Yes I think. For us the audit was part of our ISO27001 certification, but i'm pretty sure you can have other certification, as long as an official audit exist.

Basically, do you know the saying 'never roll your own crypto'? It's a bureaucratization of this saying (to avoid people getting sold insecure crypto). Agree or not on the idea that the government should control that (I'm torn tbh), but it isn't a way to force people into illegality to pressure them.