Regulated Crypto Exchanges in the US: Licences, Custody and Investor Protection

A crypto exchange can be legally operating in the United States without holding one universal federal “crypto exchange licence.”

That distinction matters.

US crypto regulation is still built from several overlapping layers: federal anti-money-laundering registration, state money-transmission licences, New York virtual-currency authorisation, securities rules, derivatives regulation and product-specific requirements. The legal status of an exchange therefore depends on the company, the state, the asset and the product being offered.

In March 2026, the US Securities and Exchange Commission and Commodity Futures Trading Commission issued a joint interpretation clarifying how federal securities laws apply to certain crypto assets and transactions. The interpretation improved the federal classification framework, but it did not create a single nationwide licence that automatically authorises every centralized exchange activity.

For users, “regulated in the US” should therefore be treated as the start of the analysis—not the conclusion.

The short answer

When evaluating a US crypto exchange, verify at least five separate questions:

Which legal entity serves your account?
Is that entity registered or licensed in your state?
Does the permission cover the product you intend to use?
How are customer cash and crypto assets held?
What protection actually applies if the exchange, custodian or partner bank fails?

A FinCEN registration, state money-transmitter licence, New York BitLicense, CFTC registration or SEC registration can all be meaningful. They are not interchangeable.

There is no single US crypto exchange licence

The phrase “US regulated crypto exchange” is often used as though one regulator approves an exchange for every activity across the country.

That is not how the current framework works.

A centralized exchange may interact with several regulatory systems at once.

Regulatory status	What it generally covers	What it does not prove
FinCEN MSB registration	Bank Secrecy Act obligations, AML controls, recordkeeping and reporting	Solvency, investment approval or nationwide permission for every product
State money-transmitter licence	Covered money-transmission activity within that state	Approval of every crypto asset, staking product or derivatives service
New York BitLicense / approved trust charter	Virtual-currency business activity in New York within the approved scope	Nationwide authorisation or FDIC protection for crypto
CFTC registration	Registered derivatives markets or intermediaries within the relevant activity	General approval of an exchange's unrelated spot products
SEC broker-dealer / exchange registration	Securities-market activity within the registered scope	Automatic protection or approval for every crypto asset offered by the brand

The correct regulatory question is therefore not:

Is this exchange regulated?

It is:

Which entity is regulated, by whom, for which activity, and in which jurisdiction?

That is the same entity-level approach Cexvia uses when evaluating exchange regulatory standing.

What changed in US crypto regulation in 2026?

The US regulatory framework has continued to change.

On March 17, 2026, the SEC issued an interpretation, joined by the CFTC, clarifying the application of federal securities laws to certain crypto assets and transactions. The interpretation became effective on March 23, 2026.

Among other points, the agencies set out a clearer taxonomy for categories including digital commodities, digital collectibles, digital tools, stablecoins and digital securities, while explaining when a non-security crypto asset may still be involved in an investment-contract transaction.

This is important for exchanges because the regulatory treatment of an asset or transaction can affect which federal rules apply.

However, the interpretation should not be read as a new universal federal exchange licence.

The US framework still requires users and researchers to distinguish among:

Spot crypto trading
Crypto asset securities
Futures and derivatives
Money transmission
Custody
Stablecoin activity
State-specific virtual-currency activity

The GENIUS Act, signed into law in July 2025, added a federal framework for payment stablecoins. It did not replace the broader state and federal licensing analysis for centralized crypto exchanges.

1. FinCEN registration: important, but not an approval badge

Many US-facing crypto businesses are registered with the Financial Crimes Enforcement Network as Money Services Businesses.

FinCEN's virtual-currency guidance explains that a business acting as an administrator or exchanger of convertible virtual currency can fall within money-transmitter rules unless an exemption applies.

That can trigger obligations including:

MSB registration
Anti-money-laundering controls
Recordkeeping
Suspicious Activity Report obligations
Other Bank Secrecy Act requirements

FinCEN MSB registration is therefore meaningful compliance evidence.

But it should not be presented as a general federal licence proving that an exchange is safe, solvent or approved for every trading product.

A useful rule for exchange research is:

MSB registration = AML and money-services status, not a complete exchange-safety verdict.

Official reference: FinCEN — Money Services Business Registration

2. State licences: US access can change from state to state

Crypto exchanges serving US customers may also need state-level money-transmission permissions.

