To start trading crypto, you open an account with a licensed or registered crypto-asset service provider, pass its identity checks, add funds, and place a spot order to buy a crypto asset. Placing the order itself takes a few minutes. The identity check usually takes longer, and the provider controls how long it lasts. What makes the difference later is everything you understand before that first order: which order type you used, who holds your coins, and what reports reach the tax authorities.
Step 1: Check that the provider is authorised where you live
Under the Financial Action Task Force's Recommendation 15, countries are expected to make virtual asset service providers (VASPs) licensed or registered. Those providers must also apply the same anti-money-laundering measures as banks: customer due diligence, record-keeping, suspicious transaction reporting and sanctions screening. Rules on paper and rules enforced are not the same thing. In FATF's 2025 targeted update, only 46 of 138 assessed jurisdictions (33%) satisfactorily required VASPs to be licensed or registered.
In the European Union, the newest change took effect this year. The MiCA transitional period ended on 1 July 2026. On 17 April 2026, ESMA warned that "not all crypto-asset service providers operating after 1 July will be authorised under MiCA". It also said MiCA protections cover only the specific EU-authorised entity, not other companies in the same group or non-EU entities trading under the same brand. ESMA's advice is to check the provider in its MiCA register before investing or transferring funds, and to read the contract to see which legal entity is actually providing the service.
Step 2: Pass identity verification (KYC)
Because licensed providers have customer due diligence duties, you will be asked for an identity document and personal details before you can trade or withdraw. The provider sets how long verification takes, so complete it before you intend to trade.
Step 3: Understand what gets reported about you
Two reporting regimes now shape how visible your trading is to tax authorities.
- OECD Crypto-Asset Reporting Framework (CARF). On the OECD Global Forum's commitments list, 46 jurisdictions plan to start automatic exchanges of crypto-asset information in 2027, 27 in 2028 and four in 2029. The 2029 group is Argentina, Azerbaijan, Mexico and the United States. Argentina's September 2026 commitment brought the total to 77. Jurisdictions that exchange in 2027 report on 2026 activity, so data collection there began on 1 January 2026.
- United States, Form 1099-DA. According to the IRS instructions (last updated 30 April 2026), brokers must file Form 1099-DA for digital asset sales they carry out for customers. They must also report cost basis for "covered securities": digital assets acquired after 2025 and held in a custodial account until they are sold.
Step 4: Fund the account and pick a trading pair
Providers usually accept bank transfers, cards or crypto deposits, and each method has its own fees and processing times. Trades are quoted as pairs. In BTC/USDT, BTC is the base asset you buy or sell and USDT is the quote asset you pay or receive.
Which order type matches your priority?
Answer two questions about what matters most on your order to see which order type does that, and what it can cost you.
What matters most to you on this order?
- That it fills straight away → Market order
- That it fills only at my price or better → Limit order
- That it acts only once the price reaches a trigger level → next question
Once the stop price is reached, what matters most?
- That it fills as soon as possible → Stop order
- That it never fills beyond a price I set → Stop-limit order
It fills straight away at the best available price. The catch, in FINRA's words: "You might not get the price you saw or were originally quoted, especially in fast-moving markets."
It fills only at your price or better: a buy at or below it, a sell at or above it. The catch, in FINRA's words: "There's a chance your order doesn't get executed at all."
It becomes a market order once the stop price is reached and fills as soon as possible after that. The fill price can differ from your stop, and in a sharp move it can be well below the stop level, so it caps losses only approximately.
Once the stop is triggered, it becomes a limit order at your limit price. The catch: it may never fill if the price moves past your limit.
This only sorts the four order types FINRA describes by what each one does. It does not recommend an order type, and it leaves out fees, leverage and how a particular provider's order book behaves.
Step 5: Choose the order type
FINRA's investor guide on order types explains the trade-offs. They apply to crypto order books in the same way:
| Order type | What it does | The catch |
|---|---|---|
| Market order | Fills straight away at the best available price | "You might not get the price you saw or were originally quoted, especially in fast-moving markets" |
| Limit order | Fills only at your price or better (a buy at or below, a sell at or above) | "There's a chance your order doesn't get executed at all" |
| Stop order | Becomes a market order once the stop price is reached | It fills as soon as possible after the trigger, so the price can differ from your stop |
| Stop-limit order | Becomes a limit order at your limit price once the stop is triggered | It may never fill if the price moves past your limit |
A stop order caps losses only approximately. Once triggered, it sells at whatever price the market offers. In a sharp move that can be well below the stop level.
Step 6: Decide who holds your coins
The SEC's investor bulletin "Crypto Asset Custody Basics for Retail Investors" (December 2025) describes custody as how and where you store and access your crypto assets. Wallets hold the private keys that authorise transactions, not the assets themselves. You can choose between two models:
- Third-party custody. The platform manages the keys. You rely on its security and solvency. ESMA's MiCA statement names moving assets to self-custody as one option when a provider is not authorised.
- Self-custody. You manage the keys yourself, in a hot wallet (connected to the internet) or a cold wallet (offline). If you lose the keys, nobody can restore access.
The Canadian Anti-Fraud Centre's bulletin of 10 August 2026 explains that a 12- or 24-word recovery phrase "works like a master key". It states that "a recovery phrase should never be shared", and that legitimate organisations will not ask for it by email, text, social media, online form or letter. The bulletin also warns against storing the phrase in email, cloud accounts, online documents or photos.
The risks the regulators name
- Volatility. The US Commodity Futures Trading Commission (CFTC) says virtual currencies "are more volatile than traditional fiat currencies". It also lists flash crashes as a risk.
- Leverage. In the same CFTC advisory, leveraged accounts "can amplify the risks", and traders "may lose more than their initial investments". Spot buying with your own funds limits the loss to the amount you put in. Leveraged products do not.
- Platform and cyber risk. The CFTC warns that cash-market platforms "may lack critical system safeguards, including customer protections". It adds that virtual currencies are commonly targeted by hackers and fraudsters, including through phishing.
- The record of retail outcomes. A Bank for International Settlements study (BIS Bulletin No. 69, 20 February 2023) used crypto app data from August 2015 to December 2022. It found that "a majority of crypto app users in nearly all economies made losses on their bitcoin holdings". After the Terra/Luna collapse and the FTX bankruptcy, it found large and sophisticated investors selling while smaller retail investors were buying.
Frequently asked questions
Can I really start in 15 minutes?
Only once your identity check is done. Choosing a pair and placing an order takes minutes. Opening the account and passing verification depend on the provider.
Do my trades get reported for tax?
More and more, yes. Jurisdictions on the OECD's 2027 list collect data on 2026 activity. In the United States, brokers report sales on Form 1099-DA, and for assets acquired after 2025 and held in custody, they also report cost basis.
What protects me if a provider fails?
In the EU, MiCA protections apply only to the authorised entity you contract with. Elsewhere, the protection depends on local law. Keeping assets with a provider means you depend on that provider's safeguards and solvency.
Limitations: rules change by jurisdiction and over time, so check your local regulator's register and your tax authority's current guidance.
