Most crypto investors spend hours researching the token they’re about to buy. Almost nobody spends ten minutes researching the company that’s about to hold their money.
In November 2022, millions of customers learned a painful lesson almost overnight. The collapse of FTX wasn’t ultimately about Bitcoin, Ethereum or any other crypto asset. It was about trusting the wrong platform, and that platform’s lack of supervisory oversight.
Many customers assumed they were dealing with a sophisticated, well-supervised financial institution. Given the hundreds of millions of dollars the company had spent on splashy advertising and celebrity endorsements, their assumptions were understandable. Instead, they found themselves caught in one of the largest corporate failures in modern financial history, with billions of dollars of customer assets tied up in bankruptcy proceedings and years of uncertainty over what, if anything, they would recover.
Europe’s Markets in Crypto-Assets Regulation (MiCA) was designed to reduce the chances of that happening again. It introduced common rules for exchanges serving European customers, including governance standards, disclosure requirements, safeguarding obligations and regulatory supervision.
But MiCA only protects consumers when they are actually dealing with regulated European entities.
Today, many global crypto exchanges continue to operate through complex groups of companies spanning multiple jurisdictions. A customer may see a single brand, a single app and a single login – and although one of these entities may well be registered in Europe, many of the additional services offered in the same app aren’t. In fact, they’re almost certainly products provided by different legal entities operating under entirely different regulatory regimes. Some services may fall within Europe’s regulatory framework. Others may not. And as a consumer this makes a big difference.
That distinction may not matter when everything goes to plan. But it becomes critically important when something goes wrong. As we’ve seen time and again with insolvencies or “bank runs” like the case of FTX, BlockFi, or Mt Gox before them, if your funds are sitting on unlicensed, offshore platforms, they’re beyond the reach of regulators, insurance will be limited or non-existent, and your legal options greatly diminished. To put simply, if the platform goes down, the chances of ever seeing your assets is exceedingly fleeting.
So, what can you do? Start by asking these seven questions before depositing your next dollar, euro or stablecoin.
1. Who is actually holding my assets?
This sounds obvious. But in practice, many people couldn’t answer it. Don’t just know who owns the exchange. Know which legal company you’re contracting with. In the case of most banks, the company whose name is on your account statement, is almost always the company that is responsible for your money. But with offshore crypto platforms, many go to great lengths to obfuscate who you’re actually dealing with. This matters because if the platform experiences a cyberattack, becomes insolvent or freezes withdrawals, it’s the legal entity you’ll ultimately have to deal with.
If you can’t identify that company in under two minutes, that’s your first warning sign.
2. Is every product I’m using actually licensed where I live?
Many investors assume that if an exchange is licensed somewhere in Europe, every product it offers must also be regulated. This is simply not the case.
Spot trading, derivatives, staking, lending, payment cards, recurring purchases and stablecoin services may all operate under different legal arrangements depending on the jurisdiction and the entity providing them. For instance, one Austrian-based crypto platform highlighted below entices users to sign up and trade on its MiCA-registered spot exchange. It then offers derivatives and other unlicensed products under the same brand name, but from an unlicensed, offshore entity without ever disclosing that the customer is in fact entering into a net-new relationship with a platform completely outside the supervision of European regulators. However, importantly, this means that while their spot transactions (i.e., basic trades) are protected under EU law, any interactions with, or assets stored on, the derivatives platform are completely unregulated and unprotected. A regulated logo on the homepage should never be treated as confirmation that every service carries the same protections.
Check the legal entity providing the specific product you’re using or being offered – not just the exchange’s marketing.
3. If the platform is hacked tomorrow, what happens to my assets?
Every exchange talks about security. Far fewer explain what happens after security fails.
Ask simple questions.
Who custodies customer assets?
Are my assets insured by a trusted third party underwriter? (So called “Self Insurance” is a big red flag)
Are assets segregated?
Are regulated, qualified custodians used?
What happens if those providers fail?
If the answers are buried in dozens of pages of legal terms – or don’t exist at all – you should think carefully before depositing meaningful sums.
4. Does the exchange trade against its own customers?
This is one of the least understood questions in crypto: When you place an order, who is on the other side? Trading against a firm’s own customers has long been illegal in traditional capital markets – for good reason. A firm trading its own book creates numerous conflicts, primarily the opportunity for the company’s trading desk to front-run customer orders to either inflate asset prices or otherwise take advantage of other non-public information. MiCA explicitly prohibits platforms operating a trading platform from dealing on their own account (or “prop trading” as it’s sometimes called). This means an exchange cannot take the opposite side of your trade – acting as your counterparty – while you are executing orders on their venue. So while platforms registered under MiCA are legally bound to operate ethically, offshore venues are most certainly not. In fact, one of the world’s largest offshore exchanges, Binance, was accused by the U.S. Commodity Futures Trading Commission (CFTC) by operating more than 300 “house accounts” to trade against its clients and enrich its founder.
