Independent verification. Every 30 days.
Monthly third-party attestations across reserves, SPV structure, proof of reserves, and operational controls. Plus the full document pack — Cayman legal opinions, SOC 2, DPA — available under NDA in one business day.
Request the full pack
Cayman legal opinions, SOC 2, pen test summaries, AML policy, DPA. One business day turnaround under signed NDA. Cite artifact IDs in your request to scope quickly.
Monthly Attestation Reports
Public reports. Every report is produced independently and made available for download within 15 days of period close.
| Report Date | Period | Type | Auditor | Download |
|---|---|---|---|---|
| April 15, 2026 | March 2026 | Reserve Attestation | Accountable | Download PDF |
| March 15, 2026 | February 2026 | Controls Review | Accountable | Download PDF |
| February 15, 2026 | January 2026 | Reserve Attestation | Accountable | Download PDF |
| January 15, 2026 | December 2025 | SPV Verification | Accountable | Download PDF |
| December 15, 2025 | November 2025 | Proof of Reserves | Accountable | Download PDF |
| November 15, 2025 | October 2025 | Reserve Attestation | Accountable | Download PDF |
Our Independent Verifier
One specialised third-party firm across all four attestation areas. SOC 2 Type II is run separately by a Big Four auditor.
Accountable
Sole attestorSpecialised independent verification provider for tokenized asset issuers. Performs the monthly reserve attestation, the cryptographic audit of the Merkle-tree proof of reserves, and the periodic SPV and controls reviews.
Engagement type: Agreed-Upon Procedures (AUP) and attestation engagements. Scope and limitations disclosed on the face of each report.
Four Areas of Attestation
Each monthly cycle covers one of these four areas, ensuring the full trust stack is independently verified every quarter.
Reserve Attestation
Independent verification that total on-chain Flo token supply is fully backed 1:1 by custodied positions at Interactive Brokers and Alpaca. Covers stocks, bonds, ETFs, and private credit across every supported chain.
SPV Verification
Confirmation that Flo Issuance SPV remains a properly structured SPV under Cayman Islands law, with the trust-like shareholding and independent director in good standing, and that the note program documentation remains current and consistent with the on-chain register.
Proof of Reserves
Cryptographic audit of the Merkle-tree-based proof of reserves system. Verifies that the on-chain root hash correctly represents all liabilities and that none are omitted from the tree.
Controls Review
Assessment of operational controls including access management, key custody, multi-sig governance, incident response readiness, and change management.
Legal & Regulatory
Under NDACorporate documents, legal opinions, regulator correspondence. Request by artifact ID.
Certificate of Incorporation · Cayman registry extract
Incorporation documents for Flo Issuance SPV. Confirms SPV status, single-purpose charter, independent director appointment, and the trust-like shareholding arrangement.
Note program · Offering memorandum · Terms & conditions
Governing documentation for the blockchain-based structured notes. Defines the instrument, the reference underlying, holder entitlements, transfer mechanics, and the on-chain / off-chain register model.
Cayman legal opinion (addressee-specific)
Opinion letter covering SPV corporate existence, due authorisation, note program enforceability, structure bankruptcy remoteness, and the trust-like shareholding arrangement. Issued on counsel letterhead to named addressee.
US securities memo
Analysis of US distribution under Reg D / Reg S, accredited-investor standards, and the allowlist enforcement at the token contract level.
Brazil distribution memo
Analysis of CVM regime, distribution constraints, and the licensed-partner structure for Brazilian end users.
Compliance & Data
Under NDASOC 2, pen tests, AML / sanctions policy, DPA template.
SOC 2 Type II report (or bridge letter)
SOC 2 Type II is in progress — Year-1 observation window under way. Bridge letter and final report available on completion.
Penetration test executive summaries
Executive summaries of the most recent application and infrastructure pen tests. Remediation status and retest confirmation included.
AML & sanctions policy
Entity-level Cayman AML Regulations program, CIMA-aligned AML officer structure, OFAC / EU / UK / UN / Cayman FRA sanctions screening methodology, and contract-level denylist enforcement.
Data Processing Agreement (template)
Standard DPA for partners whose distribution reaches EU or UK data subjects. SCCs included where needed for onward transfer.
Smart Contract
Under NDA for drafts; audit reports publicArchitecture documentation and the two independent audit reports.
Smart contract architecture
Architecture document covering mint controller, redeem controller, position ledger, bridge adapter, and the sanctions-enforcement hooks. Published diagrams and state machines.
Smart contract audit reports (3×)
Independent audit reports from Sherlock, Hellborn, and Cantina. Issues categorised by severity, remediation status, and retest confirmation.
Reserves
PublicAttestations are public. Request the bundle or browse the monthly table above.
Most recent proof-of-reserve attestation
Latest monthly attestation. Total tokens per series, total underlying by CUSIP, 1:1 reconciliation, independence statement.
Historical attestations (trailing 12 months)
Twelve most recent monthly attestations with auditor cover letters. Download as a single bundle.
How to Request
Artifacts under NDA are shared on a named-addressee basis. The process is designed to take one business day.
Email compliance@flo.finance
Cite artifact IDs (L-03, C-01, etc). Include the counterparty entity and the signatory who will execute the NDA.
Mutual NDA
We send our standard mutual NDA. Turnaround is typically a few hours. We accept reasonable markups.
Receive materials
Artifacts delivered via secure share to named recipients. For legal opinions, counsel issues the letter on letterhead to the named addressee.
Follow-up call
Optional review call with our legal and security leads to walk through anything your team flags.
12× per year vs industry standard 4×
Most protocols publish quarterly attestations at best. Flo publishes monthly — giving you 3× the assurance touchpoints and significantly reducing the window of unverified operation.