Recommended Free Tools
The safest way to choose a custodial crypto exchange is to verify the exact legal entity serving you, confirm that its permissions cover the services you need in your jurisdiction, read how it holds client assets, and test the actual withdrawal rules for each asset and network before depositing significant funds. A registration or licence is evidence of oversight, not a promise that withdrawals will be immediate or that every asset will be recoverable if the provider fails.
Use the process below to compare exchanges on the same jurisdiction, asset and service basis. Terms, supported networks, fees, limits and custody arrangements can change, so check the regulator’s current records and the exchange’s current agreement immediately before opening an account.
As an Amazon Associate I earn from qualifying purchases.
Start with the legal entity, not the brand name
An exchange’s consumer-facing name may cover several companies. The company that accepts your account agreement, holds your assets and processes withdrawals is the entity whose permissions and insolvency arrangements matter.
Identify the contracting company
- Open the account agreement, terms of service and privacy notice.
- Record the company’s complete legal name, registration number, registered address and governing-law clause.
- Check whether the agreement names a different custody company, payment company or affiliated trading venue.
- Confirm which entity will hold your assets and which entity will owe you any fiat balance.
If the legal name is difficult to find, changes between pages or differs from the regulator’s record, stop the comparison until the discrepancy is resolved. A familiar brand does not establish which company you are contracting with.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Match permissions to the activity
Permission requirements depend on what the firm actually does. Check separately for the services you intend to use: buying and selling, operating a trading platform, custody or safeguarding, transferring cryptoassets, staking, lending, derivatives and fiat payments may have different regulatory treatment. A registration for one purpose should not be treated as authorisation for every other service.
In the United Kingdom, the Financial Conduct Authority (FCA) explains that an existing registration does not automatically establish all permissions required for specific activities. Its standards page says final rules published on 30 June 2026 apply to firms granted permission to operate under the Financial Services and Markets Act on or after 25 October 2027. That future regime date is not a current authorisation check: use the FCA’s current firm record and the precise activity description for the entity you are considering.
Check the regulator for your location
Regulatory status is jurisdiction-specific. An authorisation in one country may not cover residents of another country, a particular website, or a particular product. Check the regulator serving the place where you live and the entity named in your contract.
European Union: read the MiCA custody and return rules in context
For a custodial crypto-asset service provider (CASP) operating under the European Union’s Markets in Crypto-Assets (MiCA) framework, Article 75 sets expectations for the custody agreement and custody policy. The policy should address the authentication system, security systems, fees, applicable law, client-position registers and measures intended to reduce risks from fraud, cyber threats and negligence.
On 18 February 2026, the European Commission’s answer published in the European Securities and Markets Authority (ESMA) Q&A clarified Article 75(6): “The words “return crypto-assets held” in Article 75(6) should be understood as meaning that the same type of crypto assets as the crypto-assets held at the time of the client’s request must be returned.”
A provider may let you choose conversion into fiat or another cryptoasset, subject to the applicable service and execution rules, but it cannot substitute an equivalent asset when you asked for the asset you hold. Return can still be subject to technical requirements, fees, account type and destination-address limitations. Those conditions must not make return difficult for most clients.
United Kingdom: distinguish registration from broader permissions
Use the FCA’s current register and permission descriptions for the exact firm and service. Do not infer that a firm allowed to perform one regulated activity can automatically provide custody, transfers or other services. Also distinguish a firm’s regulatory status from the protection attached to a particular asset or balance; the permission itself does not guarantee that an exchange will remain solvent or that every loss will be reimbursed.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- Proven security at scale: Over 9 years and millions of cards issued with no known remote hacks, while military‑grade EAL6+ security keeps your private keys locked inside the chip. Your cryptocurrencies stay strongly protected from online attackers.
- Tap once to manage your entire crypto wallet across 90 blockchains - no USB cables or Bluetooth, no batteries, no setup. Access 14,100+ coins & tokens, DeFi, NFTs, and staking instantly from your phone
- Smart backup: Use your second Tangem Wallet as your Backup keys with end‑to‑end encryption; no more papers, pictures. If one card is lost, the remaining can still restore full access, with an optional seed phrase available for advanced users.
