How to start a crypto exchange: a step-by-step guide
Choose the model and the markets, get the licence, then assemble software, custody, banking, liquidity and compliance. The licence sets the pace, so everything else runs alongside it.
The short answer to how to start a crypto exchange: a founder decides what the exchange will do and for whom, gets the licence for those services in each market, and puts together the software, custody, banking, liquidity and compliance the business runs on. The licence and the outside partners usually take longest, so they start first and the technology is built or bought alongside them.
This guide is general information, not legal advice. Which licence an exchange needs depends on its services and its markets, and counsel confirms it.
How to start a crypto exchange in eight steps
Whether the plan is to create a cryptocurrency exchange from scratch or to start a crypto exchange business on a white-label platform, the steps are the same:
Choose the exchange model and the markets.
Pick a jurisdiction and its licence.
Build, buy or white-label the software.
Set up custody and banking.
Arrange liquidity.
Put KYC, AML and the Travel Rule in place.
Secure and test the platform.
Launch and operate.
Steps 2 to 6 overlap, and the order of work at the end shows how.
Step 1: Choose the exchange model and the markets
"Crypto exchange" covers several businesses, and each is a different regulated service. The model decides the licence, the software and the partners, so it comes first.
Model | How a trade happens | Under MiCA, roughly |
|---|---|---|
Spot exchange (order book) | Customers' buy and sell orders meet on an order book, matched by the platform's engine | Operating a trading platform |
Brokerage | The firm buys from or sells to the customer, or passes the order on | Exchange of crypto-assets for funds or other crypto-assets, or reception and transmission of orders |
P2P marketplace | Users trade with each other, often with funds in escrow | Depends on whether buyers and sellers meet in the platform's own system |
Derivatives | Futures or perpetual contracts on a crypto price | Usually outside MiCA, under investment-services rules |
Decentralised (DEX) | Smart contracts settle trades on-chain | Outside MiCA only if fully decentralised |
MiCA, the EU's crypto-asset regulation, separates operating a trading platform, a multilateral system where third parties' buying and selling interests meet and result in contracts, from exchanging crypto-assets for funds, where the firm deals with clients using its own capital (Article 3(1)(18) and (19)). MiCA does not apply to crypto-assets that qualify as financial instruments (Article 2(4)), which is where many derivatives fall.
Decentralisation is not an automatic exemption. MiCA's recital 22 leaves out only services provided in a fully decentralised manner without any intermediary, and keeps services a person performs or controls in scope even when part runs in a decentralised way. A company that runs the front end, holds admin keys or takes fees is unlikely to count as fully decentralised, and counsel decides.
The markets come with the model:
Where the customers are. This decides which regulators are involved.
Which assets and pairs. A centralised exchange in the EU assesses each crypto-asset's suitability before admitting it to trading, including the reliability of its technology and any link to illicit activity (Article 76(2)).
Which currencies. Fiat deposits mean a bank and payment rails; crypto-only means neither, but a smaller market.
Step 2: Pick a jurisdiction and its licence
Whoever operates the order book needs the licence for it, in each market where it serves customers.
European Union. No one may provide crypto-asset services in the EU without authorisation as a crypto-asset service provider (CASP), unless it is a firm such as a bank or an investment firm allowed to provide them under Article 60 (Article 59(1)). A CASP needs a registered office in a member state where it provides services, its place of effective management in the EU and at least one EU-resident director, and once authorised it can serve the whole EU (Article 59(2) and (7)). The transitional period for firms already operating ended on 1 July 2026 at the latest (Article 143(3)); what an application contains is in the MiCA checklist for a crypto exchange.
United Kingdom. Firms providing in-scope cryptoasset services in the UK register with the FCA under the Money Laundering Regulations before they start. Applications for authorisation under FSMA opened on 30 September 2026, the new regime is expected to start on 25 October 2027, and since the gateway opened the FCA encourages firms to focus on authorisation rather than registration (FCA). The steps are in FCA cryptoasset registration.
United Arab Emirates. In Dubai outside DIFC, a firm has to be licensed by VARA before it starts operating, in two stages: an Approval to Incorporate, which does not permit virtual asset activities, then the licence itself. An exchange follows four compulsory rulebooks plus the Exchange Services Rulebook. DIFC and ADGM have their own regulators, and the choice between the three is in where to license a crypto business in the UAE.
Step 3: Build, buy or white-label the software
An exchange is a set of systems that have to agree on every balance at every moment. Whatever the route, the software needs the same parts:
Trading apps for web and phone.
A matching engine that pairs orders by price and then by time, and gives the same result every time it replays the same orders.
A double-entry ledger of every fill, fee and transfer, reconciled against the wallets and the bank.
Wallets with deposit addresses, withdrawal approvals and limits.
A backoffice for staff, with an audit log.
An API for the apps and for market makers.
There are three ways to get it:
Build it. Full control and no vendor, but the longest route, with the hardest parts (matching, the ledger, custody) built from nothing.
Rent a white-label platform. The vendor hosts and runs it, and the operator configures it and pays fees for as long as it operates.
Buy a white-label platform with the source code. The vendor brands and deploys it on the operator's infrastructure and hands over the code.
Whichever route is chosen, the responsibility stays with the licensed firm: a CASP that outsources operational functions remains fully responsible for its obligations (Article 73). It also helps to try a finished product before deciding: you can see a working exchange in Marengo.
