I'm not sure what they realistically do. They regulate banks but at least banks have deep enough pockets to pay the fines. What do you do when 18 and 21 year old brothers get hacked and lose $100M+?
Well, you say, they wouldn't get registered because they wouldn't have what they would need to provide a fair risk to customers. Then what? People will simply run the exchanges elsewhere and the money will keep getting "lost", "stolen" or seized by the authorities.
Bank deposits of legal tenders are insured by the central bank. In the Eurozone the ECB insures all personal deposits up to 100.000€. When the bank of Nicosia, Cyprus went bankrupt and the account holders could no longer withdraw, their losses were fully subsidized by the ECB, up to the 100.000€ limit.
This undue confidence or trust we bestow in regulated banks comes at the expense of the wider public: when we lose our deposit due to insolvency, everybody is forced to pay for it by the monetary expansion of the ECB, which covers our loss by printing (or by digitally creating) more euro, and distributes this minted money to the affected bank, allowing withdrawals to resume. This intervention of the ECB dilutes the purchasing power of every unrelated person holding euro, regardless of their country of residence, and regardless on how meticulous they are in choosing a reliable bank. Even the CFA franc in West Africa suffers from this enforced depreciation, being pegged against the euro at a fixed ratio.
Thus, the account holders gain an artificially strong confidence in the bank of their choice, regardless of whichever bank that might be, regardless of how much risk exposures the bank takes, regardless of what financial instruments it edges against, and regardless of the size of its fractional reserve compared to its liabilities. It is an insurance whose only purpose is to allow the bank to take undue risk with volatile instruments and to collectivize any resulting losses against the public, while deluding the account holders with the ancillary excuse that their deposits are safe no matter what.
The alternative to having 21 year old Joe running a million-dollar crypto exchange website from a laptop in his basement is to apply fucking due diligence in choosing our counterparty, and prosecute whenever proper fraud and intentional deception take place.
Well, you say, they wouldn't get registered because they wouldn't have what they would need to provide a fair risk to customers. Then what? People will simply run the exchanges elsewhere and the money will keep getting "lost", "stolen" or seized by the authorities.