Exchanges / Crypto.com
30-second risk check: Crypto.com
Crypto.comRisk Rating and Review
crypto.com · Official site verified ↗Likely contracting entity: Foris DAX Asia Pte. Ltd.Major Payment Institution
Product and service-entity split · Elevated Risk
Cexvia rates Crypto.com Elevated Risk at 65/100.
For Singapore users, the mapped entity is Foris DAX Asia Pte. Ltd. under Major Payment Institution. Its strongest area is Regulatory & legal standing; the main observed concern is Asset & solvency transparency.
Cexvia Exchange Risk Rating0 critical · 100 stronger evidence
Crypto.com65Elevated Risk
Asset & 46Security58Corporat68Regulatory & legal standing74Corporate transparency68Asset & solvency transparency46Security & incident history58Operations & user protection74
Across five rated dimensions, Regulatory & legal standing scores highest at 74/100, while Asset & solvency transparency scores lowest at 46/100.
- 01
Crypto.com uses different Foris DAX entities in Singapore, Malta and Dubai. The licence type and permitted activity differ by region.
Selected: SG / Foris DAX Asia Pte. Ltd. · Verified 2026-07-27
Overall score65Elevated Risk
Dimensions covered5 / 5
Regional Legal Entity Map
The brand does not define the regulatory perimeter.
Foris DAX entities cover digital-asset trading, while card and e-money products may be provided by other companies. The service entity must be checked product by product.
RegionContracting entityRegulatory recordScopeStatusChecked
What these records can establish
- Named legal entity and jurisdiction
- Permitted or registered activities
- Current public-record status at the verification date
What these records do not prove
- Protection against all asset loss
- Global coverage for every user or product
- Complete solvency or future regulatory status
Regulatory & legal standingComplete
74score / 100Weight 25% · Confidence 90%
Key entities in Singapore, Malta and Dubai are verifiable, but some products may be provided by other group companies.
- 3 key legal entities
- SG / MT / AE
- Product entity must be checked
Score contribution0.2 / 25
Why this score
Evidence highlights3 key legal entities · SG / MT / AE · Product entity must be checked
Observed limitationKey entities in Singapore, Malta and Dubai are verifiable, but some products may be provided by other group companies.
Missing or limited evidenceNo material publication gap recorded for this dimension.
0 source records · Reviewed 2026-07-27Corporate transparencyPrimary evidence
68score / 100Weight 15% · Confidence 78%
Legal-entity and licence disclosures are relatively complete, but the private group does not publish one audited consolidated financial statement.
- Legal entities: disclosed
- Licence page: public
- Consolidated financials: unavailable
Score contribution0.1 / 15
Why this score
Evidence highlightsLegal entities: disclosed · Licence page: public · Consolidated financials: unavailable
Observed limitationLegal-entity and licence disclosures are relatively complete, but the private group does not publish one audited consolidated financial statement.
Missing or limited evidencePrimary evidence
0 source records · Reviewed 2026-07-27Asset & solvency transparencyPrimary evidence
46score / 100Weight 20% · Confidence 88%
A Mazars reserve snapshot dated 7 December 2022 and user Merkle inclusion can be verified, but recent continuous coverage is unavailable.
- Snapshot: 2022-12-07
- Coverage: 9 tokens
- Recency: low
Score contribution0.1 / 20
Why this score
Evidence highlightsSnapshot: 2022-12-07 · Coverage: 9 tokens · Recency: low
Observed limitationA Mazars reserve snapshot dated 7 December 2022 and user Merkle inclusion can be verified, but recent continuous coverage is unavailable.
Missing or limited evidencePrimary evidence
1 source records · Reviewed 2026-07-27Security & incident historyComplete
58score / 100Weight 15% · Confidence 90%
In 2022, 483 users experienced unauthorised withdrawals. Crypto.com said users were fully reimbursed and added a 24-hour delay for new withdrawal addresses.
- Affected users: 483
- BTC: 443.93
- ETH: 4,836.26
Score contribution0.1 / 15
Why this score
Evidence highlightsAffected users: 483 · BTC: 443.93 · ETH: 4,836.26
Observed limitationIn 2022, 483 users experienced unauthorised withdrawals. Crypto.com said users were fully reimbursed and added a 24-hour delay for new withdrawal addresses.