- Engineered to last up to 25 years: Waterproof (IP69K), shockproof and tested for extreme temperatures from −25°C to 50°C. A durable cold wallet with long‑term protection and independently audited security.
- Trusted by 6 million users worldwide - buy, sell, swap, stake, and spend cryptocurrency directly. The secure offline storage wallet designed for how people actually use crypto wallets
Hong Kong: use licensed-platform controls as a practical benchmark
The Securities and Futures Commission’s guidance for licensed virtual-asset trading platforms describes operational controls that are useful questions anywhere: safeguards against fraudulent or coerced withdrawal requests, limits on staff directing assets to another address, and checks that prevent a destination address from being changed before a transaction is signed and broadcast. These are controls described for Hong Kong’s licensed-platform context, not a universal requirement for every exchange worldwide.
Switzerland: investigate where custody occurs
FINMA’s statement of 12 January 2026 warns that cross-border custody can create additional legal issues if a custodian becomes insolvent. It says customer cryptoassets should not form part of the custodian’s bankruptcy assets. That is regulator guidance, not a universal guarantee under other countries’ laws and not an assurance that an exchange will be solvent. Ask where the keys and records are held, which entity is the custodian and which law governs the custody relationship.
Read the custody agreement before depositing
Do not rely on a security badge, a claim that assets are “segregated” or a description of cold storage. The contract should tell you what you are actually entitled to and who can move the assets.
Questions the custody policy should answer
- Who controls the private keys or other means of access?
- Does the provider hold assets directly, use a third-party custodian or place assets in a pooled wallet?
- How are your holdings recorded, reconciled and shown in the client-position register?
- What authentication and security systems protect account access and transaction approval?
- Which fees apply to custody, deposits, withdrawals, conversions and address changes?
- Which law and courts govern the agreement?
- What happens to your assets if the exchange, a custodian or an affiliate becomes insolvent?
- Can the provider rehypothecate, lend, pledge, stake or otherwise use your assets?
Under MiCA Article 75, these subjects belong in the custody policy and related agreement. Outside the EU, the exact legal content differs, so treat the list as a due-diligence checklist rather than proof that another jurisdiction imposes identical rules.
Separate ownership language from access language
Terms may say that you retain an interest in an asset while the exchange controls the wallet keys. That distinction matters: you may have a contractual claim without having the technical ability to transfer the asset yourself. Find the clause describing when a withdrawal becomes effective, whether the provider may freeze an account, and whether assets are pooled with other customers’ holdings.
Test withdrawals for every asset and network you will use
“Withdrawals supported” is not a single feature. An exchange may support an asset for trading but not permit on-chain withdrawal, or may support one network while rejecting another. Evaluate the exact asset-network combination before funding the account.
Confirm the return path
- Is the specific asset withdrawable, rather than merely tradable?
- Is the network you intend to use listed, and does it match the destination wallet or service?
- What is the minimum withdrawal amount and fee?
- Are there daily, rolling or account-level limits?
- Are destination addresses restricted to an allow-list or subject to a cooling-off period?
- What identity, device or transaction confirmations are required?
- Can the exchange pause withdrawals for compliance, fraud or security review?
- How are failed, rejected or misdirected transactions handled?
In the EU MiCA context, technical requirements and fees may apply, but they must not make returning the asset difficult for most clients. Ask support to confirm the rule for the exact account type you will use; institutional, retail, new and recently modified accounts can have different conditions.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Perform a small test withdrawal
- Open the exchange’s published withdrawal page without making a large deposit.
- Select the exact asset and network.
- Write down the minimum, fee, estimated processing stages and any address restrictions.
- Send the smallest practical test amount to a wallet you control and have verified for that network.
- Record whether the request required email, authenticator, device, identity or manual-review confirmation.
- Keep the transaction identifier and compare the exchange’s status with the destination wallet’s receipt.
