Q: How do I know a platform is genuinely licensed?
A: Search the name in AFSA's public register. That is the only method that counts. Anything written on the platform's own site — including the word "licensed" — is marketing until you have checked the register.
AFSA is the financial services regulator of the Astana International Financial Centre, responsible for authorising and supervising firms within it, digital asset businesses included. It maintains a public register that anyone can search without an account.
This deserves its own guide because it is one of the few things in this industry an ordinary person can independently verify. Most claims you cannot check: how much is in reserve, how good the security is, how reliable the team is — you can only decide whether to believe. "Does this authorisation exist" has a findable answer. When an answer is findable, do not guess.
Q: What exactly am I looking at?
A: Four columns. Entity name, permission type, current status, attached conditions. Seeing the name and closing the tab is not checking.
One: does the entity name match
A platform's brand and its registered operating entity are frequently different. What you are confirming is that the service you use is operated by the entity in the register.
How? Look at the platform's terms — the "this agreement is between you and X" line at the top. X is your actual counterparty. Search that name, not the brand in your address bar.
Two: does the permission cover what you want
Digital asset authorisations are not one-size. At minimum they separate operating a trading facility from providing custody. A firm may hold only the first — it can match your trades, but safeguarding your assets is outside its permission.
The practical consequence: if something goes wrong in a part of the business outside the permission, regulatory protection does not extend there either.
Three: is the status current
Registers usually retain history, including lapsed, suspended and withdrawn entries. Seeing the name and relaxing may mean you are reading a record that expired long ago.
Four: are there conditions
Some authorisations carry conditions — professional clients only, or certain products excluded. If you are a retail user and the condition says professional only, that licence has nothing to do with you.
We built a checklist generator for this. It deliberately holds no list of licensed firms: licensing status changes, and a stale list is more dangerous than none, because people rarely stop to ask how old the data is. It produces the checklist; you work through it against the official register.
Q: Which phrases carry no legal weight?
All of these are common on platform pages and none of them establishes anything on its own:
| Marketing phrase | Why it does not count |
|---|---|
| "Regulated" | Does not say by whom, or under what permission |
| "Fully compliant" | Not a defined legal term |
| "Holds an international licence" | May be an offshore permission unrelated to digital assets |
| "Registered in multiple countries" | Company registration is not a business licence |
| "Meets AML standards" | Self-declared, with no third party attesting |
| "Partnered with a licensed institution" | The partner is licensed; that says nothing about them |
The last row is the easiest to be walked into. "Our custodian is a licensed institution" may be perfectly true, and it protects something entirely different from "we are licensed". When something goes wrong, who you contracted with determines who you can pursue.
Also worth saying: a licence tells you what rules a platform must follow. It does not stop you losing money. Markets fall regardless. Treating authorisation as a cushion is a different misreading.
Q: How is impersonation usually done?
A: Impersonating a licensed firm is among the more effective frauds here, because it borrows the credibility of a real regulator. The defence is a habit rather than a trick: go from the register to the platform, not from the platform to the register.
The direction matters. Most people work the other way: they encounter a platform, like the look of it, then go looking for evidence to support a view they already hold — at which point anything resembling evidence will do. Do it in reverse: open the register first, search there, and only continue if you find it.
| Method | Where it falls apart |
|---|---|
| Quoting a real firm's licence number | Look the number up; the entity name will not match |
| Registering a company with a near-identical name | Compare character by character — an extra word, a missing one, a plural |
| Displaying a forged certificate image | A certificate is a picture; a register is a database. Only the second counts |
| "Our partner is licensed", implying they are | Read who the subject of the sentence is |
| A lookalike domain | Check the domain character by character; enter from your own bookmark |
The second row is worth dwelling on for readers working across languages: near-identical names are especially effective when you remember a firm by a translated or transliterated name, which carries no legal meaning at all. Always compare using the registered legal name.
One check that runs the other way
A genuinely licensed firm will normally tell you its licensed entity name and permission clearly and without being asked, because it is an asset. Conversely, if you have to hunt through footer small print, or can only find a vague "regulated", that absence is itself the answer.
