To check if a crypto exchange is safe, confirm it is authorised to serve customers in your country, find out who legally holds your coins, look for credible proof of reserves and strong security features, and test a small withdrawal before trusting it with more.
Key takeaways
- Authorisation in the EU is the first filter; check it on the official register yourself.
- Know which legal entity you sign up with and where your assets are held.
- Proof of reserves is useful but only shows part of the picture.
- Turn on strong security: app-based 2FA, withdrawal allow-lists and anti-phishing codes.
- Keep only what you need on any exchange and move long-term holdings to your own wallet.
Exchange failures have cost customers billions over the years. In most cases the warning signs existed: unclear ownership, no regulation, unrealistic yields or a lack of transparency. A few minutes of checking can save you from the worst outcomes.
The 10-point checklist
| # | Check | What good looks like |
|---|---|---|
| 1 | Authorisation | Listed on the ESMA CASP register or your national regulator’s register |
| 2 | Legal entity | Terms of service name a company that matches the register entry |
| 3 | Custody | Clear explanation of how client assets are segregated and stored |
| 4 | Proof of reserves | Regular attestations that include liabilities, not only assets |
| 5 | Security features | App or hardware-key 2FA, withdrawal allow-list, login alerts |
| 6 | Track record | Years of operation, transparent handling of past incidents |
| 7 | Fees | Trading, spread, deposit and withdrawal fees published clearly |
| 8 | Withdrawals | Withdrawals to your own wallet allowed and processed promptly |
| 9 | Support and complaints | Real support channels and a formal complaints procedure |
| 10 | Product promises | No guaranteed returns or “risk-free” yield offers |
1–2. Authorisation and legal entity
In the EU, companies offering crypto exchange or custody services need authorisation as a crypto-asset service provider under MiCA. Search the company on the ESMA register and, for Irish firms, the Central Bank of Ireland register. Then open the exchange’s terms of service and find the exact legal name you are contracting with. Global brands often operate through several companies, and the one serving you may be different from the one holding a licence. Our MiCA guide explains what authorisation means.
3–4. Custody and proof of reserves
Ask who controls the private keys to your coins and whether they are kept separate from the company’s own funds. Look for an explanation of cold storage and insurance, and read the limits of any insurance carefully.
Proof of reserves (PoR) is a cryptographic or audited report showing that the exchange holds customer assets. It is a good sign, but it has limits: a snapshot can be timed, and assets mean little unless liabilities are also shown. The strongest reports include both, are repeated regularly and are checked by an independent firm.
5. Security features you should switch on
- App-based or hardware-key 2FA instead of SMS, which can be hijacked by SIM swapping. See our 2FA guide.
- Withdrawal address allow-list, so funds can only go to addresses you approved earlier.
- Anti-phishing code shown in genuine emails from the exchange.
- Login and device alerts so you notice unknown access quickly.
If an exchange does not offer these basics, think twice.
6–8. Track record, fees and withdrawals
Search the exchange’s name with words like “withdrawal problems” or “hack” and read how it handled past incidents. A firm that disclosed a problem openly and repaid customers is very different from one that went silent.
Fees are not only the trading fee. The spread on “instant buy” buttons can be several times higher than the order-book fee, and network withdrawal fees vary. Our article on market vs limit orders shows how to pay less.
Most important: make a small test withdrawal to your own wallet early on. If withdrawals are slow, restricted or come with unexpected conditions, you have learnt something valuable cheaply.
9–10. Support and red-flag promises
A legitimate exchange has a support system, documented complaints handling and clear contact details. Be very wary of:
- Guaranteed or unusually high returns on deposits
- Pressure to deposit quickly to get a bonus
- Support that only works through private messaging apps
- Requests for your seed phrase or remote access to your computer
These are typical of fraud, not of a real exchange. Our crypto scams guide lists more warning signs.
How much to keep on an exchange
Even a well-run, authorised exchange is a company that can be hacked, frozen or fail. A sensible rule is to keep on an exchange only what you are actively trading and to store long-term holdings in a wallet you control. Compare options in hot wallet vs cold wallet.
Questions to ask before you sign up
Write down the answers as you research. If you cannot find them, that is information too.
- Which company will I have a contract with, and in which country is it based?
- Is that company authorised for the services I plan to use, such as custody and exchange?
- Where are customer assets held, and are they kept separate from company funds?
- What happens to my assets if the exchange becomes insolvent?
- How do I make a complaint, and is there an external body I can escalate to?
- What are the total costs of a typical buy, including the spread?
- How long do withdrawals take, and are there daily limits?
Earn, lending and staking products
Many exchanges offer extra products such as “earn” accounts, lending, staking or leveraged trading. These often carry different risks from simply buying and holding. Your coins may be lent to other parties, locked for a period or used in protocols outside the exchange. Read the specific terms of each product, check whether it is covered by the exchange’s authorisation and be very careful with anything promising a fixed high return. Our staking guide explains how real staking rewards are generated.
Warning signs after you have joined
Keep an eye on your exchange even after you sign up. Delayed withdrawals, sudden new limits, a change in terms that moves you to a different company, or support that stops responding can all be early signs of trouble. If you notice them, move funds you do not need for trading to your own wallet promptly.
FAQ
Is a regulated exchange risk-free?
No. Regulation adds rules on custody, conduct and complaints, but the value of crypto can fall sharply and crypto is not covered by deposit guarantee schemes.
What is the most important check?
Confirm authorisation on an official register and make sure the legal entity in the terms matches it.
Does proof of reserves mean my money is safe?
It shows the exchange held certain assets at a point in time. It is more meaningful when liabilities are included and reports are regular and independently checked.
Should I use an exchange recommended in a social media group?
Check it independently first. Fake exchanges are often promoted in groups and through direct messages.
Next step: learn how to buy cryptocurrency safely and protect your account with two-factor authentication. This article is general information, not financial advice.
