Crypto regulation is fragmented by design — no single body licenses exchanges globally, and "regulated" can mean very different things depending on the country and the specific activity. These are the official sources, organized by function, not blended together.
Worried about a specific opportunity? Start with our free Crypto Scam Red Flags Checklist.
Licensing and conduct regulators with actual jurisdiction over crypto activity — not scam-reporting portals (see Section 8 for that).
US — Securities and Exchange Commission (SEC)
What: Federal jurisdiction over crypto assets that qualify as securities. sec.gov itself blocked automated verification from this environment on every attempt (HTTP 403, including with browser headers) — investor.gov is the SEC's own official investor-education domain and was used instead since it returned a verified 200. Re-verify sec.gov directly from a different network if it's specifically needed here.
US — Commodity Futures Trading Commission (CFTC)
What: Federal jurisdiction over crypto assets that qualify as commodities, including derivatives and futures markets.
US — Financial Crimes Enforcement Network (FinCEN)
What: AML enforcement and money services business (MSB) registration — the body an exchange operating in the US must register with for anti-money-laundering purposes, distinct from the SEC/CFTC's securities/commodities jurisdiction.
UK — Financial Conduct Authority (FCA)
What: The UK's cryptoasset AML/CTF registration authority, and the body building the incoming FSMA-based crypto regime (applications open 30 September 2026).
EU — European Securities and Markets Authority (ESMA)
What: Coordinates consistent application of MiCA (Regulation (EU) 2023/1114) across the EU and publishes the EU-wide register of authorised Crypto-Asset Service Providers (CASPs). ESMA does not itself license firms — that's delegated to each member state's own National Competent Authority (NCA) below.
Germany — BaFin
What: Germany's National Competent Authority for MiCA licensing.
France — AMF
What: France's National Competent Authority for MiCA licensing.
Spain — CNMV
What: Spain's National Competent Authority for MiCA licensing.
Italy — CONSOB
What: Italy's National Competent Authority for MiCA licensing.
Finland — FIN-FSA
What: Finland's National Competent Authority for MiCA licensing.
Ireland — Central Bank of Ireland
What: Ireland's National Competent Authority for MiCA licensing — a common EU domicile for large crypto firms passporting services across the bloc.
Australia — ASIC
What: Australia's conduct and licensing regulator for crypto assets that fall within its financial services jurisdiction (e.g. AFS-licensed platforms) — distinct from AUSTRAC's AML-specific role below.
Australia — AUSTRAC
What: Australia's AML/CTF regulator — digital currency exchange providers must register with AUSTRAC specifically for anti-money-laundering purposes, separate from ASIC's broader licensing/conduct role.
Naming specific exchanges as "licensed" goes stale fast and this session's tools can't query these interactive registers directly (they require search-by-entity-name, not a fetchable list) — so rather than guess which exchanges currently hold authorization, these are the four official lookup tools themselves. Search the exchange's exact legal entity name (which often differs from its brand name — e.g. Coinbase operates in the UK as CB Payments Ltd, Kraken as Payward Ltd) directly against the regulator, not a third-party summary site.
US — FinCEN MSB Registrant Search
What: Search whether an exchange is registered as a Money Services Business. FinCEN explicitly states registration is not an endorsement — verify the business independently as well.
UK — FCA Financial Services Register
What: Search by firm name or reference number and look for "Cryptoasset activities" under registered permissions. The FCA also separately maintains a public warning list of unauthorised firms.
EU — ESMA CASP Register
What: The EU-wide register of Crypto-Asset Service Providers authorised under MiCA Article 109, published by ESMA. An authorisation from any one member state's NCA passports across the whole EEA and appears in this register.
Australia — ASIC Professional Registers
What: Search for an Australian Financial Services (AFS) licence directly, for platforms whose activities fall under ASIC's licensing jurisdiction.
Look up any wallet address, transaction, or contract directly on-chain — official explorers only.
Etherscan
Covers: Ethereum mainnet.
Blockchair
Covers: Multi-chain — Bitcoin, Ethereum, Litecoin, and several others from one search.
Blockstream Explorer
Covers: Bitcoin and the Liquid Network.
Solscan
Covers: Solana.
Tronscan
Covers: TRON.
BscScan
Covers: BNB Smart Chain.
Tools that import exchange/wallet history and calculate gains, losses and income for tax filing. Coverage varies by country — check before assuming your jurisdiction is supported. See also our free Crypto Tax Records Checklist for what to keep track of year-round regardless of which tool you use.