This creates a major practical difference between the United States and markets with a single national crypto-asset service-provider regime.

A platform may:

Operate in one state but not another
Restrict certain assets by state
Disable staking or rewards in selected states
Offer spot trading but not a different financial product
Change its product scope without changing the global brand name

Users should search the exact legal entity through the relevant state regulator and, where applicable, the Nationwide Multistate Licensing System consumer database.

Do not search only for the brand.

For example:

Brand: Example Exchange
Legal entity: Example Exchange US, Inc.
NMLS ID: XXXXXXX
State: California
Activity: Money transmission
Status: Active

The entity name, NMLS identifier and state permission should match the company named in the account terms.

A licence number copied onto a website is not enough on its own.

3. New York is a separate regulatory check

New York has a distinct virtual-currency regulatory framework administered by the New York State Department of Financial Services.

Businesses conducting covered virtual-currency activity in New York can operate through a BitLicense or an approved New York Banking Law charter, such as a limited-purpose trust company structure, depending on the business.

For a New York customer, this is a more relevant check than simply finding an MSB registration.

The NYDFS record should be reviewed for:

Legal entity
Authorisation type
Current status
Approved activity
Any product or coin-listing limitations

Official reference: NYDFS — Virtual Currency Business Licensing

A platform being registered elsewhere in the United States does not override a New York restriction.

4. SEC and CFTC status depends on the product

Federal securities and derivatives regulation must be evaluated separately from money-transmission licensing.

SEC

If a platform is engaged in activity involving securities, federal securities rules may become relevant depending on the asset, transaction and service.

In 2026, the SEC and CFTC clarified that not every crypto asset is itself a security, while also explaining that a non-security crypto asset can still be involved in a transaction subject to securities laws.

That makes product-level analysis more important, not less.

A broker-dealer registration held by one affiliate should not automatically be treated as SEC approval of every crypto service offered under the same brand.

Official reference: SEC — Application of Federal Securities Laws to Certain Crypto Assets

CFTC

The CFTC regulates US derivatives markets and relevant registered intermediaries.

For crypto, this can include futures, options and other derivatives activity.

A CFTC-registered designated contract market or intermediary is meaningful regulatory evidence for the activity it is authorised to conduct.

It does not automatically put the brand's unrelated spot exchange under the same regulatory status.

Official verification tool: CFTC — Check Registration & Backgrounds Before You Trade

5. Identify the legal entity before comparing exchanges

The legal entity is one of the most important fields in a crypto exchange review.

A single brand can operate through:

A US retail entity
A state-licensed money transmitter
A derivatives affiliate
A broker-dealer affiliate
A custody company
An overseas exchange
An institutional entity

These companies may have different regulators, licence scopes and customer-protection arrangements.

Before depositing, open the terms of service applicable to your region and record:

Field	What to verify
Legal entity	Full corporate name
Registered address	Jurisdiction and corporate address
Governing law	Which legal system applies to the agreement
Licence / registration	Regulator, licence type and identifier
Product scope	What the entity is actually authorised to provide
Custodian	Whether another company holds customer assets
Fiat bank	Where eligible cash balances may be held

If the exchange's marketing page names one entity but the user agreement names another, the contract should be investigated before relying on the marketing claim.

How Cexvia treats US regulatory records

Cexvia does not treat “registered in the US” as a binary safety label.

The exchange profile is mapped to the legal entity and regulatory scope that can actually be verified.

For example, current Cexvia records show:

Exchange	US regulatory record shown by Cexvia	Cexvia treatment
Coinbase	Coinbase, Inc.; US licence and product scope varies by state	Scope varies
OKX	OKX, Inc.; MSB registration and state money-transmitter licences	Scope varies
Backpack Exchange	Trek Labs, Inc.; MSB and state money-transmitter scope	Scope varies

This is deliberate.

An MSB registration, active state licence and product-specific federal registration are different forms of evidence. Cexvia does not collapse them into one generic “US licensed” label.

See:

6. Regulation does not answer the custody question

A regulated or registered exchange can still expose users to custody and counterparty risk.

When crypto remains on a centralized exchange, the user normally depends on the exchange or a third-party custodian to control the private keys and process withdrawals.

