The crypto exchange safety checklist
- MiCA authorisation: the EU entity appears in ESMA's register; check with the MiCA licence checker.
- Your country: the exchange has notified your country under its passport.
- The right website: the address matches the one in the register.
- Not on a warning list: search ESMA's non-compliant file and your regulator's warnings.
- A named company: the terms name the authorised legal entity you contract with.
- Published fees: a clear fee page, as MiCA requires.
- Fair terms: no unreasonable withdrawal holds, closure clauses or inactivity fees.
- A complaints procedure: published and free, as MiCA requires.
- Security features: app-based two-factor authentication and a withdrawal allow-list.
- Transparency on reserves: a proof of reserves report, where published.
Crypto exchange safety: what the licence covers
MiCA authorisation brings rules on client asset segregation, fee transparency, complaints and governance, explained in the guide to MiCA investor protection.
It does not protect against price falls, and crypto is not covered by deposit guarantee schemes.
Crypto exchange safety: your own account
Many losses happen through the customer's account rather than the exchange itself.
Crypto exchange safety guides
Crypto exchange safety and the Reliability Score
The Reliability Score turns several of these checks into points: the MiCA licence, the track record, transparency, identity checks, account protection and euro withdrawals.
Points are given only for facts confirmed from a public source, so a lower score can also mean that a provider documents less.
Crypto exchange safety: checks before, during and after
| When | Check | Tool |
|---|---|---|
| Before signing up | Authorisation, website, warning lists | MiCA licence checker |
| Before depositing | Two-factor authentication, email security | Account security check |
| Before buying | Total cost, including spread | Fee calculator |
| Before withdrawing | Network, address, test transfer | Withdraw to a wallet |
| Every year | Terms changes, share of savings, records | Portfolio share |
Crypto exchange safety: reading the terms
Terms of use are long, but a few sections decide most outcomes when something goes wrong.
- Who you contract with: the authorised EU entity should be named.
- Withdrawals: conditions, limits and the reasons a withdrawal can be delayed.
- Account closure: notice periods and how remaining assets are returned.
- Fees: including inactivity or custody fees.
- Delisting: what happens when a coin is removed.
- Complaints: the procedure and the template MiCA requires.
Reading the terms yourself is worth the time, because they decide what happens if something goes wrong.
Crypto exchange safety: signs of trouble at a platform
- Withdrawals suddenly delayed for many users without a clear explanation.
- New fees or conditions introduced to withdraw.
- Support that stops answering or answers only with templates.
- Unusually high yields offered to attract deposits.
- A regulator warning or a change in authorisation status.
None of these proves a problem on its own, but together they are a reason to reduce what you keep on the platform.
Crypto exchange safety: spreading the risk
Keeping everything at one provider means one point of failure.
For larger amounts, spreading holdings between two authorised exchanges, or moving long-term holdings to self-custody, limits the effect of any single problem.
The guide to exchange failures explains what happened when platforms collapsed in the past.
Crypto exchange safety and scams that impersonate exchanges
Many scams pretend to be a real, authorised exchange: fake support accounts, copied login pages and messages warning of a "problem with your account".
The safest habit is to reach your exchange only through a saved bookmark or its official app, and to ignore unsolicited contact entirely.
The guide to crypto scams lists the most common impersonation tricks.
Crypto exchange safety: what to do if you are worried
- Check the register for any change in the firm's status.
- Read official notices in the app or on the website, not on social media.
- Withdraw what you do not need to your bank or your own wallet.
- Keep records of your balances and transactions.
- Complain in writing if you are treated unfairly, as the complaints guide explains.
Crypto exchange safety: the licence check in detail
The licence check is the first item on the crypto exchange safety checklist because it separates regulated firms from everything else.
- Find the legal name in the website footer or terms of use.
- Search ESMA's register with the MiCA licence checker or on ESMA's site.
- Compare the website listed in the register with the address you use.
- Check the services: buying with euros needs "exchange of crypto-assets for funds"; holding coins needs custody.
- Check your country in the passport notification.
- Search the non-compliant file and your regulator's warnings, as the guide to warning lists explains.
Crypto exchange safety: how custody works
When you keep coins at an exchange, the exchange controls the keys, and your account shows a claim on coins held for you.
MiCA requires an authorised exchange to keep custodied crypto legally and operationally segregated from its own estate, and to be liable for losses caused by incidents attributable to it, up to the market value at the time of the loss.
Many exchanges also keep most coins in offline storage, but how much is held offline is a business decision rather than a figure MiCA sets.
Crypto exchange safety: euro balances
Euros sitting in an exchange account are not a bank deposit in your name.
MiCA requires the exchange to place client funds with a credit institution or a central bank by the end of the next business day, in an account separate from its own.
Keeping only the euros you need for planned purchases on the exchange limits your exposure.
Crypto exchange safety for different users
| User | Main safety focus |
|---|---|
| Beginner with a small amount | Authorised exchange, strong login security, avoiding scams |
| Regular buyer | Recurring buy costs, account security, records |
| Long-term holder | Self-custody or spreading across providers, inheritance plan |
| Active trader | Costs, emotional control, avoiding leverage |
Crypto exchange safety: the human factor
Many losses happen not through technical failure but through persuasion: a message, a call or a relationship that leads someone to act against their own interest.
Scammers use urgency, authority and trust, and they often target people when they are stressed or lonely.
