A regulated crypto exchange is a trading platform that holds a licence from a financial authority and operates under its supervision. With that licence come capital requirements, client asset rules, reporting obligations, and a regulator with the power to investigate.
Why it matters has a clear historical answer. In November 2022, FTX collapsed while ranking among the world's largest exchanges, having commingled customer funds with company money. Customers who had done nothing wrong lost access to their assets.
What crypto exchange regulation actually requires
Obligations, not a badge.
- Minimum capital. Under MiCA roughly €50,000 to €150,000 depending on service type. VARA sets AED 1.5 million for an exchange licence, plus an operational risk requirement scaling with volume.
- Segregated client funds. Customer assets held separately from company money, which is precisely what failed at FTX.
- Fit-and-proper management. Named individuals assessed by the regulator, rather than anonymous operators.
- KYC and AML programs. Identity verification, transaction monitoring, sanctions screening.
- Market surveillance. Systems to detect manipulation and abusive trading.
- Audits and reporting. Ongoing submissions, not a one-time approval.
Meeting those obligations costs money. Hence why unregulated platforms undercut on fees.
The major crypto regulators and frameworks
| Regulator | Jurisdiction | Notes |
|---|---|---|
| [VARA](/learn/vara) | Dubai, excluding DIFC | World's first standalone virtual asset regulator, seven licence categories |
| MiCA | All 27 EU member states | One passportable licence covering every member state |
| AUSTRAC | Australia | AML and CTF regulator, digital currency exchange registration |
| DFSA | Dubai International Financial Centre | Crypto tokens inside an existing financial rulebook |
| FSRA | Abu Dhabi Global Market | Separate framework, no passporting to Dubai mainland |
Note that these do not passport between each other. Operating in Dubai mainland and Abu Dhabi requires both licences.
How to verify an exchange's license claim
Straightforward, and almost nobody bothers to do it before handing a platform their money.
Regulators publish public registers of licensed entities. ESMA maintains the EU's CASP register. VARA and AUSTRAC publish theirs. Searching the regulator's own site takes a minute, and it confirms whether a claim on an exchange's homepage is true.
Watch the wording too. "Compliant" is not "licensed." Naming a jurisdiction is not naming a regulator. Holding a licence in one category, such as advisory, does not authorize operating an exchange.
Regulated vs unregulated exchanges
| Regulated | Unregulated | |
|---|---|---|
| Client funds | Segregated by requirement | No obligation |
| Recourse if things fail | A supervisory authority exists | Generally none |
| Identity verification | Required | Frequently absent |
| Reported volume | Statistically normal distributions | Wash trading averaged 77.5% in NBER research |
| Fees | Higher, because compliance costs money | Lower |
That fourth row deserves attention. Testing 29 unregulated exchanges, a National Bureau of Economic Research study published in December 2022 found wash trading averaged 77.5% of reported volume. Regulated venues displayed the statistical patterns observed across normal financial markets. Unregulated ones did not.
What regulation does not do
Being honest about the limits matters, since "regulated" gets used as a synonym for "safe."
- Assets are not insured. No deposit guarantee scheme covers crypto.
- Failure is not prevented. Capital requirements reduce the chance. They do not eliminate it.
- Individual tokens go unvetted. A licence covers the platform, not what trades on it, which is why a whitepaper still needs reading.
- Market risk is untouched. Bitcoin has fallen more than 75% from a peak on four separate occasions. No licence changes that.
- Not every service is covered. Check which activities the authorization actually includes.
What regulation does do
It reduces the specific category of risk you have no realistic way of assessing on your own.
Auditing an exchange's reserves personally is not possible. Neither is verifying its internal controls, or confirming customer funds sit where they should. A supervisor can do all three, and has the power to act when things are wrong.
That is the trade. Risks you have no way to evaluate become risks someone with authority evaluates on your behalf.
mb.io is a regulated crypto spot exchange
mb.io holds licences from VARA in the UAE and AUSTRAC in Australia. Both are verifiable on the regulators' own public registers.
mb.io is backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Regulated by VARA in the UAE and AUSTRAC in Australia
- 10/10 security score from Hacken, an independent blockchain security auditor
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- A curated list of assets, so you're not sorting through thousands of tokens to find the ones worth trading
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 multilingual customer support
Open your account and start trading on mb.io.
Frequently asked questions
How do I check if a crypto exchange is regulated?
Search the regulator's own public register rather than trusting the website. ESMA publishes the EU's CASP register, and VARA and AUSTRAC maintain theirs. Confirm the licence covers exchange services specifically.
Is a regulated exchange safer?
Through capital requirements, segregated client funds, and supervision, it reduces operational and counterparty risk. Market risk is unchanged, and no licence insures your holdings.
What is the difference between "regulated" and "compliant"?
A regulated firm holds a licence and answers to an authority. "Compliant" is a self-description with nothing verifying it, and platforms use the word precisely because it sounds similar.
Why are regulated exchanges more expensive?
Because meeting capital, audit, surveillance, and reporting requirements costs money. Avoiding those costs is where the fee difference originates.
Does regulation protect me if the exchange fails?
Partly. Segregated client funds make recovery far more likely, and a supervisor exists with power to investigate. In most jurisdictions, no deposit insurance scheme covers crypto.
Can a regulated exchange still be hacked?
Yes. Mandating controls and audits is not the same as guaranteeing outcomes. Independent security scores and custody arrangements are worth checking alongside the licence.
Do decentralized exchanges have regulation?
Generally not in the same form, since no company onboards users. Obligations have been extending toward interfaces and developers, and a DEX offers no recourse when something goes wrong.
What happened with FTX?
It collapsed in November 2022 after customer funds were found commingled with company money and used elsewhere. Since then it has been the clearest illustration of why segregation requirements and supervision matter.
