How to Check Whether a Crypto Exchange Is Licensed (and What That Does Not Prove)

Why can't I take the platform's word for its licence?

Scammers copy real firms' names, addresses and licence numbers, and a 'regulated' badge on a website proves nothing on its own. The check that counts is the regulator's own register, reached from your own bookmark or by typing the regulator's address, never from a link on the platform's page. If you cannot find the firm there, treat that as the answer.

A licence is also not a recommendation. This guide shows you how to read a public register; it does not tell you which exchange to use, and this page contains no affiliate links, and we do not rank exchanges. Some exchange links elsewhere on the site are referral links, labelled where they appear; see /how-we-make-money.

Step 1: find the legal entity, not the brand

Scroll to the footer or the terms of service. You want the registered company name, its country, and any licence or registration number. Brands are not licensed; companies are. A brand may operate through several companies serving different countries, and your account is with one of them.

ESMA's consumer warning makes the same point for the EU: MiCA protections apply only to the specific authorised legal entity in the EU, not to other companies in the same group and not to non-EU entities, so review your contract to confirm which entity is actually providing your service. No legal entity named anywhere is a red flag on its own.

Step 2: choose the right register for where you live

EU and EEA. ESMA publishes an interim MiCA register that includes a list of authorised crypto-asset service providers. ESMA says the MiCA transitional period ended across the EU on 1 July 2026, that any entity providing crypto-asset services to EU clients without a MiCA licence after that date is in breach of EU law, and that consumers should check the company is listed as authorised in the ESMA Interim MiCA Register before investing or transferring funds. Your national regulator's own list is a useful second check.

United States. FinCEN's MSB Registrant Search shows money services business registrations, which are an anti-money-laundering registration rather than an endorsement. State licences are separate: NMLS Consumer Access, the state regulators' licensing system, lets you check whether a company is licensed in your state, though not every state agency puts every licence type there. New York requires a BitLicense (or a NYDFS limited-purpose trust charter) for virtual currency business activity involving the state, and its Department of Financial Services lists regulated entities. California's Digital Financial Assets Law requires covered crypto businesses serving Californians to be licensed by the DFPI, or to have applied, from 1 July 2026.

United Kingdom. The FCA says cryptoasset businesses such as exchanges, crypto ATMs and custodian wallet providers must be registered with it for money-laundering purposes, and that you should avoid using firms for those services if they are not registered. Use the FCA Firm Checker or Financial Services Register, and its Warning List. The FCA also says registration is not a recommendation or endorsement, and that for most cryptoassets customers are unlikely to have access to the Financial Ombudsman or the FSCS.

Elsewhere. Use your national financial regulator's register, typed in yourself. Our country pages, such as /countries/united-states, summarise local rules, and /guides/crypto-bans-sanctions-know-your-line covers restricted jurisdictions.

Step 3: match every detail, then test from the other direction

Compare the register entry with the platform, not just the name: the legal name and registered address, the website address listed (character by character, because look-alike domains are common), the services covered, the status (authorised, registered, withdrawn or suspended) and any restrictions or warnings. The FCA warns that clone firms copy a genuine firm's details and advises checking that the contact details you were given match the ones on its register.

Then test the claim from the other direction. Search the regulator's warnings for the firm name, and search the firm name with words like 'complaints' and 'withdrawal'. A real licence number on the wrong website is still a fake site.

Step 4: do a small test before you commit

Deposit a small amount, withdraw it to a wallet you control, and read how fees and verification work. Never pay a 'tax', 'unlock' or 'verification' fee to withdraw; that pattern is explained in /guides/pay-to-withdraw-crypto-scam.

If you have already sent money to a platform that fails these checks, stop sending more, save screenshots, addresses and transaction IDs, and follow /guides/crypto-scam-recovery-next-steps and /scam-reporting-resources. Be wary of 'recovery' firms that contact you first.

What a licence does and does not prove

A licence or registration can indicate that the firm meets some legal requirements, that a regulator can supervise it and act, and that there is a legal entity you can complain to. It does not prove that your money is insured or will be returned, that the firm is solvent or well run, that its products suit you, or that every service it offers is covered.

Supervised firms have still failed; /guides/exchange-collapse-thodex-lesson shows how an exchange collapse plays out. Fake-licence tells include a licence number shown only as an image, a 'verify' badge that links back to the firm's own page, a regulator name you cannot find independently, a claim of being 'regulated' without saying by whom, and a support agent who sends a 'certificate' PDF; /guides/fake-crypto-app-detector covers cloned apps and sites.

Risk: crypto assets are volatile and can go to zero. A licence or registration does not promise safety, solvency or suitability, and registers can lag behind real-world events. Compare /guides/exchange-vs-self-custody before deciding where to keep anything.

FAQ