Where to Complain About a Crypto Exchange and What Each Regulator Can Do

The short version

• Complain to the exchange first and get its final answer in writing. Its own policy sets the clock: Crypto.com’s European entity acknowledges within two working days and responds within fifteen.
• For a scam, report to the FBI’s Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC). They take the report for intelligence and enforcement. Neither recovers your money or decides your case.
• For a problem with the firm itself, say a frozen account or a blocked withdrawal, use the Consumer Financial Protection Bureau (CFPB), which sends your complaint to the company, which usually responds within about fifteen days, or your state regulator such as California’s DFPI or New York’s Department of Financial Services (NYDFS).
• Which federal body depends on the asset: a security-type token points to the Securities and Exchange Commission (SEC), a commodity or derivative to the Commodity Futures Trading Commission (CFTC), a payment or transfer to the CFPB.
• In the EU, the Markets in Crypto-Assets Regulation (MiCA) Article 71 gives you a free complaint right and makes the provider respond. In the UK, crypto is largely unregulated as of 30 October 2026, so the Financial Ombudsman cannot yet consider a complaint about an exchange itself.
• An on-chain transfer, a transfer on the blockchain itself, cannot be reversed, so the money comes back only if the recipient chooses to refund it. Be wary of recovery services that charge an up-front fee.^{2,3,4,6,9,10,12,14,15,16,21}

This guide maps the routes, country by country. The arbitration clause buried in your user agreement, and when you can still sue, is covered in crypto exchange arbitration and crypto exchange arbitration clauses. Commercial and investor disputes sit in crypto arbitration, and code-level disputes in smart contract dispute resolution. For how ombudsman and online schemes work more generally, see financial ombudsman schemes.

Where do I complain about a crypto exchange or a crypto scam?

Start with the exchange’s own complaints process and get its final response in writing. If that fails, escalate to the regulator that fits your problem, and to an ombudsman (an independent body that can decide a complaint and order redress) only where one covers crypto. Most places still have none.²¹

If a crypto exchange has frozen your account, will not let you withdraw, or has stopped answering support, treat it as a complaint about the firm, not a scam. Put it through the exchange’s own process first, then take it to the CFPB or your state regulator, such as California’s DFPI or NYDFS.^4,10,12

Whether the exchange is regulated decides what is open to you. A regulated firm owes you a complaints process and, in a few places, an ombudsman. An unregulated one owes you neither, which is why most crypto complaints still have no ombudsman.^14,15,16

The internal ladder is the required first step and usually the fastest. Send a written complaint through the channel the exchange names, keep the reference, and hold it to its own deadline. Crypto.com’s policy is a worked example. Its European entity, Foris DAX MT Limited, acknowledges a complaint within two working days and gives a final response “by no later than fifteen (15) working days” from submission, after which a client still unhappy may escalate to Malta’s Office of the Arbiter for Financial Services. That policy, shown as last updated on 20 November 2025, binds the European entity only, not Crypto.com worldwide. Internal complaints and early resolution are covered in AI in dispute avoidance.²¹

If the terms contain an arbitration clause, that is the contractual route once the complaint deadlocks, covered in crypto exchange arbitration clauses. The table below maps the rest.

Report a scam even if you think nothing will come back. The scale is the reason: IC3 logged 181,565 complaints with a cryptocurrency nexus in 2025, up 21% on 2024, with $11.366 billion in reported losses. The reports build the cases that enforcement and tracing work from.¹

Which US body handles my complaint, SEC, CFTC, CFPB, FTC or the FBI?

It depends on what went wrong. A scam goes to the FBI’s IC3 and the FTC. A security-type token points to the SEC, a commodity or derivatives product to the CFTC, and a payment, transfer or money-services problem to the CFPB. Your state regulator can take either.^2,3,4,6,9

