A Top-10 Exchange Ranking Is Not Due Diligence. Ten Checks It Cannot Do For You

Start with the verdict. A published exchange ranking is a list of names to investigate, and it is not an assessment of safety. CoinGecko’s trust-score leaderboard orders ten venues. What follows is not a review and not a recommendation. It is a list of what that table cannot say, and where to check each item yourself.

I ran the query myself. On 2026-09-29 at 08:38 UTC I called CoinGecko’s public endpoint GET /api/v3/exchanges?per_page=10&page=1&order=trust_score_desc with no key, and it returned the ten rows below. I had run the identical query half an hour earlier, and the headline numbers had already moved.

A published ranking is a list of names, and a list of names is not a safety assessment

The shape of the table tells you what it is. This ordering is not volume. Binance traded 147,816 BTC in the twenty-four hours before that call and sits second; Coinbase traded 30,751 and sits first; KuCoin traded 20,913 and sits tenth, while Gate traded 20,134 and sits fifth.

The same query, run roughly thirty minutes earlier, returned 147,938 BTC for Binance and 30,774 for Coinbase; at 08:38 those had become 147,816 and 30,751. The number moves while you read it, which is reason enough to refuse to file it under facts. Six of the ten entries carry a trust score of 10 and four carry 9, and inside each band the order is the vendor’s own arrangement, resting on inputs the table does not print. A rank is an opinion formatted as a number.

The table is a starting list. It gives you ten names and a link to each; it does not give you a solvency opinion, and it never claimed to.

The 24-field record behind the number two entry

24 top-level fields. That is the entire per-exchange record the vendor carries for the number two entry, the venue the table shows trading 147,816 BTC. The full description for that exchange is one sentence, and we will return to it at the end.

Two of the fields are named public_notice and alert_notice, so the schema has slots for warnings. What no field carries, for any of the ten, is a licence number, a regulator’s name, a proof-of-reserves link, an attestation date, a fee schedule, or withdrawal limits. Those are the things a person needs before sending money, and none of them fits the columns the vendor chose. The absence is a description of the file, not an accusation: it is a catalogue built from fields that describe a website, not fields that describe a counterparty.

What is the score actually made of?

Every number has a recipe, and the recipe decides what the number can prove. The vendor publishes its own. The headline method line, quoted exactly, reads:

Trust Score 2 (Sep 2019) – ranks exchanges based on web traffic, liquidity, scale & API coverage.

CoinGecko, Methodology

The same page lists the current per-trading-pair inputs: web traffic statistics for an exchange, measured by SimilarWeb; orderbook spread and depth within two percent of the mid price; overall trading volume; trade frequency; and outlier checks. The first declared input is third-party website traffic.

Read that list again, because it settles what the score measures. Traffic counts how many people visit a website. It does not count how many of them got their coins back when they asked. A measure built partly on popularity ranks popular venues highly, which is what a catalogue is for, and says nothing about whether a popular venue can pay everyone who arrives on the same afternoon. The method is at CoinGecko’s own methodology page; read the inputs rather than take my summary.

Set the two columns side by side and the blanks become the point:

Six blanks, and each one is a task.

A balance on an exchange is a claim on that exchange, not a coin you hold

Go and look at your account. What you call your bitcoin is a row in a database, and the row is a promise. If you can move it to an address whose key you alone control, today, without a support ticket, you are holding something. If you cannot, you hold a claim, and a claim is only as good as the party who owes it.

The vocabulary matters, so use it precisely. If you have not read what a bitcoin actually is, the difference between a coin and a claim stays abstract, and it is not abstract. A coin is an asset you possess; a balance is a debt someone owes you. What happens when the key is not in your hand is not a philosophy question; it is a support-ticket latency question, and you can measure it before you need it.

A proof of reserves does not close this gap. It shows assets existed at one moment; it does not show that no other claims sit against those assets. The check is narrow: the attestation date, who signed it, and whether a matching statement of liabilities exists alongside it. A number without the other side of the ledger is half a statement.

Licence, contracting entity, and jurisdiction

The table compresses three facts into one word, and the word is a country. The country field is a registered base: not the licence a venue operates under, not the legal entity your account contracts with, not the place a dispute is heard. Those are three separate lookups, and the table performs none of them.

The licence is specific or it is nothing. Ask which activity it covers, under which entity, and whether it is current on the day you check; the answer lives in a regulator’s public register, searched under the legal entity name, not in the badges a footer displays. Then read the terms for the named contracting entity, the governing law, and any arbitration clause that moves your dispute into a foreign forum.

