Bitvavo review 2026

ExchangeFacts verdict

Bitvavo is the most user-friendly route for Dutch beginners: iDEAL, instant SEPA and a MiCA licence via the AFM. But the taker fee (0.25%) and spread are higher than at sharper competitors, and the 2022 Genesis loss — despite full compensation — weighs on the security score. Fine for small, simple buys; cost-conscious or active traders will find cheaper options.

Best suited for

Overview

Founded in Amsterdam in 2018, Bitvavo has grown into the largest crypto exchange in the Benelux, with more than 2 million users. It is known for its simplicity, Dutch support and instant EUR onboarding via iDEAL and SEPA.

Licensing & regulation

• MiCA licence: via AFM (Netherlands)
• EU supervision: under MiCA, no warnings
• MiFID II: no — no perpetuals or derivatives
• GDPR & AML: no enforcement known — there are, however, open questions about internal access to customer data up to spring 2024, see track record

Products

Costs

• Maker: 0.15% (entry) → down to 0% at high volume
• Taker: 0.25% (entry) → down to 0.02% at high volume
• Spread: ~0.11% on BTC/USDC — higher than competitive exchanges
• Deposits: 0% via SEPA, iDEAL free

The 0.25% taker fee is high for the sector. With spread, total costs can reach ~0.36% per order for small users.

Yield & capital efficiency

• Staking: yes, on selected assets (ETH, SOL, ADA, DOT)
• Yield on collateral: n/a (no perpetuals/collateral)
• Cross-collateral / unified wallet: n/a

Proof of Reserves

• Frequency: quarterly
• Method: independent attestation
• Coverage: 13 assets (BTC, ETH, EUR, etc.)

Track record

• Operating since 2018: market leader in Dutch retail trading, with a DNB registration since 2020 and a MiCAR licence from the AFM since 2025.
• No enforcement known: there is no public fine, warning or measure from DNB or the AFM against Bitvavo.
• Genesis loss (2022–23): hundreds of millions in client crypto were outstanding at the collapsed Genesis. Bitvavo guaranteed the balances from its own funds and repaid clients in full — but in our security pillar a loss of client funds counts, regardless of compensation.
• The co-founder left (July 2025): CEO Mark Nuvelstijn stepped down from his duties after publications by Het Financieele Dagblad (the Dutch financial newspaper) about his private investments. According to that newspaper, he transferred millions to the later convicted investment fraudster Max R. and declared those transfers to his bank as a loan, so the money laundering checks were not triggered. He has not been prosecuted or convicted for this. Bitvavo had an external investigation carried out; the outcome has not been made public.
• Management could access customer data: Bitvavo confirmed in 2025 that managers were able to view personal customer data until the spring of 2024. According to the company this was necessary in the early years because they helped with registration and customer questions, and the permissions have been restricted since then. Professor of privacy law Gerrit-Jan Zwenne called that broad access “at odds with the privacy law” and “a risky and therefore problematic choice”. A supervisory authority has not given an opinion on it.
• Data breach (May 2024): a limited group of users was notified that name, address, IBAN and recent trading volume, among other things, had been exposed. Bitvavo reported it to the Autoriteit Persoonsgegevens (the Dutch privacy regulator). The number of customers affected and the cause have never been disclosed.
• Scams using the Bitvavo name: the Fraudehelpdesk (Dutch fraud reporting centre) received more than 1,800 reports in 2025 about criminals posing as Bitvavo, compared with 716 the year before. Those are reports to a reporting centre, not established cases, and it concerns fraud by third parties — not a leak at the exchange. It is, however, a reason never to respond to phone calls made in the name of Bitvavo.
• X account hacked (October 2024): the official account briefly promoted a non-existent “BVAVO token”. Bitvavo confirmed the hack and got the account back; nothing is known about any damage.
• Reclame Code Commissie (Dutch advertising self-regulator, 2022): the claim of “one million Dutch users” in a TV commercial did not hold up. That is a recommendation from a self-regulatory body, not a fine.

Since July 2025 Bitvavo has had no permanent CEO. A successor has been identified, but the AFM still has to assess that appointment. What is set out above concerns governance, data and reputation — not the balances themselves: customers have not lost money at Bitvavo, not even with Genesis.

Reviewed on 10 August 2026 · Sources: Bitvavo news updates ↗ · NOS on access to customer data ↗ · Security.NL on the data breach ↗ · Fraudehelpdesk ↗ · Reclame Code Commissie ↗

Pros / cons

Score breakdown in detail

Every point is traceable per methodology v1.6 (as of 23 August 2026):

Frequently asked questions