• FBI IC3: file at ic3.gov even if you lost nothing. The FBI wants the wallet addresses and transaction hashes (the TXID that identifies an on-chain transfer), how much and which coins, the dates, and how the scammer first reached you.
• FTC: report scams at ReportFraud.ftc.gov. Reports feed the Consumer Sentinel database that law enforcement uses. Cryptocurrency was the second-largest payment method by reported fraud losses in 2024, at $1.42 billion.
• CFTC: send a tip or complaint at cftc.gov/complaint, or a whistleblower Form TCR, which can carry an award of up to 30% of money collected, or call 866-366-2382. Before you trade, the CFTC says to check whether a platform is registered, through the National Futures Association’s BASIC database and the FinCEN money-services-business register.
• SEC: use its tips, complaints and referrals (TCR) form for conduct it treats as involving securities. It takes the information for possible investigation and does not decide your claim.
• State regulators: California’s DFPI runs a Self-Service Complaint Portal and a Crypto Scam Tracker, and says you may complain about a legitimate platform, not only a scam. New York residents file with NYDFS.^{2,3,6,8,9,10,11,12}

The line between the SEC and the CFTC turns on whether a token is a security or a commodity, and it is contested and still moving. If you are unsure, a scam report to IC3 and the FTC and a firm complaint to the CFPB or your state regulator cover the ground as of 30 October 2026. Commodity, property and tracing questions in commercial cases are in crypto arbitration; member arbitration before the National Futures Association is in NFA arbitration and, on the securities side, FINRA arbitration, with the wider picture in financial markets arbitration.^6,9

What can each regulator or ombudsman actually do about my complaint?

Most US reporting channels take your information to build cases, not to get your money back or to rule on your dispute. Set your expectations by that difference.^2,3

• IC3 and the FTC: intelligence and enforcement referral. There is no promise of an investigation, a response, recovery or a decision on your case.
• CFPB: it accepts complaints about “money transfers, virtual currency, and money services,” sends more than 100,000 complaints a week to companies for response, and says most companies respond within about fifteen days. Its complaint role sits in statute at 12 U.S.C. 5534. Fraud and scams were the top issue in the crypto complaints it analysed, at 40% of more than 8,300 complaints from October 2018 to September 2022.
• CFTC reparations: an “inexpensive, expeditious, and fair forum” that decides a customer’s claim against a futures-industry professional registered with the CFTC, under 17 CFR Part 12. It is narrow: reparations reaches only CFTC-registered professionals, and an ordinary crypto exchange (a spot platform, where you buy the coin itself rather than a futures contract) is not usually one.
• SEC: it takes tips for possible investigation and does not resolve your claim.
• An ombudsman can decide a complaint and order redress, but only where one covers crypto. In the UK it does not yet. How ombudsman and online dispute resolution schemes work is in AI in dispute resolution and financial ombudsman schemes.^{2,3,4,5,7,9,15,16,25}

How do complaints work in the UK and the EU?

As of 30 October 2026, UK crypto is largely unregulated, so the Financial Ombudsman cannot consider a complaint about an exchange itself. In the EU, MiCA already gives you a free, written complaint right against a crypto-asset service provider.^14,16

In the UK, the Financial Conduct Authority’s (FCA) regulated cryptoasset regime is not yet in force. Under FCA Policy Statement PS26/13, the regime commences on 25 October 2027, and the authorisation gateway closes to new applications on 28 February 2027. From commencement the FCA will apply its DISP 1 complaint-handling rules and the Consumer Duty to cryptoasset firms, and it will extend the Financial Ombudsman’s compulsory jurisdiction to their complaints. It will not extend the Financial Services Compensation Scheme (FSCS), the UK backstop that pays out when a firm fails, to cryptoasset activities. Once those rules bite, a firm must handle a complaint fairly and respond, and a consumer who stays unhappy may go to the Ombudsman within its time limits.^15,22,23,24

For now, the Financial Ombudsman says it “cannot currently help with complaints about cryptocurrencies.” It can still look at whether a bank or payment firm did enough before processing an authorised push payment (an APP scam, where the customer is tricked into authorising a payment themselves) to a crypto provider. The complaint is then about the bank’s conduct, not the exchange’s.^16,17

In the EU, MiCA has applied since 30 December 2024. Article 71 requires a crypto-asset service provider (a CASP, a licensed firm that runs an exchange, custody or other crypto services) to maintain “effective and transparent procedures for the prompt, fair and consistent handling of complaints,” publish them, let clients complain “free of charge,” give a complaint template, keep a record of every complaint and the measures taken, and communicate the outcome “within a reasonable period.” ESMA was tasked with the detailed standards, so we state no fixed day or month deadline here.¹⁴

MiCA sets up no EU-wide crypto ombudsman. National consumer-ADR bodies differ from country to country, so where a CASP’s own process fails, the next step depends on the member state.¹⁴

What about Singapore and Hong Kong?

