Choose an Exchange Service by What It Does

An exchange label does not explain the whole service. One company may sell directly to you, another match customer orders, and a website may connect your wallet to contracts. Before comparing prices, establish what the service actually does, who controls assets and which obligations apply. This makes later execution and custody checks much clearer.

Education only. Crypto assets can lose substantial value or become worthless. No lesson requires buying an asset, depositing money or sharing real passwords, private keys or recovery words.

Picture an exchange as a market hall with a cashier

Think of a covered market in Mumbai where, before you can trade, you hand your cash or goods to the hall's cashier. The cashier keeps a ledger of what everyone owns and matches buyers with sellers for you.

That is close to how a centralised exchange works. You open an account, deposit money or crypto, and the company records your balance in its own books. When you buy, it matches your order with a seller and updates both balances. Well-known examples include Coinbase, Kraken and Binance; naming them here describes the category and is not a recommendation.

The wallet and custody lesson in Level 2 called this custody. Your exchange balance is a promise from the company, and that convenience brings a matching risk. The US SEC warned in a March 2023 investor alert that crypto platforms often combine the jobs of marketplace, broker and custodian inside one company, and that this mix creates conflicts of interest and risks for investors. The exchange failure lesson in Level 3 shows what happened when some of these companies failed.

The analogy has a limit: in a real market you watch your goods change hands, but on an exchange you see only numbers until you withdraw. And not every crypto app runs a market hall.

Tell an order book exchange from a broker app

In Toronto you can buy a used car at an auction, where you see every bid, or from a dealer, who names one price and sells from his own stock.

Crypto has both. An order-book exchange is the auction: it shows customers' buy and sell orders and matches them by price. A broker-style app is the dealer: you tap "buy", it quotes one price, and the firm fills your order from its own inventory or by trading elsewhere for you. Many companies offer both, often as a "simple" screen and an "advanced" screen.

Neither model is automatically better: the broker screen is quicker, but its markup is harder to see. Both are usually custodial, and both are different from a decentralised exchange (DEX), where trades happen through programs running on a blockchain and you keep your own keys. DEXs bring their own risks, and Level 6 explains them in detail.

Whichever screen you use, prices start with an order book, so learn to read one.

A broker may quote a price or arrange access to another market. Peer-to-peer services connect counterparties and may provide escrow or dispute handling. The answer should describe the actual service rather than the marketing category.

Map your on ramps and off ramps

Think of a motorway in Italy. Slip roads take you on and off, and each has its own toll, speed limit and queues.

An on-ramp is any route that turns your local money into crypto, and an off-ramp turns it back. Common routes include bank transfers, debit or credit cards, mobile money or instant-payment apps, and P2P marketplaces (the exchange and order lessons in Level 3).

Each route has rules about how fast your money can leave again, which surprises many beginners.

Expect holds limits and delays

A hotel in Rome may place a hold on your card at check-in. The money is still yours, but you cannot use it until the hold lifts.

Exchanges place similar holds. Kraken's support pages explain that withdrawals can be held after deposits by methods that can be reversed: for example, 72 hours after card or digital-wallet purchases and seven days after some bank-debit purchases, while trading continues normally. After a password reset, withdrawals to new addresses are held for 24 hours for security. The reason connects to Level 0: card payments and some bank debits can be reversed, so a provider waits before letting crypto leave.

Limits are common too. Deposit and withdrawal limits often depend on your verification level, and a large or unusual withdrawal may trigger extra checks under the KYC and AML rules from the provider checking lessons in Level 3. Plan transfers well before you need the money.

Once the hold lifts, one decision remains: which network to withdraw on.

Payment methods may include bank transfers, cards or supported local services. Availability, fees, limits and settlement timing depend on country and provider. A displayed crypto balance may appear before the underlying payment has fully settled. For a learner in India, a price quoted in INR does not establish that the service is authorised for every Indian customer or payment method. A learner in France may face different eligibility and disclosure rules.

Find out who you are really trusting

Before you hand your spare house key to someone in Cape Town, you want to know more than their name. Where do they live? Who vouches for them? What happens if they lose it?

The exchange and order lessons in Level 3 showed that an exchange balance is a promise from a company. So choosing a provider is really choosing whom to trust with your money and keys. A polished app tells you little about that. The questions that matter are about the business behind the logo: which legal company you are contracting with, which regulator supervises it, how it holds your assets, what it charges, and how it protects your account.

