A US-based business evaluating a crypto exchange should assess the specific contracting entity, services, custody arrangements, security evidence, compliance responsibilities, and operational terms—not rely on a platform label or general claim of regulatory status. Use current authoritative records and contract documents to verify claims, and send unresolved legal, tax, security, and recovery questions to qualified reviewers.

What business due diligence on crypto exchanges should establish

Start by defining the business task: which activity the exchange would support, which business users would access it, and which assets and locations are in scope. Write down the intended workflow and the business requirement it must meet. These are assessment inputs, not assumptions about what a provider supports.

Then map the services involved. A centralized exchange may combine trading with proprietary activity, lending, token issuance, or custody, but not every operator performs every function. When roles are combined, they can create operational dependencies or conflicts worth examining. Do not assume that a trading service also provides custody, payments, or another function your workflow requires. [1]

Set decision criteria before comparing provider materials. For each criterion, record the evidence needed, who will review it, and what remains unverified. This makes a marketing statement, a contractual commitment, and a business requirement distinct items in the assessment. It also prevents a general description of a service from being treated as proof that the particular entity, product, or workflow meets the need.

Crypto exchanges in USA: verify regulatory and compliance scope

Identify the legal entity that would contract with the business, the entities performing each service, and the actual activities in scope. A brand name alone does not establish which entity holds assets, executes trades, or provides a separate service. Request current documentation identifying those roles, then compare the stated scope with authoritative records relevant to the entity and activity.

Do not turn this review into a blanket conclusion that an exchange is “regulated” or “compliant.” The allowed evidence does not establish particular US registration or licensing requirements, or the status of any provider. Those questions must be checked against current authoritative records for the specific entity, service, activity, and jurisdiction, with qualified legal review where needed.

Map compliance tasks between the business and its providers. In the United States, persons and virtual-currency businesses subject to US jurisdiction are responsible for avoiding prohibited sanctions transactions and applying a tailored, risk-based compliance program appropriate to their activities. [2] That scope does not determine obligations in other jurisdictions or whether a particular merchant is a regulated virtual-asset service provider. Do not assume a provider’s controls discharge the business’s own responsibilities; have counsel assess the applicable obligations and contractual allocation.

For identity checks, sanctions screening, transaction monitoring, and records, document which party is expected to perform each task, what evidence supports that understanding, and what escalation path applies. The available evidence does not specify a universal allocation of these duties for every exchange relationship. Treat the allocation as a question for current provider documentation and legal review, not as a standard feature inferred from the word “exchange.”

Assess security controls, custody, and recovery

Ask for current, appropriately scoped evidence for the controls relevant to the planned workflow. Organize the review around access to accounts, key management, withdrawal authorization, incident handling, recovery, and any independent assurance the provider claims. For each document, note its date, scope, responsible entity, and limitations. A general security statement does not by itself establish that a control applies to the service or account under review.

Determine how assets are held and who controls access to the private keys. A centralized exchange customer typically transfers assets into the exchange’s custody before using its internal trading system, but some venues and products use different custody, brokerage, or settlement arrangements. [3] Confirm the specific arrangement in current terms and service documentation; do not infer custody, segregation, recovery rights, or protections from a platform interface or trading feature.

Separate protocol-level control from provider and user responsibilities. Where a third party manages keys, the business depends on the provider’s custody arrangements and contractual terms. Where the business controls key material itself, its own access and recovery procedures require review. The evidence allowed for this article does not establish a particular provider’s key controls, insurance, independent audit, incident history, or recovery guarantees. Request evidence and assess its limits rather than treating an unsupported claim as confirmation.

Review how the provider describes withdrawal approvals, account recovery, incident notification, and continuity. Record the practical effect of each term on the business’s operations, including what remains dependent on provider processes. If a material recovery or incident question cannot be answered from current evidence and contracts, mark it unresolved and escalate it before relying on the service.

Check operational fit, availability, and fees

Verify that the entity and product under review support the intended business, users, assets, and locations. The allowed evidence does not establish current availability, supported assets, geographic access, limits, service levels, settlement timing, or fees for any provider. Obtain current documentation and contractual terms directly, and record when each item was checked. Do not treat a general product description as a commitment for a particular account or workflow.

Map each operational step: who initiates it, which service performs it, what confirmation the business receives, and what dependency could interrupt the process. Review stated service levels, limits, settlement arrangements, and third-party dependencies in the applicable terms. If a term is missing or ambiguous, list the question for the provider rather than filling the gap with an assumption.

Obtain the current fee schedule for the relevant service and identify any charges that may vary by activity or arrangement. This evidence does not support fee comparisons or claims about which exchange is cheaper. The task is to confirm the costs applicable to the business’s proposed use and document any uncertainty before onboarding.

Document findings and escalate unresolved risks

Create a decision record with the entity and service reviewed, the intended use, evidence sources and dates, scope limitations, open questions, and the person responsible for follow-up. Separate verified facts from provider statements and internal assumptions. Revisit time-sensitive claims when the business’s use, provider terms, or relevant records change.

Assess dependencies and continuity as part of operational fit. Identify which business processes depend on the exchange, what alternatives or workarounds the business has evaluated, and how it would approach an orderly exit or migration. The evidence here does not establish that any provider offers a particular continuity or migration capability, so verify these points in current terms and operational documentation.

Keep legal and tax conclusions with qualified professionals. This framework does not determine whether a business or provider meets a legal requirement, nor does it establish business-specific tax treatment. Escalate unresolved regulatory, sanctions, custody, security, recovery, or tax questions to the appropriate qualified reviewer before making an onboarding decision.

A useful final review is to test each conclusion against its evidence rather than treating a completed checklist as a guarantee. For every decision-critical point, ask whether the document concerns the same contracting entity, service, account type, and business activity; whether it is current; and whether it states a binding term, a control description, or only an aspiration. Keep those categories separate in the decision record.

Also distinguish a missing answer from a negative finding. If provider documentation does not describe recovery or incident notification, record that the point remains unverified; do not conclude that no process exists. Conversely, a stated process does not establish its effectiveness or contractual availability unless the relevant evidence supports that conclusion. Assign an owner and a next step for each gap, such as requesting an applicable contract provision, obtaining a scoped control report, or seeking qualified review.

Before onboarding, summarize the operational dependencies and unresolved issues for the people authorized to accept them. The summary should state what the business expects the exchange to do, what remains the business’s responsibility, which assumptions are still open, and what conditions would trigger reassessment. This keeps a provider comparison from becoming an unsupported assurance about security, compliance, continuity, or suitability.

Sources and references