A test does not prove that a larger withdrawal will be immediate. It reveals whether the advertised path exists, whether the network selection is clear and which controls could delay a future request.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUnderstand why a withdrawal may be delayed
A pending withdrawal is not automatically evidence of misconduct, but you should know which event is occurring and what action is available.
Common control-related holds
- Fraud or coercion review: an unusual device, location, amount or pattern can trigger a review designed to stop an attacker or someone acting under pressure.
- Destination protection: a newly added or changed address may be blocked temporarily, especially where the platform uses an allow-list or cooling-off period.
- Account recovery: a password, authenticator, phone or email change can cause a security hold before withdrawals are re-enabled.
- Compliance review: the exchange may request information about identity, source of funds or transaction purpose before releasing assets.
- Technical requirements: the selected asset, network, account type or transaction format may not meet the provider’s current processing rules.
Questions to ask support
- Is the request queued, under manual review, rejected or broadcast to the network?
- Which rule or missing verification caused the status?
- What documents or account action will resolve it?
- Has the destination address been accepted and locked?
- What is the escalation route and the expected review window stated in the terms?
Do not send a second payment to “unlock” a withdrawal unless the contractual fee and process are independently verified. A legitimate review should identify the applicable rule and the official channel for resolving it.
Look for operational safeguards, not just security claims
Good custody is partly an operational process. Ask how the exchange protects a withdrawal after you authenticate and before the transaction reaches the network.
Controls worth verifying
- Separate confirmation for a withdrawal and for changing a destination address.
- Alerts through an independent channel when a withdrawal, device change or address change is requested.
- Protection against fraudulent or coerced instructions.
- Limits on employees initiating or redirecting customer withdrawals.
- Checks that the destination cannot be changed between approval, signing and broadcast.
- A documented account-recovery process that does not let a support request silently bypass transaction controls.
- Clear records showing the request time, approval status, broadcast status and transaction identifier.
The Hong Kong SFC’s licensed-platform guidance provides a concrete model for these questions. It does not establish that an unlicensed or overseas exchange has the same controls, so ask for the provider’s actual process and read the relevant terms.
Assess insolvency and cross-border custody risk
Before choosing an exchange, identify the legal route you would follow if it stopped operating. A licence does not by itself assure immediate access to assets, priority in bankruptcy or recovery after insolvency.
Record the custody chain
- Contracting entity and its regulator.
- Entity or entities that hold the keys.
- Country where the custodian and wallet records are located.
- Governing law and dispute forum.
- Whether customer assets are held separately, pooled or pledged.
- What the terms say happens during suspension, administration or bankruptcy.
Cross-border structures can require action in more than one legal system. FINMA’s 12 January 2026 guidance specifically highlights this additional complexity and states that customer cryptoassets should not form part of a custodian’s bankruptcy assets. Treat that as a Swiss regulatory position, not as a promise that another jurisdiction will reach the same result.
Rank #4
- UNPARALLELED SECURITY: Protect your assets with Trezor Safe 5's NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency.
- EFFORTLESS NAVIGATION: Experience seamless crypto management with the vibrant color touchscreen, designed for intuitive and user-friendly interactions.
- ENHANCED USER EXPERIENCE: Enjoy tactile confirmation with Trezor Touch Haptic Engine, making each interaction precise and engaging.
- SUPPORTS 1000s OF COINS & TOKENS: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet.
- EASY ASSET MANAGEMENT: Monitor and transact seamlessly with Trezor Suite, our user-friendly desktop and mobile app
Do not confuse segregation with guaranteed recovery
Segregated records can help identify customer property, but they do not eliminate delays, disputes over control, shortfalls caused by operational failures or the cost of legal proceedings. Read whether the provider promises segregation, describes a trust or similar structure, or merely records an unsecured contractual obligation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Understand the self-custody alternative
Self-custody changes who can bring about a transfer. The FCA’s guidance explains the distinction: “This means that where a firm supplies a customer with a solution for the customer to keep their own cryptoasset secure by exercising control themselves, and the firm itself has no means to bring about the transfer of the benefit of the cryptoasset to another person, the firm will not be carrying on the activity of safeguarding cryptoassets.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsMoving assets to a wallet you control can remove the exchange from control of those assets, but it transfers responsibility to you. You must protect the private key or recovery material, verify addresses and networks, plan for loss or incapacity, and understand that a mistaken or unauthorised transfer may be irreversible.
