How Crypto and FX Exchanges Keep Trading Fair

A rulebook is just a promise with paperwork

Imagine a busy market street where everyone shouts their prices at once. Now imagine there is no referee, no shop inspector, and no one checking whether the scales are honest. That's roughly what an unregulated trading venue looks like. A rulebook is the referee. And enforcement is what happens when someone ignores the whistle.

In traditional finance, this referee role is often played by what's called a self-regulatory organization — a body that writes conduct rules for its members and disciplines them when they break those rules, while still sitting under a government watchdog. In the US securities world, that's FINRA, created in 2007 by merging two older bodies and operating under the SEC's supervision. It writes the rules, exams the professionals, and runs BrokerCheck, where you can look up a broker's background. The idea is simple: someone has to check the plumbing.

Crypto and foreign exchange markets grew up faster than their plumbing. Now the pipes are being installed in public, jurisdiction by jurisdiction, and the fittings don't always match.

What "fair trading" actually means in practice

Strip away the acronyms and venue rules tend to protect four things. First, no manipulation — nobody should be able to nudge prices or fake volumes to trap other traders. Second, orderly and transparent trading, so you can see what's on offer. Third, no conflicts of interest, meaning the venue shouldn't quietly trade against its own customers. Fourth, customer money should be kept safe and separate.

The US CFTC's enforcement chief Ian McGinley once traced the whole idea back to the "bucket shops" of the 19th and early 20th centuries — unregulated outfits that let people bet on commodity prices, then looted accounts, traded against customers, or simply vanished. Congress eventually responded with the laws that became the Commodity Exchange Act. If that sounds like a familiar plot, it should. The technology changed. The temptation didn't.

The tactics regulators actually watch for

Some conduct is subtle. Some is not.

Wash trading means buying and selling the same asset with yourself to create the illusion of activity. In 2015, the CFTC settled with a registered exchange called TeraExchange after two traders, the only two with trading privileges there, executed a Bitcoin swap at the same price in and out — no real risk, no real market, but a nice press release about "the first Bitcoin derivative transaction" on a regulated exchange.

Spoofing and layering involve placing orders you intend to cancel, to fake supply or demand. Regulators reportedly watch the ratio of cancelled orders to executed ones as a red flag. It's a bit like a restaurant that keeps posting "table for two, available now" and then hangs up on every caller.

Insider-style trading happens where someone has non-public knowledge. In 2025, a political candidate traded on his own candidacy on a prediction market. The venue's compliance team called him the same day; he admitted the trades broke the rules. He was penalised and suspended for five years. Separately, a YouTube channel editor traded contracts about that channel while holding advance knowledge of its videos — the venue found the trades were likely based on misappropriated information and imposed a penalty plus a two-year suspension. These were handled by the exchange itself, but the CFTC has been clear it retains full authority to police such conduct on any designated contract market.

Who polices whom, and why the map keeps redrawing

This is where it gets genuinely messy, and honesty requires saying so.

In the US, the CFTC has proposed rules known as Regulation CTX and Regulation CAM for crypto exchanges that choose a single federal framework. Its own chairman, Michael S. Selig, has been blunt that these rules would not force all crypto assets onto CFTC-registered venues — the agency says it lacks that authority without Congress acting. The proposal would, however, let registered venues offer retail margined or leveraged crypto trading, which state-licensed money transmitters generally may not.

Enforcement has filled the gap meanwhile. There's the landmark Binance case, which ended with $2.85 billion in combined monetary relief to the CFTC and $4.3 billion across US agencies, involving allegations that customers were coached to use VPNs and shell companies to obscure their locations. There's Falcon Labs, which let US customers reach unregistered exchanges through sub-accounts and paid roughly $1.2 million in disgorgement plus about $590,000 in penalties — a reduced figure reflecting cooperation. And there's Ooki DAO, where a court found that a decentralised autonomous organisation counts as a "person" under the Commodity Exchange Act. Moving control to a token-holder vote, the court effectively said, does not move you outside the law.

Meanwhile the SEC and CFTC signed a memorandum of understanding in March 2026, pledging to "clarify, coordinate, and harmonize" — including a joint interpretation categorising crypto assets as digital commodities, collectibles, tools, stablecoins, and digital securities. The agencies have also begun reducing duplication between them. Note the verb: begun.

Behind the curtain: how surveillance actually works

Regulators don't wait for complaints. They run automated surveillance across exchange data feeds, analysing order flow, cancellation rates, and price movements, and flag anomalies. A civil subpoena for trading records and communications is often the first sign a firm is under scrutiny. Enforcement actions frequently pair civil penalties and disgorgement with parallel criminal referrals.

That shift matters for ordinary participants in one specific way: modern market abuse rules impose positive duties on exchanges and intermediaries to detect, monitor, and report suspicious trading. Not doing so can itself become the basis for action. Being a passive bystander is no longer a defence.

The UK's approach, and why your postcode matters

Britain took a different road. The FCA's cryptoasset regime, underpinned by regulations passed by Parliament in February 2026, brings a broad range of crypto activities inside its regulatory perimeter for the first time, expanding fully from 25 October 2027. It applies established rulebooks covering conduct, senior manager accountability, operational resilience, and financial crime, plus dedicated rules on admissions and market abuse — including requirements that large UK trading platforms monitor for abusive behaviour.

On customer assets, the FCA is applying its client-asset rules to crypto, with protections around ownership rights, record-keeping, reconciliation, and private key management. On lending, it retains retail safeguards including appropriateness testing and negative balance protection. On stablecoins, issuers face full backing and redemption-at-par expectations. The FCA has also committed to a formal review roughly two years after the regime takes effect.

It's a deliberately phased, consultative approach. The FCA ran four discussion papers and ten consultation papers since 2023 — a volume of reading that would defeat most people on a beach holiday, and a reminder that regulatory clarity is usually slow because it's trying to be careful.

What none of this promises you

Here's the part that deserves to be said plainly. A rulebook reduces certain kinds of harm. It does not make cryptoassets safe. The FCA itself notes that cryptoassets are high risk, will remain high risk, and that most are highly speculative — with the possibility of losing your entire investment. UK-issued qualifying stablecoins are treated differently because they must be fully backed and redeemable at par, but that's a narrower promise about money-like instruments, not about crypto generally.

Jurisdiction matters enormously. A platform licensed in one country may be operating in a grey area in yours. Rules in the EU, UK, US, Singapore, Hong Kong, and the UAE are converging on common themes — reserve transparency, custody safeguards, travel-rule data sharing — but they are not identical, and complying with one does not mean complying with all. If you're dealing with a venue, the useful questions are concrete: Which regulator authorises it? Where are my assets held? What happens if it fails? Are there published reserve or disclosure practices?

Two decades of enforcement cases tell a consistent story. The markets that work are the ones where somebody is checking the scales. Everything else is just a busy street with good signage.