What is a crypto exchange?

By the Blockhorizon Editorial Team · Updated 2 October 2026 · How we check facts

For most people, a crypto exchange is the first step into crypto: an app or website where you sign up, add money and buy a coin. This guide explains what is actually happening behind that screen, who ends up holding your coins, and what financial regulators in the US, UK and EU say about the protection you do — and do not — get. We do not name or rate individual platforms here.

What does a crypto exchange actually do?

“Crypto exchange” is the everyday name for a company that matches buyers and sellers of crypto-assets such as Bitcoin. Regulators often use the broader words “crypto platform” or “crypto asset entity”, because many of these firms do far more than run a marketplace.

A single platform may act as an exchange (where trades are matched), a broker (which takes your orders), and a custodian (which holds your coins for you). In a March 2023 investor alert, the US Securities and Exchange Commission (SEC) warned: “The commingling of these functions, exchange, broker-dealer and custodial functions, for example, creates conflicts of interest and risks for investors.”

How does buying crypto on a platform work?

The basic steps look much like a share-dealing app:

1. Open an account. You sign up, and the platform may ask you to prove your identity.
2. Add money. You transfer ordinary money (pounds, euros, dollars) into your account.
3. Place an order. You buy a crypto-asset at the price the platform shows, plus any fees it charges.
4. Hold or withdraw. The coins appear in your account balance. You can usually leave them there or send them to a wallet you control.

Step 4 is the one beginners skip over — and it is where most of the platform risk sits.

Who holds your crypto when it sits on an exchange?

Crypto is controlled by private keys, the secret codes that let someone move coins on the blockchain. The SEC defines custody as “how and where you store and access your crypto assets.”

When you leave coins on a platform, the platform usually holds the keys. That is called third-party custody. The SEC’s December 2025 custody bulletin is blunt about the downside: “If the third-party custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets.”

The same bulletin names two further practices to ask about. Some custodians lend out or pledge customers’ coins (called rehypothecation), and some pool customers’ coins together instead of holding them separately (called commingling).

Ownership itself can be at stake. The SEC’s 2023 alert says investors who deposit assets with such an entity “might cease to have legal ownership of those assets and might not be able to get those assets back when they want to.”

The alternative is self-custody, where you hold the keys yourself. That removes the platform risk but puts all of the responsibility on you — the SEC says that if you lose your private key, you permanently lose access. Our guide to crypto wallets and private keys explains both options.

Is a crypto exchange protected like a bank or stockbroker?

Generally, no — and regulators in three major markets say so directly.

• United States. Customers of registered stockbrokers generally benefit from the Securities Investor Protection Corporation (SIPC). The SEC’s 2023 alert says: “There are no such protections for accounts that you place with crypto asset entities.” At that date it also said none of the major crypto asset entities was registered with the SEC as a broker-dealer, exchange or investment adviser. A 2022 SEC bulletin adds that crypto sent to interest-paying crypto companies is not insured by the bank deposit insurers FDIC or NCUA.
• United Kingdom. The Financial Conduct Authority (FCA) says crypto “is largely unregulated in the UK, so it is highly unlikely you will be covered by the Financial Services Compensation Scheme”.
• European Union. The EU’s crypto rules, known as MiCA, have been fully applicable since 30 December 2024. Even so, the EU’s three financial supervisors (EBA, ESMA and EIOPA) say MiCA protections are not as extensive as for traditional products and “you will not benefit from compensation schemes”. With providers that are not authorised in the EU, they warn “you may not benefit from any consumer protection”.

What can go wrong with a crypto platform?

The problems regulators describe fall into a few groups:

• Frozen withdrawals. The SEC reported in 2023 that some crypto firms had faced severe financial difficulties, “sometimes resulting in suspending customers’ ability to withdraw their assets.”
• Bankruptcy. The SEC notes that some entered bankruptcy proceedings, and “it is unclear how much of their holdings (if any) customers might be able to recover.”
• Hacks, glitches and fraud. The US Commodity Futures Trading Commission (CFTC) lists the risk of theft from hacking, and warns: “If fraud or theft occurs, you may not be able to get your money back.”
• Markets that vanish. A 2022 SEC bulletin warns that the market for a particular crypto-asset “may disappear altogether”.
• Fake platforms. Some “exchanges” are scams built to take deposits. A joint CFTC and SEC alert from 2019 lists warning signs such as promises of high returns described as guaranteed, unsolicited contact and pressure to act fast. See our crypto scam red flags.

How can you check whether a crypto platform is authorised?

Always check the firm on the regulator’s own register, by typing the regulator’s web address yourself rather than following a link the firm sent you.

• UK: use the FCA’s Firm Checker or Financial Services Register, and the FCA Warning List of unauthorised firms.
• EU: the EU supervisors point consumers to the ESMA register to check whether a crypto provider is authorised; ESMA also links to each national regulator.
• US: the CFTC and SEC advise checking registration through Investor.gov and state securities regulators. The CFTC also publishes a RED List of foreign firms that appear to need registration but do not have it.

When you find an entry, confirm that the exact legal name, the reference or licence number, and the website, phone and email all match. The FCA warns that scammers copy genuine firm reference numbers, so a matching number alone proves little. And a firm missing from a warning list is not proof that it is safe — the FCA says it may still be unauthorised or a scam. Our step-by-step guide on how to check if a crypto firm is authorised covers each register.

In the UK, the marketing itself is a clue. Since 8 October 2023, FCA rules require crypto promotions to UK consumers to carry a clear risk warning, ban bonuses for joining or referring a friend, and give first-time investors a 24-hour cooling-off period. The FCA says a firm that skips the warnings and offers incentives “could be illegal, or even a scam.”

What are the risks of using a crypto exchange?

In short, using a platform adds platform risk on top of the price risk of crypto itself:

• You may not control your coins. If the platform holds the keys, it may also lend or pool customer assets (SEC).
• Little or no compensation. No SIPC cover in the US, FSCS cover “highly unlikely” in the UK, and no compensation schemes under MiCA in the EU.
• Withdrawals can stop. Firms in difficulty have suspended withdrawals, and recovery in bankruptcy is uncertain (SEC).
• Conflicts of interest. One company acting as exchange, broker and custodian creates conflicts (SEC).
• Prices can still collapse. The FCA says crypto-assets “are all high risk and speculative as an investment”. Read the risks of crypto, in regulators’ words.

The SEC’s rule of thumb applies here: “The only money you should put at risk with any speculative investment is money you can afford to lose entirely.”

Blockhorizon is an education site. We do not recommend any crypto exchange or crypto-asset, and nothing here is financial advice.