VALR

Is VALR safe?

VALR is one of the better-run exchanges in Africa, with a clean security record and a South African licence. We found no theft from its wallets since it opened in 2018, no enforcement action, and two independent reserve checks. The limits are that those checks are yearly snapshots, there are no public audited accounts, and nothing insures or legally ring-fences your crypto if the company fails.

We score VALR 70/100, a little below Luno (75), its main South African rival, which publishes monthly proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary prepared with an accounting firm, and well below Kraken.

Who runs VALR?

The exchange is operated by VALR (Pty) Ltd, a South African company registered in 2018 and based in Johannesburg. It says it has more than a million users. The group has separate companies for derivatives (VALR DAM), lending (VALR Loans, a registered credit provider) and a Dubai arm (VALR FZE). Which one you deal with depends on the product and where you live; South African spot customers deal with VALR (Pty) Ltd.

Two 2026 products change who holds your money. Since July, "Perps" offers more than 200 leveraged perpetual contracts on shares, commodities, currencies and crypto, with liquidity sourced from Hyperliquid, a decentralised exchange. VALR DAM is the licensed provider, but VALR's own disclosure says order execution, margin, liquidation and funding rates are run by third-party liquidity providers and that VALR "disclaims any liability" for them. Since August, "Borrow" lends against crypto collateral through VALR Loans; its risk disclosure warns that you could lose some or all of the collateral if prices move against you.

Licences: strong at home, thin abroad

South Africa declared crypto assets a financial product in 2022, so exchanges giving advice or intermediary services need a licence from the FSCA. VALR (Pty) Ltd holds one as FSP 53308. It is also registered with the Financial Intelligence Centre, which means identity checks and suspicious-transaction reports. Its derivatives business, VALR DAM, got its own FSP and over-the-counterOver-the-counterA medicine you can buy without a prescription, in a pharmacy or shop, with directions on the pack for safe use without a doctor.More in the glossary derivatives licences from 24 November 2025 instead of working under another firm's licence.

Abroad the picture is weaker. In Dubai, VALR FZE has only initial approval from VARA and says it is moving to a proprietary trading licence. In the Cayman Islands it has provisional approval. An Indian affiliate is registered with India's financial intelligence unitFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary. VALR has no licence in the US, the UK, the EU or Japan, which is why licensing stays below 60.

How good is the proof of reserves?

In August 2025 Hacken, a blockchain security firm, ran a proof-of-reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary check: it took a signed snapshot of what VALR owed customers, verified the wallets VALR controls on-chain and confirmed that assets covered 100% or more of liabilities. A second one-off check followed in July 2026, published by Hacken on 1 September 2026.

Including liabilities is what matters, and VALR does that. The weaknesses are frequency and depth. A yearly snapshot can miss what happens in between, and a crypto security firm does not check the company's wider finances the way an accounting firm auditing full accounts would. Luno publishes a monthly report with Moore; Kraken lets customers verify their own balance.

How VALR holds coins

VALR describes a standard institutional set-up:

• most coins in multi-signatureMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, with keys held offline in vaults in several locations;
• multi-signature hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary for withdrawals, using cloud key management;
• no single person, including the chief executive, able to move funds alone;
• a full-reserve model where customers trade only with pre-funded balances and VALR does not lend out their assets.

The exception is VALR's opt-in DeFi lending, which sends customer coins to third-party protocols such as Aave. Its terms say there is no insurance on those funds and a protocol hack could mean total loss.

What is missing is legal protection. VALR's terms do not say customer crypto is held in trust or legally segregated, and its risk disclosures state that balances are not covered by deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary or any other government protection. In an insolvency, how customers would rank has not been tested in South African courts.

How to use VALR more safely

1. Switch two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary from SMS, which VALR turns on by default, to an authenticator app.
2. Check the whole withdrawal address before sending. VALR has warned about address poisoning, where a look-alike address is planted in your transaction history.
3. Stay out of DeFi lending unless you accept the smart-contract risk; it falls outside VALR's full-reserve promise.
4. Keep long-term holdings in a wallet you control. No insurance or trust protects coins on the exchange.

How we scored it

Security history (85) and legal record (85) are VALR's strongest factors: no known wallet theft and no enforcement action. Custody (55) is the weakest because there is no legal segregation or insurance. Reserves (60) and licensing (58) reflect yearly crypto-auditor checks and a licence that is strong in South Africa but thin elsewhere.