Crypto exchange licensing is easy to misunderstand. A platform may say that it is “regulated,” “registered,” or “licensed,” but those words can describe very different permissions. One registration might cover anti-money-laundering supervision only; another authorisation may cover custody and trading services; a third may belong to an affiliate that does not serve the customer.

A licence is evidence of a regulatory relationship, not a guarantee that an exchange is safe. Licensed firms can suffer cyberattacks, operational failures, misconduct, liquidity problems, or insolvency. This guide is general education, not legal, investment, or financial advice, and it does not endorse any exchange.

Start with the exact legal entity

Consumer-facing brands often consist of several companies. The mobile app, website footer, account agreement, deposit instructions, and privacy notice may name different entities. The company serving a customer in one country may not serve customers elsewhere.

Before checking a licence, record the entity’s full legal name, company number if shown, registered address, website domain, and the jurisdiction named in the customer agreement. If the platform will not identify the contracting entity clearly, that is a material due-diligence problem.

Understand the regulatory label

“Registered” does not necessarily mean “authorised to provide every financial service.” For example, the UK Financial Conduct Authority maintains a register for cryptoasset businesses under anti-money-laundering and counter-terrorist-financing requirements. The FCA expressly warns that registration is not a recommendation or endorsement and does not provide the same protections as authorisation for other regulated activities.

In the European Union, the Markets in Crypto-Assets Regulation establishes authorisation and conduct requirements for crypto-asset service providers. MiCA entered into force on 29 June 2023, applied to asset-referenced and e-money token provisions from 30 June 2024, and generally applied from 30 December 2024. National transitional arrangements for qualifying existing providers can differ and may extend no later than 1 July 2026.

In the United States, relevant permissions may include federal money services business registration and state money-transmitter or virtual-currency licences. FinCEN registration does not mean that FinCEN has approved the business model, verified solvency, or insured customer assets. Securities, commodities, derivatives, and state trust laws can add separate obligations.

Use the regulator’s own register

Never rely only on a licence number, badge, screenshot, or hyperlink shown by an exchange. Open the regulator’s official website independently and search its register. Fraudsters sometimes copy the name and registration details of a real company while directing victims to a different domain—a practice regulators call cloning.

Compare all available fields:

  • the exact legal name and any approved trading names;
  • the official website, email, telephone number, and address;
  • the licence or registration status and effective date;
  • the activities, products, and customer types covered;
  • restrictions, conditions, disciplinary notices, or cancellation dates;
  • whether the entity is authorised directly, acts as an agent, or relies on a transitional regime.

If any detail differs, contact the regulator or the firm through contact information taken from the official register—not through a message or number supplied by the person promoting the account.

Check the scope, not just the status

An exchange can provide several services under one interface: spot trading, derivatives, custody, staking, lending, card payments, or token issuance. A permission for one service does not automatically cover the others. Products may also be delivered by separate group companies with different regulators and contract terms.

Confirm whether the permission covers holding customer cryptoassets, holding fiat money, operating a trading venue, executing orders, transferring assets, or offering derivatives. Check whether retail clients are permitted and whether the licence applies in the customer’s country. An offshore licence does not by itself authorise active marketing everywhere.

Custody and control remain critical

Licensing cannot replace an examination of custody terms. Ask whether customer cryptoassets are legally and operationally segregated from the exchange’s own assets, how wallet records are reconciled, and whether the provider may lend, stake, pledge, or otherwise use customer assets. The terms should explain who controls private keys and what happens if the custodian or exchange fails.

Proof-of-reserves publications can add information, but they are not equivalent to a complete financial audit. A wallet snapshot may omit liabilities, borrowed assets, affiliated transactions, or off-chain obligations. Investors should look for audited financial information, clear liability reporting, governance disclosures, and independent assurance where available.

Do not assume compensation protection

Bank deposit insurance and investor-compensation schemes often do not cover cryptoassets, or cover only narrowly defined regulated services. Coverage can depend on the legal entity, product, cause of loss, and customer eligibility. A fiat balance may receive different treatment from a token balance, and a regulated custody service may differ from an unregulated lending product.

Read the regulator’s explanation of consumer protection and the scheme operator’s eligibility rules. Do not infer protection from a familiar regulator logo. If an exchange says assets are “insured,” identify the insurer, policyholder, covered events, exclusions, limits, and whether customers have a direct claim.

Review complaints and failure arrangements

A credible provider should publish a complaints process, response timetable, and escalation route. Check whether an ombudsman or alternative-dispute body has jurisdiction over the exact service. Cross-border customers may have to pursue claims in another legal system.

Insolvency disclosures matter before a failure, not after one. Read how the contract characterises ownership of assets, whether set-off rights apply, how shortfalls are allocated, and which law and courts govern the agreement. Withdrawal limits and emergency suspension clauses also deserve attention.

Watch for warning signs

  • The brand claims a global licence without naming the regulator or legal entity.
  • The official register shows a different domain, address, or status.
  • A promoter pressures the customer to deposit before verification.
  • Withdrawals require a new “tax,” “unlock fee,” or payment to a personal wallet.
  • Returns are described as guaranteed or risk-free.
  • Customer support avoids questions about custody, complaints, or insolvency.
  • The platform uses another group company’s licence to imply broader coverage.

A repeatable verification process

  1. Identify the contracting legal entity from the current terms.
  2. Find the regulator named by the firm through an independent search.
  3. Match the entity, domain, contact details, status, and permission scope.
  4. Check warning lists, enforcement notices, and material restrictions.
  5. Read custody, asset-use, withdrawal, complaints, and insolvency terms.
  6. Verify whether compensation or ombudsman protection applies to the product.
  7. Repeat the check periodically because licences, entities, and terms can change.

Licensing is a useful filter because it makes specific facts verifiable. It should not become a shortcut for trust. The decisive questions are which entity holds the customer’s money, what that entity is permitted to do, what protections apply, and how losses would be handled if something goes wrong.

Related reading on CoinToday

Sources