How we rate exchanges

How the score is built

A score out of 10, from four parts. Every part links to the source it came from.

Scores and ranking positions are not for sale, at any price.

• Regulation, up to 40: we count the jurisdictions where we have confirmed a license on the official register, weighted by how demanding the license is (Japan, Hong Kong, Singapore, South Korea, Taiwan, the EU, France, Germany, the Netherlands, the UK and the US count 1; Dubai, Malaysia, India, Thailand, Kazakhstan (AIFC), the Bahamas and Gibraltar 0.7; others 0.5). Three weighted jurisdictions earn the full 40. A non-compliance notice sets this part to 0, whatever licenses the exchange holds elsewhere. A regulator's warning or enforcement order that we have confirmed against the exchange also sets it to 0 when we have confirmed no license anywhere; otherwise it costs 10 points per jurisdiction, up to 20. Warnings matched only by name do not count. A license matched only by company name does not count.
• Safety, up to 25: 15 for a confirmed license in a jurisdiction whose license legally requires client assets to be kept separate, and 10 for proof of reserves we can read on-chain.
• Incidents, up to 20: starts at 20. Each of these from the last three years removes 5 points, or 10 if the amount was $50 million or more: a hack in the public DefiLlama hacks dataset (by the reported loss), and an enforcement case against the exchange that ended in a guilty plea or a settlement (by the penalty in the official release, counted from the date of the outcome; where no penalty figure is disclosed it counts in the smaller tier). Charges with no outcome yet and dismissed cases do not count. Register warnings count under Regulation, not here, so the same record is never deducted twice. Records older than three years no longer count. Three years means 1,095 days. A record with no reported amount counts as under $50 million. A record dated in the future is a data error and does not count. A hack DefiLlama has not listed yet can appear earlier, linked to the reports. At first it is marked as reported and not verified by us: it does not affect the score, and it is shown publicly only once a second independent source reports it. It is confirmed and counted once DefiLlama lists it, the exchange itself confirms it, or two independent major outlets report it. Until DefiLlama lists it, the amount is the one the reports give, and the smallest figure when they differ. A report not confirmed within 72 hours is withdrawn, and the exchange page says so. Once DefiLlama lists it, its figures replace ours. A joint resolution, where several authorities settle the same conduct with the same company at the same time, counts once, by the largest penalty among them; each authority is still listed.
• Size, up to 15: from the 24-hour spot volume we collect ourselves, on a logarithmic scale from $1 million (0) to $10 billion (15). Volume reported by third parties (CoinGecko) is used only for platforms we know only from CoinGecko's list (see below) and for tracked exchanges we have no data connection to; their pages mark it as not collected by us. If we cannot collect an exchange's market data, this part is estimated from its confirmed licenses, up to 9 points, instead of being set to 0.

Licenses that legally require client assets to be kept separate: Japan, Hong Kong, Singapore, South Korea, Taiwan, the EU, France, Dubai, Malaysia and Indonesia. The UK, US and Canadian registrations we read are anti-money-laundering registrations with no such requirement, so they do not earn these points.

No incidents means we found no hack in the DefiLlama hacks dataset and no guilty plea or settlement in our enforcement records for the last three years. It is not a statement that nothing happened.

If we have confirmed nothing ourselves about an exchange we track (no license, no regulator notice, no market data of our own), it shows “Not scored”. A blank record is not the same as a clean one.

The ranking also includes licensed platforms whose market data we cannot pull, scored from their licenses, and platforms we know only from CoinGecko's list, scored with the same formula using the trading volume CoinGecko reports. We found no license on record for the CoinGecko-only ones, so their regulation score is zero. They have no page on Takame. For licensed platforms we also find on CoinGecko, size uses CoinGecko's volume in the same way.

Advertising, payments of any kind, claiming a page or displaying our badge, and anything an exchange tells us that we cannot check against a public source never affect the score.

• Ranked: we pull their market data ourselves.
• Licensed, no market data: an official register lists them as a trading platform, but we cannot pull their order books.
• Listed elsewhere: centralised exchanges that appear on CoinGecko with at least $100,000 of daily volume, but we found no license and cannot pull their data ourselves. We score them from CoinGecko's volume alone, so their scores stay low. DEXes are left out.
• Named by a regulator: on an official warning or non-compliance list. Shown as the regulator wrote it, with the source; not scored and not ranked.

We have not verified anything about this exchange ourselves, so we publish no score. Volume data provided by CoinGecko

Is it registered where you live?

Most countries require a crypto exchange to register before it serves local residents. Japan, for example, requires registration with the Financial Services Agency and publishes the list. We check exchanges against these public registers and show the result as it stands.

