CEX vs DEX: centralised and decentralised exchanges compared, and which to build
A CEX is a firm that runs an order book and holds customers' assets; a DEX is smart contracts that users trade with from their own wallets. Fiat and retail customers usually point to a CEX.
CEX vs DEX comes down to who sits in the middle of a trade. A centralised exchange (CEX) is a company that runs an order book, holds its customers' crypto and money, and answers to a regulator for both. A decentralised exchange (DEX) is a set of smart contracts on a blockchain that users trade with directly from wallets they control, with no operator holding their assets. For a business that serves retail customers in euros, pounds or dirhams, the rules and the plumbing usually lead to a centralised exchange.
This guide is general information, not legal advice. Which licence a business needs depends on its services and its markets, and counsel confirms it.
How a centralised exchange works
A centralised exchange looks like a broker's app from the outside and like a small financial market inside. Customers open an account, pass identity checks, deposit crypto or money, and trade against each other on its systems.
The core is an order book: a list of buy and sell orders at each price. A matching engine pairs them by price and then by time, and a ledger records every fill, fee and balance.
None of this happens on a blockchain. A trade is an entry in the exchange's own books, which is why it completes in milliseconds and costs no network fee.
The blockchain appears only for deposits and withdrawals, which pass the exchange's checks and approvals. In between, the customer holds a claim on the exchange, and the exchange or its custodian holds the keys. The split between hot and cold wallets is in hot wallets, cold storage and MPC, and the full path of an order in how a crypto exchange works inside.
You can see a working centralised exchange in Marengo.
How a decentralised exchange works
A DEX replaces the company with code. Its rules are smart contracts deployed on a blockchain, and anyone with a wallet can call them. The user signs each trade with their own private key, so the assets stay in self-custody until the moment the contract swaps them.
Most DEXs use an automated market maker (AMM) instead of an order book. Liquidity providers deposit pairs of tokens into a pool, and a formula sets the price from the ratio of the two tokens in it.
A trader who buys one token adds the other to the pool, which moves the price: the bigger the trade compared with the pool, the worse the average price. That price impact is a form of slippage, and traders set a limit on how much they accept.
Every swap is a blockchain transaction. It pays the pool's fee, which goes to the liquidity providers, and a network fee to the chain, and it is final once the block confirms it. Pending transactions are public, so others can try to trade just ahead of them.
Some DEXs run an order book instead of a pool. The defining trait is the same: the user keeps the keys, and the contract, not a company, settles the trade.
CEX vs DEX: the key differences
Centralised exchange (CEX) | Decentralised exchange (DEX) | |
|---|---|---|
Custody | The operator, or a custodian it appoints, holds the keys | The user holds the keys until the swap |
Speed and fees | Matching in milliseconds off-chain; a trading fee, and a network fee only on withdrawal | Each trade waits for a block; a pool fee plus a network fee on every trade |
Fiat access | Deposits and withdrawals in money through the operator's bank | Crypto and stablecoins only; money goes in and out elsewhere |
KYC | Identity checks before trading, as the law requires of the operator | None at protocol level; a front end may add its own |
Liquidity | Market makers quote on the order book under agreements | Pools funded by liquidity providers; depth varies by pair |
Who is liable | An authorised operator, with duties to keep client assets apart and a complaints route | No operator to claim against; users carry the smart contract risk |
Upgrades | The operator ships a release | Contracts are fixed, or changed through governance or admin keys |
User experience | Email sign-up, password recovery, support, familiar app screens | A wallet, a recovery phrase, gas tokens and token approvals; no recovery if keys are lost |
The table is a trade-off, not a ranking. A CEX puts a regulated firm between customers and the market; a DEX gives them direct control and code anyone can inspect, and leaves them the risks a firm would otherwise carry.
What DEXs do well
DEXs are open around the clock to anyone with a wallet, with no account to open. Their contracts and trades are public, so anyone can check reserves and history on-chain.
A new token can trade as soon as someone funds a pool, and other contracts can build on a DEX's pools directly. Users never hand their assets to an intermediary that could fail or freeze them.
What centralised exchanges do well
A CASP running a CEX can take card and bank payments, pay out to a bank account, recover a locked-out account, and offer limit, market and stop orders on an order book quoted by market makers. Under MiCA, it safeguards clients' ownership rights (Article 70) and handles complaints free of charge (Article 71). For most retail customers, that makes crypto usable.
Hybrids sit somewhere in between
The line is not always clean, and many products mix the two models:
Off-chain matching, on-chain settlement. An operator matches orders on its own engine, as a CEX does, and settles each trade on-chain from users' own wallets or from a smart contract.
A CEX with self-custody options. A centralised app adds a wallet whose keys the customer holds, or routes some trades to on-chain pools for them.
A DEX with a gate. A front end, or a pool, admits only verified wallets, so a protocol open by design serves only checked users.
For regulation, the question is not what the technology is called but whether someone provides a service, as the rules below show.
CEX vs DEX under the rules
The EU: MiCA
MiCA, the EU's Markets in Crypto-Assets Regulation, is written around people and firms. It applies to natural and legal persons and certain other undertakings that issue, offer or admit crypto-assets to trading, or that provide crypto-asset services in the EU (Article 2(1)). Operating a trading platform, exchanging crypto for funds or for other crypto, and custody are all crypto-asset services (Article 3(1)(16)), and no one may provide them in the EU without authorisation (Article 59(1)).