Missing or limited evidenceNo material publication gap recorded for this dimension.
1 source records · Reviewed 2026-07-27Operations & user protectionPrimary evidence
74score / 100Weight 25% · Confidence 69%
The withdrawal component was operational at the review point. The status page listed two unresolved incidents, while a recent EUR-channel delay had been resolved. Complaint evidence remains limited and is not treated as proof of safety.
- Withdrawals: operational
- Unresolved incidents: 2
- Support channel: connected
- Trust Score: 9 / 10
Score contribution0.2 / 25
Why this score
Evidence highlightsWithdrawals: operational · Unresolved incidents: 2 · Support channel: connected · Trust Score: 9 / 10
Observed limitationThe withdrawal component was operational at the review point. The status page listed two unresolved incidents, while a recent EUR-channel delay had been resolved. Complaint evidence remains limited and is not treated as proof of safety.
Missing or limited evidencePrimary evidence
4 source records · Reviewed 2026-07-27Risk Drivers and Data Gaps
What moves the rating—and what remains uncertain.
Missing evidence is reported separately. It lowers coverage or confidence and is not automatically scored as a negative fact.
Key rating drivers
Regulatory & legal standing
740.2 weightedKey entities in Singapore, Malta and Dubai are verifiable, but some products may be provided by other group companies.
Operations & user protection
740.2 weightedThe withdrawal component was operational at the review point. The status page listed two unresolved incidents, while a recent EUR-channel delay had been resolved. Complaint evidence remains limited and is not treated as proof of safety.
Corporate transparency
680.1 weightedLegal-entity and licence disclosures are relatively complete, but the private group does not publish one audited consolidated financial statement.
Security & incident history
580.1 weightedIn 2022, 483 users experienced unauthorised withdrawals. Crypto.com said users were fully reimbursed and added a 24-hour delay for new withdrawal addresses.
Asset & solvency transparency
460.1 weightedA Mazars reserve snapshot dated 7 December 2022 and user Merkle inclusion can be verified, but recent continuous coverage is unavailable.
Missing or limited evidence
Corporate transparency
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Asset & solvency transparency
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Operations & user protection
Evidence status: Primary evidence. This limits confidence in the dimension conclusion.
Scope limitation
Card and e-money services may be provided by other Foris entities outside these three exchange-service records.
Scope limitation
MiCA, MPI and VARA VASP licences are not interchangeable.
Security Intelligence Coverage
9 signal families, with collection boundaries shown.
5 automated or configured · 4 require analyst review
Official service status
Statuspage components, maintenance and unresolved incidents can be fetched without credentials.
- Cadence
- Every 5 minutes
- Rating use
- Eligible after validation
Independent probes
Public API, homepage, DNS and TLS probes are configured.
- Cadence
- Every 5 minutes
- Rating use
- Context only
Security incidents
Status incidents and official security reports are retained as separate historical records.
- Cadence
- Daily
- Rating use
- Eligible after validation
Reserves and wallets
Published proof-of-reserves and user-verification methods are reviewed.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Account controls
Passkeys, MFA, FIDO2, anti-phishing codes and withdrawal allowlisting are documented.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Legal and regulatory
Regulator registers are reconciled against the Foris entity named in each product agreement.
- Cadence
- On change + weekly review
- Rating use
- Eligible after validation
Domain and phishing
Official-domain and certificate baselines are configured.
- Cadence
- Daily
- Rating use
- Context only
Vulnerability signals
Named-product and dependency matches are collected for analyst review.
- Cadence
- Daily
- Rating use
- Never scored directly
Verified complaints
Official support escalation and structured Cexvia complaint evidence are mapped.
- Cadence
- On change + weekly review
- Rating use
- Context only
Latest Risk Events
Verified changes connected to Crypto.com.
Asset, Security and Operations
The evidence behind the dimensions users care about most.
Asset and solvency transparency
46/100A Mazars reserve snapshot dated 7 December 2022 and user Merkle inclusion can be verified, but recent continuous coverage is unavailable.
