Whether you start from a blank sheet or a white-label box, the hard part is the same everywhere: the regulated plumbing around the order book. This workspace compiles what we learned scoping and building exchanges across markets — use it before any vendor shows you a slide deck. Sections 01–07 are the buyer’s view: routes, vendors, licensing, corridors. Sections 08–11 are ours to defend — the engagements behind those numbers, the architecture we assemble, a written boundary between what we have run in production and what gets built new, and the operational answer on custody security, incident response and proof of reserves.
A vendor box gets you an order book fast — and stops there. Local payment rails, reporting formats, your own roadmap and your own token listings live outside the box. Teams discover this after signing, not before.
Per-transfer reporting, local KYC stacks, payment-rail limits — and in some markets per-trade tax withholding. The mechanics that make an exchange legal in its market exist in no off-the-shelf product. Someone builds them, every time.
The largest exchange security losses of recent years were custody-operations failures, not matching-engine failures. Cold-storage segregation, proof-of-reserves and incident playbooks belong in the design — not the post-mortem. Section 10 is the rest of this answer.
Every bidder will sell you their default. This workspace exists so you can walk into that conversation knowing the routes, the vendors, the licensing map and the honest corridors — ask any bidder to show you the path of one dollar through their platform.
Compiled from our exchange engagements and estimation library across markets. Vendor and regulatory facts current to mid-2026.
No forms, no email gate. Multi-select what will trade — the finder maps your answers onto the three routes we actually deliver, and says honestly when the answer is “decide in discovery”.
Corridors are indicative bands from module-level estimations of comparable builds; not a quote. The finder’s logic is the same one our architects argue about in discovery — just faster.
Money in, buy, sell, money out. Drag the amount, switch the market profile, then flip the white-label toggle and see which steps a vendor box actually covers — and which ones are your build list.
Every step is something the exchange operator must build, integrate or answer for. The steps a vendor skips in their demo are the ones you will be building — usually under deadline, after signing.
The market is real and often good. The mistake is not renting — it is not knowing where the box ends. Facts below are current to mid-2026; published pricing only.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| HollaEx | Hosted / on-prem exchange kit: spot, wallets, admin, open-source core | Revenue share on lower enterprise tier | from $700/mo; ent. ~$35K/yr +15% rev share |
| AlphaPoint | Institutional exchange + tokenization backend, deep customization | Custom quotes only | not published |
| B2Broker | Turnkey engine, liquidity aggregation, crypto-fiat gateway, CRM | Brokerage / FX DNA more than crypto-native | not published |
| ChainUP | Enterprise CEX/DEX/hybrid, perps, staking; liquidity network | SaaS cost grows steeply at scale | quote-based |
| Openware / OpenDAX | Open-source cloud-native stack; perpetual license, full source ownership | You own the code — and the maintenance burden | not published |
| PayBitoPro | Budget white-label, US-compliance marketing | Entry tier is thin; customization pushes tiers up fast | $149–12,000/mo |
| Shift Markets | WL exchange + integrated liquidity, brokerage tools | Quote-based; smaller footprint | not published |
| Devexperts (DXtrade) | Institutional multi-asset trading platform infrastructure | Trading-front DNA more than full CEX back-office | not published |
| Binance CaaS | Exchange-as-a-service on Binance infrastructure (replaced Binance Cloud, 2025) | You cannot list your own token or stablecoin in your own order books | rev-share |
| Exberry / Connamara EP3 | Standalone matching engines (SaaS / platform + clearing + surveillance) | Full-platform licensing — not a cheap drop-in | not published |
Cross-cutting: on every core, the engine and order books remain the vendor’s; jurisdiction mechanics are in no box. First-year white-label TCO seen across deals: $50–200K.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| Fireblocks | MPC wallet infrastructure + transfer network; 550M+ wallets served | Enterprise quotes; budget a six-figure annual line at scale | not published |
| BitGo | Qualified custodian, multi-sig + MPC, wallet-as-a-service; OCC trust charter | Custody vs wallet-tech product lines differ in regulatory cover — pick deliberately | not published |