As a trader, it’s often impossible to know exactly who is taking the other side of your position. But there are a few questions you should ask to ensure you have the best shot at a fair trade.
Is the platform matching buyers and sellers on a one-for-one basis, or is it directing “flow” to large market makers or trading houses?
Is your exchange acting in a principal or agency model? If principal, what mechanisms can you rely on to ensure the best price discovery?
Does it operate affiliated market makers?
How are conflicts of interest managed – is this policy readily available to review?
Traditional financial markets impose extensive rules around these questions because incentives matter.Crypto investors should not settle for anything less.
5. If something goes wrong, who can actually help me?
Every regulated financial institution has a supervisor. Do you know yours? Too many people assume that because you’re accessing a particular platform from where you reside, that their local regulator may be able to assist them if something goes wrong. Unfortunately, this just isn’t true. If you choose – either deliberately or indirectly – to use a product or service provided by an offshore, unregulated platform, it’s very likely that it will be beyond the reach of your country’s consumer protections or law enforcement. So choose carefully.
Can you identify and verify the regulator responsible for the entity you’re using? Many regulators in the EU will have an online tool to check the status of your platform of choice. The European Securities and Markets Authority also has a great tool.
Is there a formal complaints process?
Can disputes be escalated to an external authority?
What is the overall reputation of the company you’re planning to deal with? Does it have hundreds of one-star reviews on Trustpilot? Likewise, does it have no reviews at all?
If the answer is “I’m not sure,” you’re relying largely on the platform’s goodwill if something goes wrong.
6. Is the product I’m being shown appropriate for me?
Some of the biggest risks in crypto aren’t hidden in the technology, they’re hidden in the marketing. Crypto companies operate some of the most sophisticated marketing programs in the world. From targeted online advertising, to social media tracking, to influencers and “exclusive trading groups” often hosted on encrypted messaging platforms like Telegram or WhatsApp. These programs exist for one reason: to motivate you to trade on a certain platform. But while algorithms and cookies can recognise intent, they can’t identify how much experience you have or what your appropriate risk tolerance may be.
Ask yourself why a particular product is being promoted to you.
Is it because it’s genuinely appropriate for your circumstances? Or because somebody is being paid when you trade?
Do you need to trade with excessive margin, or are you doing it because someone online has demonstrated “how easy it is to make hundreds of thousands in no time at all”?
If the platform uses influencers, affiliates or referral programmes, take the time to understand how those people are compensated before relying on their recommendations. Always keep in mind the old saying that if you’re not paying for the product (in this case the “online tutorials” or discounted trading fees), you are the product and should proceed accordingly.
7. Could I lose access tomorrow?
Perhaps the most important question of all. Regulators around the world are increasingly restricting the services that unlicensed offshore platforms can provide to local customers. If you’re using a platform or a particular product – that sits outside the regulatory framework in your country, ask yourself what happens if regulators intervene. Also keep in mind that as we’ve seen during recent geopolitical events, even VPNs can’t be relied upon to secure access to sites or platforms that governments deem to be illegal for their citizens to access,
So if the worst happens, what are your contingency plans?
Will I be able withdraw funds if my access is cut off?
Does the platform have a live customer support line that you can access?
Does the platform have a history of pausing withdrawals or moving customer funds without permission?
Does the platform have a significant enough presence in other regulated markets for you to be comfortable that it won’t disappear overnight (along with your funds)?
Does the entity have partnerships or business relationships with other trusted brands?
Or, ultimately, is it possible that the legal entity you’ve been using was never authorised to offer services to you in the first place?
These aren’t hypothetical questions. They’re exactly the kind of issues that have arisen repeatedly as regulators have tightened oversight of crypto markets.
The Bottom Line
Most crypto investors spend their time analysing charts, reading token whitepapers and debating market cycles. Very few spend the same amount of time researching the exchange holding their assets, and that may be the most expensive mistake they ever make.
The easiest time to investigate an exchange is before you deposit.
The hardest time is after withdrawals have been frozen.
Europe has built one of the world’s most comprehensive regulatory frameworks for crypto markets. But no regulation can protect consumers who unknowingly place their assets outside its scope.
Before you trade, take five minutes to understand who you’re trusting with your money. It might turn out to be the most important position in your portfolio.
