Built by Security Engineers, Verified by Independent Auditors: Anchorage Digital's SOC 2 Type 2 Examination

Anchorage Digital was founded by two security engineers who believed the digital asset industry deserved better than security by assertion. That conviction shaped everything that followed: a custody platform designed around institutional-grade security architecture from day one, and a federal bank charter pursued on the premise that protecting client assets requires infrastructure and oversight built to a higher standard than the industry default. 

Today, Anchorage Digital, home to the first federally chartered crypto bank in the United States, is extending that same rigor to the independent, third-party attestations that have continuously validated its security controls dating back to 2021, by publishing the details of its SOC 2 Type 2 attestations.

‍What SOC 2 Type 2 is, and why it matters

SOC 2 is a voluntary, independent attestation framework developed by the American Institute of Certified Public Accountants (AICPA), built around five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is the required baseline; organizations choose which additional criteria to include based on what's relevant to their business.

Anchorage Digital's SOC 2 reports cover security, availability, and confidentiality,  the criteria most directly tied to how Anchorage Digital safeguards digital assets for institutions.

A SOC 2 report can be a Type 1 or a Type 2. A Type 1 report assesses whether an organization's controls are properly designed as of a single point in time. A Type 2 report goes further: it evaluates whether those controls operated effectively over an extended period, in Anchorage Digital's case, a 12-month window. Type 2 is the stronger, more rigorous standard, and it's the one Anchorage Digital has maintained since shortly after first pursuing SOC 2 in 2021.

Anchorage Digital also maintains SOC 1 Type 2 reports, a related but distinct attestation focused on internal controls over financial reporting, which institutional clients' own auditors often rely on when validating asset balances held in custody. Between SOC 1 and SOC 2, Anchorage Digital maintains four reports in total across its custody offering.

‍Critical scoping considerations for digital asset custody

Most companies that disclose having a SOC 2 report stop there. Few describe what the report actually covers, and SOC 2 predates crypto entirely, so a report can be scoped narrowly enough to say very little about how a custodian actually protects client assets.

Anchorage Digital's SOC 2 reports are scoped to include the controls around its private key management infrastructure: the hardware security modules (HSMs), signing processes, and authentication architecture that sit at the center of how Anchorage Digital secures client assets. That scope has been part of Anchorage Digital's SOC 2 reports from the beginning. In an industry where SOC 2 reports don't always extend to key management, Anchorage Digital's independent auditors have tested the controls that matter most for asset security, not just the controls around the infrastructure and IT processes surrounding them.

‍What this means for clients:

• Independently verified key security: Anchorage Digital's SOC 2 Type 2 examination specifically tests the controls protecting private key generation, signing, and authentication.
• Sustained, not one-time, assurance: Type 2 status means these controls have been tested for effective operation continuously over a rolling 12 month reporting period, not just verified as designed.
• Attestation alongside a federal charter: Anchorage Digital pairs its OCC bank charter with independent SOC 1 and SOC 2 attestation reports, a combination few in the digital asset industry can offer.
• A clean track record on security, specifically: Since Anchorage Digital's reports began, its security control domain has had no testing exceptions.

SOC 2 Type 2 status isn't earned once and set aside, we re-demonstrate annually for a 12 month reporting period, through controls that hold up under continuous testing. As Anchorage Digital and its client base continue to grow, that ongoing validation remains part of how Anchorage Digital operates, not a one-time announcement. To learn more about our SOC 2 status, please get in touch.