On an exchange
Lesson 1 of 4
By the end of this lesson you’ll know what you own when you buy crypto on an exchange, how to check that the exchange is allowed to serve you, and what the purchase really costs.
What you own on an exchange
An exchange is a company that sells you crypto for euros, pounds or dollars and keeps it for you afterward. Most people’s first purchase happens here, because this is where ordinary money goes in.
When you buy, the coins do not go anywhere near you. They sit in wallets the company controls.
Your account shows a balance. That balance is a promise to hand over the coins, or their cash value, when you ask. For as long as the company is solvent and honest, the promise holds.
Where your coins sit when you buy on an exchange.
November 2022 · FTX
More than $8 billion
In November 2022 the exchange FTX collapsed. Its customers found out what their balances really were: claims on a bankrupt company.
US prosecutors said its founder had taken more than $8 billion of customer deposits and used them for his own trading firm, and in March 2024 he was sentenced to 25 years in prison.
Customers waited until February 2025 for the first repayments. By July 2026 the FTX Recovery Trust had paid out more than the full allowed claims, but those claims were fixed in dollars at November 2022 prices, so customers missed any rise in their coins.
A bank balance is a claim too, but a deposit guarantee scheme stands behind it up to a limit. Crypto has no such scheme.
The Central Bank of Ireland says plainly that crypto “is not protected by any form of compensation scheme,” and the UK’s Financial Conduct Authority (FCA) says a firm that is only registered with it, as crypto exchanges are, is unlikely to be covered by the UK compensation scheme.
Under the EU’s Markets in Crypto-Assets Regulation (MiCA), a firm that keeps coins for its customers must hold them legally apart from its own, so that its creditors “have no recourse” to them, in particular if it goes insolvent. The firm is also liable for coins lost in an incident it’s responsible for, up to their market value at the time.
That protection works only if the firm has followed the rule, and national insolvency law decides how you’d get your coins back. If the coins have already been lost or taken, the rule can’t bring them back.
At an exchange outside that rule, you can join the queue of creditors if it fails, as FTX’s customers did.
Exchanges are still the right place to hold what you’re using, with a company you’ve checked. They’re the wrong place to leave everything for years.
Check the register before you send money
Since 1 July 2026, every firm offering crypto services to customers in the EU needs an authorization under MiCA or, for a bank or other already regulated firm, a notification. The transition periods that let old firms keep going have all ended.
The Central Bank of Ireland’s advice to anyone holding coins with an unauthorized provider is to move them to an authorized provider, or to “a self-hosted wallet” (a wallet whose keys you hold).
Authorization means the firm answers to a regulator for how it handles your money and your complaints, and that someone has looked at who runs it. It’s no promise that the firm is safe. An unauthorized firm gives you none of that.
So before you open an account:
1
Find the company’s legal name. It’s in the terms of service or the footer of its website, and it’s often different from the brand on the app.
2
In the EU, open the MiCA page on the website of ESMA, the EU markets regulator, and download its register of authorized crypto-asset service providers, which is a spreadsheet file. Search it for that legal name. ESMA updates the register weekly. Check that the authorization hasn’t been withdrawn and that custody is among the firm’s listed services, and open the separate file of non-compliant entities on the same page.
3
In Ireland, the Central Bank’s registers list the firms it has authorized itself. A bank or investment firm that’s already regulated can offer crypto services by notifying the Central Bank instead, so if the firm is a bank or investment firm, search for it in the Central Bank’s main registers.
4
In the UK, use the FCA’s Firm Checker. Match the phone number and website on the register against the ones you were given, because scammers clone real firms’ names. Check the FCA’s Warning List while you’re there. Note the FCA’s own words as of November 2026: crypto exchanges there are “registered with us for anti-money laundering purposes,” which is narrower than being authorized. Full FCA authorization starts on 25 October 2027.
5
In the US, there’s no single national register. Look up the legal name in the MSB Registrant Search of FinCEN, a US Treasury bureau, which shows whether the firm has registered as a money services business. Then look it up for your state on NMLS Consumer Access or your state regulator’s site. A listing is no promise that the firm is safe.
6
If the name isn’t on the register, don’t send money. Don’t send a small amount to try it out either.
Keep a note of the legal name and the date you checked. You’ll want it later if anything goes wrong.
Fake apps and fake support.
Scammers copy exchanges’ apps and support staff. Type the exchange’s address yourself, and install its app only from a link on that site.
Exchanges and wallet makers rarely contact you first, so treat anyone who messages you offering help as a scammer.
What a purchase really costs
The price on the screen is rarely the price you pay. The gap comes in pieces, and each one is small enough to miss.
The spread
The exchange buys from you at one price and sells to you at a higher one. The difference is a cost, even when the fee line says zero.
The trading fee
Usually a percentage of the amount, shown on the confirmation screen.
The card fee
Paying by card is quick and costs more than a bank transfer.
The currency conversion
If the exchange prices everything in dollars and you pay in euros, there’s a conversion in the middle, and the rate used is the exchange’s.
The withdrawal fee
Moving coins out to your own wallet costs a fee, often a fixed amount per coin rather than a percentage. On a small purchase it can be the largest cost of all.
A good test is to work out what you’d get back if you bought and sold right away. The amount you’d lose is the true cost of buying and selling.
Buying or selling person to person skips the exchange’s fees and its checks. It’s also a route for fraud, and if the money you receive was stolen from someone else, your bank can freeze your account. Leave it alone.
Identity checks and the Travel Rule
An authorized exchange will ask for a photo of your passport or driver’s license, a proof of address and a selfie. That is the anti-money-laundering law, and it’s the same reason a bank asks.
An exchange that asks for nothing is telling you it isn’t authorized.
When an exchange sends or receives crypto, the transfer now carries the sender’s and receiver’s details, as bank transfers do. The EU’s rule for this, Regulation 2023/1113, known as the Travel Rule, has applied since 30 December 2024.
When you move coins from the exchange to your own wallet and the amount is above €1,000, the exchange has to check that the wallet is yours. The European Banking Authority’s guidelines say the exchange must “assess whether that address is owned or controlled by the CASP customer.”
A CASP is the law’s name for a crypto-asset service provider, so the exchange itself. The exchange picks the method, and it may ask you to sign a message with your wallet, or to send an exact small amount that it sets, from that wallet to the exchange.
You’ll see a real request inside your logged-in account, and it never asks you to approve anything. One that arrives by email or message is fake, and lesson 3 shows how to tell the two apart.
It can feel like suspicion. The law asks the same of everyone.
Since 1 January 2026, exchanges in the EU and the UK have been collecting your details and a record of your transactions, to report to the tax authorities from 2027. Lesson 4 goes through what that means for the records you keep.
Your next step
Pick the exchange you’re thinking of using and do the register check now, before you open an account. Write the legal name, the register you used and today’s date in a note you’ll keep.
Last checked: 6 November 2026
