Is Bitvavo Safe in 2026? Licence, Custody and the Fine Print

Is Bitvavo Safe? The Short Answer

Our Video After a Year on Bitvavo

Our video looks back on more than a year of using Bitvavo and covers the interface, fees, deposits, the choice of coins and security. Its verdict is positive: we call Bitvavo a solid platform for beginners and long-time investors, and the video points to your own cold storage for larger amounts. This article reads the fine print more closely and checks each point against Bitvavo's own documents. Where the two differ, this article is the current view. Fees, spread and the sign-up offer are covered in our Bitvavo review.

Who Runs Bitvavo and Where You Can Use It

Bitvavo B.V. is a Dutch company based in Amsterdam, founded in 2018 and registered with the Dutch Chamber of Commerce under number 68743424. In its User Agreement it states that the AFM, the Dutch financial markets regulator, licenses it under MiCA with registration number 41000010. Bitvavo announced the licence in June 2025.

You can check the licence yourself. ESMA, the European Securities and Markets Authority, publishes an interim MiCA register of authorised crypto-asset service providers as downloadable CSV files on its MiCA page. Open the file for crypto-asset service providers and search for Bitvavo B.V., whose legal entity identifier is 724500MX2WBKDJP9HE56. The entry names the AFM as competent authority and lists 26 June 2025 as the authorisation date. It holds up against the User Agreement, because it shows the same three services: custody and administration, operation of a trading platform and transfer services.

Several companies sit behind the name. Next to Bitvavo B.V., Bitvavo's documents name these roles:

• •Bitvavo Custody B.V. is a party to the User Agreement only for lending and margin trading, and it is not regulated or supervised.
• •A Dutch foundation, called Stichting Bitvavo Payments in the help centre, holds users' digital assets and, under the standard terms, their euros. Assets in the Lending Service are the exception.
• •Inveniam B.V. is your counterparty when you trade with a price guarantee order. Bitvavo says it has its own management and is operationally separate.
• •Sutor Bank GmbH holds the euros of residents of Germany in a trust account.

A licence that covers the EU does not open every door. You have to live in a supported SEPA country to create an account. The help centre lists 24 countries, and the countries page on the website lists 25 by adding Hungary. For the identity check, Bitvavo accepts a passport, a plastic ID card or a residence permit valid for at least three months. The help centre's table also lists a plastic driving licence as accepted, except for Germany. Documents must have been issued in the EEA, Switzerland or the UK, and documents from other countries are not accepted, according to the help centre.

One detail matters for expats. At the time of writing, the countries page adds a note to the lines for Belgium and Spain. It says the information is not intended for citizens of those countries and links to bitvavo.be or bitvavo.es instead. The help centre still lists both countries as supported. We could not resolve the difference. Check which Bitvavo site applies to you before you register. The help centre also says that a VPN or travelling may cause problems when you create an account.

What the MiCA Licence Covers, and What It Does Not

MiCA is the EU's Markets in Crypto-Assets Regulation. Under it Bitvavo may operate a trading platform for crypto-assets, provide custody and administration, and run transfer services. The help centre describes this as conduct supervision by the AFM. It says Bitvavo has to report to the regulator regularly and meet MiCA standards on security, conflicts of interest and governance.

The licence is narrower than the word suggests. The opening of the User Agreement names four services that are not regulated under MiCA: the Lending Service, the Margin Trading Facility, the Price Guarantee Service and the Staking Service. Users may not get the same level of rights and protections under MiCA there.

That matters because Auto Earn bundles flexible staking and lending, and assets in the Lending Service can leave Bitvavo's custody, as described below. In the help centre's description, lending means eligible crypto-assets are lent to partners on the platform. The help centre adds that lent crypto can also be used for on-chain staking and margin products. The staking article states that the safeguards for regulated crypto services do not extend to staking and lending. Our review walks through all four services.

Who Holds Your Money: The Foundation Structure

How the Crypto Is Stored, and What Third Parties Add

The security page says the vast majority of digital assets sit in offline cold wallets, with transfers that need several signatures. It mentions two custody partners without naming them, says employees pass background checks and says outside firms review the code and run penetration tests. All of that comes from Bitvavo itself.

A help centre article on the safety of your crypto adds a qualifier. To keep withdrawals quick, Bitvavo holds a percentage of the stored crypto in a hot wallet. The pages we read do not say how large that percentage is.

Clause 6.9 explains the other half. The foundation may store digital assets offline and with third-party crypto-asset service providers. That can delay withdrawals, and Bitvavo says it has no control over the functionality, security, availability or continuity of these providers' services. The clause then excludes liability for provider-related losses if two conditions hold. The incident must not be attributable to the provider, and the loss must not be attributable to a failure by Bitvavo or the foundation to select and monitor providers as the law requires. The clause also adds a plain warning: if a custody provider defaults or goes bankrupt, you may not be able to retain all of your assets.

