How to buy crypto safely: a step-by-step guide

Key points

Safety starts with the amount: only money you could lose entirely, with your safety net already in place.
EU firms need MiCA authorisation; check the firm's legal name in ESMA's interim register.
In the Netherlands, also check the AFM register; in the UK, the FCA's Financial Services Register.
Two-factor authentication and a unique password stop most account takeovers.
Most crypto losses to fraud start with contact out of the blue and a promise that sounds too good.

Before you start: what "safely" can and can't mean

Learning how to buy crypto safely protects you from avoidable losses: fake websites, unauthorised firms, hacked accounts and scams. It cannot protect you from the price. Crypto prices can fall by half or more, and the EU's financial supervisors warn of "the very real possibility of losing all their invested money". If you are new to the topic, our plain guide to what Bitcoin is is a good place to start.

We don't name a "best" exchange, and this page has no affiliate links. The steps below work for any provider you are considering.

Step 1: Decide an amount you can afford to lose entirely

Do this first, before you open any app, so the decision isn't made while prices are on the screen.

A simple test: if the whole amount went to zero tomorrow, would your rent, bills, debt payments and emergency fund be untouched? If not, the amount is too big. Many people only consider crypto once they have an emergency fund and no expensive debt.

Worked example

Illustration: €50 a month for a year, then a 70% fall

Monthly amount€50

Months× 12

Total put in€600

Value after a 70% fall€180

Loss on paper−€420

Worst case: the asset goes to zero−€600

A made-up example, not a forecast. Fees are not included. Ask yourself whether you could live with the last line.

Step 2: Check the provider is authorised

This is the single most useful check you can make.

In the EU: MiCA and ESMA's interim register

Since December 2024, the EU's Markets in Crypto-Assets Regulation (MiCA) requires firms that buy, sell or hold crypto for customers to be authorised as a crypto-asset service provider (CASP). Transition periods that let some firms keep operating under older national rules ended on 1 July 2026 at the latest.

ESMA, the EU's markets regulator, publishes an interim MiCA register. It is not a search box but a set of downloadable spreadsheet files. Here is how to use it:

Go to ESMA's MiCA page (esma.europa.eu, under Digital Finance and Innovation) and find the interim MiCA register section.
Download the file of authorised CASPs (named CASPS.csv) and open it in a spreadsheet app.
Search for the firm's legal company name, which is often different from the app's brand name. You can usually find the legal name in the app's terms or website footer.
Check the home country, the national authority that authorised it and the services it is authorised for.
Look for a withdrawal date. Withdrawn authorisations stay in the file, with the date the withdrawal took effect.
Also open the file of non-compliant entities (NCASP.csv). If the firm is in there, stay away.

ESMA updates the files weekly, so a very recent change may not show yet. When in doubt, check the national regulator's register too. ESMA's page said it was last updated on 5 November 2026 when we checked.

In the Netherlands: the AFM register

The AFM (the Dutch Authority for the Financial Markets) publishes a register of crypto-asset service providers on its website as a downloadable spreadsheet. A firm authorised in another EU country can also be allowed to serve Dutch customers. If a company isn't listed, the AFM advises you to "be extra cautious and carefully consider" whether to do business with it.

In the UK: the FCA register

UK crypto firms must currently be registered with the FCA under the money laundering rules. Search the firm's name or firm reference number on the FCA's Financial Services Register, check that the details match the website you are using, and look it up on the FCA Warning List of firms running scams or operating without permission. A new UK regime for crypto firms is expected to come into force on 25 October 2027. Registration is not an endorsement, and it doesn't mean you can use the FSCS or the Financial Ombudsman if things go wrong.

Step 3: Secure your account

Most account takeovers rely on reused passwords or a hacked email account.

Unique password. Use a long password you use nowhere else. A password manager makes this easy.
Two-factor authentication (2FA). This asks for a second code when you log in. An authenticator app or a physical security key is generally safer than text-message codes, which can be intercepted if someone takes over your phone number.
Secure your email. Whoever controls your email can often reset your crypto password. Give it its own unique password and 2FA.
Turn on withdrawal protections if offered, such as an allow-list of addresses you can send to.
Type the address yourself. Bookmark the real website or install the app from the official store. Fake sites and fake apps are common.

Step 4: Learn the common scams

The FCA describes the patterns it sees again and again:

Fake ads, often on social media and using celebrity images, leading to professional-looking sites that "fake prices and investment returns". Once you have paid in, the account can be closed and your money kept.
Relationship scams, where someone builds a friendship or romance online before introducing an "investment".
Recovery scams, where, after a loss, someone offers to get your money back for an upfront fee. These are often the same fraudsters.
Clone firms, which copy the name and details of a real authorised firm.

The warning signs are the same every time: contact out of the blue, pressure to act quickly and returns that sound unrealistic. EU supervisors add misleading promotion by influencers to the list.

Step 5: Decide where to keep your crypto

You have two broad choices:

Leave it with the provider (custodial). Simple, and you can recover access through the firm if you forget your password. But you depend on the firm staying solvent, honest and secure.
Move it to a wallet you control (self-custody). Nobody else can freeze or lose your coins, but you are fully responsible. If you lose your recovery phrase, nobody can help you.

For larger amounts, some people use a hardware wallet. Our guide to hardware wallets covers the pros, the cons and how to set one up safely.

Step 6: Keep records for tax

Crypto tax rules differ a lot between countries. Some tax gains when you sell or swap one coin for another; others tax the value of what you hold. Keep a simple record of every purchase, sale, swap and transfer: the date, the amount, the price in euros and the fees. Most providers let you export your history, and you can check your national tax authority's guidance.

Common mistakes

Buying because prices are rising fast. Fear of missing out is exactly what scams exploit.
Using a firm you found through an ad or a message. Find the provider yourself and check the register first.
Putting in money you'll need soon. Crypto can be down a lot at the moment you need to sell.
Keeping the recovery phrase as a photo on your phone or in cloud storage.

Crypto is speculative. If you want to build long-term wealth, start with the basics of investing first.

Investing for beginners

Questions people ask

Which crypto exchange is the safest?

We don't name a best exchange. What you can check is whether a firm is authorised where you live: in the EU, under MiCA (listed in ESMA's interim register and your national regulator's register); in the UK, on the FCA's Financial Services Register. Authorisation reduces some risks but does not protect you from price falls.

Is my crypto protected if the exchange goes bust?

Not in the way bank deposits are. Crypto is not covered by deposit guarantee schemes, and in the UK the FCA says you generally won't be protected by the FSCS. Don't count on compensation if a provider fails.

What if a firm isn't in the register?

Don't use it. The AFM advises being extra cautious with any company that is not in its register, and the FCA says that if you can't find a firm, you should avoid it.

Do I pay tax on crypto?

Often, yes, but the rules depend on your country. Some countries tax gains when you sell or swap, others tax the value you hold. Keep a record of every purchase, sale and transfer, and check your national tax authority's guidance.

Sources

Written by Fakhri. Published 6 November 2026, last reviewed 6 November 2026. We update this page when the numbers change. Read our editorial policy.