Crypto exchange transparency: Consumer Reports finds no FDIC or SIPC warning at sign-up

Crypto held in an exchange-managed wallet has no Federal Deposit Insurance Corporation (FDIC) or Securities Investor Protection Corporation (SIPC) protection. In an evaluation published on Aug. 4, 2026, Consumer Reports found that none of the five major crypto exchanges it tested clearly disclosed this during onboarding. If an exchange goes bankrupt, customers can lose everything they hold there. Consumer Reports also found unclear fees, hidden spreads and gamified features that push people to trade more. The findings come from that one evaluation. The rules on insurance, tax reporting and reserve reports below come from the regulators and standard-setters that set them.

What Consumer Reports found (Aug. 4, 2026)

Consumer Reports describes the review as a multi-month evaluation of five major crypto exchanges. Its press release lists these findings:

• Missing protection disclosures: none of the five clearly disclosed at onboarding that the exchange lacks key financial protections. The release says exchange-held crypto has no FDIC or SIPC backing, so a bankruptcy could mean a total loss.
• Fees: transaction fees appear just before a purchase, but most platforms do not explain how the fees are calculated.
• Spreads: only one of the five exchanges showed its spread, which averaged about 1% during testing. The other four kept spreads hidden inside the transaction flow, so the full cost of a trade was not visible.
• Gamification: all five use rewards, sweepstakes, challenges and celebratory graphics to encourage frequent trading. The release says this can amplify losses and add short-term capital gains tax. It compares these features to those in sports gambling apps.
• Fraud warnings: at the point of a transaction, one exchange required several fraud acknowledgments, one gave no fraud warning, and three showed a single alert that users could skip.
• Ease of use: all five made buying and selling easy.

The release does not score the exchanges. It asks companies to give clear, accessible information about risks, costs and protections.

Why FDIC and SIPC protection does not apply

FDIC

The FDIC's fact sheet on deposit insurance and crypto companies (July 28, 2022) sets out three limits:

• The FDIC insures deposits only at insured banks and savings associations, and pays out only if an insured bank fails.
• It "does not insure assets issued by non-bank entities," such as crypto companies.
• Deposit insurance does not cover crypto assets, and it "does not protect against the default, insolvency, or bankruptcy of any non-bank entity," including crypto exchanges, custodians and wallet providers.

The FDIC's current consumer pages repeat that deposit insurance does not apply to crypto assets.

SIPC

SIPC protects cash and securities held at a failed SIPC-member brokerage firm. The limit is $500,000, which includes a $250,000 limit for cash. SIPC says it does not protect digital asset securities that are unregistered investment contracts. It also does not protect any digital or crypto asset that does not qualify as a "security," even when a SIPC member firm holds it.

In practice: an "FDIC" or "SIPC" badge on a platform's website may refer only to cash at a partner bank or to securities at a broker affiliate. The FDIC and SIPC pages above show which assets each scheme does and does not cover.

Tax transparency: the CARF and DAC8

Transparency also means what exchanges must report about their users to tax authorities. This affects users, not just platforms.

The OECD's Crypto-Asset Reporting Framework

The OECD, working with G20 countries, published the Crypto-Asset Reporting Framework (CARF) in June 2023. The OECD's step-by-step implementation guide was approved by the CARF Group on Oct. 4, 2024 and adopted by the Global Forum Plenary by written procedure on Nov. 9, 2024. Its key points:

• Who reports: a Reporting Crypto-Asset Service Provider (RCASP) is "any individual or Entity that, as a business, provides a service effectuating Exchange Transactions for or on behalf of customers, including by acting as a counterparty, or as an intermediary, to such Exchange Transactions, or by making available a trading platform."
• What users must provide: a self-certification with name, residence address, tax residence(s), taxpayer identification number(s) and date of birth. The provider checks it against its anti-money-laundering and KYC (know-your-customer) records.
• What gets reported: totals per crypto-asset type for crypto-to-fiat trades, crypto-to-crypto trades, transfers, and retail payments above USD 50,000. Transfers to external wallets not known to belong to a regulated provider are also reported. Providers must keep those wallet addresses for at least five years.
• Timing: the guide says around 60 jurisdictions had committed to start exchanges in 2027, or in 2028 where 2027 is hard to meet.
• Oversight gap: the guide notes that exchanges "may currently only be subject to limited or no regulatory oversight and reporting obligations."
• Limit of the guide: the OECD says RCASPs should not rely on it to show they comply. They must follow each jurisdiction's own rules.

The EU's DAC8

In the European Union, Council Directive (EU) 2023/2226 (DAC8) brings these rules into EU law. Member States had to apply it from Jan. 1, 2026. The European Commission says exchanges of data for 2026, the first reporting year, will take place by Sept. 30, 2027.

Proof of reserves is not an audit

Some platforms publish proof-of-reserves reports to show they hold customer assets. On March 8, 2023, the Public Company Accounting Oversight Board (PCAOB) Office of the Investor Advocate warned investors about these reports. The PCAOB said:

• They are not audits and do not provide meaningful assurance.
• They cover a single point in time.
• They may leave out the platform's liabilities, customers' rights to the assets, and whether assets have been borrowed.

The PCAOB urged extreme caution before relying on them to conclude that a platform has enough assets to cover what it owes customers.

A short checklist before you leave assets on any platform

• Protection: check exactly which assets any FDIC or SIPC claim covers. Under the rules above, crypto is not covered.
• Cost: look for the fee formula and the spread. Comparing the quoted price with a live market price shows the spread.
• Custody: read the terms on how customer assets are held, and whether they are kept separate from the company's own assets in a bankruptcy.
• Reserves: treat a proof-of-reserves report as a snapshot, not an audit.
• Tax: expect your tax residence and transaction totals to be reported where the CARF or DAC8 applies.

Limitations: the exchange findings rest on a single Consumer Reports press release, and its full report and methodology were not reviewed.