How to choose an exchange: licences, fees and the small print

For years the standard way to pick an exchange was to compare fees and take the lowest number. In the European Union of 2026 that criterion has dropped to second place, and not by preference: by law. If a platform is not authorised, its fees are irrelevant, because it should not be serving you at all.

The second change is less visible and costs you money every month. Almost no platform charges what its fee page advertises, because that page describes an interface most users never open. Buying the same €1,000 of bitcoin in the "simple" app or in the professional interface of the same company can multiply the cost by four.

Take them in order: first the filter that eliminates, then the one that compares.

Criterion one: the licence

Regulation (EU) 2023/1114, known as MiCA, entered into force on 29 June 2023 and has applied in phases: the stablecoin titles from 30 June 2024, and Titles II and V, which govern crypto-asset service providers (CASPs), from 30 December 2024.

Member states ran their own transition windows, all of which have now closed. Supervision is split nationally: in Spain, for instance, the CNMV supervises service providers while the Bank of Spain handles stablecoin issuance. Every member state has an equivalent pairing, and each competent authority publishes a searchable register of the firms it has authorised.

A practical point about passporting: a firm authorised in Malta or Ireland can serve customers across the EU without appearing in your own country's register. So the check is not "is it in my national list" but "which specific legal entity is contracting with me, in which member state is it authorised, and is it in that supervisor's register". The entity is usually named in the terms of service, and it is frequently not the brand on the homepage.

Who holds a licence and who does not

Status as of August 2026. We have no confirmation on Bit2Me's licence status, so we make no claim either way: check the register yourself.

The Binance case, stated precisely

It is the most significant move of the year and deserves detail, because contradictory versions circulate. The verified facts: Binance withdrew its MiCA authorisation application in Greece and on 26 June 2026 announced it would cease services in the European Union from 1 July 2026, notifying users in Spain, France, Italy and Poland. It stated it would seek authorisation in France.

The caveat worth keeping: as of 14 July 2026, AML Intelligence was reporting that Binance, MEXC and HTX remained de facto accessible to EU users despite holding no licence. Being able to load a website does not mean the entity is authorised or that you have the protection of the European framework.

This is a photograph of something moving. Anything you read about the status of a specific platform — this guide included — may already be out of date. The national registers are the only source worth treating as current.

Criterion two: what you actually pay

These are basic-tier spot fees, before volume discounts, as of August 2026.

Two warnings about this table. Kraken's official figure (0.40% / 0.80%) differs from the historical Kraken Pro schedule (0.25% / 0.40%): it depends on which product you use, so confirm which applies to you before calculating anything. And we publish no figures for Bitstamp, because the ones in circulation come from secondary sources we have not been able to verify.

The spread trap

Look at the two rows with no numbers. That is not an omission: those interfaces have no fixed fee to publish, and that is precisely the problem.

A platform can charge you in two ways. The first is an explicit commission on a trade executed at the market price. The second is to sell to you at a worse price than the market and keep the difference: that is the spread. The second never appears in a fee table, never shows up on your receipt, and is perfectly legal as long as the price is shown to you before you confirm.

The clearest example lives inside a single company. Coinbase Advanced charges 0.40% maker and 0.60% taker at the basic tier. The Coinbase simple app can reach 1.875% plus an embedded spread. Same custodian, same licence, same account: up to more than four times the cost for using the comfortable screen instead of the one with an order book. The pattern repeats at Bit2Me, where buying from the wallet reaches 1.99% against 0.5-0.6% on the Pro interface.

Learning the professional interface takes an afternoon. It is probably the best-paid hour in your relationship with crypto.

Worked example: €1,000 of bitcoin on three platforms

Suppose you buy €1,000 of bitcoin and then withdraw it to your own wallet. We add the purchase fee, the estimated spread and the network fee for the withdrawal. For that last item we use the real cost of a typical Bitcoin transaction as of August 2026: with the mempool clear at 1-2 sat/vB, a transaction of around 140 vB costs 140 to 280 sats, that is $0.11 to $0.22. We round to €0.20 and note that some platforms add their own fixed surcharge on top.

Scenario A — Coinbase Advanced, limit order (maker). Fee: €1,000 × 0.40% = €4.00. Spread: effectively zero, because you set the price in the book. Network withdrawal: €0.20. Total cost: €4.20, or 0.42%.

Scenario B — Kraken, market order (taker). Fee: €1,000 × 0.80% = €8.00. Spread: minimal on a liquid pair such as BTC/EUR. Withdrawal: €0.20. Total cost: €8.20, or 0.82%.

Scenario C — simple app, one-tap purchase. Fee: if the 1.875% maximum applies, €18.75. On top of that comes the embedded spread, which is not observable but on retail purchases typically sits in the region of a few tenths of a percent: at an estimated 0.5%, another €5.00. Withdrawal: €0.20, plus the platform's own surcharge if it has one. Estimated total cost: around €24, or 2.4%.

The gap between A and C is roughly €20 per €1,000 purchased. Buy €200 a month for two years — €4,800 in total — and you are looking at about €96 of difference for doing exactly the same thing on a different screen.

Proof of reserves and how far it goes

After the FTX collapse in November 2022 — $9 billion of liabilities against $900 million in liquid assets, a hole of roughly $8 billion — many platforms began publishing proof of reserves. It works like this: the platform aggregates all customer balances into a Merkle tree, publishes the root and gives you your verification path, so you can confirm your balance was included in the audited total without seeing anyone else's. It also demonstrates control of on-chain addresses by signing messages with the relevant keys.