The key questions include:

Which entity holds the assets?
Are customer assets segregated?
Can assets be lent or pledged?
Is a subcustodian used?
What happens in insolvency?
What happens after an unsupported-chain deposit?
Are withdrawal rights subject to additional conditions?
What evidence exists for reserves and liabilities?

The SEC's retail custody guidance emphasizes that third-party custody introduces risks including loss of access if a custodian is hacked, shuts down or fails.

Official reference: Investor.gov — Crypto Asset Custody Basics for Retail Investors

Proof of Reserves is not the same as a full solvency audit

A Proof of Reserves system can provide useful evidence that specified assets existed at a particular point in time and, in some systems, that a user's balance was included in a snapshot.

It does not automatically prove:

All liabilities are included
Every affiliated entity is solvent
Assets are unencumbered
Customer claims have a particular bankruptcy priority
The exchange will remain liquid during a withdrawal surge

Reserve transparency and legal protection should therefore be assessed separately.

7. FDIC insurance: crypto itself is not an insured deposit

FDIC terminology is frequently misunderstood in crypto marketing.

The FDIC explicitly lists crypto assets among financial products that are not FDIC insured.

Eligible fiat balances can be different.

If an exchange places customer US dollars at an FDIC-insured bank, pass-through deposit insurance may apply when the legal and recordkeeping requirements are satisfied.

That protection concerns qualifying deposits at an insured bank.

It does not mean:

Crypto balances are FDIC insured
Token prices are protected
Every exchange failure is covered
Every dollar shown in an app automatically qualifies
Stablecoin balances are ordinary insured bank deposits

Official reference: FDIC — Financial Products That Are Not Insured

When an exchange refers to FDIC coverage, identify:

The partner bank
The account structure
Who is recorded as the beneficial owner
Whether pass-through requirements are satisfied
Which balances qualify

8. SIPC protection is also product-specific

SIPC protection applies in the context of failed SIPC-member brokerage firms and covered cash or securities.

It does not protect against market losses.

SIPC also states that a digital or crypto asset that does not qualify as a security under SIPA is not protected simply because it is held through a related brokerage business.

This matters where a crypto brand also operates a registered broker-dealer.

The existence of the broker-dealer should not be presented as blanket SIPC insurance for the platform's ordinary crypto balances.

Official reference: SIPC — What SIPC Protects

9. Compare the full transaction cost, not only the trading fee

Regulatory status should be checked first, but users still need to compare the economic cost of using the platform.

A realistic exchange comparison should include:

ACH or bank-transfer funding
Card-purchase fees
Trading fee
Maker versus taker pricing
Spread
Slippage
Currency conversion
Crypto withdrawal fee
Blockchain network fee
Minimum withdrawal amount

For example, comparing only the advertised spot fee can produce the wrong result if one platform has a wider spread or more expensive withdrawal route.

A better comparison is to model one complete transaction:

Deposit $1,000
→ Buy BTC
→ Hold or trade
→ Withdraw BTC to self-custody

Calculate the total amount lost to fees and execution across the full route.

10. Product availability must be checked separately

A US exchange may be available in a state while a particular product is not.

Check separately for:

Spot trading
Staking
Margin
Futures
Options
Lending
Yield products
Stablecoin services
Tokenized securities
USD deposits and withdrawals

The presence of a token on an exchange's global website does not prove that a US user can trade it.

The same applies to derivatives.

A derivatives licence attached to one entity does not automatically authorise the retail spot exchange to offer the same product.

11. Security controls remain important after licensing checks

Licensing does not eliminate account-takeover risk.

Useful controls include:

Passkeys
Hardware security keys
App-based multi-factor authentication
Withdrawal address allowlisting
New-device alerts
Anti-phishing codes
Withdrawal cooling-off periods
Session and device management

SMS-only authentication is weaker because phone numbers can be targeted through SIM-swap attacks.

The email account connected to an exchange should also use a unique password and strong multi-factor authentication.

Before increasing exposure, users can test:

Identity verification
Bank funding
Spot execution
Crypto withdrawal
Fiat withdrawal

A successful test does not guarantee future access, but it can reveal immediate operational or account restrictions.

A practical US exchange verification checklist

Before using a platform, complete this sequence.

Step 1 — Confirm the domain

Verify that the domain and app publisher belong to the genuine exchange.

Step 2 — Find the contracting entity

Read the user agreement for your state or country.

