Crypto.com is a Singapore-based cryptocurrency company that runs a custodial exchange, a payments app, and a Visa card programme under a web of separately licensed legal entities.
It is not one regulated firm but a brand sitting on top of many, and that distinction decides what protection a user actually has.
The operator began life in June 2016 as Monaco in Hong Kong and adopted the Crypto.com name in 2018. The founders were Kris Marszalek, Gary Or, Rafael Melo, and Bobby Bao, and the group now reports more than 50 million customers across 90-plus countries.
It also trades its own token, CRO, on a separate chain called Cronos. None of that tells you whether your money is safe, which is why the regulatory map below matters more than the advertising spend.
Three product lines share the name but differ in who holds the keys. The Crypto.com App and the Crypto.com Exchange are centralised and custodial: the company stores customer assets. The Onchain product, by contrast, leaves private keys with the user, so the safety profile of the three is not the same.
Behind the interface sit Foris DAX entities, and the exact legal name changes with your country. A British resident deals with Foris DAX UK. A Singapore user deals with Foris DAX Asia. This structure is normal for global exchanges, but it carries a consequence many users miss: a licence held by one entity does not automatically extend to another, and a protection available in one jurisdiction may be entirely absent in yours.
The company says it holds more than 100 regulatory approvals worldwide. The ones a user can actually verify on a public register are the useful ones, and they split by region.
In 2025 the U.S. derivatives arm, Crypto.com Derivatives North America, received an amended DCO approval from the CFTC on 26 September 2025. The company filed for a national trust bank charter with the OCC on 24 October 2025, and the OCC granted preliminary conditional approval for Foris DAX National Trust Bank on 20 February 2026. That trust-bank status is not an ordinary FDIC-insured retail bank, and readers should not treat it as one.
This constant expansion of permissions is the backdrop, not a guarantee. A licence to clear derivatives in the United States says nothing about whether a spot wallet in another country is insured.
A crypto licence rarely means what a bank licence means. The FCA registration in the UK is anti-money-laundering oversight, not authorisation as an investment firm, and crypto balances are excluded from the Financial Services Compensation Scheme. If the UK entity failed, those balances would not be covered the way a bank deposit up to 85,000 pounds would be.
Customer crypto is held in segregated accounts at banking custodians, which helps if the company itself runs into financial trouble, but segregation is not insurance against the company's insolvency. Regulatory status also shifts without notice. The U.S. App was unavailable to New York residents as of 21 August 2026, a restriction that did not apply to most other states. Always recheck the specific product and state before assuming availability, because yesterday's green light can be today's block.
Crypto.com runs two pricing worlds, and confusing them is expensive. On the Exchange, spot maker and taker fees sit around 0.075 percent when paying with CRO, with the lowest volume tier near 0.10 percent maker and 0.16 percent taker. Those numbers fall further as 30-day volume rises, and staking CRO is the lever that lowers them.
The consumer App is a different story. Because the platform acts as a principal there, the spread it embeds can be far wider than the Exchange, and independent testing has found single trades costing around 6 percent on the App side. The lesson is blunt: route serious size through the Exchange interface, read the quoted price before confirming, and never assume the App price equals the Exchange price you read elsewhere.
Withdrawal costs are network fees plus whatever the chain charges, and Crypto.com generally does not add a large markup on top. Ethereum withdrawals cost more than Solana or Polygon ones, so the network you pick changes the bill. Confirm the live figure on the confirmation screen rather than from memory, and remember that a low trading fee can sit next to a high network fee on the wrong chain.
The company says 90 to 95 percent of customer crypto sits in cold storage, offline, and that client assets are kept in segregated accounts. Since 2022 it has published Proof-of-Reserves attestations, typically every six months, performed by firms such as Hacken, with Merkle-tree data that lets each account holder verify a balance independently rather than trusting a PDF.
A self-reported 250 million dollar insurance fund covers cold-wallet compromise and internal collusion.
It does not cover losses from phishing, SIM-swap, or account takeover, which remain the user's responsibility. Read that boundary carefully, because most real-world losses come through the account, not through the warehouse, and no insurance line fixes a password handed to a scammer.
Crypto.com has had genuine incidents, not just theoretical risk. On 17 January 2022, unauthorised withdrawals hit roughly 483 customer accounts and removed about 34 million dollars of Bitcoin and Ethereum at the time. The company paused withdrawals, reimbursed affected customers, and later rebuilt parts of its two-factor infrastructure.
A separate employee-account phishing and customer-data incident was reported in 2023 and drew wider attention in 2025. The company said only a small number of people had limited personal information exposed, that customer funds were not accessed, and it disputed claims of a concealed breach. On the regulatory side, the Monetary Authority of Singapore imposed a 30,000 Singapore dollar administrative penalty in January 2024 for transaction-reporting lapses with no customer losses, and the FCA issued a marketing-related consumer warning in November 2023 that was resolved while the firm stayed on the register.
The U.S. Securities and Exchange Commission matter ran from an August 2024 Wells notice, through a Crypto.com lawsuit against the SEC in October 2024 that the company dropped in December 2024, to a formal close on 27 March 2025 with no enforcement action. That outcome is a fact worth stating plainly: the investigation ended without charges, but a closed investigation is not a clean bill of health for every product the brand sells, and the resolution reflected a broad shift in U.S. crypto enforcement rather than a finding on the merits.
Verification is concrete, and it takes minutes. Pull up the public register for your jurisdiction and search the exact entity name, not the brand. In the UK, confirm the FCA cryptoasset registration and note the reference number 928240, then check that it is anti-money-laundering registration rather than investment-firm authorisation. In Australia, confirm the AUSTRAC Digital Currency Exchange registration. In Singapore, confirm the MAS Major Payment Institution listing for Foris DAX Asia, and in Hong Kong confirm the SFC Virtual Asset Trading Platform licence.
Watch for clones. Regulators have flagged fake sites such as crypto-com.ai and cryptocom.ai impersonating the brand, and the Central Bank of Ireland warned about a "Cryptocom" clone. Use the genuine domain and the official app store listing, and bookmark it rather than clicking an advertisement. Finally, test the deposit path with a small amount, enable authenticator-based two-factor authentication rather than SMS, and whitelist withdrawal addresses before moving size, because a locked account is cheaper than a drained one.
Product availability, fees, and licensing change faster than a static article can track, and this one was written from public sources current in 2026. Nothing here is investment, legal, or tax advice. Verify the live fee schedule, the entity on your jurisdiction's register, and the specific product you intend to use on the day you transact, because a licence in one country says nothing about your recourse in another.