Legitimate firms have no reason to be vague about this. Vagueness is information.
Q: What else should I look at once the licence checks out?
A: A licence answers "is this firm bound by rules". Three things it does not cover: who actually holds the assets, what has gone wrong before and how it was handled, and how easily you can leave.
Who actually holds the assets
The number in your account and coins existing on a chain are two different things. The first is a record of what the platform owes you; the second is an actual asset. Nearly all centralised platforms work this way, which is not itself a problem — the question is whether the two match.
Some platforms publish reserve attestations. These have value, but read what they establish: typically that addresses controlled by the platform held a certain amount at a point in time. Not that those coins have no matching liabilities, nor that they were not borrowed for the occasion. Better than nothing, not insurance.
What has gone wrong before
More informative than any marketing material. Search whether the platform has had incidents — withdrawal pauses, outages, security events — and how it handled them: was there a public explanation, how were user losses treated, how long did recovery take.
A platform with no history of incidents may simply be young. One that had an incident and handled it cleanly is arguably more trustworthy, because you have seen how it behaves under pressure.
How easily you can leave
The most overlooked. Every platform is welcoming at signup. What tests it is trying to take everything out: withdrawal limits, extra reviews, settlement times, and whether excuses appear.
The way to test it is the one from the signup guide: run a small amount through the full round trip. Done before you commit real money it costs almost nothing. Done afterwards it is too late.
Questions people actually ask
The platform says it is regulated. Is that reliable?
The phrase carries no legal meaning by itself. Regulated by whom, under what permission, covering which business — without those it is empty. The only way to verify is the regulator's public register.
Does that mean I must never use an unlicensed platform?
The question is not whether you can, but whether you have anywhere to turn when something goes wrong. An unlicensed platform is not bound by local supervision, so there is no local complaints route and no asset segregation requirement. Your call, but make it knowingly.
If the name is in the register, am I done?
No. Check that the permission type covers the service you want, that the status is current, whether conditions are attached, and that the registered entity is the one you actually contract with.
Does a licence mean I cannot lose money?
No. Licensing governs conduct and asset segregation, not market movements. Assets on a licensed platform rise and fall like any other, and you can lose everything you put in.
Risk notice: crypto prices move violently and you can lose everything you put in. Licensing status changes over time; the method described here is what to rely on, and the register's current contents are authoritative for any conclusion. Some jurisdictions restrict crypto assets — check the rules where you are.
Where I checked the licence status
Everything below is a page I actually opened while checking licence status. The register itself is public and needs no account, so you can run the same search yourself.Opened September 2026
- AFSA public register of regulated entities Astana Financial Services AuthorityThe four columns this article walks through are the actual fields of this register.
- AFSA official website Astana Financial Services AuthorityThe official definitions of licence categories, including the difference between a trading facility and custody.
- AFSA regulatory actions Astana Financial Services AuthorityA live entry in the register does not mean a clean record; enforcement actions are listed separately here.
- AFSA warning on unlicensed digital asset platforms (29 April 2026) Astana Financial Services AuthorityPlatforms named in public warnings, which should be checked alongside the register.
- AFSA news and announcements Astana Financial Services AuthorityChanges in licence status usually appear in announcements before the register itself is updated.
- Regulation of the digital assets market National Bank of KazakhstanFirms outside the AIFC are not in AFSA's register; not finding one there does not by itself mean it is unlicensed.
- Unsecured digital asset exchange operators: licensing conditions National Bank of KazakhstanThe National Bank's entry conditions for exchange operators, which are a different regime from AFSA licences.
- Digital financial asset platform operators: registration requirements National Bank of KazakhstanPlatform operators are registered rather than licensed; the two statuses are not equivalent.
- Law of the Republic of Kazakhstan No. 193-VII On Digital Assets (6 Feb 2023) Adilet legal information systemThe statutory basis for the register; the licence categories originate in this law.