Luno

Luno claims more than 15 million account holders spread across over 40 countries, and dates itself to 2013. Ownership is not buried: the about page describes the business as an independent operating subsidiary of Digital Currency Group, and the footer carries a Luno PTY (Ltd) copyright line for 2026.

The detail that matters most to a British reader sits in a table few people open. A Terms of Use List dated 3 September 2025 maps each country of verification to the company you become a customer of. Both the United Kingdom and Europe point at Luno Australia (Pty) Ltd, under one shared document. South Africa, Nigeria, Malaysia, Indonesia, Uganda, Zambia and Kenya each get a separate local company instead.

On authorisation, a plain statement of what we found: no British or European licence number appears anywhere in the pages of luno.com read on 5 August 2026, though the footer links to a licences and registrations page not included in that capture. The compliance note, last revised on 1 March 2021, is unusually frank. It says that in some countries where Luno has a presence it is not always clear whether anti-money-laundering duties fall on cryptocurrency providers, and that the company built systems and controls which "seek to emulate the standards applicable to regulated sectors". That is voluntary alignment in its own words, not a licence.

What Luno does publish is a reserves claim: every asset held on a one-to-one basis, backed by a monthly proof of reserves. Its stated framework names a Money Laundering Reporting Officer, an independent risk committee reporting to the board, tiered due diligence keyed to deposit and withdrawal limits, travel-rule handling, and sanctions screening against United Nations, European Union, UK Treasury and OFAC lists.

The complaints process, also dated 1 March 2021, sets real deadlines. An officer acknowledges within three business days and aims to issue a resolution notice within fifteen. A review must be requested within seven days and decided within a further fifteen, stretching to twenty if a committee is convened, and any court action has to begin within one year of the final decision. External adjudication is described as possible depending on country and entity, but no ombudsman is named. On phishing, the same document says safeguarding funds is the account holder's own responsibility.