Safekeeping of funds and security

The thesis of this lesson: you protect capital off the chart

The best strategy will not protect funds that vanish through missing 2FA or a “broker” without a licence. The safety of your funds is a separate layer: where you keep the money, who has access to the account, how you verify identity, and what you do when something raises doubt. It is a procedure, not “extra caution”.

Segregation of funds — what it means in practice

Segregation means client funds are held separately from the company’s own assets. Three questions matter, and the answers sit in the documents, not on the marketing page:

1. Who the legal entity is that you sign the agreement with — a trading name is not enough.
2. Where the funds actually sit — whether they are in accounts separated from the company’s assets, and the instruments with a custodian.
3. What protection scheme applies if the firm becomes insolvent — an investor compensation scheme exists, but its payout is capped at a statutory limit expressed in euro. Do not assume you will recover the whole balance.

The third question matters most with larger amounts. If you hold more with a single entity than the scheme’s upper limit, the excess above it is not covered. That argues for splitting capital across institutions, not for choosing the “safest broker”.

A client account versus the broker’s own account

These accounts differ in who owns them. The firm’s own account belongs to the company, so on bankruptcy its funds join the insolvency estate. A client account has a different beneficiary — the client — and client funds stay out of that estate. That account does not belong to you either: you have no view into it, and your balance exists only in the broker’s records, which are the evidence of your claim.

With individual segregation each client has a separate account; with an omnibus account the funds of many clients sit together and the split exists only in the firm’s books. In a dispute it is you who must prove your balance in those books, so ask how the broker segregates funds and in whose accounts.

What happens if the broker goes bankrupt

Bankruptcy triggers a procedure, not a transfer of your balance back to you. The administrator establishes the state of claims as of the date of the event and draws up a list of eligible parties — you must be on it and document your claim.

Financial instruments sit in the custody chain described in the lesson on instruments and markets, not on the firm’s balance sheet. Cash is covered by the compensation scheme up to its upper limit; anything above that you pursue as a claim. This takes months — segregation is a procedure, not a guarantee.

The compensation scheme — who is covered and up to what amount

A payout when an investment firm becomes insolvent is provided by a mandatory compensation scheme, administered in Poland by the National Depository for Securities (KDPW) under the supervision of the KNF. Brokerage houses, banks conducting brokerage activity, and fund management companies take part.

The protection covers cash in the account and the value of lost financial instruments. It does not cover trading losses — a disputed position is handled by a complaint, not by compensation.

Compensation is 100% up to the equivalent of EUR 3,000, and above that 90% of the excess — with an upper limit of the equivalent of EUR 22,000 per investor (Article 139 of the Act on Trading in Financial Instruments). Status as of September 2026 — confirm the amounts in the Act and in KDPW materials.

The limit is counted per investor, not per claim: claims against the same firm add up, so a brokerage account and a funds account with one broker share a single limit. With a larger balance the protection is a margin — the lesson capital plan shows how to split capital.

Where your funds actually sit — jurisdiction

The legal regime is set by the country of the entity maintaining the account — not by the website’s language or the currency. A broker may hold client assets at a bank in another country than its registered seat, and each layer has its own route for pursuing a claim.

• Legal entity: the name and registered address from the agreement.
• Account country: the first two characters of the IBAN indicate the bank’s country.
• Place of custody: a document naming the custodian and the jurisdiction.
• Passport: an EU firm operates under a licence from its home country — supervised by that country’s authority, not by the KNF.
• Enforcement: whether a claim can actually be enforced in that jurisdiction.

Comparison table of custody models

Checklist before your first deposit

Seven points to check before you deposit:

1. The entity maintaining the account: full name and registered seat from the agreement.
2. Licence: an entry in the supervisor’s register and none on the KNF warning list.
3. Passport: its own licence in Poland or a licence from another EU country.
4. Place of custody: the custodian and jurisdiction from the asset custody disclosure.
5. Insolvency: participation in the compensation scheme and the limit on your claims.
6. The account you pay into: the recipient name and IBAN country consistent with the agreement.
7. Withdrawal test: a return transfer carried out and recorded with the date.

With crypto, these points come down to the MiCA regime.

The pre-deposit test — the recipient’s name

This is the single most effective test you can run, and it takes a minute.

1. Take the legal entity name from the agreement (not from a banner on the website).
2. Check that name in the supervisor's register and on the public warning list.
3. On your first deposit, check whose account you are sending the transfer to.
4. The name of the transfer recipient must match the entity from the agreement, or a
   clearly designated entity handling payments on its behalf.

If the money is meant for a private account, an unrelated company, or an account abroad with no explanation in the agreement — stop. That single signal precedes most stories that end in lost funds.