| Copper | MPC custody + ClearLoop off-exchange settlement | MiCA authorization was still pending as of mid-2026 | not published |
| Cobo | Custody + wallet-as-a-service; HK TCSP, MAS in-principle | APAC-centric licensing footprint | not published |
| Utila | Institutional MPC wallet ops incl. DeFi access | Younger vendor, shorter track record | not published |
Reference OPEX from deal research: MPC custody $50–250K/yr + $10–50K setup. Custody choice shapes the licence application — decide them together.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| Sumsub | IDV, liveness, KYB, AML screening, Travel Rule in one platform | Local ID stacks (e.g. national eKYC registries) are not native — pair locally | from $1.35/check, $149/mo min |
| Jumio | Enterprise IDV, broad document/biometric coverage | Sales-led, quote-based | not published |
| Onfido (Entrust) | IDV + biometrics inside the Entrust portfolio | Post-acquisition packaging is Entrust-driven — re-verify SLAs | not published |
| Shufti / Persona | Global IDV/AML; developer-first workflow builders | Thinner crypto-specific compliance modules | not published |
| Chainalysis | Most-deployed KYT: real-time monitoring + investigations | License is a top-3 compliance OPEX line | not published |
| Elliptic / TRM Labs | Broad-coverage screening; AI-driven threat intel | Often run as second provider | not published |
| Notabene | End-to-end Travel Rule SaaS aggregating major protocols | Reachability depends on the counterparty VASP’s network | not published |
Reference OPEX: KYT $30–120K/yr · Travel Rule $15–60K/yr · sanctions/PEP $10–40K/yr · KYC $1–3/check (cheaper via local-market IDV vendors). EU TFR threshold is now zero; several regulators require originator/beneficiary data with no de-minimis.
| Vendor | Out of the box | Watch-out | Published pricing (typical) |
|---|---|---|---|
| MoonPay | Widest-known widget on/off-ramp, cards + wallets | Highest fees of the majors | ~4.0–5.5% |
| Ramp Network | Widget on/off-ramp with cheap bank rails | Regional coverage narrower than MoonPay | SEPA ~0.49% · card ~2.9% |
| Transak | On/off-ramp incl. local rails; locally registered in several markets | Coverage gaps by state/market — verify yours | ~1–3% |
| Banxa | Listed provider, broad payment-method coverage | Mid-pack pricing | card ~2.99–3.99% · SEPA ~1.99% |
| Mercuryo | On/off-ramp with strong SEPA Instant rails | Card side is pricey | SEPA ~1.95% · card ~3.95% |
Pattern from deals: ramp aggregators are the MVP fast-track; direct banking rails come later and are never advertised — a discovery item, not a checkbox.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| B2C2 | Institutional OTC liquidity / electronic LP | OTC LP model, not designated MM on your books by default | not published |
| GSR / Wintermute | Global algorithmic market making across CEX + DEX venues | Prioritize larger venues and tokens | not published |
| FalconX | Prime brokerage: execution, credit, custody access | Prime-broker model rather than order-book MM | not published |
| Flowdesk | Market-making-as-a-service; client keeps funds ownership | Retainer economics vary widely | not published |
| Nasdaq SMARTS | Multi-asset trade surveillance for the largest venues | Big-institution pricing and implementation weight | not published |
| Solidus Labs / Eventus | Crypto-native and mid-market surveillance (wash trading, spoofing, cross-venue) | Coverage DNA differs — crypto-native vs multi-asset | not published |
Reference: MM retainers ~$10–50K+/mo, quote-based. A pragmatic MVP alternative is a vendor liquidity bridge — with an exit plan to direct arrangements.
In our module-level gap analysis of a white-label-based offer against a full institutional scope, the box genuinely covered about 11% of the modules, partially covered a third, and left the majority to custom build. The box is not a scam — it is a start. Price the other 89% before you sign.
Aggregate third-party TCO seen across exchange deals: one-off $85–270K, annual $293K–1.47M. Vendor facts current to mid-2026; verify at contract time.
Each route below is a real delivery we would sign up for. The matrix shows the trade-offs; the watch-outs are the ones we say in the room.
The engine, order books and admin come from the box. Your market layer — local rails, reporting, tax mechanics, your listings policy — is built beside it.
Your contracts, data model and code from day one; vendor components behind adapters ship the MVP at near-box speed. Implementations degrade — contracts never do: every rented piece stays swappable.
