Skip to content
Basis Desk
Security & Hacks · 6 min read Last reviewed September 29, 2026

Choosing a Crypto Exchange: A 12-Point Checklist

Evaluating a cryptocurrency platform requires analyzing regulatory compliance, custodial infrastructure, and fee models to minimize counterparty risk and ensure efficient trade execution.

Neutral

Key points

  • Jurisdictional registration ensures an exchange complies with local AML and KYC laws, reducing regulatory risk.
  • Proof of Reserves verifies on-chain assets but must be paired with financial audits to confirm true solvency.
  • The majority of customer assets should be held in offline cold storage to mitigate remote hacking vectors.
  • Maker-taker fee models incentivize liquidity by charging lower fees to users who add resting orders to the book.

Selecting a cryptocurrency exchange requires evaluating a platform's regulatory compliance, custodial security, and fee structures rather than just its asset selection. A rigorous assessment minimizes counterparty risk by verifying how an exchange holds user funds, executes trades, and operates within jurisdictional legal frameworks. This 12-point checklist outlines the critical infrastructure and operational standards that define institutional-grade trading platforms.

The legal foundation of an exchange dictates how it handles user data, monitors for illicit activity, and protects client assets during corporate distress.

First, users must verify jurisdictional registration. Operating legally in a user's jurisdiction ensures the platform adheres to basic anti-money laundering (AML) and know-your-customer (KYC) laws. In the US, this typically involves registration with the Financial Crimes Enforcement Network (FinCEN) as a Money Services Business. In the UK, platforms must register with the Financial Conduct Authority (FCA). In the European Union, the Markets in Crypto-Assets (MiCA) framework overseen by the European Securities and Markets Authority (ESMA) establishes the baseline. Regulatory frameworks governing digital assets evolve rapidly, altering which platforms can legally operate in specific jurisdictions.

Second, the platform must enforce strict segregation of funds. This is the legal and operational separation between corporate operating capital and customer assets. If an exchange commingles these funds, users risk becoming unsecured creditors in the event of corporate bankruptcy. Transparent exchanges explicitly state in their terms of service that user assets are held in trust and cannot be used to settle corporate debts.

Financial Health and Asset Verification

Assessing an exchange's solvency requires looking beyond marketing claims to cryptographic and traditional financial verification.

Third, platforms should provide regular Proof of Reserves (PoR). This is a cryptographic method, often utilizing Merkle trees or zero-knowledge proofs, that allows users to verify that the exchange holds the on-chain assets it claims to hold on behalf of its clients. PoR provides a snapshot of on-chain assets, ensuring the exchange maintains 1:1 backing for customer deposits.

Fourth, PoR must be paired with independent financial audits. Because PoR only verifies assets and ignores off-chain liabilities or corporate debt, it is an incomplete measure of financial health. Reputable exchanges undergo traditional financial audits by certified third-party accounting firms. These audits verify the company's overall balance sheet, ensuring that the platform's liabilities do not exceed its assets and that internal financial controls are functioning correctly.

Custodial Infrastructure and Platform Security

The technical mechanisms an exchange uses to secure private keys determine its vulnerability to external hacks and internal theft.

Fifth, the platform must maintain high cold storage ratios. Cold storage refers to holding the cryptographic private keys to user funds in offline hardware environments, entirely disconnected from the internet. This mitigates remote attack vectors. Industry standards dictate that exchanges should keep the vast majority of customer assets in cold storage, utilizing multi-signature (multisig) or multi-party computation (MPC) technology to ensure no single employee can authorize a transfer.

Sixth, users must evaluate the platform's security history and bug bounties. While past breaches are a red flag, the response to a breach is equally informative. Platforms that have successfully navigated security incidents by making users whole via corporate treasury funds demonstrate financial resilience. Furthermore, proactive exchanges operate continuous bug bounty programs, financially incentivizing independent security researchers to identify and report vulnerabilities before they can be exploited.

Seventh, the exchange must offer robust user-level security controls. Platform-wide security is irrelevant if individual accounts are easily compromised. Exchanges should mandate or strongly encourage hardware-based two-factor authentication (such as FIDO2/WebAuthn standard security keys) rather than relying solely on SMS-based authentication, which is vulnerable to SIM-swapping attacks. Additionally, platforms should offer withdrawal allowlisting, a feature that restricts outbound transfers to pre-approved wallet addresses, subject to a mandatory time delay for new additions.

Fee Structures and Execution Costs

Trading costs extend beyond advertised commissions, encompassing execution models and network transfer fees. For a deeper dive into these mechanics, see How Crypto Exchanges Work: Order Books, Custody, and Fees.

Eighth, users must understand maker-taker fees. Exchanges use this model to incentivize order book depth. A "maker" places an order that does not immediately execute (e.g., a limit order below the current price), adding liquidity to the book. A "taker" places an order that executes immediately against existing orders (e.g., a market order), removing liquidity.

