What an Exchange Does Behind the Scenes

A centralized crypto exchange is a company that verifies customers, takes and matches their orders, holds their coins and keeps the records, all under one roof. A trade between two of its customers usually changes entries in the company's own ledger; the blockchain comes in mainly when coins enter or leave the platform. That design is fast, but customers depend on one company's records, controls and solvency.

Key takeaways

• In US stock markets, broker, trading venue and clearing agency are separately registered. A crypto platform often combines these roles with custody, which the SEC says creates conflicts of interest.
• Your trade with another customer typically needs no blockchain transaction. The platform's on-chain activity comes from deposits, withdrawals and moving coins between its own wallets.
• A proof-of-reserves report is a point-in-time check of assets. The SEC says it does not tell the whole story about liabilities or whether customers would stand in line behind other creditors.
• Who owns the coins in a bankruptcy can turn on the account agreement. In the Celsius case, the court held that Earn account assets became the company's property under its terms of use.
• Routine identity checks, rolling limits and short withdrawal holds are normal controls. They say nothing about solvency, and a platform-wide halt on withdrawals is a different matter.

One company, several jobs

In a March 2023 investor alert, the SEC said that so-called crypto exchanges may offer a combination of services typically performed by separate firms, each of which may need its own registration. It said that combining exchange, broker-dealer and custodial functions creates conflicts of interest and risks for investors. It added that SEC-registered entities follow rules that limit those conflicts, in some cases by putting the functions in legally separate and unaffiliated entities.

Onboarding, KYC and licensing

Before a platform lets you trade, it verifies who you are. The federal basis is the Bank Secrecy Act. FinCEN's May 2019 guidance (FIN-2019-G001) treats a business that accepts and transmits convertible virtual currency as a money transmitter unless an exemption applies, and FinCEN reads those exemptions strictly. A money transmitter must register with FinCEN as a money services business and run an anti-money-laundering program that includes verifying customer identification, filing reports, keeping records and responding to law enforcement requests. The guidance says it adds no new requirements, only consolidating earlier rules.

The same guidance describes hosted wallet providers, the model that fits a typical exchange account, as account-based money transmitters. In FinCEN's description the value belongs to the owner, may be represented as an entry in the host's accounts, and is under the host's total independent control, although the host is contractually obliged to act only on the owner's instructions. That description serves anti-money-laundering rules; who owns the coins in a failure is decided by the account terms and bankruptcy law, as the Celsius case below shows.

States can add their own layer; New York is one example. Under 23 NYCRR Part 200, a business needs a license from the superintendent to engage in virtual currency business activity involving New York or a New York resident. The NYDFS page lists transmitting, holding virtual currency for others, buying and selling it as a customer business and exchange services among covered activities. A firm can hold a BitLicense or a limited purpose trust company charter; only the trust company can exercise fiduciary powers.

Ledger, wallets and the blockchain

Two sets of books

An exchange keeps an internal ledger of what each customer is owed, and it holds actual coins in wallets it controls, often omnibus wallets in which one wallet holds many customers' coins. The two are meant to match. New York's custody guidance expects licensed custodians to be able to show that their books reconcile with on-chain activity, and to keep an audit trail showing each customer's beneficial interest in an omnibus wallet.

When two customers trade, the platform debits one ledger balance and credits another. For those two customers, the on-chain events are the deposit that filled the wallet and any later withdrawal.

Deposits and withdrawals

Kraken's support pages show how one platform handles the boundary. On its Kraken Classic interface, a withdrawal request passes through internal checks for up to 10 minutes, then a pending stage of up to 10 more, before it is broadcast. It can be cancelled only in those stages and can be held for a manual check. Its funding limits depend on verification, country, activity, account age and asset, and the page calls them dynamic. These are one platform's rules as of October 2026; others differ.

Illustrative example: one trade, two ledgers

The numbers below are hypothetical. Assume a taker fee of 0.60%, a maker fee of 0.40% and a price of $60,000 per bitcoin. The exchange's customer omnibus wallets hold 50.00 BTC against customer ledger balances of 50.00 BTC. Alice starts with $10,000 and no bitcoin; Bob starts with 1.00 BTC and no cash. Alice buys 0.10 BTC with a market order that fills against Bob's resting sell order.

Trade value    = 0.10 BTC x $60,000                = $6,000
Alice's fee    = $6,000 x 0.60% (taker)            = $36
Bob's fee      = $6,000 x 0.40% (maker)            = $24
Exchange fees  = $36 + $24                         = $60

The trade moves $6,000 and 0.10 BTC between customers and $60 to the exchange, yet the on-chain balance stays at 50.00 BTC. The blockchain changes only when Alice withdraws. With an assumed flat withdrawal fee of 0.0002 BTC, 0.0998 BTC leaves the wallet and customer ledger balances fall by 0.10 BTC to 49.90 BTC. The leftover 0.0002 BTC is the platform's revenue; under segregation standards such as New York's it should leave the customer wallet, so 49.90 BTC on-chain backs 49.90 BTC owed. The network fee for broadcasting the withdrawal is left out for simplicity. No account screen shows whether that reconciliation actually happens.

Fees and the matching engine

The matching engine is the software that pairs orders. Kraken's trading glossary says the platform uses a central limit order book in which orders are matched by price and time priority. A maker is a limit order that is not immediately matched, adding liquidity; a taker is a market or limit order matched immediately, removing it.

