Articles Neil Hodge Jun 01, 2022
Companies such as Amazon, Coca-Cola, and Starbucks are making the leap to accept cryptocurrencies, in response to growing consumer demand. As the number of crypto transactions rises to unprecedented levels, organizations and their internal auditors must assess the processes and risks involved with these often-volatile digital currencies.
More and more, organizations are using cryptocurrencies to facilitate payments and reach out to customers, driven by the ease, speed, and low-cost of transactions. Companies across a wide range of industries have already made the leap. Corporate giants Amazon, AT&T, Coca-Cola, Microsoft, and Starbucks all accept cryptocurrency payments. Luxury goods brands, such as watchmaker Hublot, also have been early adopters, while last year boutique hotel group Pavilion Hotels & Resorts started allowing its guests to pay in up to 37 cryptocurrencies.
Even payment firms such as Mastercard and PayPal are allowing crypto coins. In its first earnings call of 2022, Visa said it has processed more than $2.5 billion worth of payments with crypto-linked cards in its first fiscal quarter.
Indeed, crypto is rapidly being seen as an effective way to do business. According to a survey released in April by global payments provider Checkout.com, Demystifying Crypto: Shedding Light on the Adoption of Digital Currencies for Payments in 2022, crypto is rapidly gaining in appeal among younger demographics in particular. The survey notes that 40% of consumers 18 to 35 years old want and plan to use cryptocurrencies to pay for goods or services within the next year. In fact, consumer demand appears to be outpacing the willingness of online retailers to facilitate crypto payments, as only 23% of online businesses surveyed say they are planning to accept them.
“Even though the market and the technology are still evolving, the number of crypto transactions is rising massively, which indicates that cryptocurrencies are only going to become more popular,” says Tim Davis, principal and U.S. Blockchain & Digital Assets leader for Risk & Financial Advisory at professional services firm Deloitte in Seattle. “It therefore makes sense for some companies to start moving toward crypto now so that they are prepared to offer crypto payments for when the market is in full swing.”
Moving to crypto payments can bring several advantages. A survey released in September 2020 by Bitcoin, found that up to 40% of customers who pay with crypto are new to the merchant and spend around twice as much as those making credit card purchases. They also pay less in transaction fees.
Crypto also provides a range of other benefits that transacting in traditional, fiat currencies, such as the U.S. dollar, U.K. sterling, and the euro, do not offer, Davis says. For example, cryptocurrencies can enable real-time and accurate revenue-sharing while enhancing transparency to facilitate back-office reconciliation. They also enable simple, real-time, secure money transfers and cut foreign exchange costs, as well as the need for organizations to maintain bank accounts in separate currencies.
However, while adopting crypto may gain some attention and provide a potential competitive advantage, organizations need to be clear about why they think it is a good idea for both themselves and their clients before they make the move. As a result, internal audit has a role to play in making sure “those involved in formulating the strategy — namely the board and senior management — know what benefits they want to realize,” Davis says, “while also making sure those involved in implementing the project, such as compliance, legal, IT, finance, and risk management, know what the risks are and how to manage them.”
Davis says one of the easiest ways to facilitate payments is to rely on a third party to convert crypto in and out of fiat currency to receive or make payments. This approach will typically require the fewest adjustments to internal processes and IT systems, too.
Davis adds that the third-party provider also will handle most of the technical questions and manage much, but not all, of the risk, compliance, and control issues on behalf of the company. He warns that “organizations need to remember that while they can outsource the processes, they are not outsourcing their own legal responsibilities and liabilities. Companies still need to ensure that applicable anti-money laundering/know your customer controls are in place to monitor crypto transactions, as well as ensure that their payment processes comply with applicable sanctions.” That is even more the case now given the financial sanctions imposed by many governments against key Russian individuals, financial institutions, and companies, following Russia’s invasion of Ukraine.
Companies also need to ask their third parties some key questions, especially regarding the way they operate, their levels of cybersecurity, and how financially resilient they are. This is particularly necessary given the swings in price volatility associated with crypto coins. Typical questions include:
Ideally, Davis says, the vendor can provide some third-party assurance about these issues, such as a System and Organization Controls (SOC1 or SOC2) report. Companies also need to understand the vendor’s conversion pricing to determine whether they are at risk of price volatility.
Amy Park, U.S. Audit & Assurance Blockchain & Digital Assets partner at Deloitte in Chicago, says because the crypto market — and regulation of it — is still evolving, “companies need to ensure that the third-party vendors they are using are able to keep up with the changing licensing and regulatory environment across multiple jurisdictions.”
For example, she says, companies need to understand what processes and controls the vendor has in place and know whether the vendor can provide adequate technical support and information across different jurisdictions. They also need to find out what level of information the vendor will be able to provide related to its crypto transactions to ensure the company can comply with the tax, accounting, and reporting requirements needed for its financial records, such as the time, date, and value of the crypto at the time of receipt.
Using crypto as a means of exchange similarly to fiat currencies presents particular accounting challenges, Davis says. Crypto is generally considered an intangible asset. It may warrant adjustments or additional disclosures to profit and loss and cash-flow statements, among other financial documents.
Meanwhile, for tax purposes, the use of crypto for receiving or making payments may be treated as a barter transaction (a nonmonetary exchange of goods, services, or nonfinancial assets between two counterparties). Also, price volatility may impact how crypto assets are valued for accounting and tax purposes.
In addition to accounting considerations, companies need to assess which of the 18,000 types of crypto coins they should use. Bitcoin and Ethereum are the most widely used cryptocurrencies, but they are still highly prone to price volatility. A sell-off this year has sent the value of crypto coins down sharply, with Bitcoin down 37% so far in 2022.
Instead, a somewhat less-risky way to enter the market may be to use stablecoins. These crypto coins often are pegged to specific fiat currencies, which means they may be more stable and safer to use. For example, USDC is a coin built on the Ethereum network that is pegged to the U.S. dollar. Stablecoins are not risk-free — they are only as financially stable as their issuers, and some fell beneath their tether value recently — so companies should check their liquidity.
“Crypto payments make a lot of sense for many businesses, but organizations need to have a clear understanding of what the process involves and what the potential benefits — and risks — are,” Davis says. “Internal audit can have a strong role in that process.”