How to Start a Crypto Exchange: License, Tech & Compliance Roadmap 2026

A crypto exchange is not a software project with a compliance afterthought. It is a regulated financial-services business with a software core. Founders who treat it the other way around lose months, because the regulator, the banking partner, and the liquidity provider all gate the launch in ways no amount of engineering can shortcut. The roadmap below breaks the work into six phases that, in practice, overlap rather than run strictly in sequence.

The single most useful framing is this: there are three parallel workstreams, the licence, the technology, and the compliance program, and the licence almost always sets the timeline. You can deploy a white-label exchange in a fortnight, but you cannot legally take a customer until your authorisation is granted. So the smart sequence is to lock the business model and jurisdiction first, file the licence application early, and build the technology and compliance framework while the regulator reviews. For a broader view of the surrounding company-setup steps, see our companion guide on how to start a crypto business.

This guide assumes you are building a centralized exchange, a CEX with an order book and a matching engine, rather than a decentralized protocol. The licensing and custody logic differs sharply between the two, and the centralized model is where the regulatory and operational roadmap below applies most directly.

Everything downstream, the licence, the capital, the custody design, flows from the business model. Decide early whether you are running a pure spot order-book exchange, a brokerage that fills customer orders against your own book, a derivatives venue, or a hybrid. Each carries a different regulatory classification and a different risk profile. A spot exchange is the most common starting point and the simplest to licence.

Next, define your target customers and markets, because that decides which regulator owns you. Serving EU retail users pulls you into MiCA. Serving Singapore users pulls you under the Payment Services Act. Serving US users pulls in FinCEN and state money-transmitter regimes. Many founders narrow to one or two markets at launch precisely to keep the licensing and banking workload manageable.

Finally, model the revenue and the unit economics honestly. Trading fees on a thin order book generate little until volume arrives, and liquidity is expensive to rent. A clear-eyed business model that accounts for the cost of liquidity, compliance staff, and capital is what separates an exchange that launches from one that runs out of runway during the licence review.

The licence is the spine of the whole project. Operating a crypto exchange almost always requires an authorisation, and the regime you choose shapes your capital, your timeline, and your access to banking. The three reference regimes below cover most launches. Our detailed walkthrough on how to get a crypto licence covers the application mechanics, and the VASP licence overview sets out the baseline VASP route many offshore exchanges take.

In the European Union, operating a trading platform for crypto-assets is a regulated service under the Markets in Crypto-Assets Regulation (MiCA). It carries the highest own-funds tier under MiCA Annex IV, EUR 150,000, against EUR 125,000 for custody and exchange and EUR 50,000 for advisory or transfer-only services. A MiCA crypto-asset service provider authorisation passports across all EU member states, which is its biggest draw. The transitional window for firms operating before MiCA closes around 1 July 2026 in most member states.

In Singapore, digital payment token services are licensed by the Monetary Authority of Singapore under the Payment Services Act, typically via a Major Payment Institution licence for an established exchange. MAS requires an AML/CFT compliance officer, an independent external auditor assessment, and segregated, safeguarded customer assets. In the United States, you register with FinCEN as a money services business and, to serve New York, obtain a BitLicense from NYDFS, which carries a USD 5,000 application fee and a famously demanding review.

A centralized exchange has four technical pillars, and each one is a project in its own right. Get the architecture right and the platform scales; cut corners and it fails under load or, worse, loses customer funds. The four pillars are the matching engine, the wallet and custody system, the KYC and AML layer, and liquidity.

1. The matching engine

The matching engine is the heart of the exchange. It pairs buy and sell orders, almost always on a price-time priority basis, also called FIFO: the best price fills first, and where prices are equal, the oldest order fills next. Because latency is a competitive feature, matching engines are typically written in a fast language such as Go or Rust and must process orders deterministically at high throughput.

2. Wallet and custody

Custody is where exchanges most often fail their customers and their regulator. The industry standard is to hold the large majority of assets, typically 90 to 95 percent, in offline cold storage, keeping only a small operating float in hot wallets for withdrawals. Multi-signature or MPC key management, segregation of customer assets from company funds, and regular reconciliation are baseline expectations under MiCA, MAS, and most VASP regimes.

3. KYC, AML, and supporting infrastructure

Around the engine sits the rest of the stack: KYC onboarding and identity verification, transaction monitoring, a trading and wallet services layer often built in Node.js or Python, a transactional database such as PostgreSQL with Redis caching the live order book, and container orchestration on a cloud platform for horizontal scaling. This is the plumbing that turns a matching engine into a usable, compliant exchange.

This is the single biggest cost-and-speed decision in the project. A white-label exchange gives you a ready-made platform, the matching engine, wallets, admin panel, and basic KYC, branded as your own and live within weeks. A custom build gives you full control of the engine, custody design, and roadmap, at the cost of months and a much larger budget. Most regulated exchanges start white label to reach market, then migrate to custom infrastructure once volume justifies it.

Industry estimates put an entry-tier white-label deployment at roughly USD 8,000 to 30,000 with a two-to-four-week launch, scaling up to USD 250,000 or more for a feature-rich white-label build. A custom MVP typically runs USD 50,000 to 250,000 over four to nine months. Our overview of the white-label exchange route covers what a turnkey package includes and where its limits show. Layer licensing legal fees of USD 50,000 to 500,000 on top, and a realistic all-in minimum lands around USD 300,000 to 500,000.

Two operational dependencies sink more exchange launches than any technical problem: fiat banking and liquidity. Neither is optional, and both must be arranged before you go live.

Fiat rails, the bank or payment-institution relationships that let customers deposit and withdraw money, are notoriously hard for crypto businesses to secure. Banks de-risk aggressively, and a credible licence in a respected jurisdiction is often the price of admission. This is one reason a MiCA authorisation can be worth its higher cost: it opens banking doors that an offshore VASP licence frequently cannot.

Liquidity is the other make-or-break. A brand-new exchange has empty order books, wide spreads, and poor execution, which drives traders straight back to established venues. New exchanges fix this by integrating liquidity aggregators and professional market makers through APIs, often connecting to larger venues, so the order book shows tight spreads and real depth from day one. Budget for liquidity as a recurring operating cost, not a one-off integration.

Authorisation is the beginning of compliance, not the end. A licensed exchange runs a permanent program that the regulator can examine at any time, and weak compliance is the fastest route to losing the licence you worked months to obtain.

At the centre sits the AML and KYC framework: customer due diligence at onboarding, ongoing transaction monitoring, suspicious-activity reporting, and sanctions screening against watchlists. Most regimes require you to appoint an anti-money-laundering compliance officer, often called an MLRO, at management level, and the regulator will assess that person's fitness as part of authorisation. Our team implements this framework end to end as part of a licensing engagement.

On top of AML sits the FATF Travel Rule, Recommendation 16 applied to crypto, which requires you to collect and share sender and recipient identity data with the counterparty provider for transfers above the threshold. By 2025, 85 of 117 surveyed jurisdictions had passed Travel Rule legislation, and a working Travel Rule solution is now a baseline expectation in most licence applications. Add segregated, safeguarded custody with regular reconciliation, IT and cyber-security controls, and periodic regulatory reporting, and you have the standing compliance load of a live exchange.

The five phases below describe the core sequence of an exchange launch. In practice they overlap, the licence application, the technology build, and the compliance framework all run in parallel, but the milestones below are consistent across jurisdictions.