Where in the report do they verify off-chain liabilities?
> 14) Compare the total liabilities from the Client Liability Report extracted from Kraken’s production database as observed within Procedure 5 to the total assets controlled by the Kraken custodied addresses (the “In-Kind Assets”) as of the specified date and time of the assessment time and calculate the collateralization ratio based on the In-Kind Asset-to-Client Liability mapping provided by Kraken Management
Ex: I am Kraken. Someone deposits 1 BTC with me. I then sign a contract with someone else saying "You give me 1 BTC now, I will give you 1.2 BTC in a year". I then sell 1 BTC. In my wallet, I will have 1 BTC, exactly matching my client liabilities. But my total liability is 2.2 BTC. And if those contracts start calling in early (IE, margin calls), I'll end up in a liquidity crisis.
Or more simply, what if Kraken just uses the BTC as collateral for normal loans from a bank? If they fail to pay them, then they'll fork over the client BTC.
Your defense against these tail risks is to remember, "not your keys, not your coins", and self-custody when you're not actively exchanging. In the end you do have to hope that the < 1 hour it takes you to exchange your coins and transfer them back to your own wallet doesn't overlap with the moment they decide to torpedo their 10+ year old business with no prior warning or red flags. But these are infinitesimally small tail risks.
But there is a very easy way to prove that there are not contracts external to the blockchain.
That's the whole point of an audit.
And it's very telling that they don't want their books audited, but repeatedly point to a clearly incomplete (from the perspective of someone who is concerned that the business might go under) as proof of solvency.