Note

Who Holds the Coins Mid-Trade? CEX, DEX and Escrowed P2P

Exchange models differ in who holds the assets while a trade is in progress and what identity is collected: a CEX balance is a claim, a DEX settles in code, escrowed P2P locks coins in multisig.

2026-11-13 · dex, cex, kyc, custody, self-custody, escrow, multisig, p2p-exchange, verify-before-trust, civil-liberties

Listen · 7 min · AI voice

Dark CryptoDecentral hex mesh with three lit hexagons in a row: a solid bronze hexagon enclosing a smaller teal one, an open teal hexagon joined by a thin line to one small node below, and a hexagon ring split into separate teal and bronze segments with gaps between them; no text.

"Exchange" covers several different arrangements: a company with a login page, a program on a blockchain, or software that locks two strangers' coins in a shared box. Arguments about which is "better" usually skip what actually differs.

Thesis, stated once: the useful difference between exchange models is who holds the assets while a trade is in progress, and what identity the operator collects. It is not about which model is better.

Centralised exchange: a balance is a claim

A centralised exchange (CEX) is a business that holds its customers' assets in wallets it controls and records each customer's share in its own ledger, so the balance shown in an account is a claim on the operator, not coins under the customer's keys. CryptoDecentral calls that an IOU; the exact rights depend on the operator's terms and local law.

Trades between customers can be settled as entries in the operator's own ledger. Withdrawal is the moment that matters, and it depends on the operator having the assets and being willing and permitted to send them. An operator can pause, limit or freeze withdrawals, and a customer cannot override that with a key they never held. As an earlier note puts it, an exchange balance is an IOU. The FATF Glossary counts exchange and "safekeeping and/or administration of virtual assets" as virtual asset service provider (VASP) activity, which brings identity checks in.

KYC: what customer due diligence collects

Know your customer (KYC) is the everyday name for customer due diligence: the identity checks a regulated financial business must run on its customers before and during a relationship, and the records it must keep afterwards.

The global reference point is FATF Recommendation 10. FATF sets the international standard; each country writes its own law. Recommendation 10 bars "anonymous accounts" and lists four measures: verifying the customer's identity "using reliable, independent source documents, data or information"; identifying the beneficial owner; understanding the purpose of the relationship; and ongoing scrutiny of transactions, "including, where necessary, the source of funds." The Interpretive Note to Recommendation 15 applies these rules to VASPs. The stated purpose is combating money laundering and terrorist financing, and where the checks cannot be completed, Recommendation 10 says the business "should be required not to open the account".

The data outlives the relationship. Recommendation 11 asks for records, including "copies or records of official identification documents like passports, identity cards, driving licences", to be kept "for at least five years after the business relationship is ended" and made available to competent authorities. A store of identity documents can also become a breach target. Recommendation 2 asks countries to keep these rules compatible with data protection and privacy law.

DEX: a contract settles, your wallet signs

A decentralised exchange (DEX) is a set of smart contracts that settles trades on a blockchain: the user's own wallet signs each transaction, and the contract moves the assets according to its code, so no operator takes custody of them during settlement.

Ethereum's documentation describes a smart contract as a program that is "not controlled by a user," and notes that "interactions with them are irreversible." The contract has no sign-up form, but that is not privacy: addresses and transactions sit on a public ledger, and whoever runs the website or node a wallet talks to can see its requests, the point of our note on network privacy.

Removing custody does not remove risk: a contract can contain bugs or privileged controls. Token approvals let a contract spend a wallet's tokens later; Ethereum's guide on revoking access warns that an unlimited approval can be used "even if you have withdrawn your funds from their platform." The website in front of the contract is a separate piece, covered in a later note. And no one can reverse a mistaken trade.

Escrowed P2P: a shared lock and a referee

An escrowed peer-to-peer (P2P) exchange matches two traders directly and locks the coins being traded, plus both traders' security deposits, in a multisig escrow, so neither trader can take the funds alone, and a defined dispute process decides the payout if they disagree.

The national-currency leg, such as a bank transfer, happens outside the software; deposits make abandoning a trade costly. Two open-source projects document different locks.

Haveno uses a 2-of-3 Monero multisig: "the 3 keys are distributed one each to the two traders and one to the arbitrator." Normally the traders sign; in a dispute the arbitrator uses the third key to side with one of them, and can award a misbehaving trader's deposit to the other. The arbitrator cannot move funds alone; the FAQ says arbitrators "never have custody of trade funds, because they hold only one of three keys." Trust in their judgment remains.

Bisq (the Bisq 1 trading rules; Bisq 2 and Bisq Easy are not covered here) once used that design too. Its rules say that since v1.2 trade funds sit in a "2-of-2 multisig escrow" between the traders, and arbitrators "no longer have a key." A time-locked transaction made at the start of each trade can, if mediation fails, send the whole escrow to the Bisq donation address, a role approved by DAO vote; an arbitrator who rules for a trader reimburses them personally and claims it back from the Bisq DAO.

Neither project's documentation describes identity checks by the software; Haveno's FAQ says it "is and will always be non-KYC." Identity still flows sideways: Bisq's rules expect the name on a payment account to match the trade's payment details, so the counterparty sees it. Haveno's official repository does not support real trades directly; its README says those run on third-party networks, none of which it endorses.

Side by side

	CEX	DEX	Escrowed P2P
Who holds the assets during a trade	The operator	The user's wallet, until the contract settles	A multisig escrow neither trader controls alone
Who signs	The operator	The user's wallet	Both traders; in a dispute, Haveno's arbitrator key or Bisq 1's time-locked payout
Identity collected	CDD under national law based on FATF R.10	None by the contract; public addresses, and requests seen by website and node operators	None described for the software in project docs; payment details visible to the counterparty
Who resolves disputes	The operator	No one; settlement is final	Mediator or arbitrator, as each protocol defines

What this is not

This is not a ranking; each model swaps one dependency for another. Bisq and Haveno are named only as documented examples of the escrow mechanism, not recommendations, and CryptoDecentral has not traded on any venue described here. It is not a guide to buying, selling or trading, and says nothing about prices, fees or returns. It is not legal or compliance advice: KYC obligations depend on each country's law. And "no KYC" is not anonymity; payment rails and public ledgers carry their own identifiers. Project behaviour is as documented on 13 November 2026.

The one-line takeaway: before asking whether an exchange is good, ask who holds the coins mid-trade, who can sign them out, and who learns your identity.