You build the engine the vendors spent years hardening. Total control, total responsibility — justified when derivatives mechanics or exotic market structure genuinely demand it.
| Route 1 · Vendor + layer | ★ Route 2 · Composable | Route 3 · Custom | |
|---|---|---|---|
| Ownership & IP | |||
| Code & contracts ownership | ✕vendor’s core | ✓yours from day one | ✓total |
| Own-token / listings freedom | ◖vendor policy applies | ✓yours | ✓yours |
| Delivery characteristics | |||
| Time to first trade | ✓fastest | ✓near-vendor | ✕slowest |
| Market layer (rails, reporting, tax) | ✕custom on every route | ✕custom on every route | ✕custom on every route |
| Risk & growth | |||
| Vendor lock-in | ✕structural | ✓every piece swappable | ✓none |
| Scales past MVP without rebuild | ◖until the ceiling | ✓by design | ✓by design |
| Watch-outs — the trade-off you accept | |||
| The honest one | re-platforming later costs more than Route 2 would have | adapter discipline or it quietly becomes Route 1 | pays us more, delays your launch |
Live in weeks on a major exchange’s infrastructure. Ruled out for most: you cannot list your own token or stablecoin in your own order books, and the economics are permanent rev-share. Parked for franchise-style ventures.
Full source ownership at licence-price zero. Ruled out as a primary route: you inherit the maintenance burden on day one without the vendor’s hardening cadence. Viable inside Route 2 as one adapter among several.
Institutional engines (SaaS or licensed) are excellent — and only ~10% of the scope. Sensible inside Route 2 or 3; not a route by itself. Parked.
Budget figures are indicative corridors at a blended rate, before the market layer; the matrix criteria mirror the ones we use in delivery grammar internally: time-to-market, IP control, lock-in, scaling ceiling.
Twenty-plus regimes, one table. The dates matter: several markets closed their transition windows this year — sequencing the licence is now part of the build plan, not an afterthought.
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| EU / EEA | MiCA — CASP authorisation | One licence passports to 30 states. Transition ended 1 Jul 2026; ~204 CASPs authorised, unlicensed firms must exit. |
| Norway | Crypto Asset Act (MiCA via EEA) | Same CASP regime, offset transition closed 30 Jun 2026; local venues already authorised. |
| UK | FCA — FSMA regime, QCATP category | Brand-new full regime: final rules Jun 2026, application window Sep 2026–Feb 2027, fully live Oct 2027. |
| Switzerland | FINMA — FinTech / securities-firm + DLT facility | Reputation-grade; dedicated crypto-institution licence category expected from 2027. |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| USA | FinCEN MSB + SEC/CFTC + state MTLs; NY BitLicense | Highest-cost patchwork (45+ state licences). Stablecoin law in force; market-structure bill cleared committee, not yet law mid-2026. |
| Canada | CSA/CIRO — investment-dealer registration | Platforms regulated as securities dealers; 4-tier custody framework (2026). Strict. |
| Brazil | BCB — VASP authorisation | Effective Feb 2026: capital ~$2–7M, monthly proof-of-reserves, existing firms deadline 30 Oct 2026. |
| Mexico | Fintech Law (ITF) | Grey-light: regulated entities restricted from public crypto offering; exchanges operate under AML reporting. |
| El Salvador | CNAD — DASP | $2K min capital, 0% digital-asset tax, 3–6 month timeline; scrutiny rising. |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| UAE — Dubai | VARA — VASP Exchange Services | Most active licensing hub; retail OK; derivatives rulebook live Mar 2026; ~45 VARA VASPs. |
| UAE — ADGM / DIFC | FSRA FSP / DFSA | Common-law frameworks; institutional focus; 25+ / 10+ licensees. |
| Bahrain | CBB — Crypto-Asset Licence | Fastest GCC route; often obtained first while other applications run in parallel. |
| Turkey | CMB — CASP licence | Capital ~$4.1M; unlicensed operation criminal; the 30 Jun 2026 deadline for unlicensed firms has passed — confirm current status before relying on this line. |
| Nigeria | SEC — ISA 2025 registration | Exchanges inside capital-markets law; NGN 2bn capital floors; compliance deadline mid-2027. |
| Kenya / South Africa | VASP Act 2025 / FSCA CASP | Kenya operationalising 2026; South Africa most mature African pipeline (310 approved). |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| Singapore | MAS — MPI (DPT services) | High bar, top credibility; 37 active holders; overseas-only DTSP licences effectively not issued. |
