Which registers actually name a crypto exchange?
Three, and each one covers a jurisdiction rather than a different question.
In the United States a money services business registers with FinCEN, and that registration is searchable by legal name, trading name and address. In the United Kingdom the FCA publishes the Financial Services Register. In the European Union, ESMA publishes a MiCA register of authorised crypto-asset service providers, reissued weekly as a set of CSV files.
| Register | Who runs it | What an entry means |
|---|---|---|
| MSB Registrant Search | FinCEN, United States | A money services business filed a registration form. Not a licence and not an endorsement. |
| Financial Services Register | FCA, United Kingdom | The firm is registered or authorised. For cryptoasset firms that means anti-money-laundering supervision. |
| MiCA register | ESMA, European Union | A national authority authorised the firm under MiCA. A companion file lists non-compliant providers. |
Check the register for the country the exchange is soliciting you in. Absence from it is not proof of fraud, and it is a question the marketing page will never raise on its own.
What does registration prove, and what does it not?
That a form was filed, and that is the whole of it.
FinCEN wrote this down after fraudsters started using the register as a credential. Its alert of 18 December 2024 states that registration and a company's appearance on the search page is not a recommendation, certification of legitimacy, or endorsement by FinCEN or any other US government agency.
The same alert is blunter on licensing. FinCEN does not license money services businesses to operate in the United States, and any claim that a registration is a licence is false. State licences are a separate thing, and the alert names the Nationwide Multistate Licensing System as where one can be looked up.
It also describes the abuse directly: scammers submit false information, then point victims at the search page, sometimes as part of pig butchering schemes. An entry is evidence that a form exists rather than evidence that anybody read it.
What does an FCA or MiCA entry mean?
Supervision of one narrow thing, rather than approval of the business.
The FCA's own page says a firm must register if it wants to provide cryptoasset services that come within scope of the money laundering regulations. That is financial crime supervision. The same page dates the new cryptoasset regime to 25 October 2027.
The consumer half is stated elsewhere on the FCA site, and it is not ambiguous. Crypto is largely unregulated in the UK, so it is highly unlikely you will be covered by the Financial Services Compensation Scheme.
ESMA's register carries something the other two do not. Beside the authorised providers it publishes a file of non-compliant entities offering crypto-asset services, which is a published list of firms an EU reader has already been warned away from.
A booth on a street can be walked past and looked at. An exchange is a website, and everything you can look at is a record somebody else filed.
How old is the exchange's domain?
Weeks or months, on the platforms that turn out not to exist.
FinCEN's pig butchering alert of 8 September 2023 lists it as a red flag in those words: a website or application with a domain name misspelled to resemble another business, or a recently registered one, or no physical street address and contact only by chat or email.
The FBI put the same point more narrowly a year earlier. Its notice of 3 October 2022 advises readers to look out for domain names that impersonate legitimate financial institutions, and names cryptocurrency exchanges as the ones being impersonated.
Reading a registration record works the same way for an exchange as for a shop, and the domain checks are set out in full there. Only the comparison changes: an exchange describing years of operation on a domain created this spring has contradicted itself.
Is proof of reserves the same as an audit?
No, and the body that oversees US audit firms published an advisory saying so.
The PCAOB's investor advisory, dated 8 March 2023, states that proof-of-reserve engagements are not audits and that the reports do not provide meaningful assurance. They are not performed under PCAOB auditing standards, and the engagements are not subject to PCAOB inspection.
The limits are structural rather than incidental. A report of this kind verifies assets at one moment, and typically says nothing about the exchange's liabilities, about whether assets were borrowed to cover the count, or about what moves the following morning.
So the page is worth reading for who signed it and what they wrote that they did not do. Treating it as an audited balance sheet is precisely the reliance the advisory was published to prevent.
The withdrawal that works, and the one that does not
The small one clearing is part of the design.
FinCEN describes the step in sequence. The scammer may even allow the victim to withdraw a small amount of the investment to build confidence, before urging larger deposits.
The ending is documented just as precisely. That alert says an attempted withdrawal may be met with a demand for purported taxes or early withdrawal fees, and the FBI's notice of 14 March 2023 records that victims are told they need to pay a fee or taxes.
The FTC names the reason there is nothing behind the balance. The company taking the money is not really investing it, and the reports showing growth are written by the same people.
Read the withdrawal terms on the exchange, not in the chat. A real exchange publishes its fees and its limits, and its support can be reached without going through whoever introduced you. A charge that exists only in a conversation is not a charge.
Who published the exchange's app?
A name you can hold against the company, on both stores.
