Short answer: To buy crypto on an exchange, verify the platform, secure the account, compare the full cost, fund it with a supported payment method, choose the correct spot market, review the order and test any withdrawal with a small amount. Buying is simple; verifying the exchange, asset and network is the important part.
| Step | Action | Critical check |
|---|---|---|
| 1 | Choose an exchange | Legal entity, regulator register, custody and fees |
| 2 | Create and secure the account | Official domain, unique password, app-based 2FA |
| 3 | Complete verification | Required documents and privacy policy |
| 4 | Fund the account | Deposit fee, limits and settlement time |
| 5 | Select the spot pair | Correct asset, quote currency and contract address |
| 6 | Place the order | Preview price, spread, fee and amount received |
| 7 | Store and record | Cost basis, withdrawal network and test transfer |
1. Verify the Exchange Before Creating an Account
Do not choose an exchange only because it appears in an advertisement or offers a high yield. Confirm the exact legal entity serving your country, search the financial regulator’s public register and read the current fee and custody disclosures.
- Is the domain official and correctly spelled?
- Which company holds customer assets?
- Are customer assets segregated?
- What are the deposit, trading, spread and withdrawal costs?
- Does the exchange publish proof or disclosures you can verify independently?
- Can support freeze withdrawals, and how does recovery work?
Use the Forvest Trust Score framework to organize platform evidence.
2. Secure the Account Before Funding
Use a password that is unique to the exchange, enable app-based or hardware-key two-factor authentication and save recovery codes offline. CISA’s MFA guidance recommends using the strongest available method and identifies security keys as the most phishing-resistant option. Turn on withdrawal allowlists and anti-phishing codes if available. Never share a password, one-time code, seed phrase or remote-access session with “support.”
Bookmark the verified login page and avoid signing in from links in email, messages or search ads.
3. Complete Identity Verification Carefully
Centralized exchanges may require identity and source-of-funds checks. Upload documents only inside the authenticated official site or app. Read what data is collected, how long it is retained and how account closure or data requests work.
4. Compare Funding Methods
| Method | Possible advantage | Cost/risk to check |
|---|---|---|
| Bank transfer | Often lower direct cost | Settlement time, bank policy, deposit fee |
| Debit/credit card | Fast | Higher fee, cash-advance treatment, chargeback rules |
| Third-party payment service | Convenient in some regions | Extra intermediary and conversion fee |
| Crypto deposit | No fiat transfer | Correct chain, memo/tag and network fee |
Start with a small amount. Confirm that the account is credited correctly before sending more.
5. Select the Correct Asset and Spot Market
Search by full asset name and ticker, then verify the network and contract address when tokens share a name. Choose the spot market unless you deliberately understand margin, futures and liquidation risk. A pair such as BTC/USD means the asset is priced in the quote currency shown after the slash.
Research the asset separately with the project Trust Score checklist. Exchange availability is not evidence that a token is suitable or safe.
6. Choose an Order Type
- Market order: aims to execute immediately at available prices. Final price can differ in a thin market.
- Limit order: sets the worst price you are willing to accept. It may fill partially or not at all.
- Instant buy/convert: is simple but may include a wider spread or separate service fee.
Before confirming, review the total amount paid, quantity received, explicit fee and implied spread. Do not assume a “zero commission” label means zero cost.
7. Record the Transaction
Save the date, asset, amount, price, fee, payment method and transaction ID. These records support performance calculation, cost basis and tax reporting. Use the crypto profit calculation guide for multiple buys and fees.
Should You Keep Crypto on the Exchange?
Exchange custody is convenient but creates counterparty and account-access risk; IOSCO’s analysis of crypto-asset trading platforms highlights operational failure, key loss, asset commingling and record-keeping risks. Self-custody gives you key control but makes you responsible for seed security, address verification and recovery. The right choice depends on amount, time horizon and technical ability.
If withdrawing, verify the receiving wallet supports the same asset and network. Copy the address, check the first and last characters, send a small test and wait for confirmation before transferring the rest. Read the crypto wallet guide first.
Beginner Safety Checklist
- Official exchange domain and legal entity verified
- App-based 2FA and recovery codes configured
- All-in cost previewed
- Correct spot pair selected
- No leverage or borrowed funds
- Transaction record saved
- Withdrawal chain and address tested
Common Mistakes
- Following a sponsored “best exchange” list without checking eligibility
- Buying a token with the right ticker but wrong contract
- Using market orders in a thin market
- Sending funds on an incompatible network
- Confusing platform yield with guaranteed return
- Leaving the entire balance under one account and one recovery method
For a broader start-to-finish plan, see how to invest in cryptocurrency and the crypto risk guide.
Related reading: For the next step, continue with DEX custody, slippage and approval risks.