- Snapshot: 2022-12-07
- Coverage: 9 tokens
- Recency: low
Security and incident history
58/100In 2022, 483 users experienced unauthorised withdrawals. Crypto.com said users were fully reimbursed and added a 24-hour delay for new withdrawal addresses.
- Affected users: 483
- BTC: 443.93
- ETH: 4,836.26
Operations and user protection
74/100The withdrawal component was operational at the review point. The status page listed two unresolved incidents, while a recent EUR-channel delay had been resolved.
- Withdrawals: operational
- Unresolved incidents: 2
- EUR delay: resolved
- Support channel: connected
- Comparable sample: insufficient
Exposure guidance
Transaction-only exposure
- Use case
- Use primarily for transactions and withdraw unnecessary balances.
- Avoid
- Avoid using the exchange as a single long-term custody location.
- Reason
- Regulatory & legal standing is the strongest observed area, while Asset & solvency transparency limits a stronger conclusion.
Action checklist
Choose your next step based on your current situation.
- 01Verify the official domain and app publisher
- 02Confirm the legal entity named in the account agreement
- 03Check whether the selected product is covered in your region
- 04Start with the minimum deposit
- 05Test one withdrawal
- 06Enable strong account security
- 07Avoid keeping unnecessary long-term balances
Compare Alternatives
Compare Crypto.com with other published Passports.
ExchangeRiskScoreRegulatorySecurityConfidence
FAQ
Questions about Crypto.com
Is Crypto.com safe?
Crypto.com is currently rated Elevated Risk at 65/100. This reflects observed public evidence and is not a guarantee of safety.
Is Crypto.com regulated?
3 legal-entity records are mapped in this Passport. Each record has a jurisdiction-specific status and scope.
Which entity serves the selected region?
Singapore: Foris DAX Asia Pte. Ltd. — Major Payment Institution.
Does Crypto.com publish reserve or solvency evidence?
A Mazars reserve snapshot dated 7 December 2022 and user Merkle inclusion can be verified, but recent continuous coverage is unavailable.
Should funds be stored on Crypto.com long term?
Transaction-only exposure. Use primarily for transactions and withdraw unnecessary balances. Avoid using the exchange as a single long-term custody location.
Verified sources
Every conclusion links back to primary evidence.
Each source shows its verification date and the specific statement it supports.
Regulator · Monetary Authority of Singapore
Tier A↗MAS Directory — Foris DAX Asia Pte. Ltd.
Legal entity, MPI status, permitted DPT activity and registered address.
Platform terms · Crypto.com
Tier B↗Crypto.com Regulatory Licenses
Malta entity, company number, MiCA status and authorised activities.
Regulator · Virtual Assets Regulatory Authority
Tier A↗VARA Public Register — Crypto.com
Dubai VASP entity, licence number, status and activity scope.
Platform terms · Crypto.com
Tier B↗Crypto.com App and Web Terms — Singapore
Relationship between the brand, Singapore entity and contractual scope.
Platform terms · Crypto.com
Tier B↗Crypto.com Licenses — UAE
Dubai entity and published licence information.
Reserve disclosure · Crypto.com
Tier B↗Crypto.com Proof of Reserves
Published reserve or asset-disclosure evidence used in the solvency assessment.
Security notice · Crypto.com
Tier B↗Crypto.com security report and next steps
Published security or incident evidence used in the security assessment.
System status · Crypto.com
Tier B↗Crypto.com status
Official service-status evidence used in the operational assessment.
Evidence coverage · Cexvia methodology
Method↗Cexvia complaint evidence standard
Complaint comparisons use verifiable primary evidence. The current cross-platform sample remains limited.
Market data · CoinGecko
Tier B↗Crypto.com Exchange market data
Third-party market-quality data used as a supporting signal.
Market data · CoinGecko
Tier B↗Trust Score methodology
CoinGecko methodology covering liquidity, cybersecurity, API coverage, team and incident signals.
Cexvia ratings reflect observed risk under available public evidence. A higher score means lower observed risk, not guaranteed safety. Coverage, confidence, redlines and score direction are published separately. This page is not investment, legal or custody advice. Commercial relationships do not change scores or suppress verified evidence.