How to assess an exchange's security
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 6 min
In short
Assess an exchange on a few checkable points: whether it is registered with the FSA, how it segregates customer assets and how much it holds in cold storage, which defences it gives you as a user — two-factor authentication, withdrawal whitelists, withdrawal delays — and how it has handled past incidents. All of these can be confirmed from official disclosures and from the regulator's own publications.
Key points
- Check the operator's name on the FSA register of crypto asset exchange service providers
- Look for disclosure on segregation of customer assets and cold storage policy
- Compare the defences you can actually use: 2FA, whitelists, withdrawal notifications
- Look at how past outages or losses were disclosed and compensated
Definition
A way of judging how safe it is to hold assets at an exchange, looking at three sides: regulation, the operator's own controls, and the defences available to you as a user.
Start with regulation. A service handling Japanese yen domestically must be registered with the Financial Services Agency as a crypto asset exchange service provider. The FSA publishes the register, so this is regulator information rather than a company's own claim, which makes it the most reliable starting point. If an operator is unregistered, or is an overseas firm soliciting residents of Japan, understand that the protections you are relying on are different.
Next, read what the operator discloses about how it holds customer assets. Registered domestic operators are required to keep customers' money and crypto separate from their own, and each publishes how it does so. Most also publish what proportion of customer crypto sits in cold storage, disconnected from the internet. Both points bear directly on what happens to your assets if something goes wrong.
Third, look at the defences you can switch on yourself. Two-factor authentication is close to a given; beyond that, compare withdrawal whitelists, the delay before a newly registered destination can be used, notifications for withdrawals and logins, visible login history, and app locks. These decide not whether the operator protects you but whether you can protect yourself — and in practice that is usually what determines how bad an incident gets.
Fourth, examine the track record. Any long-running operator has had outages and faults. The question is not whether something happened but whether they disclosed it, explained the cause and the remediation, and how they handled compensation. Scrolling back through the notices page tells you a great deal about that posture.
Finally, consider the risk of leaving assets on an exchange at all. Crypto in an exchange account is not held under keys you control. For holdings you do not trade often, moving them to a wallet you manage yourself is an option — though self-custody brings its own risk, namely losing the seed phrase. Which suits you depends on the amounts and on how organised you are. 'What is a wallet' and 'Managing your seed phrase' are worth reading alongside this.
Watch out for
- · Some operators claim FSA registration while not appearing on the register at all. Always check the regulator's published list
- · Security certifications and audits cover a defined scope at a defined moment. Their presence alone is not proof of safety
- · This article neither recommends nor warns against any particular exchange; it only sets out the points to compare
Frequently asked questions
Is it safe to leave assets on an exchange?
It depends on the amount and the purpose. Keeping what you actively trade on the exchange is practical, while long-term holdings can be moved to a wallet you control. Both carry their own risks, so understand each and split your holdings deliberately.