SQ-E03
ACCOUNT PRIVACY FILE
Crypto.com
A multi-product brand where custodial App, Exchange and self-custody Onchain have different entities, identifiers and data dependencies.
- REVIEW DATE
- STATUS
- partially verified
- CONFIDENCE
- medium
Written by SignalQuoin Editorial TeamIndependently reviewed by SignalQuoin Review TeamPublished by SignalQuoin Team
EDITORIAL ASSESSMENT
The most important privacy finding is categorical: there is no single Crypto.com data path. Account-based App and Exchange services must be separated from Onchain's user-held recovery material and protocol interactions.
- App and Onchain custody distinction is public
- Onchain legal provider is named
- Regional regulator records can be checked
- No complete cross-product telemetry map
- Security certifications are provider disclosures requiring scope validation
- The public PoR reference is a 2022 snapshot
CLAIM → EVIDENCE → LIMIT / 5
The privacy ledger
Custodial identity
- CLAIM UNDER REVIEW
- The App is account-based and custodial; Onchain is a separate self-custody wallet.
- EVIDENCE FOUND
- Crypto.com explicitly distinguishes private-key control and account requirements.
- DO NOT INFER
- The distinction does not prove what telemetry either application sends.
Onchain provider
- CLAIM UNDER REVIEW
- Onchain has a separate legal provider and protocol-facing risk model.
- EVIDENCE FOUND
- The terms name Onchain Wallet Limited in the Cayman Islands and describe third-party dependencies.
- DO NOT INFER
- Entity location does not establish lawful availability or audit status in every user market.
Sources: Crypto.com Onchain Terms ↗
US account entity
- CLAIM UNDER REVIEW
- US App and Web services have their own entity allocation.
- EVIDENCE FOUND
- The US terms identify Foris DAX Inc. and, for specified services, affiliates including Foris Services Inc.
- DO NOT INFER
- This cannot be applied to the Exchange, Onchain or non-US services.
Sources: Crypto.com US App and Web Terms ↗
Security claims
- CLAIM UNDER REVIEW
- Crypto.com reports passkeys, MFA, HSM and multiple certification or assurance programmes.
- EVIDENCE FOUND
- The security page lists the controls and named standards.
- DO NOT INFER
- A provider list cannot prove default activation, certificate scope, incident absence or data minimisation.
Sources: Crypto.com security disclosures ↗
Reserve disclosure
- CLAIM UNDER REVIEW
- The public PoR path is historical and product-specific.
- EVIDENCE FOUND
- The page points to a December 2022 agreed-upon-procedures snapshot.
- DO NOT INFER
- It is not a current financial audit, privacy assessment or proof that all customer obligations are covered.
Sources: Crypto.com Proof of Reserves ↗ · MAS directory — Foris DAX Asia Pte. Ltd. ↗
EXPERT PRIVACY REVIEW / 8 FLOWS
From identity edge to revision trigger.
Crypto.com App, Exchange and Onchain as separate data systems. The file follows identity, custody, embedded services and regulator evidence without assigning one product's privacy properties to the others.
Readers willing to identify the exact Crypto.com surface and regional entity before evaluating convenience, custody or privacy.
Anyone expecting one controller, one identity threshold or one deletion path across the brand, or treating a self-custody key model as proof of no metadata processing.
App and Onchain custody distinction is public
A standalone wallet can reduce ecosystem account-linking; Kraken or Coinbase provides a different hosted-account disclosure trail but retains KYC and financial-account data.
IDENTITY / AUTHORITY BOUNDARY
The App is a KYC custodial brokerage, Onchain is user-custodied and can operate without the same account, and Exchange access depends on product and region. Each surface introduces its own provider and purpose.
- 01
A user compares App KYC and an Onchain empty-wallet setup, then documents an internal transfer and one Exchange permission path without merging their data conclusions.
- 02
App-to-Onchain handoff: KYC App balance → withdrawal/internal handoff → user-controlled address
- 03
Exchange API permission: Verified Exchange account → API key → read/trade calls → revocation
- 04
Alternative path: A standalone wallet can reduce ecosystem account-linking; Kraken or Coinbase provides a different hosted-account disclosure trail but retains KYC and financial-account data.
