What technical challenges prevent the creation of Monero rich lists?
Without a rich list or transparent blockchain how can a business or charity publish proof of XMR reserves?
Using a combination of ring signatures (collections of cryptographic signatures with at least one real participant in each group) and stealth addresses (requiring the sender to create one-time addresses for every transaction they make), Monero effectively obfuscates transactions and account balances on the blockchain thus eliminating any possibility of "rich lists".
RingCT, which is currently under active development, will add further layers of anonymity to Monero transactions. Here is a link to the RingCT whitepaper: https://eprint.iacr.org/2015/1098.pdf
To respond to your second question, Monero's viewkey (a private key that shows all incoming account transactions) allows for optional transparency, thus allowing organizations to publish proof of their XMR holdings (but not grant spend access since the viewkey is more of a "look, but don't touch" tool).
In this sense, Monero is private by default due to its ring signatures and stealth addresses, and it is optionally transparent by way of the viewkey.
A richlist requires the ability to aggregate and accumulate outputs per account/address/owner/etc. This is not possible with Monero since every single output has its own one time address, which an observer can't unambiguously relate to any other.
With Bitcoin, address reuse is discouraged. With Monero, it is taken out of the user's decision: every output has its own address. An output's recipient is able to determine the output's private key, and thus spend it, but this requires the view private key, so an observer cannot do this, and this is unable to determine which outouts belong to the same account/address/owner/etc.
As for the second question, this seems to be a copy/paste of How can a business or charity publish proof of XMR reserves? so I will refer you to my reply there.
The business or charity can publish their public viewkeys.
Monero is private by default and public by choice.