Why a checklist matters more than a ranking
Crypto broker and exchange searches often lead to provider rankings published by media sites or affiliate platforms. InvestorTrip is not publishing a crypto exchange ranking until each exchange has verified source rows for legal entity, products, custody, fees, proof-of-reserves context, withdrawal terms, source URLs, extracted snippets, confidence, and reviewer status. Until that dataset exists, a due-diligence checklist is safer than a ranking page.
This page is a due-diligence checklist for checking a crypto broker, exchange, or app before you send money or crypto. It draws on guidance from FINRA, the FTC, SIPC, and Investor.gov. It does not rank or recommend any specific platform.
Start with the legal entity
A trading app, website domain, or token logo is not enough evidence that a counterparty is legitimate or regulated. Record the following before sending any money or crypto:
- Legal entity name
- Country of incorporation
- Regulator or registration status
- Account agreement (read it, do not just click accept)
- Custody terms
- Supported products (spot, derivatives, staking, lending)
- Fiat rails (which banks or payment processors are used)
- Withdrawal policy (limits, timelines, fees)
- Complaint route
If the platform uses different entities for spot crypto, derivatives, staking, lending, or custody, check each one separately. A single brand can operate through a web of related companies with different regulatory protections.
FINRA states that it regulates member firms and associated persons, and that activities involving crypto assets that are securities must comply with applicable federal securities laws and FINRA rules. That does not mean every crypto service shown near a broker brand is supervised the same way as a securities account.
Ask these specific entity questions:
- Which entity opens the account?
- Which entity custodies crypto assets?
- Which entity handles fiat deposits and withdrawals?
- Are services provided by a registered broker-dealer, an affiliate, a bank partner, a money services business, an offshore exchange, or another entity?
- Which products are supported: spot crypto, derivatives, staking, lending, stablecoins, wrapped assets, or tokenized securities?
- Which services are unavailable in your country or state?
Do not assume a familiar brand means every crypto feature has the same protection as a securities brokerage account. Entity structure matters.
Separate custody from trading access
The custody question is practical: who controls the private keys, what happens if the platform fails, and what records prove your claim? If the platform says assets are held in cold storage, segregated wallets, omnibus wallets, trusts, or bankruptcy-remote structures, ask for written terms rather than marketing copy.
SIPC explains that its protection is for securities and cash in a brokerage account when a SIPC member fails, not for every asset or market loss. Crypto assets held away from a securities account can have different protections, and market losses are not insured.
Before funding, save these documents locally or in a secure folder:
- Custody agreement.
- User agreement.
- Fee schedule.
- Withdrawal policy.
- Stablecoin or staking terms, if used.
- Any proof-of-reserves or attestation page, with the date checked.
- Complaint and dispute process.
Proof-of-reserves is a records, not a guarantee. Some platforms publish attestations from third-party auditors. Others post self-created reports. Read the methodology and check whether the attestation covers all liabilities or only a subset. Also verify the date of the latest report and whether it is periodic or one-time.
Check communications and risk disclosures
FINRA reviewed crypto asset retail communications in a targeted exam and reported a high rate of potential issues. The lesson for investors is simple: marketing can be incomplete, and crypto communications need careful reading.
Look for plain answers to these questions in the platform's marketing materials, website, and user agreements:
- Does the platform explain whether the asset is a security, commodity, stablecoin, derivative, or another category?
- Does it distinguish crypto services from regulated brokerage services?
- Does it disclose volatility, liquidity, and loss risk?
- Does it explain conflicts, spreads, routing, market-making, or affiliate relationships?
- Does it avoid implying guaranteed returns or risk-free yield?
If the page focuses on rewards, celebrity quotes, referral bonuses, or token upside before legal and custody terms, slow down. FINRA's exam found that some communications omitted material facts about fees, volatility, liquidity, and the speculative nature of the assets.
Withdrawal and scam checks
The FTC warns that scammers often use crypto payments and that only scammers demand payment in cryptocurrency in advance to protect money, unlock earnings, or solve a supposed account issue.
Pause and do not send additional funds if any of these red flags appear:
- Support moves the conversation to a private messaging app (WhatsApp, Telegram, Signal).
- Deposits go to a personal wallet or unrelated account.
- Withdrawals require a new tax, clearance, anti-money-laundering, or release payment.
- The app shows profits but refuses withdrawals.
- A broker, influencer, or social media contact tells you which wallet address to use.
- The platform cannot identify the legal entity and withdrawal route before deposit.
Investor.gov also warns investors to be cautious with crypto asset securities and celebrity endorsements. A celebrity or influencer mention does not prove legitimacy or suitability.
Additional withdrawal checks to perform before depositing:
- What is the minimum withdrawal amount?
- What are the withdrawal fees (flat fee, percentage, network fee)?
- How long do withdrawals typically take?
- Are there daily or monthly withdrawal limits?
- What identity verification is required for withdrawals?
- Is there a withdrawal pause or freeze clause in the terms?
Read the withdrawal policy in the user agreement, not just in a help center article. Help center articles can be updated without notice. The user agreement is the binding contract.