In our view, the insurance claims are among the less clear parts of Bitvavo's own account of its security. The security page says the custody providers are insured up to $755 million, and the Account Guarantee page says EUR 755 million. The help centre article on the safety of your crypto names two providers. One is insured up to EUR 255 million and the other up to 500 million, with no currency given for the second figure. By our sum, that makes 755 million. The pages disagree on the currency and do not explain what the policies cover or who can claim on them. We do not treat these figures as protection for you.

In practice, cold storage and multi-signature access are Bitvavo's answer to theft risk. That said, the third-party chain adds counterparty risk that the terms acknowledge openly, and the risk still sits with you.

What Bitvavo Owes You If Something Goes Wrong

The liability clauses show how far the safety language reaches. Clause 21.2 sets the starting point: Bitvavo and its affiliates are not liable for damage in connection with the services. The exception is damage that results directly from a failure to meet their obligations and stems from wilful intent or gross negligence. The clause then lists further cases without liability. Among them are:

• •temporary outages or suspensions of the services, including not being able to deposit, withdraw, trade or log in (21.2.3);
• •lost profits and trading losses (21.2.5);
• •malware, and SMS, email or two-factor services that may be vulnerable to spoofing and phishing (21.2.8);
• •actions of third parties for which Bitvavo is not responsible (21.2.11).

Clause 21.2.2 adds scams: Bitvavo is not liable when a user sends assets or funds to a scam or another fraudulent third party.

Clause 21.3 then limits what Bitvavo owes in all cases. The list covers fees and other amounts paid in the preceding twelve months, excluding VAT. Where a report within 24 hours would have limited the damage, liability is capped at what the damage would then have been. The clock starts when you become aware of the facts, or should have become aware of them (clause 21.3.2). Direct, foreseeable losses from a breach of the agreement are covered too, without consequential damages. Clause 21.3.4 covers lost digital assets in connection with custody, transfer, staking or lending services. It applies where an incident attributable to Bitvavo or an affiliate caused the loss and Bitvavo is liable under the agreement. The measure is the market value at the time of the loss.

Two more clauses frame this. Clause 6.12 obliges Bitvavo to compensate the foundation for losses directly related to safekeeping and holding the assets. That includes risks from third-party custody providers, from holding funds with the Bitvavo group and from staking. The same liability limits apply to the foundation. The obligation runs to the foundation, not to users. Clause 21.4 says Bitvavo may reimburse users in specific cases at its discretion, without an obligation, and may amend or repeal reimbursement policies at any time.

What stands out is how much of the practical protection depends on conditions you can only read in the contract. We summarise the clauses as written and do not predict how a court would apply them to your case. This is not legal advice, so read the version of the User Agreement that applies to you before you deposit.

The Account Guarantee: What It Excludes

The Account Guarantee may reimburse up to €100,000 when someone gains unauthorised access to your account and withdraws funds without permission. The help centre lists unauthorised withdrawals of crypto and of euros as covered. Annex 1 of the User Agreement speaks of withdrawn digital assets. It says the payout is always a euro amount equal to their value at the time of withdrawal, so read Annex 1 for the exact scope. Bitvavo's Account Guarantee page adds that the programme is not a regulatory requirement, not part of the EU deposit guarantee schemes and not an insurance policy.

The exclusions matter more than the headline. That page lists four groups and calls its list indicative, not exhaustive:

• •Crypto sent to a wrong address, because blockchain transfers cannot be reversed.
• •Buying, selling or sending crypto that you later regret, including funds sent to a fraudster.
• •Losses after careless security, such as a click on a phishing link, a missing 2FA setup or access given to a third party through a remote tool like AnyDesk or TeamViewer.
• •Lost profits, for example when hackers convert BTC to ETH, the ETH then loses value, but they cannot withdraw anything.

Annex 1 is more specific than the help centre page. Among other cases, you are not entitled to a reimbursement if you shared your login credentials or 2FA codes with third parties. You are also excluded if you gave others access to your account or devices. The same applies if the assets left through an API key you created before the incident (Annex 1, clause 3.1). Clause 3.1.1 excludes incidents that result from gross negligence or irresponsible behaviour, including insufficient account security. The help page words this as negligence, inadequate security or irresponsible behaviour. Phishing is excluded outright (clause 3.1.5), without the negligence threshold of clause 3.1.1.

The conditions are strict as well. The help centre's main ones are completed verification, at least 30 days of trading eligibility and authenticator-app 2FA for at least 30 days before the incident. You must also file a police report, submit your claim within 90 days and cooperate fully with Bitvavo's investigation. Annex 1 itself requires 2FA for at least 30 days without naming an authenticator app. In effect, for a new account, an incident in the first 30 days after verification cannot qualify. Only one incident per user is covered, and Annex 1 reduces a payout by anything you recover elsewhere, for example from an insurance policy. Annex 1 has the complete wording.

