How to Evaluate a Crypto Exchange: Custody, Regulation and Withdrawal Risk
A comparison based only on listed assets and fees misses who the user contracts with, how keys and client assets are managed, and when withdrawals can stop. Registration is a first gate, not a value guarantee or proof against failure. This guide builds an evidence file around legal entity, regulatory scope, custody, execution, liquidity, withdrawals, outages, outsourcing and support.
Who this guide is for: People selecting a first crypto service or reviewing concentration and withdrawal risk across existing providers
Key points to understand first
- Match the brand to the contracting legal entity, location, registration number and regulated activity.
- Read client-asset segregation, hot/cold controls, external custody and exclusions from insurance.
- Verify withdrawal limits, delays, review triggers and the legal claim during an outage or insolvency.
- Avoid concentrating assets and identity data in one provider; test a small withdrawal periodically.
Narrow marketing claims into contract, custody and withdrawal evidence
- 01Brand and domainRemove lookalike sites and counterfeit apps
- 02Entity and registrationMatch the contracting entity and regulated scope
- 03Assets and keysSegregation, custody, outsourcing, insurance
- 04Market and executionOrder book, spread, venue and price source
- 05Withdrawal and incidentLimits, delays, stops and recovery
- 06Your controlsSmall test, diversification and records
Candidate to keep: A provider whose terms and evidence fit the intended use
Start by matching the service name to the contracting legal entity
The first provider check links the URL, app publisher, contracting entity, location, terms and registration number to one organization. A brand can be operated by different group companies, and a domestic registration may apply only to certain activities. Start from the regulator’s register and official links, not a search advertisement or social-media post.
Registration is a minimum gate. It does not remove price, outage, cyber or business failure risk, and a regulator does not guarantee the value of every asset listed by a registered service. A licence in another country does not automatically establish protection or legality for a resident elsewhere. Write down exactly which entity performs which regulated activity under which authority.
| Field | Evidence | Warning sign |
|---|---|---|
| Official entry | Regulator list to official domain | Search ad or lookalike spelling only |
| Contracting entity | Legal name and address in terms | Different names in footer and terms |
| Regulated scope | Number, activity and jurisdiction | “Licensed” without a number or scope |
| Contact | Official domain and address | Social DM or remote-access request |
| Change history | Terms and fee revision notice | Unannounced material change |
Save the URL and access date, not only a screenshot.
Separate client assets, company assets, keys and outsourced custody
A statement such as “cold storage” or “100% reserves” is incomplete. Check how fiat and crypto assets are separated from the company, the hot-wallet operating range, how many people control key actions, and which custodians or cloud providers are used. Proof of reserves does not by itself disclose liabilities, pledged assets, off-balance-sheet obligations, legal segregation or the full audit scope.
Insurance requires a defined event, insured party, limit and exclusion. A provider can be insured while a user’s account takeover or all hot-wallet losses remain outside cover. Read whether customers retain title in insolvency, could become unsecured creditors, or change status after lending or staking consent.
Distinguish dealer, order book, broker, custody and derivative services
One application can combine a dealer quote, customer order book, external-venue broker, custody, lending, staking and derivatives. Even without a displayed commission, the difference between buy and sell quotes is a cost. Maker/taker fees, minimum order, price increment, slippage, liquidation and funding can be separate. Do not mix spot ownership with a cash-settled CFD.
Order-book depth depends on real executable quantity, market-maker concentration, API stability, cancellation behavior and reference prices. Test a fictional order amount against depth and calculate the average price away from the best quote. Historic spreads do not guarantee execution during a fast market.
Keep crypto CFD point value and margin in the CFD sizing guide, and spread, commission and funding in the cross-asset cost guide. They are not an exchange network withdrawal fee.
Read withdrawal constraints before depositing
Before funding an account, review identity checks, address allowlisting, cooling-off periods, daily limits, minimums, supported networks, withdrawal fees, travel-rule fields, manual review and maintenance stops. A delay after adding an address is a security control and an emergency-liquidity constraint at the same time.
After opening the account, make a small deposit and then a small withdrawal to a controlled wallet. Record confirmation email, MFA, address display, fee, transaction hash, elapsed time and support path. Repeat periodically and do not leave a concentrated balance at a provider whose withdrawal route has not been tested for a long time.
- Read the constraints
Save limits, minimums, fees, delays, reviews and supported networks.
- Configure security
Enable unique password, strong MFA, anti-phishing code and allowlist.
- Make a small deposit
Confirm the correct network and memo/tag credit.
- Make a small withdrawal
Verify it in an explorer and the receiving wallet.