Koinly
Country support: Markets itself broadly across the US, UK, Canada, Australia and 20+ other countries with locally-formatted tax reports — confirm your specific country's report format is supported before relying on it for filing.
CoinTracker
Country support: Strongest for US filing (IRS forms), with support for several other countries — confirm your specific country's report format is supported before relying on it for filing.
CoinLedger
Country support: US-focused (IRS forms) with reports for a number of other countries — confirm your specific country's report format is supported before relying on it for filing.
Recap
Country support: UK-focused (HMRC-aligned Capital Gains Tax reporting) — confirm coverage before relying on it if you're filing outside the UK.
These are B2B compliance and blockchain-analytics platforms, built for exchanges, financial institutions and compliance professionals conducting AML/transaction-risk screening — not consumer apps. If you're an individual trying to check whether a specific wallet address looks risky, most of these require an enterprise account or API access rather than a public lookup tool.
Chainalysis
What: Blockchain analytics and compliance platform used by exchanges, financial institutions and government agencies for AML/transaction screening.
TRM Labs
What: Blockchain intelligence platform for AML compliance, fraud investigation and sanctions screening, aimed at financial institutions and government agencies.
Elliptic
What: Crypto compliance and blockchain analytics platform for AML and sanctions risk, aimed at exchanges and financial institutions.
AMLBot
What: Wallet address and transaction risk-scoring API aimed at crypto businesses for AML compliance checks.
Crystal Blockchain
What: Blockchain analytics platform for AML compliance and crypto investigations, aimed at businesses and law enforcement.
Scorechain
What: Blockchain analytics and AML risk-scoring platform for crypto businesses and financial institutions.
Whether an exchange's reserve claims are independently verifiable varies significantly and changes over time — this reflects each exchange's own published methodology as of this writing, not an independent Kibbo audit. Verify an exchange's current claim directly on its own site before relying on it, and treat any "proof of reserves" claim as a point-in-time snapshot, not a continuous guarantee.
Kraken
What: One of the longest-running PoR programs in the industry (since 2014), publishing quarterly attestations with published methodology and third-party accounting-firm involvement. Its cryptographic-proof approach lets technically sophisticated users independently verify claims rather than relying purely on the audit firm's word.
Binance
What: Publishes monthly reserve-ratio attestations for major assets, with published PoR code available for public review. Independent commentators have noted these audits are point-in-time snapshots rather than continuous verification — worth keeping in mind when reading any single attestation.
Coinbase
What: Coinbase does not run a crypto-native "proof of reserves" program. As a publicly listed company, it instead discloses assets and liabilities through SEC-filed, Deloitte-audited financial statements under PCAOB standards — a different verification model, not an absence of one.
These firms audit smart contracts and protocols for security vulnerabilities — relevant primarily to developers and project teams deciding whether to trust a contract, not to individual consumers directly. If you're an individual, an audit report from one of these firms (published by the project itself) is a signal worth checking for, not a tool you'd use yourself.
OpenZeppelin
What: Smart contract security audits and widely-used open-source secure contract libraries.
CertiK
What: Blockchain security audits and ongoing on-chain monitoring for smart contracts and protocols.
Trail of Bits
What: Security research and audit firm covering smart contracts and broader software security, not exclusively crypto.
Hacken
What: Smart contract audits, penetration testing, and proof-of-reserves audit services for crypto projects and exchanges.
Quantstamp
What: Smart contract security audits for DeFi protocols, NFT projects, and Layer 1/2 blockchains.
US — FBI Internet Crime Complaint Center (IC3)
What: The FBI's official portal for reporting internet-facilitated crime, including crypto investment fraud and pig-butchering scams.
US — FTC ReportFraud
What: The FTC's consumer fraud reporting portal, feeding its Consumer Sentinel Network used across federal and state law enforcement.
UK — Action Fraud
What: The UK's national reporting centre for fraud and cybercrime, including crypto investment scams.
EU — Europol
What: EU law enforcement coordination — for reporting, use your own country's national police or cybercrime unit; Europol supports cross-border investigation rather than taking individual reports directly.
Australia — ReportCyber (ACSC)
What: Australia's cybercrime reporting portal, for crypto scams involving hacking, account compromise, or online fraud.
Australia — Scamwatch (ACCC)
What: Australia's consumer scam-reporting and awareness portal — for scams specifically, distinct from ASIC's regulatory/licensing role in Section 1.