Google requires an organisation developer account to carry a D-U-N-S number, and says it will display your legal name, legal address, developer email address and phone number on Google Play. The developer name shown at the top is a separate field and can be changed at any time.
Apple publishes more inside the European Union. Articles 30 and 31 of the Digital Services Act require it to verify and display trader contact information — an address, a phone number and an email address — on the product page of every app distributed there.
The check is a comparison rather than a judgement. An exchange presented as a licensed company, whose app is published under an individual's name or a company that appears in no register, is carrying two identities, and only one of them was verified by anybody.
What none of these checks can settle
Whether the balance on your screen is money.
Everything above examines the wrapper: who filed a registration, when a domain was created, who published an app, what an accountant declined to certify. The platform's own ledger is published nowhere, and no register holds a copy of it.
That is the design rather than an oversight, and the fake trading platform is the part that cannot be verified. Nothing on this page changes it. These checks narrow the question without closing it.
What they do close is smaller and still worth having. A platform in no register that applies to it, on a four-month-old domain, taking deposits to an address with a fortnight of history, has failed enough of them that the rest stops mattering.
Checking the person who introduced you
Which is a different job, and the only part of this a lookup here touches.
DetectiveCheck does not verify exchanges and reads no regulator's register. What it checks is identifiers: an email address against 71 sources, a handle against 71 platforms, a name against 13 registers and a number against eight sources, reporting where each exists and where it does not.
That answers one thing well. This fraud arrives through a person, and an identity whose accounts all appeared within the same few weeks is the contradiction worth finding, which is what verifying somebody you met online is for.
It says nothing whatever about the platform. The person who introduced you may be entirely real, with a decade of history behind them, and taken in themselves.
Common questions
How do I check if a crypto exchange is legit?
Search the registers that apply to the country it is soliciting you in: FinCEN's money services business search in the United States, the FCA's Financial Services Register in the United Kingdom, ESMA's MiCA register in the European Union. Then read the domain's registration date and the developer name on its app. None of those verifies the platform's balances.
Does FinCEN registration mean a crypto exchange is approved?
No. FinCEN's alert of 18 December 2024 states that registration and appearance on the MSB Registrant Search page is not a recommendation, certification of legitimacy or endorsement by any US government agency, and that FinCEN does not license money services businesses at all. The alert exists because fraudsters were registering and citing it.
What does FCA registration cover for a crypto firm?
Anti-money-laundering supervision. A firm must register with the FCA to provide cryptoasset services within scope of the money laundering regulations, and that is financial crime oversight rather than product regulation. The FCA tells consumers crypto is largely unregulated in the UK, so compensation from the Financial Services Compensation Scheme is highly unlikely.
Is there an EU register of crypto exchanges?
Yes. ESMA publishes a MiCA register, reissued weekly as CSV files, listing crypto-asset service providers authorised by national authorities. A companion file lists non-compliant entities offering crypto-asset services in the EU, which is the rarer and more useful half: a published record of firms readers have already been warned about.
Is proof of reserves an audit?
No. The PCAOB's investor advisory of 8 March 2023 states that proof-of-reserve engagements are not audits, that the reports provide no meaningful assurance, and that they are neither performed under PCAOB auditing standards nor subject to PCAOB inspection. They verify assets at one moment and usually say nothing about liabilities.
Why did my small withdrawal work but the large one did not?
Because the small one is a scripted step. FinCEN's pig butchering alert describes the scammer allowing a victim to withdraw a small amount specifically to build confidence before larger deposits are urged. The withdrawal stops working at the point where the amount matters, which is the same point the fee demands begin.
Do real exchanges ever charge tax before releasing a withdrawal?
Withdrawal fees exist and are published on the exchange's own fee page. A tax demanded by the platform before it will release your balance is the documented ending of this fraud: FinCEN records demands for purported taxes or early withdrawal fees, and the FBI's March 2023 notice records the same thing.
How do I check who published an exchange's app?
Read the developer details on the store listing. Google displays a Play developer's verified legal name, address, email and phone, and requires a D-U-N-S number for organisation accounts. In the European Union, Apple verifies and shows a trader's address, phone number and email. Compare that with the company the exchange claims to be.
Should I install an exchange app from a link they sent me?
No. FinCEN's pig butchering alert lists downloading an application directly from a third-party website, rather than a well-known app store, among its red flags. A sideloaded app has passed no store review and carries no verified publisher details, which removes the one provenance check the stores were doing for you.
Can any check prove a crypto exchange is safe?
No. Registration, domain age, reserves reports and app provenance describe the wrapper around a platform, not its ledger. The balance a fake exchange shows is a number in its own database, published nowhere and held in no register. The checks narrow the question sharply and none of them closes it.
