Buy cryptocurrency

The headline “0% commission” you see advertised is almost never the whole bill. A purchase has three separate costs, and only one of them is usually called a fee.

The spread is the gap between the price the exchange buys at and the price it sells to you at. It is baked into the quote, so you never see a line item — Bitpanda is unusually honest about publishing its figure at 1.49% on crypto. The trading fee is the explicit percentage an order book charges, typically 0.1% to 0.6% depending on platform and volume. The funding fee is what it costs to get euros or dollars in and out: near zero by SEPA transfer, several percent by card.

The single biggest saving available to a retail buyer costs nothing and takes one click: stop using the simple Buy button. Coinbase Advanced and Bitpanda Fusion sit on the same account and the same balances as the beginner interface, with nothing to transfer and no separate signup, and they charge order-book fees instead of a retail spread. On a €1,000 purchase the difference is routinely the price of a decent dinner; on a monthly savings plan it compounds into real money.

Two smaller costs are worth knowing. Withdrawal fees are charged in the coin you are moving and depend on the network, not the exchange — sending USDC over Ethereum mainnet can cost many times what the same transfer costs over a layer 2 such as Base or over Solana. And conversion fees apply when your card or bank is not in the same currency as your deposit; funding in your own currency avoids them entirely.

Every regulated exchange will ask who you are before it lets you buy. In the EU this is MiCA plus the anti-money-laundering directives; elsewhere it is the local equivalent. Expect to supply a passport or national ID card, a live selfie or a short video call, and for larger amounts a proof of address and a question about where the money came from.

Practical advice: do it once, do it properly, and do it before you are in a hurry. Verification queues lengthen exactly when the market is moving and everyone signs up at once. Use the name as printed on the document, a document that will not expire in the next few months, and a payment method in your own name — an account funded from someone else’s bank account is the fastest way to get frozen.

Expect a second look at your first withdrawal. Many platforms run an additional check the first time money leaves, which is a good reason to test a small withdrawal early rather than discovering the hold when you actually need the funds.

A balance on an exchange is not a coin. It is a claim on a company that owes you a coin. Most of the time that distinction is academic; in November 2022 it stopped being academic for a million or so FTX customers, and the industry’s oldest slogan — not your keys, not your coins — stopped sounding like a slogan.

MiCA has improved the picture in Europe: licensed providers must segregate client assets from their own and publish how they safeguard them, which is a genuine protection and still not the same thing as holding the keys yourself.

A workable rule of thumb: an amount you would shrug at losing can stay on a licensed exchange, where it is liquid and easy to sell. An amount you would be sick about belongs in a wallet whose seed phrase only you have seen — a hardware wallet for preference. Write that seed phrase on paper or stamp it into metal, keep it away from the device, and never type it into anything. No exchange, no support agent and no wallet app will ever legitimately ask you for it.

You can also buy directly from another person. Bisq is a desktop application with no company behind it, where trades settle into a two-of-three multisignature escrow and disputes go to elected arbitrators. Hodl Hodl runs a similar non-custodial escrow as a web service. The names people remember — LocalBitcoins, LocalEthereum, LocalMonero — have all shut down; do not follow an old link to a lookalike.

Peer-to-peer trades cost more than an exchange, usually a few percent over spot, and they are slower. What you get for that premium is a counterparty instead of a company, and a purchase that does not depend on one platform staying open. What you must supply in return is discipline: follow the escrow protocol to the letter, never release funds outside the platform, be suspicious of any buyer who wants to move the conversation elsewhere, and treat reversible payment methods as a fraud vector.

One thing peer-to-peer is not: a way around the law. Tax, reporting and anti-money-laundering obligations follow the person, not the venue.

• A unique password per exchange, generated and stored by a password manager. Reused passwords are how most “hacked exchange” stories actually begin.
• Two-factor authentication from an app or a hardware key, never by SMS. SIM-swap attacks are cheap, common and specifically aimed at crypto holders.
• A dedicated email address for exchange accounts, itself protected by a strong password and 2FA.
• Bookmark the exchange and use the bookmark. Paid search results and app-store lookalikes are among the most productive phishing channels in this industry.
• Turn on the withdrawal allowlist so funds can only leave to addresses you have pre-approved, with a delay on new ones.
• Send a test transaction first, and check the network as well as the address — the same address on Ethereum, BNB Chain and Arbitrum is three different destinations.
• Nobody legitimate will ever help you. Not a support agent in your DMs, not a “wallet validation” page, not a recovery expert who found you after a loss. Every one of those is a theft in progress.

Most countries tax crypto, and almost all of them tax it on disposal rather than on purchase — but the detail varies enormously, and so does whether swapping one coin for another counts. Find out how your own country treats it before you have a gain to declare, not after.

What changed recently is visibility. Since 1 January 2026 the EU’s DAC8 directive — the European implementation of the OECD’s Crypto-Asset Reporting Framework — requires crypto-asset service providers to collect tax residence and identification details from their users and report their transactions to national tax authorities, with the first reports covering calendar year 2026. It applies to any platform serving EU residents, not only EU-based ones. In practice, the tax office will have a version of your trading history, and it should match yours.

So keep records as you go. Export a CSV from every platform at least once a year, keep the wallet addresses you own in the same file, and note the purpose of every transfer between your own wallets — a move between two wallets you control is not a sale, but it looks exactly like one in a raw export. None of this is tax advice; if the amounts matter to you, pay an accountant who has read the rules in your jurisdiction.