| FLOW QUESTION | BOUNDED FINDING | PROOF STATE | VERIFICATION PLANNED |
|---|---|---|---|
| Where is identity mandatory? | The official comparison states that the custodial App requires KYC while Onchain can be used without a Crypto.com account. | SUPPORTED RECORD | Capture the current onboarding fields for each product separately. |
| Who controls keys? | App users instruct a custodian; Onchain users control private keys. The transfer between them changes recovery authority and data context. Crypto.com App versus Crypto.com Onchain ↗Crypto.com Onchain Terms ↗ | SUPPORTED RECORD | Trace an empty or minimal-value transfer and record identifiers at both ends. |
| Which operator and market apply? | US terms and regulator records can establish specific entities, but they cannot be stretched to every product or jurisdiction. Crypto.com US App and Web Terms ↗MAS directory — Foris DAX Asia Pte. Ltd. ↗ | PARTIAL RECORD | Match account, contract, product and primary register entry. |
| What do certifications prove? | Security certifications and account controls are provider evidence whose scope and current validity must be checked; they do not prove every product path. | PARTIAL RECORD | Validate report scope and observe defaults without handling material funds. |
| How does money join the profile? | App and Exchange funding can connect identity, payment and transaction data; Onchain settlement instead exposes public-chain and RPC metadata. Crypto.com App versus Crypto.com Onchain ↗Crypto.com US App and Web Terms ↗ | PARTIAL RECORD | Map bank, internal-transfer and on-chain recipients as three distinct routes. |
| What can embedded services access? | Onchain dapps and Exchange APIs can create permissions beyond the base wallet or account. The current file has not observed endpoint or consent detail. | VERIFICATION PLANNED | Inspect permissions and network requests with an empty wallet and read-only credentials. |
| Who can recover what? | App support can assist a hosted account; it cannot recreate a lost self-custody secret under the same model. Crypto.com App versus Crypto.com Onchain ↗Crypto.com Onchain Terms ↗ | SUPPORTED RECORD | Ask a classification question and verify that support preserves the correct product boundary. |
| How are claims kept scoped? | PoR and security pages are provider records; regulator entries are entity records. Each supports a different claim and review date. Crypto.com Proof of Reserves ↗MAS directory — Foris DAX Asia Pte. Ltd. ↗ | PARTIAL RECORD | Refresh dates, scope and product mapping before each update. |
| SCENARIO | SEQUENCE | DATA DISCLOSED | OPEN QUESTION |
|---|---|---|---|
| App-to-Onchain handoff | KYC App balance → withdrawal/internal handoff → user-controlled address | App identity and transaction record plus public address and network settlement. Crypto.com App versus Crypto.com Onchain ↗Crypto.com Onchain Terms ↗ | Does an internal handoff link the wallet address to the custodial profile beyond transaction necessity? |
| Exchange API permission | Verified Exchange account → API key → read/trade calls → revocation | Account identity, key scope, IP/device and trading events depending on implementation. | Which scopes are default, is withdrawal separate, and what audit log is exposed? |
Create three columns—App, Exchange, Onchain—and never fill a blank from another column. For each action record controller, identity, keys, endpoint, recipient, retention statement, fee and user control.
Medium for the documented custody split and selected regional records; insufficient for actual cross-product account linkage, telemetry, vendor list, support access and rights execution.
- The App/Onchain custody or identity description changes.
- A regional entity or licence no longer matches the product under review.
- Observed cross-product identifiers or endpoints materially alter the data map.
CHANGE / REVISION TRAIL
Rechecked the App/Onchain split, security and regulator surfaces; expanded three-product data scenarios.
Opened the product-separated privacy dossier.
The App/Onchain custody or identity description changes.
DECISION FAQ
Does Onchain require the same KYC as the App?
The cited official comparison says Onchain does not require a Crypto.com account, while the App uses KYC.
Can a licence for one entity cover the whole brand?
No. Entity, activity, product and jurisdiction must match.
Were cross-product identifiers observed?
No. Endpoint and linkage observation is planned.
What would change this privacy conclusion?
The App/Onchain custody or identity description changes. A regional entity or licence no longer matches the product under review. Observed cross-product identifiers or endpoints materially alter the data map.
PRIMARY SOURCE REGISTER
6 records
Source access and applicable scope were recorded on 16 August 2026; records are attributed by class.- productCrypto.com App versus Crypto.com Onchain ↗Retrieved 2026-08-16
- termsCrypto.com Onchain Terms ↗Retrieved 2026-08-16
- termsCrypto.com US App and Web Terms ↗Retrieved 2026-08-16
- productCrypto.com security disclosures ↗Retrieved 2026-08-16
- productCrypto.com Proof of Reserves ↗Retrieved 2026-08-16
- regulatorMAS directory — Foris DAX Asia Pte. Ltd. ↗Retrieved 2026-08-16