Exchanges don't need to take your money on deposit with them; it's already been given to them when you deposited it. It's then in their "possession" (insofar as someone can possess a virtual currency), they simply have a corresponding liability to the user who deposited it.