1. The 5-minute method: three checks before you deposit

Every crypto disaster — from outright fake exchanges to the collapse of giants like FTX — has the same lesson buried in it: people deposited money somewhere they hadn’t actually checked. The good news is that separating a legit exchange from a trap doesn’t take research skills or insider knowledge. It takes about five minutes and three checks, and you can do all three before you deposit a single coin.

Here’s the whole method in one breath: (1) confirm the exchange is registered with your country’s financial regulator by finding it in the official registry — not by trusting a badge on its own homepage; (2) look for public proof of reserves and a real third-party audit; and (3) run the one test that can’t be faked — take some money out. The rest of this guide is just those three checks in detail, plus the red flags that mean you can skip them and walk away immediately.

2. Check 1: is it in your regulator’s registry?

Check 1 — is it registered with a regulator? Almost every country now keeps an official list of crypto businesses that are licensed or registered to operate there, and the single most important habit is to look the exchange up in that list yourself, on the regulator’s own website. A trust badge or “licensed and regulated” line on the exchange’s site means nothing on its own — anyone can write that. The registry is the source of truth.

What you’re confirming is simple: that a real legal entity, with a license number and a named regulator, is actually permitted to offer crypto services where you live. While you’re there, it’s worth noting the scope of that license (some cover custody, some only certain activities) and any country restrictions. If the exchange isn’t in your regulator’s registry at all, that doesn’t always mean “scam” — but it does mean you’re on your own if anything goes wrong, with no local protection, so treat it with much more caution and never with money you can’t afford to lose.

3. Check 2: proof of reserves and audits

Check 2 — proof of reserves and audits. After the FTX collapse, the industry standard became proof of reserves (PoR): a cryptographic way for an exchange to show it actually holds enough assets to cover everyone’s deposits. A healthy exchange publishes its reserve ratio and you want to see it at over 100% — meaning it holds at least as much as it owes you, ideally more (over-collateralised).

But PoR on its own can be gamed, so look for two more things: a third-party audit (an outside firm verifying the numbers, not just the exchange’s own dashboard), and user-level verification — a tool that lets you confirm your own balance is included in the reserves. The strongest platforms also hold recognised security certifications (like SOC 2 or ISO 27001). You don’t need to understand the cryptography; you just need to be able to open the page and see real, recent numbers. If an exchange has no PoR page, no audit and no way to verify, that absence is itself the answer.

4. Check 3: the withdrawal test (the one that can’t be faked)

Check 3 — the withdrawal test, the one that can’t be faked. Every other signal can be dressed up; this one can’t. Deposit a small amount, buy a little, then withdraw it back out. A legit exchange lets you take your money out smoothly and reasonably quickly. A fraudulent one is happy to take deposits all day and then invents reasons you can’t withdraw.

That second pattern is the heart of almost every exchange scam: the money goes in fine, but when you try to take it out you’re told you must “pay a fee/tax to unlock it,” or “upgrade your account,” or “wait for verification” that never ends. No legitimate exchange ever asks you to pay a fee to release your own withdrawal. The moment you hear that, you’re not dealing with a slow platform — you’re dealing with a thief, and paying the “fee” only marks you as someone who will pay again.

5. Red flags that mean walk away now

Sometimes you don’t need the five-minute check, because a single red flag already tells you to leave. Any one of these is enough on its own:

6. Even legit isn’t a bank: the FTX lesson

Even a genuinely legit exchange is not a bank, and FTX is the lesson nobody should forget: it was huge, famous, sponsor-of-stadiums big — and customer money still vanished, because deposits weren’t actually backed the way people assumed. The takeaway isn’t “trust no one,” it’s “verify, and don’t leave more on any exchange than you need to.”

So once you’ve found an exchange that passes the three checks, follow the golden rule: keep only trading-size balances on it, and move anything you’re holding for the long term into a wallet you control, where no exchange failure can touch it. “Not your keys, not your coins” isn’t paranoia; it’s the one habit that would have protected every FTX customer. A legit exchange is a great place to buy and trade — just not the place to store a life-changing amount.

7. The 5-minute checklist

Here’s the whole thing as a checklist you can run in five minutes, in order:

8. Where to start, and the bottom line

You should always run these checks yourself, with your own regulator — but it helps to start from platforms with a long track record, public reserves and working withdrawals. These are the exchanges we keep dashboard-verified sign-up guides for; entering a referral code at sign-up applies fee perks:

Affiliate disclosure: some links are partner links. We may earn a commission at no extra cost to you. This is not investment advice.

Frequently asked questions

Compare exchanges with proof of reserves and a track record →