Skip to main content

​
What is CEX PoL?

CEX PoL (Centralized Exchange Probability of Loss) is a structured risk assessment framework designed to estimate the likelihood that users of a centralized crypto exchange may experience a financially material loss, excluding losses caused solely by market price movements. CEX PoL focuses on non-market loss vectors specific to centralized exchanges, such as:
  • Security breaches
  • Insolvency or liquidity shortfalls
  • Operational failures
  • Transparency deficiencies
The output is a Probability of Loss score, grounded in observable risk factors and historical loss patterns. The primary purpose of CEX PoL is to:
  • Quantify custodial risk in centralized exchanges
  • Reduce information asymmetry between exchanges and users
  • Provide a standardized, comparable risk signal across exchanges
  • Support informed decision-making for users, institutions, and counterparties
CEX PoL does not attempt to evaluate trading performance, fees, spreads, or market competitiveness.

​
CEX risk assessment methodology — security, solvency, transparency

Full CEX PoL methodology spreadsheet

View the complete CEX methodology reference
The CORE3 CEX PoL methodology is built around three core risk areas:

Security

Protecting user funds and infrastructure

Solvency

Proof of reserves and financial resilience

Transparency

Live tracking and disclosure quality
Each of these areas is assessed using its own set of metrics and carries a different weight in the overall score.
The Security section is inherited from the CER.live platform and is fully aligned with its proven methodology. Given its continued relevance, CORE3 directly adopts the assessment framework of the leading CEX security evaluation platform, making it an integral part of CORE3.
The Centralized Exchange Probability of Loss methodology is designed to evaluate risks unique to custodial crypto platforms. Unlike non-custodial protocols, centralized exchanges introduce concentrated counterparty, custody, and solvency risks, making transparency and operational controls critical.

​
Security risks — protecting user funds and exchange infrastructure

The Security category assesses the exchange’s ability to protect user funds, infrastructure, and sensitive data against external attacks, insider threats, and operational failures.Centralized exchanges represent high-value targets due to pooled assets and privileged access models. Weak security controls have repeatedly led to catastrophic losses across the crypto market. This category evaluates both preventive and reactive security measures to determine how resilient an exchange is under active threat conditions.
Infrastructure hardening, segmentation, access controls, and protection against unauthorized system access.
Safeguards protecting user accounts, including authentication mechanisms, withdrawal controls, and fraud prevention systems.
Independent validation of security management practices (e.g., ISO standards), signaling organizational maturity.
Active engagement with the security research community to identify vulnerabilities before exploitation.
Periodic adversarial testing of systems to uncover real-world attack vectors.
Availability and structure of dedicated funds designed to mitigate losses resulting from security incidents.
This category mitigates the risk of direct fund loss events, which remain one of the failure modes for centralized exchanges. Security evaluation is the most heavily weighted component of the CEX crypto risk score.

​
Summary

The CEX PoL methodology provides a clear, comparable, and enforceable risk signal for centralized exchanges operating in a high-risk custodial environment.
By combining security posture, solvency verification, and transparency controls, CORE3 enables users, institutions, and regulators to assess not only how an exchange operates today, but how it is likely to behave under stress. This forms a key part of CORE3’s crypto rankings for centralized exchanges.

CEX PoL Scoring Logic

Learn how category weights produce the final exchange PoL score