Most blogs, including ours, operate on the WordPress content management system, the most popular blogging platform in the world. Last year WordPress began accepting a new, secure digital currency called bitcoins for payments and donations. This new currency combines open source software with cloud computing to dramatically lower the cost and delay of transferring funds.
Bitcoins are bought with dollars, euros, and other conventional currencies on centralized exchanges much like any other liquid asset. The currency is currently in a bull market, with the price of one bitcoin increasing from $5 to almost $18 over the past year.
Once purchased, bitcoins are used to make payments for goods and services using a distributed transaction clearing system (PDF). Instantaneous fund transfers cost less than a penny and are free if rapid execution is not a priority. The clearing system continuously broadcasts all transactions between anonymous addresses (hashes of public keys) using a “block chain” or public ledger; the equivalent of check clearing between bank accounts. This level of transparency, combined with modern cryptography (SHA-256 & ECDSA), prevents any tampering or double spending.
Over the last couple of months approximately 1,000 merchants started accepting bitcoins thanks to a start-up called Bitpay. This trend has been driven by the low costs and high security of the Bitcoin payment processing system as well as the monetary stability of the underlying bitcoin currency. Perhaps the greatest advantage of Bitcoin over the current payment system is “immediate funds transfer” or IFT. Rather than wait for overnight clearing through ACH, CHIPS, or SWIFT, payments can be deposited or disbursed instantaneously wherever there is an internet connection.
From a financial and tax accounting point of view, bitcoins are the same as any other foreign currency. However, from an auditor’s point of view they do present an unprecedented peculiarity: the entire system relies on cryptographic proof rather than human trust. It is important for auditors to understand how to verify bitcoin transactions and value a company’s inventory of bitcoins.
The public ledger is called the “block chain” because it is a series of “blocks” that contain information about transactions. All of the bitcoin transfers from one address to another that have ever occurred are recorded in the block chain. This is very convenient for auditors since transactions recorded in the company’s internal systems can be instantaneously verified by searching the block chain for the company’s addresses. The block chain can be downloaded at the cut off date from Sourceforge and its integrity can be checked using the open source Bitcoin client. Not only does the block chain make payment verification simple, it also dramatically reduces the risk of defalcation while simplifying internal controls and bank reconciliations.
It is important for accountants and corporate treasurers to be aware that all bitcoin transfers are recorded in a public ledger and that transaction patterns may reveal the identity of an address. An astute competitor or investors could quickly develop a cash-flow statement from such information. For this reason, it is best practice to generate a new address for each transaction.
Bitcoins are stored in a digital wallet after they are received. The wallet can be cloud-based for mobile payments and browser access or stored on a local system to maximize security. Treasurers should be careful to divide funds into several different wallets stored on separate systems. Managers that would normally sign and countersign checks should similarly be entrusted with the passwords to prevent unauthorized payments.
Once the physical system is properly secured, the only potential threat is the password. Management should have a password policy that balances security with the risk of one person being responsible for an unrecoverable password. Internal control designers and auditors should consult with an I.T. specialist to ensure that the wallet is stored and backed up on encrypted drives attached to dedicated systems.
Similarly, audit teams should employ an I.T. specialist to verify the bitcoin balances held in wallets. Verification includes sending a traditional confirmation letter to a 3rd party wallet custodian and obtaining the balance from the block chain. Tools like Block Explorer make independently authenticating the existence of individual bitcoins straightforward and instantaneous. Control of the addresses themselves can be evidenced with walk-throughs as well as bitcoin transfers to and from an address controlled by the auditors.
After the amount of bitcoins at the balance sheet date has been established, the auditors need to verify that this amount is translated into the reporting currency pursuant to ASC 830-20-25. The currency translation from bitcoins to dollars is effectuated through an adjusting entry that contains the gains and losses reflecting changes in the exchange rate between bitcoins and dollars. This translation must also be done for receivables and payables the company expects to settle in bitcoins. The exchange rate used for measurement at the balance sheet date, called the current rate, can be observed on liquid markets like Mt. Gox.
Cash management with bitcoin is now finally entering the Internet Age: payments are processed around the clock, anywhere in the world, and with little to no transaction costs. We can expect that this disruptive innovation will transform the treasury function just as much as social media transformed marketing campaigns. Does your business accept bitcoin payments? How do you think internal controls and audit planning should adapt to this new digital currency?