That distinction sets the fee. Kraken's fee explainer, last updated October 1, 2026, says a fee is charged when an order executes, as a percentage of the order's total value. It ranges from -0.02% for makers to 0.80% for takers depending on 30-day volume, the trading pair and maker or taker status, and orders cancelled before execution pay nothing. A negative maker fee is a rebate. The 0.60% and 0.40% in the worked example are illustrative only.

What proof of reserves shows

The SEC's alert describes proof of reserves as a voluntary method of offering evidence that an entity has enough reserve assets to cover what it holds for customers at a given point in time. It warns that such a report typically may show only a snapshot, may not disclose activity between snapshots such as lending of customer assets, and does not tell the whole story about liabilities. It is not as rigorous as an audit, and with no specific audit requirements the entity controls the terms of the engagement.

A common tool is a Merkle tree. In Kraken's December 2022 explanation, client balances are hashed and paired repeatedly into one value, the Merkle root, so clients can check that their balance was included. The same post says there are no formally accepted rules defining a proof-of-reserves audit and that involving an auditor is not a complete guarantee of accuracy. So your balance's inclusion is checkable, but debts to lenders and other creditors fall outside what the tree proves.

If the exchange fails

Who owns the coins

In a bankruptcy, the question is whether customer coins belong to customers or to the company. In In re Celsius Network, Chief Judge Martin Glenn ruled on January 4, 2023 that, based on Celsius's terms of use and subject to reserved defenses, crypto deposited in Earn accounts became Celsius's property. The assets still there on the July 15, 2022 petition date became property of the bankruptcy estates. The court called ownership a contract-law issue. It noted about 600,000 Earn accounts at the petition date, holding roughly $4.2 billion in crypto as of July 10, 2022, whose holders, as unsecured creditors, might recover only a small percentage of their claims. The opinion expressly did not decide ownership in Celsius's Custody, Withhold or Borrow programs, so it is not a rule for every platform.

FTX shows a different failure. The SEC alleged that customer funds were diverted to Alameda Research, and the CFTC that customer assets were commingled with Alameda's funds, that FTX code included an "allow negative flag" and an effectively limitless line of credit for Alameda, and that over $8 billion in customer deposits was lost. These were allegations when the cases were filed in December 2022.

Safeguards that exist

New York's September 30, 2025 guidance, which replaced the January 23, 2023 version, applies to BitLicensees and New York limited purpose trust companies that custody virtual currency. It expects customer assets to be segregated from corporate assets both on-chain and in internal ledgers, with the equitable and beneficial interest always remaining with the customer. It also rules out using customer assets for the custodian's own purposes, requires approval for new sub-custodians and requires acknowledged disclosures before a first transaction.

Frequently asked questions

Why can a deposit show up but not be withdrawable?

Kraken's deposit statuses (updated May 5, 2026) include a "Credited" stage in which funds can be traded but not withdrawn until the deposit has the required confirmations. Not every asset uses that stage, and other platforms set their own rules.

Can a limit order still pay the taker fee?

Yes. On Kraken, a limit order priced to match immediately counts as a taker. Only an order that rests on the book first earns the maker rate, and an order cancelled before it executes pays nothing.

Does the New York custody guidance cover every exchange?

No. It applies to BitLicensees and New York limited purpose trust companies that custody virtual currency. It says it is not intended to address ancillary activities such as staking in detail, and it does not limit other laws or regulations.

Does a proof-of-reserves report mean my coins are safe?

Not by itself. The SEC says such reports may provide no meaningful assurance that a platform holds adequate assets to back customer balances. A report that covers liabilities and names an independent assurance provider tells you more, but it is still a point-in-time check.

Does a platform based outside the United States need FinCEN registration?

FinCEN's 2019 guidance says the money transmitter rules apply equally to foreign-located virtual currency money transmitters doing business in whole or in substantial part within the United States, even with no physical presence here. Whether a particular platform meets that test depends on the facts.

Before you deposit: a checklist

• Read the account agreement for who holds title to your assets and whether they may be lent, pledged or commingled. The Celsius ruling turned on that kind of wording.
• Check how the company is registered and licensed, for example as a FinCEN money services business and under any state license, and whether its custody follows segregation standards such as New York's.
• Check whether its proof of reserves includes liabilities, who did the work and under what standard.
• Look up the withdrawal limits, holds and fees for your verification level before you rely on moving funds quickly.
• Weigh how much to leave on any one platform. The SEC's custody bulletin notes that if a third-party custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets.

Sources

• SEC Office of Investor Education and Advocacy, Exercise Caution with Crypto Asset Securities: Investor Alert (March 23, 2023)
• SEC, Crypto Asset Custody Basics for Retail Investors: Investor Bulletin (December 12, 2025)
• SEC Division of Trading and Markets, Clearing Agencies
• FinCEN, FIN-2019-G001, Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies (May 9, 2019)
• NYDFS, Virtual Currency Businesses and Updated Guidance on Custodial Structures for Customer Protection in the Event of Insolvency (September 30, 2025)
• US Bankruptcy Court, S.D.N.Y., In re Celsius Network LLC, Memorandum Opinion Regarding Ownership of Earn Account Assets (January 4, 2023)
• SEC, SEC Charges Samuel Bankman-Fried and CFTC, complaint against FTX, Alameda and executives (both December 13, 2022)
• Kraken support and blog pages, used to illustrate one platform's practice (checked October 2026): trading glossary, trading fees, deposit statuses, withdrawal statuses, funding limits, proof of reserves