Brand names can mislead. One brand may run several legal companies in different countries, each with different licences and terms. A friend in another country may be served by a different company from you, under the same logo. Your account agreement names the company that owes you obligations, so start there and write the name down.

There is no single "best" exchange, and this lesson names none. Instead it gives you a set of checks you can repeat for any provider. The first check is the regulator.

Check the licence on the regulator s own register

Imagine hiring an electrician in Manchester. A certificate on the van looks reassuring, but it proves nothing until you look the person up on the official scheme's website.

Financial regulators keep similar lists, called registers. A register shows which firms are authorised or registered, under which legal name, and for which activities. Many regulators also keep a warning list of firms known to be operating without permission.

The checks follow a pattern in most countries. Find your national financial regulator from its official website, not from a link in an advert. Search the register for the firm's exact legal name from its terms. Confirm that the permitted activities include the service you want, such as exchange or custody of crypto-assets. Then search the warning list. Finally, contact the firm only through details shown on the register, because clone firms copy real firms' names, as Level 0 explained.

Dated examples show how this varies. In the European Union, the Markets in Crypto-Assets Regulation (MiCA) brought its main service-provider rules into application from 30 December 2024. Covered entities need to meet the relevant authorisation or notification route; some already regulated entities use specific notification provisions. The European Securities and Markets Authority (ESMA) publishes an interim MiCA register, updated weekly, that lists authorised providers and non-compliant entities. ESMA also described a transitional period, which ran until 1 July 2026 at the latest, during which some firms already operating could continue while awaiting authorisation. In South Africa, the Financial Sector Conduct Authority (FSCA) declared crypto assets a financial product in October 2022, and its transition required covered providers of crypto-related financial advice or intermediary services to apply between 1 June and 30 November 2023. That statement does not classify every ecosystem participant as a licensed financial-services provider.

Being on a register is a starting point, not a seal of approval, which the next section explains.

Know what registration does not protect

A driving licence shows that someone passed a test. It does not promise they will never crash.

Registration works the same way. Depending on the country, it may mean a firm passed checks on its owners, anti-money-laundering controls or capital, but it does not mean your money is insured or that the firm cannot fail. The UK Financial Conduct Authority says crypto is largely unregulated in the UK, so it is highly unlikely you would be covered by the Financial Services Compensation Scheme. Its standing message is "be prepared to lose all your money".

Rules are changing in many places, so these are dated examples, not statements about your country. Ask two questions of any provider: which rules apply to this service, and what protection exists if the company fails? A registered firm will also ask you questions, which is the next check.

Providers may request identity, source-of-funds or recipient information under anti-money-laundering and other requirements. The Travel Rule concerns transmission of specified originator and beneficiary information in applicable transfers. Implementation and thresholds depend on the jurisdiction and service. A request for identity should still be verified through the genuine provider rather than an unsolicited message.

Passing identity checks does not establish that the provider is solvent, that an asset is appropriate or that losses are insured. Conversely, a delayed withdrawal may reflect a review rather than immediate proof of fraud. Read the stated procedure, preserve non-secret records and use official support. Regulatory registration has a scope; it should not be stretched into approval of every product offered by the company. Later lessons examine registration, audit and insurance claims separately.

Questions for each service

Expect identity checks and understand why

Opening a bank account in Frankfurt means showing your passport and proving your address. The bank is not being nosy; the law requires it to know its customers.

Regulated crypto providers do the same. KYC (know your customer) means verifying who you are, usually with an ID document, a selfie and proof of address. It is part of AML (anti-money-laundering) rules, which require firms to watch for suspicious activity and report it. Since 2019, the Financial Action Task Force (FATF), the global standard-setter on money laundering, has applied its standards to virtual assets and to the firms that handle them, which it calls virtual asset service providers (VASPs).

KYC has a cost: you hand sensitive documents to a company that could be hacked. So upload them only inside the official app or website, never by email or chat. A platform that asks for no checks at all may be operating without permission, or may be a fake. KYC also explains the next set of questions you may see when you withdraw.

See how the Travel Rule follows your transfer

When a bank in Seoul sends an international wire, details about the sender and receiver travel with the payment. The receiving bank can see who sent the money.

