Choosing a crypto exchange is a custody decision, not only a question of fees or available coins. This reusable checklist shows how to assess an exchange’s legal status, custody model, withdrawals, security controls, disclosures, and operational history before depositing funds or increasing an existing balance.
Overview
An exchange can make buying and selling digital assets convenient, but convenience does not remove custody risk. When funds remain on a platform, the exchange controls the account interface and typically holds or manages the private keys, depending on its custody structure. Access may also depend on identity checks, account permissions, banking partners, network availability, and the platform’s own withdrawal processes.
There is no single label that proves an exchange is safe. A familiar brand, a large asset list, or a published reserve report can be useful evidence, but each answers only part of the question. The goal of due diligence is to identify risks that matter to your use case and decide how much money, if any, should remain on the platform.
Use the following table as a first-pass comparison. Record the answer for each exchange rather than relying on memory or marketing language.
| Area to check | Questions to ask | Why it matters |
|---|---|---|
| Custody model | Does the platform hold assets for customers, offer self-custody, or use a mixed model? Who controls withdrawal permissions? | Custody determines who controls access and what can happen if the platform is restricted or unavailable. |
| Withdrawals | Are withdrawals available for every supported asset? Are there limits, review periods, address whitelists, or manual approvals? | A platform may support trading while making withdrawals slower or more restricted than expected. |
| Reserve disclosures | Does the exchange explain what its proof-of-reserves report covers, when it was prepared, and whether liabilities are included? | A reserve snapshot may not show all obligations, encumbrances, liquidity risks, or changes after the reporting date. |
| Insurance claims | What does the platform say is insured, through which provider, and under what exclusions? Does coverage apply to individual customer losses? | Insurance language can refer to limited events or platform-held funds rather than every customer balance. |
| Regulatory status | Is the entity named in the terms registered, licensed, or authorized in your jurisdiction? Can you verify that independently? | Registration may impose obligations, but it is not a guarantee against losses. An overseas or unverified entity may offer fewer practical protections. |
| Fees | What are the trading, deposit, withdrawal, spread, network, conversion, and inactivity fees? | The headline trading fee may not represent the total cost of moving money or assets. |
| Jurisdictions | Does the exchange accept residents of your country or state, and can it continue serving them under its current terms? | Features, assets, and withdrawal methods can differ by location. |
| Asset listings | Are listed assets clearly identified, and can you withdraw them to a compatible wallet or network? | Trading access is not the same as withdrawal access. Contract and network mistakes can make transfers irreversible. |
| Account recovery | What happens if you lose a phone, security key, email account, or access to your authenticator? | A strong login system is less useful if recovery procedures are unclear or vulnerable to social engineering. |
| Operational history | Has the platform disclosed outages, security incidents, halted withdrawals, insolvency concerns, or material changes to its terms? | Past incidents do not automatically predict failure, but vague or incomplete communication is a warning sign. |
Checklist by scenario
Before opening an account
- Find the legal entity that will provide the service. It may differ from the brand name or mobile app developer.
- Read the current user agreement, custody terms, privacy policy, and fee schedule. Search specifically for the platform’s rights to pause withdrawals, close accounts, or lend, pledge, or reuse assets.
- Check the exchange’s regulatory status using the relevant official register for your location. Do not treat a logo, press release, or search advertisement as independent verification.
- Confirm that your country, state, payment method, and intended assets are supported. Restrictions can apply to particular products even when account creation is available.
- Inspect security settings before funding the account. Prefer support for authenticator-based two-factor authentication or security keys, withdrawal address controls, login alerts, and device management.
Before the first deposit
- Make a small test deposit using the same payment route you expect to use later. Check the name and details of the receiving entity.
- Review the complete cost of the transaction, including spread, payment processing, conversion, and withdrawal charges.
- Ask whether the deposit creates a balance that is immediately withdrawable or subject to settlement, verification, or a temporary hold.
- Confirm the exact asset and network you intend to use. For onchain transfers, compare the network selected on the exchange with the network supported by the receiving wallet.
Before increasing your balance
- Test a withdrawal to a wallet you control. Start with a small amount and verify the destination address and network before confirming.
- Set a custody limit: the maximum amount you are willing to leave on the exchange for trading or payments.
- Separate long-term holdings from active trading funds where practical. For a self-custody comparison, see How to Compare Crypto Wallets.
- Keep transaction records, account statements, and fee information. These may be needed for tax reporting, dispute resolution, or a portfolio review.
Before using advanced products
Margin, lending, staking, derivatives, and yield features can introduce separate counterparty, liquidation, lockup, and disclosure risks. Read the product-specific terms rather than assuming that protections for a basic spot account apply. Traders should also understand how funding rates and liquidation data affect leveraged positions; the funding rates and liquidation checklist provides a separate review framework.
What to double-check
Proof of reserves is not a complete balance-sheet audit. A report may show that certain wallets held assets at a particular time, but it may not establish the full amount or priority of customer liabilities. Look for the reporting date, assets included, liabilities addressed, methodology, and any qualifications. Treat the disclosure as one input, not a guarantee of access.
Insurance has boundaries. Determine whether a policy covers theft, unauthorized access, operational failure, insolvency, or only specific assets and storage arrangements. Check deductibles, exclusions, claims procedures, and whether the customer or the exchange is the insured party. Avoid assuming that deposit protection for a bank account automatically applies to a crypto balance.
Registration is not the same as safety. Verify the exact legal entity and service covered by a registration. A company may be registered for one activity while offering another through a different affiliate. Also check whether the service is permitted where you live, rather than relying on a global availability page.
Operational transparency matters. Read the status page, incident notices, and recent terms changes. Pay attention to how the platform explains delayed withdrawals, security events, or changes in supported assets. An exchange that makes important information difficult to find deserves additional scrutiny.
Asset and network details can create user-level risk. Confirm token contract addresses from reliable sources before buying or sending, and never approve a transfer solely because a name or ticker looks familiar. Use the token contract verification checklist for that step.
Common mistakes
- Choosing on fees alone: a low trading fee may be offset by a wide spread, expensive withdrawals, or limited payment options.
- Keeping all assets on one platform: concentration creates a single point of failure for access, withdrawals, and account security.
- Confusing availability with liquidity: an asset can be listed without having convenient withdrawals or dependable execution.
- Ignoring account recovery: storing backup codes in an email inbox or sharing them with support can undermine two-factor authentication.
- Trusting impersonators: use the exchange’s verified domain and in-app support. Be skeptical of unsolicited messages promising account recovery, refunds, or urgent withdrawals.
- Failing to test an exit: a small successful deposit does not prove that a large withdrawal will be processed under the same conditions.
When to revisit
Review your exchange before opening an account, before making a large deposit, after moving to a new country, and whenever you change from simple spot buying to staking, lending, margin, or derivatives. A scheduled quarterly review is a practical minimum for active users; occasional users can review before each major transfer or seasonal financial-planning cycle.
Update the comparison when the platform changes its legal entity, supported jurisdictions, fee schedule, withdrawal limits, custody terms, security controls, reserve disclosures, or asset listings. Also revisit it after a material outage, security incident, regulatory notice, change in banking access, or prolonged withdrawal delay.
For a practical review, save the exchange’s current terms and fee page, verify its registration independently, test security and recovery settings, and record a small withdrawal result. Then set a personal custody limit and move funds that do not need to remain available for trading to an arrangement you have separately evaluated. Repeating those steps turns a one-time exchange comparison into an ongoing wallet-security and custody practice.
