for this category.

Step 4: observe the withdrawal path, 15 points

Solvency evidence is forward-looking only by inference. A withdrawal test is the only checklist item that observes a customer path, and it is deliberately worth just 15 points. A small withdrawal can prove that your account cleared ordinary checks, the XRP address and destination tag were accepted, and the exchange released the transaction at that time. It cannot prove that every customer can withdraw in a stress event.

Use an address you control, confirm the destination tag if the destination requires one, start with an amount you can afford to risk, and record the withdrawal ID plus the XRPL transaction hash. Compare the stated fee and processing time with the actual result. If the platform has a status page, review incident history and whether any paused service was explained with dates and scope. Never treat a successful test as a reason to deposit more than your risk limit.

Step 5: check whether disclosure can be audited by a reader, 15 points

Disclosure quality is the easiest area to fake with design and the easiest area to score with discipline. Full credit needs a date and time zone, named report provider, asset and liability scope, reserve ratio, method, exceptions, customer-verification instructions and an archive of prior reports. Dated history matters because one snapshot has less explanatory value than a series a reader can compare.

Use these score bands after tallying the five categories. 80 to 100 means the public evidence is comparatively complete, not that loss is impossible. 50 to 79 means material evidence is missing or limited, so reduce exposure and seek answers. 0 to 49 means the exchange has not supplied enough publicly verifiable information for a holder to rely on the claim. A missing liabilities number alone prevents a high score.

A 10-minute XRP evidence routine

1. Open the exchange’s report, save the URL and write down its exact snapshot date.
2. Search within it for “XRP,” “liabilities,” “scope,” “exceptions” and “procedures.”
3. Calculate or verify the coverage ratio only when assets and liabilities match in date and scope.
4. Read the custody agreement and identify who owns the assets, whether they are segregated and what lending or rehypothecation is permitted.
5. Run a small withdrawal only after checking the destination and tag, then save the XRPL transaction hash.
6. Repeat before a material deposit. Evidence ages, terms change and operational conditions move quickly.

Frequently asked questions

Is proof of reserves the same as an audit?

No. The PCAOB says PoR reports are not audits and may be limited to particular assets at a particular time. They may not test customer liabilities, borrowed funds, controls or future availability.

What should an XRP holder verify in a proof-of-reserves report?

Confirm that XRP is actually in scope, the report shows same-date assets and customer liabilities, the ratio is at least 100%, the provider and procedures are named, and you can verify your own balance inclusion where the exchange provides that tool.

Can an exchange have reserves but still be unsafe?

Yes. Assets alone do not show full liability coverage, customer legal rights, borrowing, governance, or whether withdrawal operations remain available. That is why this checklist weights five categories.

How often should proof of reserves be refreshed?

There is no universal standard. Treat undated or stale evidence as weaker, and recheck before a material deposit or after a change to custody, lending, product terms or withdrawal conditions.

Should I test an XRP withdrawal from an exchange?

A small test can verify the customer path at that moment, but it is not proof of solvency. Check the address and destination tag, keep the transaction hash, and never test with more than you can afford to risk.

Put verification before convenience

Exchange custody can be convenient for trading, but convenience should not turn a logo, badge or asset-only figure into a complete solvency claim. Use the score to make missing evidence visible, set a deliberate limit and recheck it when the facts change. For more XRP custody choices, see our guides to keeping XRP on an exchange, custodial versus non-custodial wallets and XRP security basics.

When you decide to put XRP to work, XORA is built for holders who do not want it idle on an exchange. XORA offers up to 22% APY value (15% native XRP yield, treasury-subsidised during a disclosed bootstrap, plus estimated XORA reward value). It is never guaranteed, and crypto carries real risk. Review the terms and custody model, then open XORA and send XRP when it fits your risk decisions.