Notice what the dataset does offer, so you can judge it fairly. It lists a registered country, and for several of these names that country is the Seychelles, the Cayman Islands, or Panama. Those run light-touch regimes by design; that is a description, not a verdict. The country column answers a question about paperwork and leaves open the one you care about: who owes you, and where you can pursue them. A registry, a licence register and a set of terms are three different documents. The table gives you one word.

Run these ten checks at the primary source

Here are the ten things the table leaves blank, each paired with the place you verify it, running from easiest to skip to most expensive to skip.

1. The keys. A custodial balance is a claim on the exchange, not a coin you hold. Verify: whether your account lets you withdraw to an address you control, today, without a support ticket.
2. The licence, for a specific activity, and whether it is still current. Verify: the regulator’s own public register, searched under the legal entity name, not the badges in the site footer.
3. The legal entity you are actually contracting with, and where disputes are heard. Verify: the terms of service, read for the named entity, the governing law, and any arbitration clause. A ranking’s country field is a registered base, not your counterparty.
4. Whether it may lawfully serve you where you live. Verify: the residency restrictions section and your own regulator. In some countries nothing is licensed to serve you, which changes the question rather than answering it.
5. The all-in cost, not the advertised fee. Verify: the fee schedule page, and the price you are actually offered compared with a public index at the same second. A zero-fee instant buy tends to pay for itself inside the spread.
6. Withdrawal limits, delays, and freezes. Verify: the limits table, plus the security policy stating how long withdrawals are held after a password change or a login from a new device.
7. What a proof of reserves proves and what it does not. It shows assets existed at a moment; it does not show that no other claims exist against those assets. Verify: the attestation date, who signed it, and whether a matching statement of liabilities exists.
8. What happens when you are right and they are wrong. Verify: the complaints route, whether any regulator or ombudsman has jurisdiction over that specific legal entity, and whether the terms push you into arbitration in a foreign forum.
9. The operating record. Verify: how the venue behaved during past volatility, including outages, trading halts, incidents, and how refunds were handled. A venue founded in 2022 has a shorter record than one founded in 2011.
10. The counterparty you cannot see. Pay by bank transfer or in a stablecoin and you also take the risk of that rail and that issuer. Verify: the deposit and withdrawal method terms, and who issues the asset you are using.

Ten checks, and the point is not to pass all of them. The point is to know which blanks are still open when you decide, so that no one else fills them in.

Which venue may lawfully serve you where you live?

This is the question the table is silent on and the one no writer can answer for you. Whether a venue may lawfully take your money depends on where you live, not on a vendor’s list. Your regulator publishes both a register of authorised firms and a warning list of unauthorised ones; in the United Kingdom that is the Financial Conduct Authority and its register and warning list. Search it before the venue’s marketing page, not after.

For some readers the honest answer is that nothing on this list is licensed to serve them at all, which replaces the question rather than answering it. I cannot tell you which venues may serve you, because I do not know your regulator, and neither does a global ranking built to be indifferent to your border. Ask the body that is not.

The five-step order, and the edge of what this list can prove

Take the catalogue at face value. Its whole account of the number two entry is one sentence. Quoted in full, the description the dataset carries for that venue reads:

One of the world’s largest cryptocurrency exchanges by trading volume, offering a wide range of services including spot, futures, and staking options.

The entire description carried for the number two entry in that dataset

That is a brochure line, and it is the catalogue’s complete account of a company you might hand your savings to. I am not mocking it; a description field was never a due-diligence report. But it shows the limit of the thing in your hands: the list is a directory of names, and the weight of the decision does not live in the directory.

So sequence the work. Run the checks in this order, because the first decides whether the others matter:

1. Licence and contracting entity first, because if those are wrong nothing else matters.
2. Then the terms, for the entity name, the governing law and the arbitration clause.
3. Then the all-in cost against a public price index at the same moment.
4. Then withdrawal limits and the freeze policy.
5. Only then the volume number, read as evidence of liquidity and never as evidence of safety.

The ranking is legitimate. As a starting list of names to investigate, it is accurate and useful, and that is the whole of its claim. I have not audited any of these companies and I will not recommend one; many of the ten are registered in light-touch jurisdictions, and light-touch is a description of the paperwork a regulator asks for, not a verdict.

Where my knowledge ends is here. I have a list of names and a record of what that list is made of; I have no data at all about who among these companies can pay every customer at once, and neither does the table. So the question was never which venue sits at the top. It was which blanks you are willing to leave open, and who, other than yourself, you are letting fill them.