Is Your Crypto Exchange Regulated? What MiCA, VASP and Registration Really Mean
Almost every large crypto exchange now describes itself as regulated somewhere, and most of them are telling the truth. What they usually hold is an anti-money-laundering registration, which supervises how they handle criminal funds rather than how they handle yours. The gap between those two things is where exchange collapses happen.
Registration for AML is not a licence to protect you
Many jurisdictions require crypto firms to register with a financial authority purely for anti-money-laundering and counter-terrorist-financing supervision. The regulator checks identity verification, transaction monitoring and reporting.
It does not review how the exchange holds customer assets, whether reserves match liabilities, or how it manages its own balance sheet. It usually brings no compensation scheme, no ombudsman and no capital requirement. A firm can be fully registered, fully compliant, and still lose every coin you hold with it.
The UK is the clearest example: the FCA's cryptoasset register is an AML regime, and firms on it sit outside the protections that apply to regulated investments. Being on the list is a floor, not a shield.
VASP is a category, not a standard
"VASP" — virtual asset service provider — comes from the international standards body that sets anti-money-laundering rules for member countries. It describes a type of business, and each country implements supervision of it differently.
So "VASP registered" tells you the firm registered somewhere as a crypto business. It tells you nothing about the strength of the regime, and some VASP registers are close to a formality. The question is always which authority, under which law, with what powers.
The regimes that go further
A smaller group of jurisdictions regulate crypto as a financial activity rather than only as a laundering risk.
- MiCA (EU). A single authorisation regime for crypto-asset service providers across the bloc, with rules on custody, conflicts of interest, complaints handling and disclosure, plus separate requirements for stablecoin issuers.
- Japan. Exchanges must register with the Financial Services Agency under the payment services framework, with segregation and cold-storage requirements introduced after major domestic exchange hacks.
- Singapore. Digital payment token services are licensed under the payment services regime, with custody and consumer restrictions attached.
- Some US states. Money transmitter licensing, and in New York a dedicated virtual currency licence with its own capital and custody standards.
These are meaningfully stronger. None of them makes crypto safe, and none insures you against a fall in price.
The questions that decide whether you get your assets back
Regulation aside, custody is the mechanism that matters.
Ask whether customer assets are segregated from company assets, and whether that segregation is legally enforceable rather than described in a help article. Ask what share is held in cold storage. Ask whether the firm's reserves have been examined by an independent auditor — a proof-of-reserves page showing wallet balances is not an audit, because it shows assets without showing liabilities or borrowings against them.
And ask what happens in insolvency. In several past collapses, customers discovered the terms made them unsecured creditors of the business, standing behind everyone else in the queue.
Applying the same test you would to a broker
The checks are the ones you already know. Identify the legal entity that holds your assets, find the authority that supervises that specific entity, read what the registration actually permits, and confirm the contact details on the register match the site you are using — the licence check is identical for an exchange. Our regulator database covers crypto authorities alongside forex ones.
Bottom line: find out whether your exchange's registration covers custody of your assets or only anti-money-laundering reporting — and if it is the second, keep only what you are actively trading on the platform.