Guide 2 - Open and secure an exchange account

Goal

By the end of this guide you will have a verified account on an exchange, reached through the official address and not a lookalike, with security settings that make a stolen password much less dangerous. You will not have bought anything yet. That is guide 4.

An exchange account is a custodial account: while coins sit there, you hold a claim against a company and not the keys. The 2022 failures of Celsius and FTX are the reminder. ^[17] So the account is a temporary workplace, and the long-term home is a wallet you control (guide 5). Nothing here is a recommendation of any platform.

Time needed

• Sign-up and email confirmation: 10 minutes.
• Identity check (KYC): 10-15 minutes of your time, then a wait. Kraken's processing-time page, updated 2026-10-01, lists about 45 minutes for standard manual review, instant for automated review, "a few days" for higher limits, and warns that high demand can slow things considerably. ^[1] Crypto.com says a pending review can take from a few hours to a couple of business days. ^[13] Third-party guides quote a Bybit range of 15 minutes to 48 hours; we could not confirm that figure on Bybit's own pages, so check the app.
• Security hardening: 20-30 minutes.

Plan for the whole thing to take an evening, with the verification wait running in the background.

Before you start

• Guide 1 done: dedicated email, password manager, a second factor that is not SMS.
• A valid government ID that is not expired, and a phone with a working camera.
• A proof of address if the exchange asks for one. Kraken says a government ID and proof of address are generally needed, with more documents occasionally. ^[2]
• A quiet moment with good light. Blurry photos are the top cause of rejection.

Steps

Step 1 - Reach the official site, not a lookalike

Phishing sites copy exchange pages exactly and are promoted through ads, social media and messages. Kraken tells customers to check that emails come from a genuine @kraken.com address and to watch for lookalike domains and subtle misspellings. ^[7][8]

A reliable routine:

1. Start from the official address listed on this site, shown in the table below, or from the exchange's own help center. Do not click a search ad.
2. Check the domain letter by letter, and confirm the padlock shows the same domain.
3. Bookmark the page you reach and use only the bookmark afterwards.
4. Never log in from a link in an email, text or chat, even if it looks right.

The table shows what we verified about which of the eight coins each exchange lists, plus Israel availability caveats. For Sign up buttons, see Buy and store. Availability for Israeli residents is not the same as a licence: Kraken, Bybit, OKX and Crypto.com were marked available based on official pages, but Coinbase and Bitstamp availability in Israel is unverified, and ILS deposits are unverified for all except Bits of Gold. Bit2C is an Israeli exchange but supports none of the eight coins, and Binance is excluded because no official source confirms service to Israeli residents.

Step 2 - Create the account

Use the dedicated email and a unique password from your manager. Confirm the email and set up the second factor immediately, before the verification step. Prefer a passkey or security key, then an authenticator app. Kraken recommends a passkey for sign-in because passkeys resist phishing, while authenticator-app codes can be stolen. ^[16] CISA calls FIDO authentication phishing-resistant and notes that attackers have bypassed traditional MFA such as SMS texts, authenticator apps and push notifications. ^[14]

Step 3 - Complete KYC

KYC (know your customer) is the identity check that regulated platforms must run. The documents differ by platform and country:

• Kraken: a government-issued ID, choosing the issuing country and ID type, with the option to pause and resume. ^[4] Levels range from a verified individual account to one with higher limits, and a business account. ^[2]
• Bybit: three levels (Standard, Advanced, Pro), with proof of address needed for Advanced and dated within the last three months, according to a summary of Bybit's help center. ^[9] One third-party guide says electronic copies of the ID are not accepted; we did not verify that from Bybit's own page.
• Crypto.com: your full legal name, a photo of a government ID (passport preferred) and a selfie. Submit documents only inside the app, never by email or chat. ^[13]
• OKX: the OKX page we cited does not describe the verification steps, so the document list was not verified; check the in-app flow for your country.
• Bits of Gold, Coinbase, Bitstamp: requirements were not verified for this guide. Use each platform's help center. ^[15]

Enter your name exactly as on the document, use full names not initials, and photograph the ID in good light with all four corners visible. ^[13]

Step 4 - What to do if KYC is rejected

Kraken lists two common causes: low-quality or incorrect document images (blurry, cropped or unreadable) and mismatched or incomplete details such as name or address. ^[3] Bybit documents similar reasons such as blurry images and expired IDs. ^[10] Read the rejection email, correct the exact issue and resubmit once. Resubmitting repeatedly is unlikely to help; wait for the answer to each submission.

Step 5 - Add the anti-phishing and withdrawal protections

• Anti-phishing code. Where offered, you choose a word that the exchange then puts in every genuine email, so an email without it is suspect. OKX describes exactly this. ^[12] For Kraken, no anti-phishing code feature was found in its help center; it recommends checking the sender and using a dedicated email. ^[7][16] For Bybit and Crypto.com it was not verified: look in the security settings.
• Withdrawal allowlist (whitelist). This restricts withdrawals to addresses you saved earlier. OKX offers an Allowlist, plus an optional 24-hour lock on newly added addresses. ^[11] Kraken's Global Settings Lock blocks adding new withdrawal addresses and changes to email, 2FA and API keys for a waiting period of 24 hours to 30 days, and a Master Key can lift it immediately. ^[5] Set up the Master Key before enabling the lock.
• API keys off. API keys let software act on your account. Do not create any you do not need. If you ever do, give the minimum permission, and a trading key should not have Withdraw. ^[6]

Step 6 - Review the settings once more

Open the account's security page and read it top to bottom. Confirm the second factor, check the list of active sessions and logged-in devices, confirm that the withdrawal allowlist or lock is on, and check that the list of API keys is empty. Turn on email or app notifications for logins and withdrawals so that you hear about any action within minutes.

Finally, record the account in the one-page note from guide 1: the exchange name, the official address, which second factor protects it, and where the backup codes are kept. In an emergency, a short and accurate note is worth more than good memory.

Common mistakes

• Clicking a search ad for the exchange and logging into a clone.
• Using SMS 2FA because it was the default.
• Submitting documents by email or chat. Legitimate platforms collect them in the app or verified upload form. ^[13]
• Enabling the lock before the Master Key on Kraken, leaving no quick exit. ^[5]
• Giving a third-party tool a key with withdrawal rights.
• Assuming "available in my country" means "licensed for me". Read the notes in the table.

If something goes wrong

Verification is slow. Check the processing page and wait. Kraken says processing starts only when all documents are received. ^[1] Crypto.com suggests contacting in-app support if a pending status does not change in 3 business days. ^[13]

You were rejected twice. Check that the details match the ID exactly, retake photos, and contact support through the official site.

You clicked a suspicious link or entered a password on a fake site. Change the password from the real bookmark, revoke sessions, rotate your second factor, check the withdrawal address list, and contact the exchange. See guide 10.

You locked yourself out. Use your backup codes. On Kraken the lock itself has a waiting period. ^[5]

Official help articles

• Kraken - How to get verified ^[4]
• Kraken - Verification processing time ^[1]
• Kraken - Global Settings Lock ^[5]
• Kraken - How to create a spot API key ^[6]
• Bybit - How to complete individual KYC verification ^[9]
• OKX - Withdrawal allowlist ^[11]
• Crypto.com - All about KYC verification ^[13]
• Bits of Gold - help center ^[15]

Sources