The short version
- Decide custody first. Exchange-held or your own keys — everything else follows from that answer.
- The instant-buy button is the expensive product. All-in cost typically sits around 1.5% to 4%; the order book on the same account typically charges 0.1% to 0.6%.
- Bank transfer beats cards. ACH, SEPA and Faster Payments are cheapest; cards cost materially more and may be treated as a cash advance.
- Identity checks are a legal requirement, not a marketing exercise — exchanges are money services businesses with Bank Secrecy Act obligations.
- Exchange balances are neither SIPC nor FDIC insured. In a bankruptcy, customers are typically general unsecured creditors.
The decision that comes first
Most guides to buying bitcoin begin with account setup. That is the wrong end of the problem. The first question is not where you buy but who ends up holding the coins, because the answer changes which venue suits you, whether you need hardware before you start, and what you should do in the ten minutes after the order fills.
There are two honest answers and both are defensible. Leave the bitcoin with a licensed exchange and you get password resets, two-factor authentication you can recover, a support desk, and a regulated entity with something to lose. What you also get is counterparty risk: your bitcoin is an entry in someone else's database, and you are relying on that company remaining solvent and honest. Withdraw to a wallet you control and the counterparty risk disappears entirely. In its place arrives a different risk, and it is not a small one.
That trade — counterparty risk swapped for key-management risk — is the whole of the custody debate, and anyone who tells you one side is obviously correct is selling something. Most people who lose bitcoin lose it to their own mistakes rather than to an exchange failure. Both statements are true at once.
The mistake we see most often
People treat the seed phrase as a formality and the exchange password as the serious security decision. It is the other way round. The password is recoverable; the seed phrase is not. If you are going to self-custody, do the boring part properly before you buy anything — write the words on paper, verify them by restoring the wallet from them, store them somewhere fire and flood will not find them, and never photograph them or type them into anything connected to the internet. If that sounds like more responsibility than you want, that is a completely legitimate conclusion, and the answer is to keep the coins with a licensed custodian or to hold a fund instead. What does not work is deciding to self-custody and then doing it casually.
The seven steps
What follows is the whole process in order. Steps one and five are where the money is; the rest is administration.
-
Decide who holds the coins before you decide anything else
Every other choice on this page follows from this one. You can leave bitcoin on the exchange that sold it to you, in which case the exchange holds the private keys and you hold a claim on the exchange. Or you can withdraw it to a wallet whose keys only you control.
"Not your keys, not your coins" is a real principle, and it has a real cost. The cost is that you become solely responsible for a twelve or twenty-four word seed phrase. Nobody can reset it, nobody can email it to you, and no support desk can recover it. Decide now which of those two risks you would rather carry, because it determines whether you need a hardware wallet before you place a single order.
-
Choose a venue that is licensed where you live
Exchanges, brokerage apps, payment apps and peer-to-peer marketplaces all sell bitcoin, and they differ enormously in price and in risk. The venue types are compared in detail on where to buy crypto — that page owns the comparison and this one owns the process.
The screening test is short. Does the venue hold the licences required in your jurisdiction? Does it publish a fee schedule you can read before you sign up? Does it let you withdraw bitcoin to an external address, or only sell it back? A venue that fails the third test is selling you price exposure, not bitcoin.
-
Pass identity verification — and understand why it exists
You will be asked for a government ID, a selfie, an address and often a source-of-funds question. This is not the exchange being nosy. In the United States a crypto exchange is a money transmitter and therefore a money services business under 31 CFR Chapter X. That brings four concrete obligations: registration with FinCEN, a written anti-money-laundering programme, suspicious activity reporting, and the Travel Rule, which requires originator and beneficiary information to travel with qualifying transfers.
Two practical consequences. Use your legal name exactly as it appears on the document, because a mismatch is the most common cause of a rejected application. And expect that a large first deposit, or a withdrawal to an address the exchange cannot place, may trigger a review. That is the system working as designed, not a sign that something has gone wrong.
-
Fund the account by the cheapest route that suits your timing
Funding is where most first-time buyers lose money without noticing, because the fast method and the cheap method are never the same one. Bank transfer — ACH in the US, SEPA in the euro area, Faster Payments in the UK — is usually the cheapest and sometimes free. Cards are convenient and materially more expensive. The full ranking is in the funding section below.
If you are buying for the first time, consider sending a small deposit before a large one. You confirm the rails work end to end for the price of a rounding error.
-
Switch to the professional order book before you buy anything
This is the step that saves the most money and the step almost nobody takes. The big friendly buy button on the front of the app is the expensive product. The order book on the same account, usually one tab away, is the cheap one. Coinbase calls it Advanced Trade, Kraken calls it Kraken Pro, Gemini calls it ActiveTrader.