The FATF's Travel Rule (Recommendation 16) requires originator and beneficiary information to travel with transfers, and the FATF's standards for virtual assets apply it to crypto transfers between providers. In practice, an exchange may ask you for the recipient's name, whether the address belongs to you, or which provider it belongs to. Some ask you to declare that an address is your own self-custody wallet.

Implementation is uneven. The FATF's June 2022 targeted update found that of 98 jurisdictions surveyed, only 29 had passed Travel Rule laws, and urged faster action. So the questions you see depend on where you and the receiving provider are based, and they keep changing.

Compliance questions cost you a minute. Fees cost money, and they come in more forms than the trading fees you met in the exchange and order lessons in Level 3.

Peer to peer escrow and payment finality

In a peer-to-peer trade, one party may transfer national currency while an escrow mechanism holds crypto pending confirmation. The service's rules determine when release occurs and how disputes are handled. A screenshot saying paid can be forged. A payment may also be reversible or originate from an unrelated account, creating further risk.

Do not release escrow solely because the other person creates urgency or supplies a notification. Verify actual receipt and applicable finality through the payment provider, while following the platform's legitimate dispute process. Avoid off-platform arrangements that remove the protections the service actually offers. Escrow can reduce a specific delivery risk; it does not eliminate payment reversal, identity fraud or platform failure. This course uses paper scenarios rather than requiring a peer-to-peer trade.

Picture selling a bicycle in Jakarta through a site that holds the buyer's payment until you hand over the bike. The site sits in the middle, so neither of you has to trust the other completely.

Spot contracts account security and support

Spot trading concerns current exchange of assets under the settlement arrangement. Margin involves financing or collateral supporting exposure. A dated future has a defined contract maturity; a perpetual generally has no scheduled expiry and uses venue mechanisms such as funding. An option gives a specified contractual right, with terms such as strike and expiry. These products do not grant identical rights.

Access on the same application does not make their risks equivalent. Some products can liquidate collateral or produce obligations different from a fully paid spot holding. Mark the category in every example, and read jurisdictional eligibility as well as product terms. We will study derivatives at Levels 7 and 8 after spot execution is clear. For now, you should be able to say whether the service delivers an asset or a contract whose payoff depends on a price.

Switch on the security features before you deposit

A good front door in Toronto has a lock, a peephole and a chain. Each helps in a different way.

Exchange accounts have similar layers. The security lessons in Level 2 explained two-factor authentication (2FA) and why app-based codes or hardware security keys are stronger than SMS. Turn it on before you deposit. Then look for a withdrawal allow-list. Coinbase's help pages describe an address-book allow-list that limits sends to addresses saved in your address book; a newly added address becomes usable only after 48 hours, and changes require your 2-step verification. That delay gives you time to notice if a thief adds their own address.

Other useful features include an anti-phishing code, a word you choose that appears in every genuine email from the provider, alerts for new logins and withdrawals, and a list of logged-in devices you can review. None of these protects you if you hand over your codes, so the rule from Level 2 stands: real support staff never need your passwords, 2FA codes or recovery words.

Security features protect your login. What happens to the assets behind it depends on the custody terms.

Read the custody terms

Leaving your car with a valet in Rome, you'd want to know: will they park it in a locked garage, lend it to a friend, or put it in a shared lot with hundreds of others?

Custody terms answer those questions for your crypto. The SEC's December 2025 investor bulletin on custody suggests asking whether a provider lends out or reuses deposited assets (rehypothecation) and whether that needs your consent, whether it commingles customer assets in shared wallets rather than holding them separately, how it stores assets (hot or cold wallets, or through subcontractors), what insurance exists and on what terms, and what fees apply. It warns plainly that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your crypto.

Look in the terms for phrases such as "we may use", "lend" or "title transfers to us". Wording like that can mean the assets are no longer held for you in the way you assumed. The exchange failure lesson in Level 3 shows why this matters when a company fails. Before then, check one more thing: who answers when something goes wrong.

Test the support and complaint routes

Most people only look for a shop's returns policy after something breaks. With crypto providers, look first.

Find the official support channel inside the app or on the provider's own website, and check whether there is a formal complaints process and an outside body, such as an ombudsman or the regulator, that handles unresolved complaints. Then send a small, harmless question and see how support responds.

You now have every piece of the check. The last step is putting them together.

Everyday example

What to remember

Lesson completion check

References and further reading