Registered names rarely match brand names. Kraken is registered as Payward and Crypto.com as Foris DAX. Each exchange page shows the exact legal entity that appears on the register.

What we measure

Most exchange rankings weight liquidity heaviest. We do the opposite, because reported volume is the easiest number for an exchange to inflate and the least useful to someone deciding where to keep their money.

• Regulation

  40%

  licenses we confirmed in the registers we read. A non-compliance notice sets this part to zero; a confirmed warning costs 10 points per jurisdiction, up to 20, or sets it to zero if we confirmed no license anywhere.

• Safety

  25%

  15 for a license that legally requires client assets to be segregated, 10 for a published proof of reserves.

• Incidents

  20%

  deductions for hacks in the DefiLlama hacks dataset and for enforcement cases against the exchange that ended in a guilty plea or a settlement, from the last three years, each with its source. Regulator warnings count under Regulation.

• Size

  15%

  from the 24h spot volume we pull ourselves. An exchange with no volume figure is not given a zero; its licensed jurisdictions stand in. Platforms we list only from CoinGecko use CoinGecko's figure.

How we grade regulatory coverage

Next to the score out of 10, each exchange gets a band. We read 35 registers, so an exchange licensed only in a market we do not cover yet, such as Turkey, scores low on Regulation; the band shows that as None found, which is missing evidence, not a verdict.

Flagged

Named on a regulator's list of non-compliant entities. A flag overrides everything else, including licenses held elsewhere.

Broad

Confirmed license in three or more of the jurisdictions we check.

Partial

Confirmed license in one or two of the jurisdictions we check.

None found

No record in any register we read. Several exchanges in this band hold licenses in markets we do not cover yet. Read it as missing evidence, not as a verdict.

The table is ordered by our score by default. Sort by volume, name or the regulation column to see it another way; each exchange page shows how its score was built.

Two numbers that are easy to mix up

The home page and the exchange pages use two different counts. They measure different things, so they do not give the same figure.

No license found: 88 of 279

The home page figure. These exchanges have no confirmed license in any register we read and are not named by a regulator. Some of them still appear in a register in another form: a registration that was struck off, a filing that is not a license, or a match on company name only.

No record at all: 56 of 279

These exchanges do not appear in any register we read, in any form. They get no country-by-country page, because every line on it would be the same; their exchange page says so once.

Matched by company name only, not yet confirmed

A company with the same name is on a register, but we have not yet confirmed through its registered website that it is the same business. The country pages say exactly that, and such a match counts as a license nowhere: not in the grade, not in the home page counts.

Regulator warnings

Some regulators publish the names of operators they have warned for serving local residents without registering. Japan's Financial Services Agency is one. We show each warning with the month it was issued, next to any licenses the same brand holds elsewhere.

A warning is not a finding of fraud. It means the operator served residents of that country without registering there. On its own it does not lower the grade of an exchange that holds a license elsewhere; a platform that a regulator warned and that holds no license in any register we read is marked Flagged. Binance is a good example: Japan's regulator warned the global operator in 2018 and 2021, while its Japanese subsidiary, Binance Japan, is registered today. Both facts appear on the page, each with its entity name and date.

Where the data comes from

Regulatory status comes from official registers. Market data comes directly from each exchange's public API; the one exception is platforms we list only from CoinGecko, whose volume is CoinGecko's figure.