- Refresh evidence
Record fee, elapsed time, terms changes and next test date.
Plan communication and claims for outages, breaches and insolvency
Review the status page, incident reports, reserve evidence, financial statements, auditor, business-continuity process, withdrawal queue and support service levels. A provider that relies only on social posts is harder to verify. For a historic incident, read root cause, affected scope, customer remediation, corrective action and independent testing—not only “resolved.”
Save the account-freeze route, identity re-verification process, law-enforcement report path, appeal, complaint and dispute-resolution options. In Japan, review the current register and administrative actions. For an overseas entity, governing law and insolvency claim deadlines can make recovery costly even for a small balance.
- Single point: Could email, phone, MFA and password manager fail together?
- Notice: Where are fee, terms, delisting and maintenance changes announced?
- Incident: Who is contacted, with which evidence, within what time?
- Claim: Are account statements, asset status and governing law preserved?
Remove fake sites, added-payment demands and recovery scams first
Fraud can impersonate a romantic contact, investment group, celebrity, AI bot, government or provider support and route victims to a convincing fake platform. A profit display does not prove an asset exists or can be withdrawn. A demand for tax, collateral or an unlock payment before withdrawal is a classic advance-fee pattern. Confirm tax through the official authority, never by sending crypto to an unknown address.
After a loss, “recovery” services can become a second scam. Do not give them a seed, remote access or added fee. Preserve transaction hashes and communications, then contact the provider, bank, police and regulator through official channels. Do not rely on endorsements or social screenshots when selecting a provider.
Record unknowns and stop conditions instead of one score
A 100-point ranking lets a critical red flag disappear under unrelated positives. Use verified, unknown, inconsistent and stop states. An unidentified contracting entity, failed withdrawal test, seed request, false registration claim or guaranteed return is a stop condition—not a low weighted score. A cheap fee cannot offset broken custody or withdrawal controls.
The Financial Templates Hub can record provider, legal entity, URL, registration, service scope, custody, insurance, fee schedule, withdrawal test, incident, access date, source, owner of an unknown and next review. Do not enter passwords, identity documents, seeds or live authentication details; reference secure storage separately.
Concentrating fiat, spot assets, staking, lending and derivatives in one business means one outage can close several exits. Keep only the amount needed for the use and combine self, shared and third-party custody only after understanding the wallet and recovery model.
Frequently asked questions
Does registration make a crypto exchange safe?
Registration is an important gate but does not eliminate price, system, cyber, business, withdrawal or account-takeover risk. It is not a value guarantee.
Does proof of reserves prevent insolvency?
No. A point-in-time asset view may not show all liabilities, pledges, legal segregation, off-balance-sheet obligations or future outflows.
Do I legally own crypto shown in an exchange account?
It depends on the contract, jurisdiction and service. Custody, lending and staking can change rights, so review terms and insolvency treatment.
What should be tested first?
After configuring strong MFA and an address allowlist, make a small withdrawal to a controlled wallet and record fee, transaction hash, elapsed time and support route.
Primary sources and verification links
- Japan FSA | List of Registered Crypto-asset Exchange Service ProvidersOfficial entry point for Japan’s list of registered crypto-asset exchange service providers
- Financial Stability Board | Global Regulatory Framework for Crypto-assetsGlobal framework addressing client-asset safeguards, conflicts, disclosure and cooperation
- FATF | Updated Guidance for Virtual Assets and VASPsRisk-based guidance covering VASPs, P2P transactions, stablecoins and the travel rule
- Investor.gov | Crypto Asset Custody Basics for Retail InvestorsRetail guide to self-custody, third-party custody, hot/cold wallets and private keys
- Investor.gov | Crypto Asset Scam Warning SignsWarning signs involving social media, fake sites, added-fee demands and pump-and-dump schemes
Edited and published by: SG Group · Editorial approach: We prioritize primary materials from central banks, regulators and international institutions. Rules, product terms and release times can change, so verify current information at the linked source and with your provider before acting.
Important notice: This article is general education about crypto assets, blockchains, wallets and related services. It is not investment, legal or tax advice; a recommendation of any token, exchange, wallet or protocol; a trading signal; a price forecast; or a guarantee of profit or principal. Crypto assets can lose some or all value through volatility, lost keys, mistaken transfers, fraud, smart-contract failure, depegging, illiquidity, provider insolvency, or regulatory and tax changes. Figures are fictional learning examples unless expressly identified otherwise. Before use, verify the network, contract address, fees, registration or regulatory status, terms and tax treatment with primary sources and qualified professionals.