Assume an exchange charges a 0.10% maker fee and a 0.20% taker fee. If a user places a market order to buy $10,000 worth of Bitcoin ($BTC), they act as a taker, removing liquidity, and pay a $20 fee. If they place a limit order at a price below the current market rate, adding liquidity to the order book, they act as a maker and pay a $10 fee upon execution.

Ninth, traders must account for withdrawal fees and spread markups. Moving assets off an exchange incurs a withdrawal fee, which covers the blockchain network transaction costs (gas) and often includes an exchange markup. Exchange fee tiers and withdrawal limits frequently adjust based on network congestion and corporate policy. Additionally, platforms advertising "zero-fee" trading typically monetize by widening the spread—the difference between the highest bid and lowest ask price—resulting in hidden execution costs.

Liquidity, Asset Coverage, and Fiat Rails

An exchange's utility depends on its ability to execute large trades efficiently and bridge the traditional banking system with digital asset networks.

Tenth, the platform must possess deep liquidity. Liquidity refers to the volume of active orders at various price levels in the order book. High liquidity ensures that large orders can be executed without causing significant slippage—the difference between the expected price of a trade and the price at which it actually executes. Illiquid exchanges force traders to accept worse prices when entering or exiting positions.

Eleventh, reliable fiat on-ramps and off-ramps are critical. Exchanges rely on correspondent banking relationships to process fiat currency deposits and withdrawals via networks like ACH or Wire in the US, and SEPA in Europe. The stability of these banking relationships is paramount; if an exchange loses its banking partners, users may find their fiat funds temporarily trapped, even if the crypto assets remain secure.

Customer Support and Dispute Resolution

Twelfth, the availability of responsive customer support is a critical operational metric. Cryptocurrency markets operate 24/7, and automated compliance systems frequently flag legitimate transactions for manual review due to strict AML protocols. When accounts are frozen or credentials are lost, users require clear, documented account recovery procedures and access to human support channels. Platforms relying exclusively on automated ticketing systems often fail to resolve time-sensitive account lockouts during periods of high market volatility.

Common Misconceptions

  • Exchange balances are insured like bank deposits: Users frequently assume that fiat or crypto held on an exchange is protected by government-backed insurance. While some platforms utilize pass-through FDIC insurance in the US or FSCS protection in the UK for fiat balances, this rarely covers digital assets. The specific limits and applicability of deposit insurance vary widely by jurisdiction and change over time based on regulatory rulings.
  • Proof of Reserves guarantees solvency: A cryptographic snapshot of on-chain assets proves control over specific wallets, but it provides no information about the exchange's outstanding liabilities, corporate debt, or operational expenses. Solvency can only be verified when PoR is combined with a comprehensive financial audit.
  • Zero-fee trading means no execution costs: Platforms that do not charge explicit maker or taker commissions generate revenue by widening the bid-ask spread. Users on these platforms effectively pay for their trades through inferior execution prices, which can cost more than standard commission models on highly liquid exchanges.

How This Connects to the Market

The criteria for choosing a crypto exchange reflect a broader market shift toward institutionalization. Following a series of high-profile platform collapses, both retail and institutional capital now demand strict compliance, transparent custody standards, and verifiable solvency. This pressure forces centralized platforms to adopt infrastructure historically reserved for traditional equities and commodities markets.

As regulatory scrutiny increases globally, the operational gap between compliant, heavily audited exchanges and unregulated offshore platforms continues to widen. This bifurcation impacts market structure, driving liquidity toward platforms that can guarantee counterparty security. For a comparison of how these centralized models differ from on-chain trading protocols, see Centralized vs Decentralized Exchanges: Custody, Liquidity, and Trade Execution.

Questions this story raises

What is the difference between maker and taker fees?
Maker fees apply to orders that add liquidity to the order book, such as limit orders placed away from the current price. Taker fees apply to orders that remove liquidity, such as market orders that execute immediately. Exchanges typically charge lower fees to makers to encourage a deep order book.
Why is cold storage important for a crypto exchange?
Cold storage involves keeping the cryptographic private keys to digital assets in offline hardware environments. This protects the funds from remote cyberattacks and unauthorized internet-based access, which is the primary vector for exchange hacks.
Does Proof of Reserves mean an exchange is financially healthy?
Not entirely. Proof of Reserves uses cryptography to prove an exchange controls specific on-chain assets. However, it does not account for the exchange's liabilities or corporate debt. True financial health requires both Proof of Reserves and independent financial audits.
Are funds on a crypto exchange insured?
Generally, digital assets are not covered by government deposit insurance like the FDIC in the US or the FSCS in the UK. While some exchanges offer pass-through insurance for fiat currency deposits, this rarely extends to cryptocurrencies, and coverage specifics vary by jurisdiction.

References

  1. [1] Cryptoasset firms with temporary registration — Financial Conduct Authority (FCA)

Evergreen explainer written by Basis Desk's system and checked by an independent model pass for factual errors and advice language. Figures, fees and rules change — the references above are where to verify current specifics. Market figures marked "at the time of writing" come from live exchange data. Report an error: hello@basisdesk.news.

Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.