If you use a hardware wallet
- Confirm support for the exact asset and network before buying or transferring.
- Set up the device away from cameras, screen-sharing sessions and untrusted helpers.
- Write the recovery phrase on durable material and store it offline; never upload it or give it to an exchange or support agent.
- Test recovery and a small transfer before moving a large balance.
- Plan how a trusted person could access instructions without receiving the key casually.
A wallet does not make an exchange compliant, protect assets that remain on the exchange or guarantee recovery. It is a separate custody decision.
Use a like-for-like comparison checklist
Score each candidate only for the jurisdiction, asset and service you actually need. Mark “not stated” when the terms do not provide an answer; uncertainty is a risk to investigate, not a reason to assume the best.
| Comparison area | Evidence to record | Decision question |
|---|---|---|
| Entity and permissions | Legal name, regulator record, permission scope and contracting address | Does this entity have permission for trading, custody and any other planned service in my jurisdiction? |
| Custody | Key control, custodian location, pooling or segregation, position records and governing law | What legal and practical claim do I have to the asset? |
| Withdrawal capability | Asset, network, minimum, fee, limit, address rules and account restrictions | Can the platform return this exact asset over my intended network? |
| Withdrawal controls | Confirmations, alerts, fraud or coercion safeguards, address-change restrictions and recovery holds | Can I protect an intended destination without creating an unmanageable delay? |
| Insolvency treatment | Custody location, bankruptcy wording, asset segregation and claims process | What happens if the provider or its custodian fails? |
| Usability | Support process, status messages, security settings and recovery steps | Can I operate the controls correctly under stress? |
A practical selection procedure
- Define your use case. List the country of residence, assets, networks, trading or conversion services, expected withdrawal frequency and whether you need custodial holding at all.
- Identify the entity. Save the exact legal name and agreement for the website or app that will serve you.
- Verify current permissions. Search the relevant regulator’s current record and read the activity scope; do not rely on a logo, an old announcement or a group-company licence.
- Download the custody terms. Locate key control, asset-use, fee, authentication, records, governing-law and insolvency clauses.
- Map each withdrawal. For every asset-network pair, record minimums, fees, limits, address rules, review triggers and the process for a rejected request.
- Test security operations. Enable strong authentication, configure alerts and, if possible, complete a small withdrawal to your own verified wallet.
- Ask unresolved questions in writing. Request a precise answer about custody location, destination controls, review holds and the legal entity responsible.
- Limit exposure while evaluating. Keep only the balance needed for the service until the withdrawal path and account-recovery process have been demonstrated.
- Review periodically. Recheck permissions, supported networks, fees, limits and custody terms after material account or policy changes.
Warning signs that should stop the comparison
- The legal entity is missing, inconsistent or different from the regulator record.
- The provider claims to be “regulated” without naming the regulator, jurisdiction and permitted activity.
- Trading support is advertised but on-chain withdrawal details are unavailable until after deposit.
- Fees, limits or address restrictions are described only as “subject to change” with no current schedule.
- Support asks for a recovery phrase, private key or payment to a personal address.
- The terms allow broad freezes or asset use without explaining notice, records or release conditions.
- The provider cannot state where custody occurs or which law governs the arrangement.
- A withdrawal is delayed but support cannot identify whether it is queued, reviewed, rejected or broadcast.
Bottom-line decision rule
Choose the exchange that gives you the clearest, jurisdiction-appropriate evidence—not the one with the broadest security slogan. You should be able to name the contracting entity, verify its permissions for your intended activities, explain who controls the keys, quote the withdrawal conditions for each asset and network, and describe the process for a fraud review, account recovery and insolvency. If any of those answers is unavailable, reduce your balance, seek clarification or choose a provider whose terms make the risk understandable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