Singapore and Hong Kong both put complaint-handling duties on licensed platforms. Singapore’s low-cost dispute-resolution scheme does not yet cover crypto providers, and Hong Kong routes complaints through a licensed platform’s own process, handled independently by staff not involved in the matter.^18,20

In Hong Kong, an SFC-licensed virtual asset trading platform (a VATP, an exchange the Securities and Futures Commission licenses) must, under paragraph 11.20 of the SFC’s VATP Guidelines, give clients its complaint-contact details, keep written complaint procedures, handle complaints independently through staff not involved in the subject matter, respond promptly, and advise clients of any further steps under the regulatory system where a complaint is not remedied. The overseas-seat angle for commercial disputes is in arbitration in Hong Kong.²⁰

In Singapore, FIDReC adjudicates disputes between consumers and subscriber financial institutions up to S$150,000 for claims filed on or after 1 July 2024, after trying the firm first and within six months of its final reply. MAS consultation P017-2026, published on 16 October 2026 and closing on 30 November 2026, proposes to require payment-service providers and stablecoin issuers to join FIDReC, which means digital-payment-token providers are not yet required to subscribe as of 30 October 2026. The commercial-arbitration seat is covered in arbitration in Singapore.^18,19

Can my bank reverse a crypto payment, and can I get my money back?

An on-chain crypto transfer cannot be reversed, so the money comes back only if the recipient chooses to refund it. The FTC warns that a crypto payment carries none of the legal protections of a credit or debit card payment. Be wary of any recovery service, especially one that charges an up-front fee.^2,3

• On-chain irreversibility: the CFTC warns a blockchain transfer has no anti-fraud reversal, so once crypto is sent it comes back only if the recipient chooses to refund it.
• The card leg (a chargeback): a card or debit payment that funded the crypto carries the dispute protections through the issuer that the FTC notes a crypto payment lacks, even though the on-chain send cannot be undone. In the UK, a separate route lets the Financial Ombudsman review whether the paying bank did enough before processing an authorised push payment to a crypto provider.
• Recovery scams: IC3 warns against any service that promises to get lost crypto back, above all one that asks for a fee up front.
• Insolvency: if the exchange has failed, the route is a creditor claim in the bankruptcy or insolvency process, not a regulator complaint.^2,3,8,17

What does the law require a crypto exchange to do with complaints?

Several regimes now make a licensed crypto firm run a proper complaints process, in New York, the EU, Hong Kong and, from 2027, the UK, so the exchange’s own handling is a legal duty, not a courtesy. California adds a licensing duty on top.^{10,12,14,15,20}

New York’s rule is the most explicit. Under 23 NYCRR 200.20 a virtual-currency licensee must keep written policies to resolve complaints fairly and promptly, tell complainants they may bring the matter to NYDFS, and report any change within seven days. The 30 May 2024 Industry Letter adds a monitored phone number, an electronic (email- or chat-based) text channel, and a quarterly complaint tabulation kept available for NYDFS review from 1 November 2024. The New York seat for commercial arbitration is in arbitration in New York.^12,13

What would make crypto complaints fairer and faster?

In our view, the fairest and fastest crypto complaint is one run the same way every time under a written rulebook. The rulebooks already exist: the user agreement, New York’s section 200.20, MiCA’s Article 71, Hong Kong’s paragraph 11.20, and a firm’s own policy such as Crypto.com’s two-working-day and fifteen-working-day ladder. The volumes are large and the facts repeat. IC3 logged 181,565 crypto complaints in 2025, and fraud was the top single issue in the CFPB’s crypto complaints, so handling each one consistently matters more than handling each one bespoke. What keeps it fair is a named person who decides, with any AI used only to read the filing and draft a reply, never to make the call. And because an on-chain transfer cannot be reversed and a regulator or court may look at the file later, each complaint needs a record both sides can check: the transaction hashes, the dates, the decision and its reasons. Run that way, the same facts would not get a different answer depending on who picked up the ticket.^{1,2,5,12,14,20,21}