Bitvavo: crypto exchanges rating breakdown
Crypto exchange · reviewed against our published rubric, no affiliate links
Proof of reserves attested by a named accounting firm, quarterly, user-verifiable; client assets held by a separate legal foundation so the exchange’s own solvency cannot reach them. Never hacked. Docked for a partial in-scope asset list.
How the score is built
Each criterion is scored 0–10 and weighted. The median column is the middle score across every entry in this ranking, so a row reads as a position rather than a number.
| Criterion | What we measured | Weight | Score | Category median | Rank | Weighted gap |
|---|---|---|---|---|---|---|
| Custody of funds | — | 40% | 9 | 5 | 1 of 28 | +1.60 |
| True cost of trading | — | 16% | 4 | 6 | 23 of 28 | -0.32 |
| Liquidity and execution | — | 11% | 4 | 6 | 20 of 28 | -0.22 |
| Assets and networks | — | 9% | 6 | 6.5 | 15 of 28 | -0.04 |
| Fiat on/off ramp | — | 11% | 7 | 5.5 | 8 of 28 | +0.17 |
| KYC and access | — | 8% | 9 | 6 | 1 of 28 | +0.24 |
| Product, API and docs | — | 5% | 8 | 5.5 | 3 of 28 | +0.13 |
Measured 14 July 2026 · weights and method · decided by custody of funds, worth +1.60 points against the median
Custody of funds: 9/10
Proof-of-reserves: does it exist, who attests it, does it include liabilities (a PoR without liabilities is close to meaningless), how often. Insurance fund: size, is the address public, and has it ever actually paid out. Hack history — and above all whether users were made whole. Licences by jurisdiction, and the enforcement record behind them. Every claim here is sourced to a primary document: a regulator’s register, a court filing, or the venue’s own published proof.
Scored 9 of 10 against a category median of 5, which places it 1st of 28 among centralised exchanges on this criterion. At a 40% weight that is 1.60 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.
One of only a handful here that clears the bar. An independent accounting firm snapshots all user balances into a Merkle tree, publishes a root, and lets you verify your own balance is inside it — liabilities included, attested by a named third party, quarterly. The honest caveats: the in-scope asset list is partial, not everything you hold, and the most recent snapshot we could see from outside was dated well before today. An Account Guarantee of up to €100,000 if someone breaks into your account — and Bitvavo says plainly that it is “not an insurance policy”, not a regulatory requirement, and a pilot it can end at will. It also has real conditions: authenticator-app 2FA for at least 30 days, a police report, a 90-day claim window, one payout per user ever. Separately, cold-storage assets sit with third-party custodians carrying their own crime policies. Customer assets are held by a separate legal foundation, so the exchange’s own solvency cannot reach them — a genuinely good structure.
True cost of trading: 4/10
Measured by us, not read off a fee page. We walk the live order book and fill $1,000 / $10,000 / $100,000 of BTC/USDT, then add the venue’s published taker fee. That sum — fee + spread + realised slippage — is the effective cost. Separately: the markup on network withdrawal fees, and the hidden spread inside “convert” / “buy in one click” flows.
Scored 4 of 10 against a category median of 6, which places it 23rd of 28 among centralised exchanges on this criterion. At a 16% weight that is 0.32 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Liquidity and execution: 4/10
Order-book depth within ±0.1% and ±0.5% of mid, measured from the live book. Uptime over 12 months from the status page. Behaviour under stress: were there outages on days the market moved more than 5%.
Scored 4 of 10 against a category median of 6, which places it 20th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.22 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Assets and networks: 6/10
Number of pairs, adjusted for quality: the share of listings delisted within a year. Which networks are actually supported for deposit and withdrawal — not merely “supports USDT”.
Scored 6 of 10 against a category median of 6.5, which places it 15th of 28 among centralised exchanges on this criterion. At a 9% weight that is 0.04 points below the median contribution of the weighted total. The best score in the category is 10, the worst 1.
~438 pairs across ~428 coins — everything quoted in EUR, some in USDC
Fiat on/off ramp: 7/10
Which methods are actually available per country, their fees, and their limits per verification tier — read from the venue’s published terms and cited. Where a venue does not publish this, that opacity is itself the finding, and it scores accordingly.
Scored 7 of 10 against a category median of 5.5, which places it 8th of 28 among centralised exchanges on this criterion. At a 11% weight that is 0.17 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.
EUR only, but done properly: free SEPA in and out, plus iDEAL, Bancontact and Apple Pay. The largest euro spot venue in Europe. If you do not bank in euros, it is useless to you.
KYC and access: 9/10
Verification tiers and their limits, what is genuinely usable without verification, and the country deny-list — from the venue’s published policy, cited. A venue that will not tell you your withdrawal ceiling before you sign up is marked down for it.
Scored 9 of 10 against a category median of 6, which places it 1st of 28 among centralised exchanges on this criterion. At a 8% weight that is 0.24 points above the median contribution of the weighted total. The best score in the category is 9, the worst 1.
Published before sign-up, in plain numbers: €25,000 per 24 hours across crypto and euro combined, with a documented source-of-funds route above that. No tier ladder, no mystery. United States: SEPA-zone residents only. An account cannot be created from outside it. European Union: MiCA CASP — AFM (Netherlands). Authorised June 2025 for custody, trading platform and transfer services; passported across the EEA. The largest EUR spot venue.
Product, API and docs: 8/10
API documentation quality, whether rate limits are documented, whether a public status page with uptime history exists, and the API response latency we measured ourselves while pulling the order book.
Scored 8 of 10 against a category median of 5.5, which places it 3rd of 28 among centralised exchanges on this criterion. At a 5% weight that is 0.13 points above the median contribution of the weighted total. The best score in the category is 9, the worst 4.
Documented API and rate limits, and a real status page with a live incident history.
Its nearest neighbours in this ranking
Sources
Questions about this score
Who can open a Bitvavo account?
+
Residents of the SEPA zone, and nobody else — an account cannot be created from outside it, including from the United States and the United Kingdom. This is a deliberately narrow product, and the narrowness is why its euro liquidity is as deep as it is.
What is the foundation that holds Bitvavo's client assets?
+
A separate Dutch legal entity — a stichting — that holds client funds independently of the exchange's own balance sheet, so a Bitvavo insolvency would not put customer assets into the estate. That structure answers the question Coinbase's own SEC filings raise about custodial assets in bankruptcy, and almost no offshore venue in this rating has an equivalent.
Does Bitvavo have a proof of reserves?
+
Yes, and a good one: quarterly, attested by a named accounting firm, and user-verifiable so you can check your own balance is included. It is docked in our scoring for a partial in-scope asset list rather than for the quality of the attestation itself.