A simple rule helps: any message that asks you to move crypto, share a code or install software is treated as a scam until proven otherwise, through a channel you choose yourself.
Crypto exchange safety: phishing examples
- An email saying your account will be closed unless you "verify" through a link.
- A text about a "suspicious withdrawal" with a number to call.
- A search ad that leads to a copy of the exchange's login page.
- A social media account offering help after you post about a problem.
Open the exchange through a bookmark and check messages inside your account instead.
Crypto exchange safety: a yearly review
- Recheck authorisation and your country in the register.
- Review security settings and remove old devices and API keys.
- Download your transaction history.
- Review your crypto share of savings and rebalance if needed.
- Update your inheritance note.
Crypto exchange safety: what MiCA requires and what you check
| Area | Required of authorised exchanges | Your own check |
|---|---|---|
| Authorisation | MiCA authorisation from a national regulator | Find it in ESMA's register |
| Client assets | Segregation of custodied crypto; client funds at a bank or central bank | Keep only what you need on the exchange |
| Fees | Pricing, costs and fees policies published prominently | Calculate your total cost |
| Information | Fair, clear, not misleading; risk warnings | Read the warnings and white papers |
| Complaints | Free procedure with a template | Keep records in case you need it |
| Your login | Not specified in detail by MiCA | App-based 2FA, unique password, secure email |
Requirements summarised from MiCA Articles 59, 66, 70, 71 and 75.
Crypto exchange safety: quick answers
- Found in the register, website matches: a good start; continue with the other checks.
- Similar name in the register, different website: treat as a possible clone.
- Not in the register at all: do not send money.
- Listed as non-compliant: do not send money; withdraw if you can.
Crypto exchange safety: questions readers ask
Is a bigger exchange always safer? Size brings resources, but past failures included large platforms, which is why segregation rules and your own precautions matter more than size.
Is a local exchange safer than an international one? Under MiCA the same core rules apply wherever the exchange is authorised; local providers may offer local payment methods and language, but may notify fewer countries.
Should I avoid exchanges altogether? Self-custody removes exchange risk but brings its own risks, as the guide to crypto wallets explains.
Crypto exchange safety: tools on this site
Crypto exchange safety: a story of two checks
Example: two people receive the same message about a "new EU-regulated crypto platform" with high returns.
The first person clicks the link, sees a professional website with an EU flag and a licence number, and deposits money.
The second person searches the platform's legal name in ESMA's register, finds nothing, then finds a similar name with a different website, and stops.
The difference between them is not knowledge of crypto, but one two-minute check made before sending money.
Illustrative example; not a real case.
The MiCA licence checker makes that check quick, and the scam check covers the other warning signs in the message.
Crypto exchange safety: myths and facts
| Myth | Fact |
|---|---|
| "A professional website means a real company" | Scam sites are often polished; the register check is what counts |
| "Support will contact me if there is a problem" | Unsolicited "support" contact is a classic scam opening |
| "SMS codes make my account safe" | SMS can be bypassed with a SIM swap; app-based 2FA is stronger |
| "Profits on the platform prove it works" | Fake platforms show fake profits; the test is whether you can withdraw |
| "Regulated means guaranteed" | MiCA regulates firms; it does not guarantee prices or deposits |
Crypto exchange safety: the minimum standard
If you remember only five points from this crypto exchange safety checklist, make them these.
- Authorised: the firm is in ESMA's register, with a matching website.
- Secured: app-based two-factor authentication on the exchange and your email.
- Direct: you reach the exchange only through a bookmark or the official app.
- Private: you never share codes, passwords or recovery phrases.
- Limited: you keep on the exchange only what you need, and invest only what you can lose.
Crypto exchange safety for the people around you
Scams often reach people through those they trust, so sharing what you know protects others too.
If a friend or relative mentions a "great crypto platform" they found through a message, an ad or someone they met online, a gentle question about whether it is in ESMA's register can prevent a large loss.
Older relatives are often targeted with fake bank or police calls that ask them to move money into crypto "for safety", and a family rule never to move money because of a phone call is a strong defence.
Sharing the scam check is an easy way to start the conversation without seeming to criticise anyone's judgement.
Crypto exchange safety: three habits that prevent most losses
Use a unique password and app-based two-factor authentication on both your exchange and your email account.
Reach the exchange only through a saved bookmark or the official app, never through links in messages.
Never share codes, passwords or seed phrases with anyone, including people who say they are support staff.
These three crypto exchange safety habits cost nothing and block the most common ways accounts are taken over.
Frequently asked questions
How do I know if a crypto exchange is safe?
Check its MiCA authorisation in ESMA's register, the website address, the terms, the fees, the complaints procedure and the security features, and secure your own account.
Is a MiCA-authorised exchange completely safe?
No. MiCA makes exchanges more accountable but does not protect against price falls, scams outside the system or account takeovers.
What is the biggest risk at a crypto exchange?
For many users, account takeover through phishing or weak security, followed by price falls.
Should I keep all my crypto on one exchange?
Spreading larger amounts, or moving them to self-custody, reduces dependence on one provider.
What does proof of reserves prove?
That an exchange held certain assets at a point in time. It does not always show liabilities in full.
Every figure on this page is checked against the ESMA register, the exchange's own terms and fee pages or another primary source, and the sources are listed above. Editorial policy · How we rate