What a future ranking would need
A credible InvestorTrip crypto broker or exchange ranking would require verified rows for each provider: legal entity, jurisdiction, product coverage, custody model, proof-of-reserves evidence, fiat rails, trading fees, withdrawal fees, incident history, source URLs, extracted snippets, confidence, and reviewer status. Until that dataset exists, this checklist is safer than a ranking page.
If you see a ranking on another site, ask yourself:
- Does the ranking disclose how it collects data?
- Does it verify each provider's legal entity and jurisdiction?
- Does it include custody model and proof-of-reserves evidence?
- Does it disclose whether the ranking includes affiliate compensation?
- Does it update its data regularly?
Most published rankings are based on affiliate commissions or user reviews, not verified source data. Treat them as starting points for your own due diligence, not as recommendations.
Bottom line
Do not choose a crypto broker or exchange from a headline list. First verify the legal entity, custody terms, disclosures, product restrictions, fees, withdrawal process, and scam red flags from official or primary sources. If any of those answers are unclear before funding, the platform is not ready for your money.
Limitations and verification note
This checklist is educational only and does not constitute financial, legal, or regulatory advice. Regulatory status, fees, product availability, and safety of specific platforms can change without notice. Always verify current conditions directly with the platform's official documents and relevant regulators before making any investment or transfer of funds. Past performance or popularity of a platform does not guarantee future safety or compliance.
How to use this guide
Use this page as a decision workflow, not as a final instruction to buy, trade or open an account. Start by writing down the question you are trying to answer, then separate facts you can verify from assumptions you still need to check. For "Crypto Broker and Exchange Due Diligence Checklist", the safest workflow is usually: define the account or product, identify the legal entity or issuer, check costs and operational rules, then decide whether the risk still fits your situation.
If the topic involves a broker, platform, token, account, fee, tax wrapper, leverage or regulation, verify the current terms directly before acting. Pages like this can organize the work, but they cannot replace the latest account agreement, regulator register, product disclosure or tax guidance.
Decision checklist
- Separate the asset, wallet, exchange, network and custody decision instead of treating crypto as one product.
- Check whether a claim depends on reserves, smart contracts, issuer disclosures or exchange operations.
- Decide in advance how much counterparty, custody, liquidity and volatility risk you are willing to accept.
- Avoid yield, airdrop or token claims that cannot be traced to primary documentation.
- Keep a written exit plan for transfers, tax records, wallet recovery and failed transactions.
Common mistakes to avoid
- Treating a token ticker as proof of liquidity, safety or exchange support.
- Keeping more assets on a platform than the custody risk justifies.
- Following social proof without checking issuer, contract, reserve or wallet details.
The pattern behind most mistakes is the same: the reader jumps to the exciting part first. Slow the process down. A good decision usually starts with documents, terms and risk controls before it moves to rankings, tools or tactics.
Evidence to collect
| Area | What to collect | Why it matters |
|---|---|---|
| Issuer or protocol | Whitepaper, issuer disclosures, contract address or reserve information | The token name alone does not explain who controls the risk. |
| Custody | Wallet model, recovery process, exchange terms and withdrawal rules | Most crypto losses are operational before they are investment losses. |
| Liquidity | Supported venues, trading pairs, network fees and transfer limits | A quoted price matters less if exiting the position is difficult. |
| Security | Audit status, proof-of-reserves context and incident history | Security claims need current evidence, not saved records or social proof. |
Questions to answer before you decide
- Are you relying on an issuer, an exchange, a wallet provider, a smart contract or all of them?
- Could you recover the asset if the exchange paused withdrawals or the wallet device failed?
- Do you know which network you are using and what a mistaken transfer would cost?
- What evidence supports the reserve, security or yield claim you are considering?
- How would you exit the position if liquidity dried up or fees spiked?
When to pause
- The project, exchange or wallet asks you to trust a claim without current documentation.
- You cannot explain the custody path, withdrawal process or network used for the asset.
- Yield or upside language is clearer than the risk, lock-up, reserve or liquidation terms.
Pausing is not the same as abandoning the idea. It means the evidence is not strong enough yet. A better page, broker, exchange, wallet or account provider should make the next verification step easier, not harder.
Simple scoring sheet
Use a small scoring sheet before you make the final call. Give each row a simple rating such as clear, unclear or not acceptable, then write the source you checked. Do not score a row as clear unless you can point to a current document, account screen, regulator record or official disclosure.
| Check | Clear | Unclear | Not acceptable |
|---|---|---|---|
| Legal entity or issuer is identifiable | |||
| Main costs are visible before funding | |||
| Withdrawal, transfer or exit process is documented | |||
| Risk disclosure matches the product being considered | |||
| The decision still makes sense under a smaller test amount |
If two or more rows are unclear, slow down and collect more evidence. If any row is not acceptable, the next step is usually to walk away or choose a simpler route.
Final verification note
Before you rely on this guide, repeat the checks with current documents. If a term, fee, regulator record, platform feature or account rule cannot be verified today, treat it as unknown. The best decision is usually the one you can still explain after reading the fine print, testing the workflow and comparing it with at least one simpler alternative.
Reader checkpoint
If you only remember one thing from this page, make it the verification habit. Write down the claim, find the document that supports it, and decide what would change your mind. That small pause is often enough to catch outdated fees, unsupported marketing claims or a product that is more complex than it first looked.