Softer limits come on top. Bitvavo says it cannot promise a payout within a set time. Under Annex 1 the payout is due only after Bitvavo has determined definitively and beyond any doubt that the evidence is sufficient and you are eligible (clause 1.9). Annex 1 also calls the guarantee a pilot that Bitvavo may amend or cancel at any time without notifying users.

If someone gets into your account, the Account Guarantee page, the support page and the User Agreement point to these steps:

1. •Contact Bitvavo at once and ask for the account to be locked. Clause 14.4 requires you to report immediately if you know or should know that your login data may be misused. Clause 21.3.2 can cap Bitvavo's liability at the damage that would have occurred with a report within 24 hours of becoming aware. Use live chat while you are logged in, or the help centre webchat or an email from your registered address if you cannot log in.
2. •Expect limits. Human agents work from 07:00 to 23:00 CET every day, there is no phone support, and emails outside those hours are answered on the next working day.
3. •File a police report, because the guarantee claim needs one.
4. •Send the reimbursement request to Bitvavo within 90 days of the incident.

Outages and Incidents on the Record

Safety also depends on how the platform behaves under stress. We looked at what Bitvavo itself has published and at media reports. This is not a complete register of every incident.

Three outages stand out:

• •14 November 2023. Customers could not log in for about five hours, according to Bitvavo's first update. Its third update says the cloud infrastructure provider confirmed infrastructure problems as the root cause, made worse by a monitoring system that looped while trying to activate a backup. Bitvavo said the issue was not related to asset safety. The first two update pages carry 2024 dates, while the third is dated 23 November 2023.
• •20 February 2025. The status page recorded a full outage after a planned upgrade, with buying, selling, deposits and withdrawals affected for roughly two and a half hours.
• •10 August 2025. In the early hours, Amsterdam time, a login problem could leave some users seeing a zero balance. Bitvavo called it a display issue and said funds stayed safe.

For outages like these, clause 21.2.3 says Bitvavo is not liable for damage from not being able to deposit, withdraw, trade or log in.

On top of that, three further incidents mainly touched data or accounts:

• •7 September 2022. Bitvavo's own incident report says a caching misconfiguration exposed the personal data of eight users to other logged-in users for 15 minutes. Bitvavo locked down its app, contacted the eight users and notified the authorities, including the Dutch data protection authority. It called the incident a misconfiguration on its side, not a hack or a security breach, and said funds were never at risk.
• •1 May 2024. Dutch media including Security.nl and AVROTROS Opgelicht reported that Bitvavo had informed what it called a limited group of users about a data leak. According to the reports, names, email addresses, home addresses, IBANs, recent trading volume and the last three digits of phone numbers were exposed. Bitvavo said funds were safe and that it had no indication that passwords were exposed. AVROTROS, citing Tweakers, adds that Bitvavo reportedly informed "the relevant authorities" and advised users to check their account, change their password and switch on two-factor authentication. Security.nl mentions the password advice. Neither report gives a number of affected users.
• •11 October 2024. Bitvavo's status page says its official X account was compromised through a phishing attack after an employee clicked a malicious link. The attacker published false content to scam people, and Bitvavo points out that it has not issued a BVAVO token. Bitvavo said customer funds were safe and that only the X page was accessed.

Contact details combined with an IBAN are the raw material for convincing phishing messages, which is why the anti-phishing code matters. Under Bitvavo's terms, damage from falling for a phishing message is largely your own risk. The Account Guarantee excludes phishing. Clause 21.2.8 excludes Bitvavo's liability for damage from SMS, email and two-factor services that may be vulnerable to spoofing and phishing.

At the time of writing, the status history for July to early October 2026 lists 30 entries. By our count, eighteen are technical difficulties, for example with trading, login, the API or the Web3 wallet. Their incident pages show durations from a few minutes to several days. Eleven concern an individual coin or its network, and one is scheduled maintenance. Several of the coin entries suspend deposits and withdrawals after a security incident, for example RVN, NES and KITE. That said, in the entries that give details, Bitvavo places the incident with the coin's own network, token or project. For KITE and CRO, Bitvavo describes it as outside of Bitvavo. For ZIL it says the stolen funds were not in a Bitvavo cold wallet. The practical point is that an individual asset can be frozen for deposits and withdrawals while the rest of the platform keeps working. The status page works well as a source, because its incident pages show the updates from the first report to the resolution.

In a separate company notice on 2 September 2026, Bitvavo announced a reorganisation, informed the employees concerned and gave no further details. It said there is no impact on customers, partners or platform operations.

Your Part: Settings and Habits That Count

The security page lists the tools on your side: two-factor authentication, an anti-phishing code, management of enabled devices and a withdrawal address whitelist. For API users it adds permission-based access and IP whitelisting. The page calls them optional security settings, so most of them help only once you switch them on. The User Agreement does require two-factor authentication before your first crypto withdrawal (clause 7.8).

