Verify legal access and regulatory status
Start with the exact legal entity that will hold your account—not only the global brand. Check its registered country, licence or registration number, and the relevant regulator’s public register. Registration is useful evidence, but it is not a guarantee against loss and may not include deposit insurance.
Separate account security from platform security
Account controls should include app-based or phishing-resistant two-factor authentication, device and session management, withdrawal allowlists, and anti-phishing tools. Then assess the operator itself: custody model, incident history, security disclosures, and response procedures. A strong login cannot protect users from a badly managed company.
Understand custody and proof of reserves
Find out who controls client assets, how hot and cold wallets are used, and whether customer assets are segregated. Proof of reserves can provide a useful snapshot, but it may not reveal every liability, ownership claim, or off-chain obligation. Treat it as one piece of evidence—not a complete audit.
Measure the total cost, not the headline fee
The advertised maker or taker fee is only one layer. Include bid-ask spread, slippage, card or bank charges, currency conversion, network and withdrawal fees, derivatives funding, and liquidation rules. Calculate the cost for the exact transaction size and market you expect to use.
Test liquidity and execution
Large volume claims do not automatically mean good execution. Inspect order-book depth and spread on the exact trading pairs you need, especially during volatile periods. Confirm available order types, platform stability, and whether a modest market order creates avoidable slippage.
Test deposits and withdrawals before scaling
Review supported payment rails, verification requirements, limits, processing times, network selection, destination tags, holds, and fees. Make a small deposit and withdrawal before sending meaningful capital. Crypto transfers are generally irreversible, so verify the address and network carefully.
Match the product to your country and use case
An exchange can be strong for spot trading and unsuitable for derivatives, fiat access, or long-term custody. Check which products are legally available where you live, what records are provided for tax reporting, and whether leverage or complex products add risks you do not need.
Judge support and transparency
Look for a public fee schedule, status page, clear terms, named support channels, and visible update dates. Search the legal entity—not only the brand—for repeated withdrawal or access complaints. Legitimate support should never ask for your seed phrase, private key, or remote control of your device.
Put the exchange through a real test
Documents and security claims are only the first filter. Before keeping meaningful funds on an exchange, test the full path from account creation to withdrawal.
Before you register
Write down the exact legal entity, country, permitted products, fee schedule and custody model. Open the regulator or public register independently and save the result with the date.
Run a small round trip
Enable strong 2FA and an anti-phishing code, then deposit a small amount, place the type of order you expect to use and withdraw through the same asset and network. Record the true cost and processing time.
Before you scale
Repeat a withdrawal during normal conditions, review recent status incidents and decide how much is operating capital. Long-term holdings should not remain online merely because moving them feels inconvenient.
Red flags that override the score
- The legal entity or country remains unclear after account opening.
- Support asks for a seed phrase, private key, password or remote access.
- Deposits are instant but withdrawals repeatedly require new unexplained checks or payments.
- Proof of reserves is promoted without explaining liabilities, ownership or the scope of verification.
- A bonus, “VIP manager” or urgent message pressures you to deposit more than planned.
Keep a decision record
Save the entity name, register result, fee page, custody explanation, security settings and a screenshot or transaction ID for the test withdrawal. Recheck the file when the operator, terms, jurisdiction or products change.
The 60-second shortlist
Before opening an account, confirm that every answer below is clear and documented.
- The legal entity, jurisdiction, authorisation number, and services permitted for your country.
- 2FA options, withdrawal controls, active-session visibility, custody policy, and incident communication.
- Reserve methodology, liability coverage, independent verification, wallet ownership, and asset segregation.
- A complete cost example for one deposit, trade, and withdrawal in your preferred currency.
- Real pair-level depth, spread, order types, uptime information, and execution on a small test order.
- A successful small round trip using the same rail, asset, and network you plan to use later.
- Country eligibility, required product set, reporting history, fiat support, and leverage restrictions.
- Reachable support, dated policies, incident updates, complaint patterns, and clear escalation routes.
The MyProfitFactor rule
No exchange removes risk. Score the platform, test it with a small amount, keep only working capital online, and use self-custody for longer-term holdings only if you can manage keys safely.
Risk note
Cryptoassets are volatile and may not have the same protections as bank deposits or traditional investments. Availability, regulation, and consumer protections differ by country. This guide is educational, not financial advice.
Primary sources
The framework uses regulator and public-authority material as a baseline. Always verify the entity serving your account in your own jurisdiction.