Opening a crypto account

Account types

The three differ in what you own and what you can lose.

Spot exchange account

A spot exchange account is for buying crypto assets, which appear as a balance on the platform. That balance is not the same as controlling a wallet's private keys, which authorise transactions. Wallet software can be held by the customer or by the platform, and losing a private key can mean losing the crypto. Platforms can also fail or be hacked.

CFD broker account

A CFD account lets you hold derivative positions: you enter a contract on the price change of an underlying crypto asset without owning the coin. The positions within the account are derivative contracts; the account itself is the vehicle for holding them. Leverage means full exposure can exceed the margin you commit. Contract terms vary between issuers, so read the product disclosure statement (PDS). Australian CFD issuers must hold an AFS licence, and retail and wholesale classifications carry different protections. For background, see how crypto CFDs work.

Prop firm evaluation account

Prop firm evaluations are typically paid programmes: you pay a fee to attempt a firm's trading rules, and any reward depends on the conditions of the specific product. Where a fee applies, the challenge or evaluation fee is a programme charge, not a deposit into a personal investment account, so check refund, rule and reward conditions in the exact programme terms before paying. The balance traded may be simulated rather than capital you own: FTMO, for example, describes all of its accounts as demo accounts with fictitious capital. Models differ between firms; see the guide to crypto prop firms.

Check the provider and the legal entity

A registered brand, particularly one operating from overseas, does not by itself identify the contracting entity. Check the following before applying:

• Whether the product is offered to Australian residents; eligibility must never be presumed.
• The exact legal entity named in the terms and account agreement.
• Whether the specific product is available to you, not just the provider.
• For CFDs, whether you would be classified as retail or wholesale.
• How withdrawals work, before any money or programme fee is paid.

AUSTRAC, the anti-money-laundering and counter-terrorism-financing regulator, publishes an overview of virtual asset service providers linking to its public register. ASIC's professional registers are a separate check: search an entity name, licence, ABN or ACN and inspect which services are licensed. Neither registration nor licensing guarantees safety or solvency, and neither substitutes for the other.

Identity verification (KYC)

Identity verification, usually called KYC (know your customer), is how a provider confirms who you are. Customer due diligence establishes identity with reliable evidence, such as a full name, date of birth, residential address and government photo ID, and the provider may compare you to your photograph online or in person. These are examples, not a universal standard; follow your provider's instructions.

Upload documents only through the provider's official process, reached independently via its verified site or app. If the usual documentation is unavailable, ask official support what alternative evidence it accepts; alternative evidence is sometimes possible. Do not bypass requirements, and treat anyone offering to complete them for you as a warning sign.

Secure the login before funding

Lock the account down before any money touches it. Start with authenticity: fake exchanges and phishing pages exist, and fake apps can appear on legitimate app platforms, so independently establish the provider's official domain, type the address yourself or use a bookmark you created, and verify an app's publisher through the provider's official instructions rather than unsolicited links. Kraken's security guidance, for example, recommends bookmarking the verified sign-in site and notes that its support team will not ask customers to install remote-access software.

If the account uses a password or passphrase, make it long and unique to that account. Where the provider supports multi-factor authentication or passkeys, enable them; passkeys also protect against password phishing, though support varies. Keep account recovery options where only you can access them.

Never send passwords, one-time codes or a wallet recovery phrase to anyone who contacts you, and never grant remote access to your device on request. Security settings reduce specific risks such as phishing and unauthorised logins; they do not make crypto safe or protect against platform failure.

Funding checks: cash and crypto

For cash, follow the deposit instructions displayed in your own account; methods, currencies and fees change. Confirm the sending bank account is in your name and that any required reference is included, since mismatched details can delay or return deposits. Kraken's deposit checklist, for example, requires the sender name to match the account holder and a reference when its instructions ask for one; other providers set their own requirements.

For crypto, confirm the following on the provider's current deposit screen before sending:

• the exact asset and the network it will be sent on;
• the receiving address, plus any tag or memo the asset requires alongside it;
• the minimum deposit, and whether it applies after network fees.

Kraken's deposit guidance notes that credits depend on the required network confirmations rather than arriving instantly.

Kraken applies its deposit minimum after network fees, and below-minimum deposits can fail and be lost; your own deposit screen is authoritative for your method. A test transfer is only worth considering where both sides support it and the amount clears the minimum after all charges, not an arbitrary tiny value. Wait for the deposit to actually credit before sending more.

A credited test does not prove a platform legitimate or that withdrawals will work later; fake platforms can initially display gains before locking people out. Funding and network charges are also distinct from trading fees, compared in the site's crypto exchange fee comparison.

Custody: who holds the keys

Custody asks who holds the private keys that authorise transactions. With an exchange account, coins sit as a platform balance behind your login, which is different from controlling wallet keys yourself. A seed-phrase wallet is one form of self-custody: it is controlled by a recovery phrase, and restoring it is your responsibility, since a provider cannot recover a lost recovery phrase or its backup password for such a wallet, as Kraken's FAQ describes for its own seed-phrase wallet.

Self-custody is a choice with costs, not a mandatory step; there is no universal recommendation to move funds into a wallet. Nor does it apply to every product: a CFD account involves no coins, so a non-custodial wallet is not necessary, and a simulated prop balance is not coins at all. Onchain transactions are generally not reversible, so a wrong address or an exposed phrase can mean the crypto is gone.

Frequently asked questions

Can I open an account without depositing?

That depends on the exact registration and funding terms; check them rather than presuming. Creating a login is not the same as account approval, and some features may stay unavailable until verification or funding steps are complete.

Is identity verification a safety guarantee?

No. Verification confirms your identity to the provider; it is not a verdict on the platform's solvency, security or custody practices. Registration and licence checks are separate from KYC. Treat it as one step, not evidence a provider is safe.

How long does setup take?

There is no universal duration. Verification depends on the provider's checks and the documentation it requests; funding depends on the method, since cash transfers and onchain deposits settle on different timescales. Check current official instructions for your chosen method.