• ESMA MiCA register (European Union)Authorised crypto asset service providers, plus a separate list of entities named as non-compliant.
• Financial Services Agency register (Japan)Registered crypto asset exchange operators and the assets each one may handle.
• VARA public register (Dubai)Licensed virtual asset service providers and the activities each is approved for.
• SFC list of licensed platforms (Hong Kong)Licensed virtual asset trading platform operators.
• MAS Financial Institutions Directory (Singapore)Major Payment Institutions licensed for digital payment token services.
• FIU list of virtual asset service providers (Korea)Providers that filed with the Financial Intelligence Unit, in Korean only.
• FSC list of registered VASPs (Taiwan)Firms that completed anti-money-laundering registration, plus those told to stop.
• AMF white list of digital asset providers (France)Registered and MiCA-authorised providers, published as open data.
• OJK list of digital asset trading providers (Indonesia)Licensed traders, exchanges, clearing houses and custodians, published as a PDF.
• FIU-IND enforcement orders (India)Orders against offshore platforms serving Indian residents.
• SC investor alert list (Malaysia)Operators the Securities Commission warns are not registered. We read it from our web host rather than our data server, because the site's network layer blocks our server's address; there is no human-verification check.
• BSP list of virtual asset service providers (Philippines)Firms licensed by the central bank, including those marked no longer operating.
• FinCEN MSB registrant list (United States)Money services businesses that filed a registration. Self-filed, not a license.
• CFTC RED list (United States)Entities outside the US that the CFTC says solicit US customers without the registration they appear to need. We include only crypto-related entries. Being on the list is not a finding that a law was broken. Newest crypto-related entry: 2023-06-12. Updates paused since 2026-10-05: the CFTC website now blocks automated reads and we do not work around it, so the entries shown are as of our last read.
• FINTRAC money services business registry (Canada)Registered, expired, ceased and revoked MSBs, including those offering virtual currency services.
• FCA Financial Services Register (United Kingdom)Anti-money-laundering registration for cryptoasset firms. We look up only the firms we track, by their FCA reference numbers, through the FCA's own API.
• AUSTRAC virtual asset service provider register (Australia)Anti-money-laundering registration that AUSTRAC reviews and can refuse, suspend or cancel. There is only a search box, so we look up each exchange we track by name; we also copy AUSTRAC's published list of cancellations, suspensions and refusals. Source: AUSTRAC, © Commonwealth of Australia.
• SPK crypto-asset service provider lists (Turkey)Two lists: firms that declared they will keep operating while their licences are reviewed (SPK says this is not an authorisation), and firms that will not continue. Names only, with SPK's notes on individual firms.
• FSA list of virtual asset service providers (Seychelles)Two lists on one page: firms licensed under the Virtual Asset Service Providers Act 2024 (empty when we last checked), and firms whose complete application is under assessment and that may keep operating meanwhile. Only licences count toward our rating; applications under assessment are shown but not scored.
• BaFin company database: crypto-asset service providers (Germany)German firms authorised under MiCA, with their activities and dates. Firms licensed elsewhere in the EU that may serve Germany come from ESMA's register (passport column). © Bundesanstalt für Finanzdienstleistungsaufsicht / www.bafin.de
• AFM register of crypto-asset service providers (Netherlands)Dutch firms authorised under MiCA, and foreign firms that may serve the Netherlands under the EU passport. We keep only names, numbers, status, home country and dates, and link back to the AFM.
• Thai SEC list of licensed digital asset businesses (Thailand, checked by hand)The SEC's site refuses automated requests, so we read the list in a browser and copy names, websites and licence types; the date shown is when we checked. We re-check every quarter.
• GFSC register of DLT providers (Gibraltar, checked by hand)The GFSC's site refuses automated requests, so we read the list and each firm's page in a browser and copy the name, trading names, website, company number and DLT permissions; the date shown is when we checked. We re-check every quarter.
• SEC Nigeria: firms admitted to the Accelerated Regulatory Incubation Programme, ARIP (Nigeria, checked by hand)Firms the SEC has given an approval in principle to operate within its incubation programme. The SEC states this is not a final licence, so these entries are shown but never scored. The list on the SEC's site stops at May 2025, so we copy each later batch from the SEC's own notices; the date shown is when we checked. We re-check every quarter.
• CNV register of virtual asset service providers, PSAV (Argentina)Companies registered with Argentina's securities regulator to provide virtual asset services, with registration number, date and activities. The file has no status column: a firm that leaves the register simply disappears from it.
• AFSA public register of digital asset service providers (Kazakhstan, AIFC)Licences issued by the regulator of the Astana International Financial Centre, with licence number, status, issue date and permitted activities. It shows suspended, revoked, expired and withdrawn licences as well as active ones.
• CNAD register of digital asset service providers, PSAD (El Salvador)Companies registered with El Salvador's National Commission of Digital Assets as digital asset service providers, with registration number, date, website and the activities ticked on the register. The page has no status column: a firm that leaves the register simply disappears from it.
• SCB register of digital asset businesses (The Bahamas)Firms registered with the Securities Commission of The Bahamas under the Digital Assets and Registered Exchanges Act, published as a monthly PDF. We keep only the firm's name, website, registration type and status, and link back to the SCB; the register has no registration numbers or dates.
• FSC register of virtual asset service providers (British Virgin Islands, checked by hand)Firms registered under the Virtual Assets Service Providers Act 2022. The FSC's site refuses automated requests, so we read its pages in a browser and copy each firm's name, categories, website and trading name; authorised representatives are left out. The date shown is when we checked. We re-check every quarter.