Authenticator-app 2FA deserves priority, and you benefit from switching it on early. Bitvavo's Account Guarantee page says the guarantee counts only that variant, and only if it has been active for at least 30 days before an incident. The same page adds that push-notification 2FA alone does not qualify.

The User Agreement adds duties. Users should not store their username and password together with other Bitvavo documents and should not leave a logged-in device unattended. They must protect API credentials and prevent third-party access to their email account (clause 14.1). Bitvavo says it cannot be held liable for third-party misuse of login or API credentials where the user or the user's negligence directly or indirectly caused it. Bitvavo strongly recommends two-factor authentication and may require it. Under clause 14.2 it is not liable for damage resulting from you not switching it on.

Bitvavo says it will never ask for your password or 2FA code except at login or when you change credentials (clause 14.3). You may never answer such a request, even if it appears to come from Bitvavo. If a call claims to come from Bitvavo, the help centre points to the "Bitvavo calling? Check it now" tool on any crypto withdrawal page.

Beyond that, withdrawals bring checks of their own, such as a cooldown for new accounts and wallet verification under the Travel Rule. The cooldown and the Travel Rule are covered under moving coins out in our review.

In practice, a straightforward order works well. Verify your identity, switch on authenticator-app 2FA and the anti-phishing code, then add your withdrawal addresses to the whitelist before you deposit larger amounts. The setup steps that most often delay a first withdrawal are in our Bitvavo beginner mistakes guide.

Pros and Cons of the Safety Setup

Set side by side, the safety setup looks like this.

The one caveat to the pros: most of them describe how Bitvavo is set up, while most of the cons describe what happens when something fails.

What Stays Your Risk

Several risks sit outside any licence or guarantee:

• •Prices. Digital assets are volatile, and Bitvavo's own footer warns that you may lose some or all of your investment.
• •Lending. Auto Earn combines staking and lending, and Bitvavo Custody B.V. provides the Lending Service. Users who opted in carry a residual credit risk and may lose part or all of the lent assets and rewards (clause 11.3).
• •Staking. Clause 10.5 says a slashing event or a protocol malfunction can lead to a full or partial loss, and that Bitvavo has no obligation to return the assets concerned.
• •Margin. Our video lists missing margin trading as a drawback, but the help centre now describes margin trading with long and short positions and leverage of up to 5x. It adds that margin longs and the leverage feature are still rolling out. The User Agreement also places the Margin Trading Facility outside MiCA, like lending and staking. Under the standard terms (clause 12.7), you pledge to Bitvavo Custody B.V. your claims against the foundation for the assets in your margin account. They secure your margin obligations.
• •Asset rules. The help centre says trade-only assets can be bought and sold but not deposited, withdrawn or staked. It also warns that sending an asset over the wrong network may result in the full loss of your funds.
• •Dormancy. If an account sits unused for 12 months and Bitvavo cannot reach the user, clause 4.14 allows custody fees. Once those fees exceed the balance, it also allows an unclaimed-property report and account closure, and the user then loses all rights to what remains. A running staking or lending contract is exempt. The practical step is to keep your contact details current.
• •Self-custody. Bitvavo's help centre says it is always recommended to withdraw digital currencies to your own external (cold) wallet if you want to be completely independent. Our video points the same way for larger amounts. Self-custody swaps platform risk for key and address risk, and blockchain transfers cannot be reversed. The trade-off is yours to weigh.

So, Is Bitvavo Safe Enough for You?

Layer by layer, the setup answers two questions and leaves a third open. The licence and the foundation address who can reach your assets in custody if Bitvavo fails, but not necessarily assets in the Lending Service. The Account Guarantee addresses what happens if someone takes over your login, within narrow conditions. For falling prices, a custody provider that defaults or a service outside MiCA that fails, the setup gives no clear answer.

In our view, that makes Bitvavo a reasonable licensed place to trade and hold crypto while you are active. It comes across as a weaker fit as a long-term store for a large balance. Overall, the contract is explicit about its limits, while the web pages are less consistent, for example on the insured amount and the country list.

The deciding factor is which of those questions matters most to you. Four questions help before you deposit:

• •Do you live in a country that Bitvavo's website serves, and does the note for Belgium or Spain apply to you?
• •Is authenticator-app 2FA switched on, and has it been for 30 days?
• •Do you know which services you have enabled, and that Auto Earn includes lending?
• •Could you cope with a total loss of what you keep on the platform?

None of this is investment advice. Only commit money you could afford to lose completely.

Every new account is subject to Bitvavo's internal policy review, and Bitvavo can change the terms of a promotion at any time. Sign-up through our link runs to 31 December 2026, while the page stays active.