Step 4: Set up custody and banking
Custody is defined by control. MiCA treats safekeeping or controlling clients' crypto-assets, or the private keys that give access to them, as custody (Article 3(1)(17)), so an exchange either gets authorised for custody itself or appoints an authorised custodian.
Either way, clients' crypto is kept apart from the firm's own, on the blockchain too (Article 75(7)). In practice that means hot wallets for daily withdrawals, cold or MPC storage for the rest, and approval rules before anything leaves (see the custody and wallets module).
Banking is a separate track with its own checks. Under MiCA, client money other than e-money tokens is placed with a bank or a central bank by the end of the business day after it arrives, in an account separate from the firm's own (Article 70(3)). A bank runs its own checks on a crypto business before opening the account, so this conversation starts early, alongside the licence.
Step 5: Arrange liquidity
A new order book is empty, and customers leave an exchange where the spread is wide and orders do not fill. Liquidity comes from two places:
Market makers, firms that quote buy and sell prices on the order book under their own agreements, through the API.
External liquidity, where orders are routed to, or prices mirrored from, other venues.
The operator's own role is limited. Under MiCA, a trading platform operator may not deal on its own account on the platform it operates, and may use matched principal trading only with the client's consent (Article 76(5) and (6)). So liquidity agreements are drafted with counsel, alongside the licence.
Step 6: Put KYC, AML and the Travel Rule in place
Every regulator above expects the same controls, even where the rulebooks differ:
KYC at sign-up: an identity document and a selfie or liveness check.
Sanctions screening of customers and the wallet addresses they deal with.
Transaction monitoring, with suspicious activity reported to the financial intelligence unit.
The Travel Rule: information about the sender and the recipient travels with each crypto transfer between providers.
In the EU the Travel Rule is the Transfer of Funds Regulation. Since 30 December 2024, the sender's CASP has had to make sure transfers carry the originator's name, wallet address and further identifying details, and the beneficiary's name and wallet address (Articles 14 and 40). For a transfer of more than EUR 1,000 to a self-hosted wallet, it also assesses whether that wallet belongs to the customer (Article 14(5)). The KYC and AML module shows how these checks fit into the exchange.
Step 7: Secure and test the platform
Regulators look at the systems as closely as the policies. MiCA requires resilient and secure ICT systems under DORA, the EU's digital operational resilience regulation, and a business continuity policy with response and recovery plans (Article 68(7)).
The checks that matter most before launch:
Keys and withdrawals. Who approves a withdrawal, how keys are split, and what happens when someone is unavailable.
Money correctness. The ledger balances per asset, and reconciliation catches any gap.
The matching engine. Replaying the same orders gives the same trades, and a restart loses or doubles nothing.
Load and failure. Peak volume, with a service or a provider taken down on purpose.
Penetration testing by an outside firm, and an incident plan staff have rehearsed.
Step 8: Launch and operate
Many exchanges open with a short list of markets and limits, then widen them as monitoring shows how the systems and customers behave. From day one the operator runs reconciliation, reviews withdrawals and alerts, answers customers and reports to its regulator.
After launch, new listings pass the same suitability rules, and every change to the platform goes through the same testing.
How to start a crypto exchange: a realistic order of work
The steps above are not a straight line. In practice they fall into four phases, with most of the work running in parallel:
Decide. The model, the markets, the jurisdiction, a business plan and counsel.
Run the long tracks together. - The licence application, with its policies, people and capital. - Custody, banking, KYC and Travel Rule providers, each with its own onboarding checks. - Liquidity agreements with market makers. - The software, built, rented or bought, with its integrations.
Integrate and test every provider, then run the security and testing programme.
Go live once the licence is granted and every partner has onboarded the exchange.
The licence usually sets the date customers can trade. Under MiCA, once an application arrives the regulator has 25 working days to check it is complete and then 40 working days to decide, with the clock paused for up to 20 working days while it waits for answers to its questions (Article 63). Where the budget goes across all four phases is in what it costs to launch a crypto exchange.
Frequently asked questions
How long does it take to start a crypto exchange?
Mostly on the licence and the partners, not the software. In the EU, MiCA gives the regulator 25 working days to check an application is complete and 40 to decide, plus pauses for questions; preparing it, and onboarding with custodians and banks, add to that.
Do I need a licence to start a crypto exchange?
In the EU, the UK and Dubai, running a centralised exchange is a regulated activity. The EU requires CASP authorisation, the UK FCA registration now and FSMA authorisation under the regime expected from 25 October 2027, and Dubai a VARA licence before operations start.
Can I start a crypto exchange without building the software?
Yes. A white-label platform can be rented or bought with its source code, and the operator brands it and runs it under its own licence. The licence and the responsibilities stay with the operator either way.
Is a decentralised exchange regulated?
Under MiCA, only crypto-asset services provided in a fully decentralised manner without any intermediary fall outside the regulation. Where a company runs, controls or profits from part of the service, it is likely to be in scope, and counsel decides.
How much does it cost to start a crypto exchange?
The licence, the capital a regulator expects, the software, custody, banking, liquidity and staff all cost money, and they vary by jurisdiction and model. They are set out in what it costs to launch a crypto exchange.
See a working exchange
A working white-label exchange already exists, so the software does not have to wait for the licence. Try it at marengo.paynoramic.com, on a phone or a computer, and the crypto exchange page sets out what is handed over and what runs alongside it.