We now read the United Kingdom, the United States and Canada, each with a limit worth knowing. The FCA register we read is the anti-money-laundering registration for cryptoasset firms, which is not the same as being authorised under FSMA, and the FCA's warning list of unregistered businesses is not published in a machine-readable form, so it is not included. In the United States, FinCEN's list is a self-filed registration rather than a license, and state money-transmitter licenses are not covered. Canada's FINTRAC registration is also anti-money-laundering only. Thailand's SEC site refuses automated requests, and we do not work around that, so we copy its list of licensed digital asset businesses by hand in a browser, label it as checked by hand with the date, and re-check it every quarter. Australia's AUSTRAC publishes no list that can be read in full, only a search box, so we look up each exchange we track by name; its registration is reviewed and can be refused, suspended or cancelled, but it is anti-money-laundering only and does not count toward our rating. In the Philippines we read the central bank's license list but not the SEC's list of blocked platforms, which sits behind the same kind of check. An exchange missing from our table has not been judged unlicensed.

We re-read each register on a schedule and compare it with what we read last time. A fetch is thrown away, and nothing on the site changes, when the register returns fewer entries than we require for it, fewer than 60% of last time's count, or more than three times as many. The first read of a register only establishes a baseline. When an entry stops appearing we say exactly that, and we keep counting it as registered until it has been absent twice: a register can also drop an entry when a company is renamed or re-numbered.

How we link licenses to brands

Registers list legal entities, not brands. Kraken appears as Payward Europe Solutions and Crypto.com as Foris DAX MT. We link each record in one of two ways and label which one we used.

Verified

The website registered with the regulator is the exchange's own domain; or the regulator named the brand itself, word for word; or we checked by hand that the company operates that brand and listed it as such (for example Binance Japan K.K. for Binance). Only this kind of evidence can attach a warning to an exchange.

Unverified

Only the company name matches, for example Bybit EU GmbH. Shown with a dashed outline and never used to flag an exchange. It never counts toward the band either.

The EU non-compliance list includes an entity called HTXcoin-az. A naive text match would attach it to HTX, a large exchange with no connection to it. Wrongly branding a company does far more damage than missing a record, so a name match alone never produces a warning.

What we exclude from volume

Every pair is converted into US dollars using prices from that same exchange: its stablecoin, bitcoin and ether pairs give us the rates. If an exchange quotes only in a national currency and has no dollar or stablecoin pair, we fall back to our own site-wide bitcoin median price. Anything we still cannot convert is left out of the total.

Some exchanges now list tokenised shares next to crypto. Those pairs track companies like Nvidia or Nike, not crypto assets, so we remove them from the spot figure and publish the amount removed on each exchange page.

Across the exchanges we track, that currently removes $103.94B of reported 24 hour volume, almost all of it on a single exchange.

The volume that remains is still self reported and may include wash trading. Treat it as a claim, not a measurement.

How other exchange methodologies compare

Three published exchange methodologies cover similar ground. We link to them rather than quote them, because their terms do not allow reproduction, and we do not use their scores.

• Talos Exchange Scorecard (version 2.4, July 2026)Formerly Coin Metrics' Trusted Exchange Framework. Common ground: licensing and enforcement history count as their own part. Difference: it is built for institutional trading and also tests trade data, liquidity and API quality, which we do not.
• Kaiko Exchange Ranking rulebook (version 1.6, June 2026)Common ground: regulatory sanctions against an exchange count against it. Difference: Kaiko's ranking decides which exchanges feed its indices and also scores data quality, technology and liquidity; we score only what public records show.
• CoinDesk Exchange Benchmark methodologyCommon ground: the method is published and changes to it are announced. Difference: CoinDesk grades exchanges AA to F partly from the exchanges' own answers to its questionnaire; we send exchanges no questionnaire and give no letter grade.

Methodology updates

2026-10-16

Germany and the Netherlands now weigh 1, like France: a license from their own regulator under MiCA is the same kind of license. Thailand weighs 0.7, like Malaysia. At the time, 7 tracked exchanges scored higher, for example Bullish 7.6 → 8.4, Bitvavo 7.5 → 8.1, One Trading 5.9 → 6.6 and Bitkub 3.3 → 3.6. No coverage band changed.

2026-10-15

One MiCA license now counts once, as the European Union. Foreign firms that appear on France's AMF list or the Netherlands' AFM list because of the EU passport are shown in a separate passport column and no longer add France or the Netherlands as a second licensed jurisdiction. Firms authorised by the national regulator itself still count (for example Paymium in France, Bullish in Germany, Bitvavo in the Netherlands). At the time, 24 tracked exchanges scored lower, for example Kraken 8.7 → 7.4, Bitvavo 8.8 → 7.4 and bitFlyer 8.1 → 6.8; 7 of them moved from the broad to the partial coverage band.

2026-09-25

Canada's FINTRAC registration is now scored the way this page already described it: an anti-money-laundering registration, not a license, so it no longer adds regulation points. Four scores changed at the time: WEEX 4.0 → 3.3, DigiFinex 3.7 → 3.0, CEX.IO 5.7 → 5.1, NDAX 2.9 → 2.2. No coverage band changed.