The withdrawal test

The second simple procedure worth running before you deposit the capital you intend to trade with:

Only after that test do you deposit more. Many investors check the deposit route and never the withdrawal route — and it is the latter that must work when things go wrong.

Protecting access — a checklist

The most common mistake: a broker with 2FA but an unprotected mailbox — all the protection disappears in a single reset. The second most common: 2FA enabled but backup codes never written down; after replacing a phone, access then requires a long recovery process, often at the worst possible moment.

“Middlemen” who are not brokers

Fraudsters pose as intermediaries, “account managers”, or exchanges with “unique access”. Warning signs:

• an offer of “guaranteed profits” or of “recovering your losses” (a recovery scam),
• a request to pay into a private account or one unrelated to the firm,
• a “personal adviser” applying time pressure,
• references to licences that do not exist — you check them in the supervisor’s register,
• a request for remote access to your computer, or to install a “technical support” application.

Frauds are often hidden behind a well-made website — so formal verification in the supervisor’s registers comes first, not forum opinions.

Crypto — self-custody, hot and cold storage

With crypto there is no equivalent of a compensation scheme. In the EU, exchanges are subject to MiCA and must hold client assets separately from their own, but that is a requirement, not a guarantee of payout: if the assets disappear, no fund restores them.

A hot wallet is connected to the network and most exposed to malware and swapped withdrawal addresses. Cold storage keeps the key offline but demands discipline: an offline seed and two copies in different places. Self-custody removes the counterparty and shifts the entire risk onto you.

So keep trading capital on the exchange and withdraw the surplus to your own address — see on-chain basics. Size positions as if the capital on the platform could vanish, because platform risk does not show up in a stop-loss. Security practice is broken down in the lesson security and scams.

How to store passwords and access

• A password manager with unique passwords (not “one password for everything”).
• App-based 2FA (not SMS) on the account and the mailbox.
• Never log in through links from emails or messaging apps — always type the address yourself.
• A backup of your crypto keys in a safe place — see security and scams.

With crypto, keys and wallets are a separate world of risk — this lesson gives the foundation, that one the details.

Procedure in the event of an incident

Important: a broker does not ask for an “unlock fee” to release a withdrawal. That is the classic continuation of a fraud — and it appears exactly when you try to withdraw.

When you do not deposit

1. The transfer recipient’s name does not match the entity in the agreement. Stop before you send anything.
2. The entity does not appear in the supervisor’s register or appears on the public warning list.
3. You have not run the withdrawal test. The withdrawal route matters more than the deposit route.
4. You hold more with a single entity than the upper limit of the compensation scheme. The excess above it is not covered.
5. You cannot say which law will apply to your claims or who the supervisor is.
6. All the capital you trade with sits on a crypto exchange. Platform risk is part of your position.

A measurable exercise

Work through the checklist in one sitting and record the result with the date: app-based 2FA on the account and the mailbox (enable or confirm it), backup codes written down offline, a password manager (or a switch to unique passwords in the three most important places), verification of the legal entity in the supervisor’s register, a comparison of the transfer recipient’s name with the name in the agreement, and a written procedure for “what I do when someone asks for my data”. That is 20 minutes that protect the capital you are already risking.

Common questions

Is SMS-based 2FA enough?

App-based 2FA is safer — SMS can be intercepted. What matters most is that 2FA is active on the account and the mailbox, and that you have backup codes written down. Without those codes, a phone failure cuts you off from the account at exactly the moment access matters most.

What if I get a call "from the brokerage"?

Do not share any data. Hang up and call the official number from your documents — not the one from the message. This is a standard security check, and a genuine institution will not take offence at it.

Why check the name of the transfer recipient?

It is the single most effective test before you deposit. If the money is meant for a private account or a company unrelated to the agreement, no licence mentioned on a website matters — the transfer is irreversible and goes to an unknown party.

Where should I report a suspected fraud?

To the supervisor competent for the jurisdiction (in PL: KNF) and to CERT Polska for online incidents. Keep the evidence: correspondence, account numbers, screenshots — without them a report is far weaker.

Is the compensation scheme limit counted separately for each account?

No, the limit is assigned to the investor, not to an account or an agreement. Claims against the same firm add up, so several accounts with one participant in the scheme do not create several limits. The practical conclusion: splitting capital makes sense only across different entities, not across different accounts at the same broker.

How do I check in which country the broker holds my funds?

Start with the document on the custody of client assets: in it the broker names the custodian and the place of custody. Then compare that with the country of the IBAN of the account you send your transfer to, and with the registered seat of the entity in the agreement. Three different countries in one chain is not a formal error, but it tells you that you will pursue your claims under the law of a country other than your own.