Same account, same funds, same asset, same withdrawal address. Typically ten to twenty times the difference in cost. The arithmetic is set out in full below.
-
Place a limit order rather than a market order
A market order says "fill me now at whatever the book offers". A limit order says "fill me at this price or better, or do not fill me at all". On a deep bitcoin book in normal conditions the difference is small; in a fast market it is not, and a limit order is the only instruction that cannot surprise you.
Two mechanics worth knowing. A resting limit order that adds liquidity usually pays the lower maker fee; an order that crosses the spread immediately pays the taker fee. And you can enter the order in dollars or in bitcoin — entering it in bitcoin makes the quantity exact and leaves the dollar amount to vary, which is usually what a recurring buyer actually wants. The same order-type logic applies to funds, which we cover in the guide to market, limit and stop orders.
-
Decide whether to withdraw, and test the route with a small amount first
If you decided in step one to self-custody, do it deliberately. Generate the wallet, write the seed phrase on paper, verify it, then send a small test amount — the equivalent of a coffee — and confirm it arrives before moving the rest.
Check the network before you press send. Bitcoin sent to an address on a different chain is generally unrecoverable, and this is the single most common way people lose coins during a withdrawal. Exchanges charge a withdrawal fee that is unrelated to the trading fee, so batching one larger withdrawal usually beats several small ones.
Ready to run through those steps for real?Opening an account, verifying identity and funding by bank transfer takes most people under fifteen minutes — and bitcoin bought this way can be withdrawn to a wallet you control.
Start buyingThe two prices for the same trade
Here is the single most useful thing anyone can tell a first-time bitcoin buyer. Almost every major exchange runs two pricing regimes for the identical trade, and the one the interface pushes you towards is the expensive one.
The "simple" or "instant buy" flow — the large button on the home screen, the one with your card details already saved — bundles a stated fee with a spread applied to the quoted price. Add them together and the all-in cost typically lands somewhere in the region of 1.5% to 4%, depending on size and funding method. The spread is the part people miss, because it does not appear as a line item. It is simply a worse price.
The professional order book on the same account, reached through a tab or a menu item, charges maker/taker fees that typically sit in the 0.1% to 0.6% range and fall further with volume. Same account. Same verified identity. Same deposited funds. Same bitcoin, into the same balance, withdrawable to the same address. Often ten to twenty times cheaper.
The typical cost difference between an exchange's instant-buy flow and the professional order book on the very same account. On a $5,000 purchase, that is roughly the gap between $10 and somewhere north of $100.
The names differ, the pattern does not. Coinbase calls its order book Advanced Trade. Kraken calls it Kraken Pro. Gemini calls it ActiveTrader. Crypto.com splits it into an App and an Exchange, which are genuinely different products with genuinely different pricing.
We should say plainly what this is. The expensive path is the default path across the entire sector, and it is signposted as the easy one rather than the costly one. That is a fair criticism of the industry, not a quirk of one platform. The interfaces are not difficult — an order book takes about five minutes to understand and the concepts are the same ones any stock trader uses. But you have to know it exists to go looking for it, and nothing in the onboarding flow tells you.
Cost of the trade Funding methods, ranked by cost
The trading fee is only half the bill. How the money arrives matters just as much, and the ranking is stable across venues even though the exact numbers are not.
Bank transfer is first, and it is not close. ACH in the United States is usually free or close to it — some venues absorb the cost entirely — and SEPA in the euro area and Faster Payments in the UK behave similarly. The trade-off is time: an ACH deposit commonly takes one to three business days to clear, and some venues restrict withdrawal of the purchased bitcoin until it has. Faster Payments and SEPA Instant are far quicker. If you are not in a hurry, this is the answer, and the saving over a card compounds every time you buy.
Debit and credit cards are next, and materially more expensive. The convenience is real — funds land instantly and the purchase completes in one flow — but you are paying card network interchange, the acquirer's margin and the venue's own markup, and on an instant-buy flow that stacks on top of the spread. There is a second problem specific to credit cards: many issuers treat a crypto purchase as a cash advance, which means a separate fee, a higher interest rate and no grace period. That charge comes from your bank, not the exchange, and no exchange disclosure will warn you about it. Check your card's terms before you use it, and as a general matter, buying a volatile asset with borrowed money at cash-advance rates is a bad idea on its own merits.
Wire transfers sit apart because they are priced as a flat fee rather than a percentage. A $25 wire fee is 2.5% on $1,000 and 0.025% on $100,000. Wires only make sense at size, which is exactly why institutional flow uses them and retail rarely should. For genuinely large tickets the calculus changes again, and the venue changes with it — see how OTC desks work.