On decentralised services, recital 22 draws the line in two sentences. MiCA applies to the services performed, provided or controlled, directly or indirectly, by persons, "including when part of such activities or services is performed in a decentralised manner". Where crypto-asset services are provided in a fully decentralised manner without any intermediary, they should not fall within its scope.
The exclusion covers only services that are fully decentralised with no intermediary, so a hybrid with a company in the loop is not covered by it.
The wider question was left open: Article 142 asked the Commission for a report, by 30 December 2024, assessing decentralised finance and whether it is necessary and feasible to regulate it. What a centralised exchange needs is in the MiCA checklist for a crypto exchange.
The EU: the Travel Rule and self-hosted addresses
The Transfer of Funds Regulation, the EU's Travel Rule, has applied since 30 December 2024 (Article 40). It defines a self-hosted address as a blockchain address not linked to a CASP or to a similar provider outside the EU (Article 3(20)): in other words, the kind of wallet a DEX user trades from.
The rule reaches those wallets through the exchange, not the protocol. Its requirements apply to transfers to or from a self-hosted address as long as a CASP is involved (recital 38).
When a customer withdraws to a self-hosted address, the exchange obtains and holds the originator and beneficiary information, and for an amount over EUR 1,000 it takes adequate measures to assess whether the address is owned or controlled by its customer (Article 14(5)). Deposits from a self-hosted address are treated the same way on the receiving side (Article 16(2)).
The same regulation amended the EU's anti-money laundering directive so that CASPs assess the risk of transfers to and from self-hosted addresses and apply measures to match it (Article 38). It also asked the Commission for a report on those risks by 1 July 2026 (Article 37(2)). For an exchange, the practical result is wallet screening and address checks on the withdrawal path, covered in KYC, AML and the Travel Rule for an exchange.
The UK and the UAE
Both regimes also start from the firm. In the UK, the FCA says that a business providing in-scope cryptoasset services in the UK registers with it before it starts; applications for authorisation under FSMA open on 30 September 2026, and the new regime is expected to start on 25 October 2027 (FCA).
In Dubai outside DIFC, VARA regulates eight virtual asset activities, Exchange Services and Custody Services among them, and a firm operating in or from Dubai has a legal obligation to be licensed before it starts operating.
Which model fits which business
The choice usually follows from three questions: who the customers are, whether money moves in and out, and who the business wants to be responsible for.
A bank. A bank's customers expect crypto next to their accounts, with the bank answerable for both. In the EU, MiCA lets a credit institution provide crypto-asset services after notifying its home regulator at least 40 working days before it starts (Article 60(1)). The fit is a centralised exchange, or a brokerage on top of one, with custody in-house or at an authorised custodian.
A fintech app. A payments app adds buying, selling and holding for customers who already pay in money and have passed identity checks, and who expect a familiar screen and a fee shown before they confirm. That is a centralised exchange, or a licensed partner's service while the app's own licence is pending.
A broker adding crypto. An investment firm can provide crypto-asset services equivalent to the investment services it is already authorised for, again after a notice at least 40 working days ahead (Article 60(3)). Its clients want limit and stop orders and reporting they recognise, which points to an order book run by the firm, with liquidity from market makers.
A DeFi project. A team building for users who already hold their own keys, and who value open access and on-chain settlement, builds a DEX. The point to watch is the word "fully": a company that runs the front end, the matching or an admin key may find that recital 22's exclusion does not describe it.
The pattern is consistent. A business serving retail customers with fiat needs a bank account for client money, identity checks, a firm customers can complain to and an authorisation in each market, and every one of those assumes an operator. That is a centralised exchange, sometimes with self-custody features added, rather than a DEX.
Frequently asked questions
What is the main difference between a CEX and a DEX?
Custody and who settles the trade. On a CEX, the operator or its custodian holds the assets and matches trades on its own systems; on a DEX, users keep their keys and a smart contract settles each trade on-chain.
Is a DEX safer than a CEX?
Each carries different risks. A DEX removes the risk of an operator failing or freezing funds, but users carry smart contract risk and lose their assets if they lose their keys. A CEX carries operator risk, which regulation addresses with authorisation, safeguarding of client assets and supervision.
Do decentralised exchanges need a MiCA licence?
MiCA applies to persons that provide crypto-asset services, and its recital 22 says services provided in a fully decentralised manner without any intermediary should not fall within its scope. Where a company provides part of the service, for example the front end or the matching, MiCA can apply to it.
Can you buy crypto with euros on a DEX?
Not directly. A DEX swaps tokens on a blockchain, so euros first become crypto or a stablecoin somewhere else, usually at a centralised exchange or another regulated provider.
Why do most exchanges for retail customers stay centralised?
Retail customers pay in money, forget passwords and need someone to answer them. Banks and regulators expect an identifiable operator with identity checks and a client account, which is what a centralised exchange is.
See a centralised exchange working
The fastest way to weigh a centralised exchange is to use one. A complete white-label exchange is open to try at marengo.paynoramic.com, and the crypto exchange page sets out what is handed over and how to book a live demo.
