How to check a crypto exchange before you deposit

What are you really checking when you check an exchange?#

Asking whether a crypto exchange is safe mixes two separate questions. The first is legal: is this company allowed to offer its service to someone in your country? The second is practical: what happens to your coins once you deposit them?

The second question matters because a typical exchange account is third-party custody. The SEC describes it this way: you choose a custodian or service provider to hold your crypto, and if that custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto ^[1]. The UK regulator, the FCA, goes further and tells consumers to be prepared to lose all the money they put into crypto, naming sudden market moves, firm failure and cyberattacks among the reasons ^[2].

So the checks below do not make an exchange safe. They screen out fakes and unlicensed operators, and they show you which risks you are accepting. If you are still deciding whether to keep coins on an exchange at all, start with custodial vs non custodial wallet.

Where can you check if a crypto exchange is registered?#

Every country runs this differently, and the register that counts is the one where you live, not where the exchange says it is based. Our sources cover the UK, the EU and the US. The table shows where to look in each and what a match does and does not mean. If you live elsewhere, look for your national financial regulator's public register and its list of warnings. Our guide on how to check if a broker is regulated explains how registers work in general.

Sources: FCA firm checks ^[4]; FCA crypto scams page on ombudsman and FSCS ^[5]; ESMA statement on the end of the MiCA transitional period ^[6]; CFTC registration checks ^[7].

In the EU the date that matters is 1 July 2026, when the MiCA transitional period ended. ESMA has said it expects unauthorised providers to wind down their EU activities, and that clients of unauthorised providers, EU or non-EU, do not benefit from MiCA safeguards ^[6]. ESMA's interim MiCA register also includes a file of non-compliant entities providing crypto-asset services ^[8], which works as a warning list. For a wider picture of the rules, see crypto regulation.

How do you spot a clone or fake exchange?#

A real name on a register is not enough, because scammers borrow real names. The FCA describes clone firms as fake firms that use the name, address and firm reference number of real authorised companies ^[9]. Its advice is to make sure the contact details you have been given match those on the Firm Checker ^[4], and to use only the phone number and email address shown on the register ^[9].

Fake platforms can look convincing. The FCA warns that fraudsters build professional-looking websites and may manipulate the software to fake prices and investment returns ^[5]. A balance that keeps rising on screen proves nothing until you can withdraw it. The FCA suggests three questions to ask about any offer: were you contacted out of the blue, are you being pressured to invest quickly, and are the promised returns unrealistic ^[5]? More patterns are in our guide to crypto scams.

How do you check an exchange step by step?#

Do the checks in this order, and do them yourself. Type the regulator's address into your browser rather than following a link from an advert, a message or the exchange's own site.

1. Find the regulator for where you live

   In the UK that is the FCA ^[4], in the EU the ESMA register of MiCA-authorised providers ^[6], in the US FinCEN for spot trading and the CFTC and NFA for derivatives ^[7].

2. Search the official register by name

   In the UK, firms offering crypto products must be registered with the FCA or have permission to promote them, and the register also shows firms operating without permission ^[5].

3. Match every detail

   Compare the web address, email and phone number with the register entry. Different contact details are the classic sign of a clone ^[4].

4. Search the warnings

   If the FCA has published a warning about an unauthorised firm, it appears when you search the Firm Checker and register ^[4]. In the EU, check ESMA's list of non-compliant entities ^[8].

5. Read how it holds your coins

   Look in the terms for lending, staking or rehypothecation of customer assets, and for whether assets are pooled. The next section explains why.

6. Start with an amount you can afford to lose

   Deposit a small sum first and make a test withdrawal back to your own account. A withdrawal that works today does not prove the exchange is solvent, but one that stalls is a clear warning.

What should you find out about how it holds your crypto?#

The SEC's custody bulletin names two practices to look for. Some custodians use deposited crypto as collateral for their own purposes, such as lending, and some commingle customer assets instead of holding them separately for each customer ^[1]. Either one means your coins may not be sitting there, untouched, when you ask for them.

The usual safety nets are missing too. The SEC says the SIPC and FDIC protections that registered broker and bank accounts generally have do not exist for accounts at crypto asset entities, and that customers might lose legal ownership of deposited assets and might not get them back ^[10]. The UK's compensation scheme says it cannot protect you if a platform that exchanges or holds crypto goes out of business ^[11]. Our page on sipc fscs protection explains what those schemes do cover.

Account security is a separate risk you control. Turn on the strongest login protection the exchange offers before you deposit anything; see 2fa for crypto accounts.

Does proof of reserves show an exchange is safe?#

Some exchanges publish proof of reserves reports. The US audit regulator, the PCAOB, warned investors in March 2023 that these engagements are not audits and do not provide any meaningful assurance ^[12]. Two limits stand out. The procedures likely do not address the exchange's liabilities, meaning what it owes customers and others, and a report covers one point in time, so it says nothing about whether the assets were later used or lent out ^[12].

In other words, a report can count the coins in a wallet on a Tuesday without telling you whether they cover every customer balance, or whether they are still there on Wednesday.

Mistakes beginners make with checking a crypto exchange#

• Treating registration as protection

  In the UK, crypto exchange registration is for anti-money-laundering purposes ^[4], and most crypto activity there is not regulated ^[5]. A match on the register means the firm is allowed to operate, not that your coins are covered.

• Checking the name but not the contact details

  Clone firms copy the name, address and reference number of real firms ^[9]. The web address and phone number must match the register too.

• Trusting a high yield or an insurance claim

  Celsius advertised rewards as high as 18% a year and told customers it held a $750 million insurance policy for deposits; the FTC says those promises were false ^[13].

• Following an exchange link from a stranger

  Being contacted out of the blue is one of the FCA's three warning questions ^[5]. Find the exchange yourself, from the register.

• Depositing everything at once

  A small first deposit and a test withdrawal cost little. Moving your whole balance before you know how the platform behaves puts it all behind one company's doors.

Frequently asked questions#

The bottom line#

Before you deposit, check the register where you live, match every contact detail, search the warning lists and read how the exchange holds your coins. Then start small. None of this proves an exchange is safe: a custodian can still be hacked or fail, and crypto deposits usually lack bank-style protection. Keep only what you can afford to lose on any platform, and read the risk disclosure before you buy.

Education only. This page is not investment, tax or legal advice. Trading and crypto can lose you money. See our risk disclosure.