The limitation is large and worth being clear about: it proves assets, not liabilities. A firm can demonstrate it controls $5 billion and owe $9 billion. It can also borrow immediately before the snapshot and repay afterwards. And it proves control of keys, not who owes what to whom.

Proof of reserves without independent verification of liabilities is a partial snapshot. It is better than nothing, but it does not substitute for a licence carrying client-asset segregation obligations, or for audited financial statements.

What to ask about segregation, and why the licence is not enough

Under MiCA, an authorised provider must keep clients' crypto-assets separate from its own and may not use them on its own account. This is exactly the obligation that attacks the failure that sank FTX, and it is the main reason the licence matters. But it is worth knowing what it does not cover.

Concrete questions you can put to any platform's support team, where the answer — or its absence — tells you a great deal: where is the entity that custodies my assets domiciled, and under whose authorisation? What proportion is held in cold storage? Is there insurance, and what exactly does it cover? Are my assets lent to third parties, and can I opt out? What happens to my balance in an insolvency proceeding?

Securing your own account

Almost everything that goes wrong at an exchange happens to the account, not the platform. Three measures cover most of the risk.

Second factor via app or hardware key, never SMS. SMS is vulnerable to SIM swapping: the attacker convinces your carrier to port your number and receives the codes. An authenticator app is far better, and a FIDO2 hardware key is the most phishing-resistant option available, because it simply does not work if the domain is not exactly right.

Withdrawal allowlist. Register the addresses you are allowed to withdraw to and enable the 24 or 48-hour delay for adding new ones. If someone gets into your account they cannot send anything to an address of their own without waiting, and that wait is your window to react.

Anti-phishing code. A word you choose that the platform includes in all its legitimate emails. Any message without it is fake, no further analysis required. It is the simplest defence against the impersonation campaigns that, according to Chainalysis, grew 1,400% year on year in 2025, with the average amount up 600%.

Checklist for evaluating an exchange

• Find it in the CASP register of the supervisor that authorised it, or confirm it passports from another member state. If it is nowhere, the evaluation ends there.
• Check which specific legal entity is providing you the service and where it is domiciled: it is not always the brand you see.
• Compare the fee for the interface you will genuinely use, not the one on the published fee page.
• Measure the spread once: request a €1,000 purchase without confirming it and compare the quoted price against the market price at that instant.
• Review crypto withdrawal fees and fiat withdrawal fees separately; fixed surcharges hide there.
• Confirm it offers app-based or hardware-key 2FA, an address allowlist and an anti-phishing code.
• Read what the terms say about lending or reusing your assets.
• Try withdrawing a small amount before depositing anything serious: a withdrawal that works is worth more than any promise.
• Set a ceiling on the balance you are willing to leave in custody and move the rest into [self-custody](/en/custodial-vs-non-custodial-wallets/).

• Do not use a platform because an advert, an influencer or an acquaintance recommended it without checking the register.
• Do not reuse the password, and do not leave 2FA on SMS.
• Do not accept "0% commission" as a fact: ask about the spread.

Where things stand in 2026

Consolidation is the defining feature in Europe. The list of platforms that may legally serve EU customers is now short and checkable, which was not true three years ago, and that turns the old question "is this website trustworthy?" into a thirty-second lookup in a public register. The trade-off is that several large operators have ended up outside the European market or cut back what they offer, with tight deadlines for their users to move funds.

Outside the EU the picture is more uneven. In the United States, the GENIUS Act on stablecoins has been law since July 2025, but its implementing rules were still at proposal stage in August 2026 — Treasury published its rule in the Federal Register on 18 August 2026, with comments open until 19 October — while the CLARITY Act, which would set market structure, remained pending in the Senate. A joint SEC and CFTC interpretation of March 2026 clarified how tokens are classified, but US exchanges are still supervised through a patchwork of state and federal authorisations rather than one regime. In Latin America, Argentina has required registration in the CNV's PSAV register since 2024 and Brazil supervises providers through its central bank, while Mexico and Colombia lack a comprehensive dedicated framework.

Tax treatment is the other thing that varies by country, and it varies far more than people assume: how disposals are characterised, whether swapping one token for another is taxable, what has to be reported and by whom. Do not port a rule from one jurisdiction to another. Check your own tax authority, or a professional, before you trade at any scale.

The operational conclusion has not changed with regulation, it has only become easier to apply: the licence tells you who is allowed to operate, the real fees tell you what it costs, and neither tells you your money is safe indefinitely. An exchange is where you buy and sell. If it is also where you keep everything you own, that should be a deliberate decision rather than an inherited one, taken after comparing what a hardware wallet costs against what you are leaving in someone else's custody.

Frequently asked questions

Sources and references

1. CNMV — Crypto-asset regulation under MiCA
2. CNMV — Register of crypto-asset service providers (example national register)
3. Chainalysis — Crypto hacking and stolen funds 2026
4. Chainalysis — 2026 Crypto Crime Report
5. FBI — Cryptocurrency and AI scams bilk Americans of billions (IC3 2025)
6. SEC — Staff clarifies application of federal securities laws to crypto assets
7. Federal Register — GENIUS Act regulations on payment stablecoin issuance
8. CNV Argentina — Register of Virtual Asset Service Providers

Related guides