Wondering how your crypto exchange keeps your money safe? This article explains the safeguards that regulated platforms are required to have, how outsourcing can affect those protections, and what you should look for before trusting an exchange with your assets.
The basics of fund safeguarding
Safeguarding refers to the set of rules and technical measures that an exchange must follow to keep customer assets separate from its own operating funds. The goal is to ensure that, even if the exchange runs into financial trouble, users can still retrieve their deposits. In most jurisdictions, safeguarding includes three core components:
- Segregated accounts: Customer balances are held in dedicated wallets or bank accounts that are legally distinct from the exchange’s corporate accounts.
- Regular audits and reconciliations: The exchange must frequently verify that the amount recorded on its books matches the actual holdings in the segregated accounts.
- Transparent reporting: Regulators require periodic reports that detail the total amount of customer assets under custody and any material changes to the safeguarding framework.
When an exchange outsources part of its operation—such as custodial services, compliance monitoring, or IT infrastructure—it must still maintain full oversight. Outsourcing is common because specialized providers can offer higher security or lower costs, but the exchange remains ultimately responsible for the safety of the funds.
How outsourcing can create risk
Outsourcing introduces a second layer of risk. If the third‑party provider fails to meet the required standards, the exchange’s customers could be exposed. To mitigate this, regulators typically demand an outsourcing governance framework. Such a framework includes:
- Due‑diligence checks on the provider’s security controls, financial health, and regulatory compliance.
- Clear contracts that define service levels, data ownership, and liability.
- Ongoing monitoring and testing of the provider’s systems, often through independent audits.
- Contingency plans for quickly switching providers or bringing services back in‑house if problems arise.
If an exchange relies too heavily on a single external partner without sufficient oversight, regulators may deem the safeguarding arrangements inadequate. This can lead to fines, mandatory corrective actions, or even loss of the exchange’s license.
Real‑world illustration
In March 2026, the Central Bank of Ireland fined Coinbase Ireland €3.25 million for shortcomings in its safeguarding and outsourcing practices. The regulator found that Coinbase Ireland placed “excessive reliance” on its U.S. parent company for safeguarding processes, lacked a robust outsourcing governance framework, and had coding errors that left a safeguarding account underfunded by an average of 0.54 % in 2023 and the first half of 2024. Although no customers lost money, the fine highlighted how even large, well‑known platforms can fall short of regulatory expectations when they do not properly monitor outsourced services.
What it means for you
When you deposit crypto or fiat on an exchange, you are trusting that the platform has built-in protections to keep those assets separate and secure. A failure in safeguarding can delay withdrawals, expose you to loss if the provider becomes insolvent, or even result in funds being frozen during regulatory investigations. Understanding the exchange’s safeguarding model helps you assess the likelihood of such disruptions and choose platforms that align with your risk tolerance.
What to check before you deposit
Use the following checklist to evaluate an exchange’s safeguarding practices:
- Regulatory licensing: Verify that the exchange is registered with a reputable financial authority (e.g., the Central Bank of Ireland, FCA, or MAS) and that its license explicitly covers custodial services.
- Segregation policy: Look for public statements or documentation confirming that customer funds are held in separate accounts or wallets.
- Audit transparency: Check whether the exchange publishes regular audit reports or third‑party attestations of its custodial balances.
- Outsourcing disclosures: Review the exchange’s terms of service or compliance page for information on third‑party providers and the governance framework in place.
- Incident history: Research past regulatory actions, fines, or security incidents involving the exchange. Repeated issues may indicate systemic weaknesses.
- Insurance coverage: Some platforms obtain insurance for digital assets; confirm the scope and limits of any policies.
FAQ
What is the difference between a custodial and a non‑custodial exchange?
A custodial exchange holds your assets on your behalf, managing private keys and providing a user‑friendly interface. A non‑custodial platform lets you retain control of your private keys, meaning you are solely responsible for security.
Can I lose money if an exchange is fined for safeguarding failures?
Fines themselves do not directly cause losses, but they often signal underlying control weaknesses. If those weaknesses lead to a breach or insolvency, customers could experience delayed withdrawals or, in worst cases, loss of funds.
How often should I review an exchange’s safeguarding policies?
It’s good practice to check the exchange’s compliance updates at least once a year, or sooner if you hear about regulatory actions or major security incidents.
Does insurance replace the need for proper safeguarding?
No. Insurance is a supplemental layer that may cover certain losses, but it typically has limits and exclusions. Robust segregation, audits, and oversight remain the primary defenses against fund loss.
This article references reporting from coindesk.com.