Record the full corporate name.

Step 3 — Check FinCEN status

If the entity claims MSB registration, verify the registration and understand what it represents.

Step 4 — Check state permission

Search NMLS Consumer Access and the relevant state regulator.

Do not assume one state's licence applies nationwide.

Step 5 — Check New York separately

If you are a New York resident, verify NYDFS authorisation.

Step 6 — Check the product

Determine whether the permission covers spot trading, derivatives, custody or another specific service.

Step 7 — Read custody terms

Identify the entity or subcustodian holding crypto and what happens in insolvency.

Step 8 — Verify insurance claims

Separate FDIC-eligible fiat arrangements, SIPC-covered brokerage assets and uninsured crypto.

Step 9 — Review reserve and security evidence

Check reserve disclosures, audits where available, incident history and withdrawal controls.

Step 10 — Test the exit route

Make sure you can withdraw the intended asset or fiat balance before relying on the exchange for a larger amount.

Red flags in “US regulated” claims

Treat these statements cautiously unless the underlying evidence is provided:

“Fully regulated in the United States”
“US government approved”
“FinCEN licensed exchange”
“FDIC insured crypto”
“SIPC protects all customer assets”
“One licence covers all 50 states”
“Regulated, therefore risk-free”
“Proof of Reserves proves solvency”

The problem is not always that the underlying registration is false.

The problem can be that a legitimate registration is being described as broader than its actual legal scope.

Frequently asked questions

What is a regulated crypto exchange in the US?

There is no single definition based on one universal licence. A US-facing exchange may be subject to FinCEN registration, state money-transmitter licensing, NYDFS virtual-currency rules, SEC requirements, CFTC regulation or a combination of these depending on its activities.

Is FinCEN registration a crypto exchange licence?

Not in the broad sense commonly implied by the word “licence.” FinCEN MSB registration relates primarily to Bank Secrecy Act and anti-money-laundering obligations. It does not prove solvency or authorise every crypto product nationwide.

Does the US have a national crypto exchange licence?

As of August 2026, the US still does not operate a single nationwide licence equivalent to a blanket authorization for all centralized crypto exchange activities. Federal and state requirements remain activity- and jurisdiction-specific.

What changed in 2026?

The SEC and CFTC issued a joint interpretation in March 2026 clarifying how federal securities laws apply to certain crypto assets and transactions. It provides greater classification clarity but does not replace state licensing or create one universal exchange licence.

Is a New York BitLicense stronger than an MSB registration?

They cover different regulatory functions. A BitLicense is an NYDFS authorisation for covered virtual-currency business activity in New York. FinCEN MSB registration addresses federal Bank Secrecy Act and AML obligations. They should not be treated as interchangeable.

Are crypto balances FDIC insured?

Crypto assets themselves are not FDIC-insured deposits. Some eligible US dollar balances placed at insured partner banks may qualify for pass-through deposit insurance if applicable requirements are satisfied.

Does SIPC protect crypto held on an exchange?

Not automatically. SIPC protection depends on the brokerage relationship and whether the asset qualifies as a covered security under SIPA. Ordinary crypto balances do not become SIPC protected simply because a related company is a SIPC-member broker-dealer.

What is the safest regulated crypto exchange in the US?

There is no defensible answer based on regulation alone. Compare the legal entity, state permissions, product scope, custody terms, reserve evidence, security history, withdrawal reliability and total cost for the exact service you intend to use.

Conclusion

The most important lesson in US crypto exchange regulation is that registration is not the same as universal authorisation, and regulation is not the same as safety.

A credible assessment must connect:

brand → legal entity → jurisdiction → regulatory record → product scope → custody → user protection

That is more useful than counting licence logos or describing an exchange as simply “regulated.”

For US users, start with the entity named in the account agreement, verify federal and state records, determine whether the intended product falls within the relevant permission, and then review custody, insurance and withdrawal terms separately.

Cexvia applies the same principle when mapping exchange licences: registrations and permissions are evaluated at the entity and jurisdiction level rather than converted into a single global “licensed” label.

Primary sources

*Cexvia evaluates centralized exchanges using publicly verifiable evidence across regulatory standing, corporate transparency, asset and solvency transparency, security history, and operations and user protection. Ratings are evidence-based risk assessments, not recommendations to deposit or trade.*