Third-party payment wallets vary wildly. Some venues accept PayPal, Apple Pay or Google Pay. These are usually priced like cards because that is functionally what they are. Convenience has a price and it is charged here too.
A cheap habit worth forming
Keep a small fiat balance sitting on the exchange, topped up by bank transfer on a schedule you do not think about. Then every purchase is a limit order against funds already in the account, at order-book rates, with no card fee and no clearing delay. It converts the expensive-but-instant decision into a cheap-and-instant one.
Self-custody, honestly
If you have decided to hold the keys, here is what that actually involves, without the evangelism.
A hardware wallet is a small dedicated device that generates and stores your private keys offline and signs transactions without the keys ever touching an internet-connected computer. It is the standard answer for meaningful sums. Buy it from the manufacturer directly rather than a marketplace reseller — supply-chain tampering is a real attack — and set it up yourself. A device that arrives with a seed phrase already printed on a card in the box is a scam, without exception.
The seed phrase is the whole wallet. Twelve or twenty-four words, generated by the device, from which every key in the wallet is derived. Anyone with those words has your bitcoin regardless of the PIN on the device. Lose them and, if the device also fails, the coins are gone permanently — there is no issuer, no registrar and no court that can restore them. Write them on paper or stamp them into metal. Do not photograph them, do not store them in a password manager or a cloud note, and do not type them into any website that asks, because a legitimate service never will.
Then test the route. Withdraw a trivial amount from the exchange first, confirm it arrives in the wallet, and only then move the rest. Verify the receiving address on the hardware device's own screen rather than trusting what the computer displays, because clipboard-hijacking malware that swaps a pasted address is one of the oldest attacks in this market and still works.
The honest counterpoint, one more time: self-custody does not remove risk, it relocates it. Coins are lost to house fires, forgotten hiding places, illegible handwriting, unrecorded passphrases, and heirs who had no idea a wallet existed. Those failures are far more common than exchange collapses. A reasonable middle path is to keep a working balance on a licensed venue and the long-term holding in self-custody, sized so that no single failure is catastrophic. If none of this appeals, that is a legitimate reason to prefer the fund wrapper, and the list of US spot Bitcoin ETFs is the place to start.
What protects you — and what does not
This section is deliberately unexciting, because the facts do the work.
Crypto held on an exchange is neither SIPC nor FDIC insured. SIPC protects securities held in a failed US brokerage, up to $500,000 with a $250,000 cash sub-limit, and it explicitly does not protect against a decline in value. FDIC insures deposits at insured banks. Neither scheme covers a bitcoin balance at a crypto exchange. Some venues hold customer dollars at partner banks in a way that may attract pass-through FDIC coverage on the cash leg only — that is a genuinely different thing from your bitcoin being insured, and marketing copy sometimes blurs the two.
In a platform bankruptcy, customers are typically general unsecured creditors. Whether customer crypto is property of the estate turns on the platform's own terms of service and how assets were held, and recent history has produced years-long proceedings and recoveries well below one hundred cents on the dollar. This is a statement of fact, not a scare story, and it cuts two ways. It is the strongest argument for self-custody. It is equally the strongest argument for choosing a venue with real licences, published disclosures and a regulator that can turn up unannounced. We work through the full risk taxonomy in what can actually go wrong.
Structure matters more than branding. A limited-purpose trust company chartered by a state banking regulator holds assets under a legal regime designed for custody. A money transmitter licence is a different and lighter thing. Neither is a deposit guarantee. Read what the venue actually says about how customer assets are held rather than what its homepage implies, and be sceptical of the word "insured" wherever it appears without a named insurer and a stated limit.
Buy the coin, then decide where it lives
An exchange account gets you bitcoin in minutes and lets you withdraw it to your own wallet whenever you choose. The custody decision stays yours, which is the point.
Trading since 2013, with US state money transmitter licences and a UK cryptoasset registration with the FCA.
The tax you have just created
Buying bitcoin with dollars is not a taxable event; it sets your cost basis. Everything you do afterwards potentially is. Under IRS Notice 2014-21 virtual currency is treated as property, so every disposal produces a capital gain or loss — selling for dollars, spending it on something, and, critically, swapping one crypto asset for another, which catches people who never moved a dollar and assumed nothing had happened. Holding period splits at one year for the long-term rate. Form 1040 also asks a digital asset question on page one that everybody must answer, including with a "no". Broker reporting has arrived: Form 1099-DA covers gross proceeds for transactions on or after 1 January 2025, with basis reporting on certain transactions from 1 January 2026. Keep your own records anyway, because basis for coins acquired before that window may simply be blank on the form. Our tax guide covers the differences between holding coins and holding a fund, including the wash-sale asymmetry that favours direct holders.