| Hong Kong | SFC — VATP licence | 13 licensed platforms (29 May 2026), 6 applications pending. 98% of client assets in cold storage; assets held via a wholly owned HK subsidiary with a TCSP licence. Circular of 3 Nov 2025 allows a shared order book with a licensed global affiliate, on approval and full pre-funding. |
| Japan | FSA registration + JVCEA | Regime mid-upgrade: 2026 FIEA amendment moves crypto into securities law; flat 20% tax from 2028. |
| South Korea | FSC/FIU — VASP + VAUPA | Real-name bank accounts; effectively closed to foreign platforms without local structure. |
| Australia | AFSL (Digital Asset Platforms) + AUSTRAC | Licensing cliff: existing platforms had to lodge AFSL applications by 30 Jun 2026. |
| India | FIU-IND registration (PMLA) | AML-registration regime (54 entities), not a market-structure licence; 30% tax + 1% TDS; travel rule with no de-minimis. |
| Kazakhstan | AIFC — AFSA trading-facility licence | ~$200K capital, ~6–7 months; crypto legal inside the AIFC perimeter; active regional hub. |
Summary only, not legal advice; regimes verified against primary and legal-industry sources, mid-2026. Your counsel owns the licence; we build to its conditions.
Every corridor, vendor watch-out and licensing note in this workspace came out of real builds. Here they are — split honestly into what we shipped and what we architected, because conflating the two does not survive a technical call.
custody · vault topology · ledger · treasury · AML
named · live mainnet · publicly verifiable
order lifecycle · deferred signing · embedded wallets
liquidity · smart order routing · hedging
omnibus vs segregated · taint · sweeping · AML
onboarding · screening · sanctions · case management
An earlier full CEX stack — trading core, wallets, back office and compliance surface — also sits in the portfolio; it is no longer operated by its owner, which is why we lead with the systems above.
The fastest way to lose a technical evaluation is to be caught overstating one thing. So here is the boundary, unprompted.
Every bidder you meet will claim the matching engine. Ask each of them the same question we just answered: which of these have you run in production, and which are you building for the first time on my budget?
Engagements described without client names except where the client is public. Named references available under mutual NDA.
Section 05 shows what one order has to survive. This is the machine that survives it — and where each part comes from. Red outline: built by us and proven in production. Grey: an integration we already run. Dashed: purpose-built per venue, because no shortcut exists.
Eight tiers in production: customer, per-user quarantine, omnibus, withdrawal, warm, company, gas station, cold. Automated top-up between tiers with a safety interlock that suspends automation after repeated emergency refills instead of silently draining the floor.
Self-hosted double-entry ledger as the single source of truth. Every trade, fee, deposit and withdrawal is a balanced posting with an idempotency reference, so webhook redelivery is safe and reconciliation is a query rather than a monthly fire drill.
Sweep-on-threshold from customer addresses, scheduled and floor-triggered refills, per-asset minimum and target balances. A custody vendor's native rebalancing covers a couple of vaults; everything past that is webhook-and-worker logic someone has to write.
MPC custody in production, abstracted behind a provider interface. Hot and cold cannot share a workspace on the platform — that constraint shapes the topology, and knowing it in advance is worth more than a slide about it.
Per-network fee monitoring with normal, elevated and spike modes against a rolling baseline. In spike mode withdrawals queue FIFO per network with a TTL and drain at a metered rate. Fee tiers are sized from the 95th percentile of observed cost, not guessed.
Not one button: a pricing state machine with automatic and manual transitions, granular blocking per asset, network and operation, manual override behind four-eyes approval with a mandatory reason code. Internal transfers keep working while external flow is halted.
KYC behind a provider-agnostic interface, chain analytics for transaction and address screening, Travel Rule with hosted and unhosted classification, per-user quarantine with manual-only release. Never an automatic allow.
The order book is built for the venue, not reused from a previous one — instrument set, fee model, latency target and settlement path all change the design. We have specified an institutional core in Rust with FIX and a binary API; the throughput profile gets sized against your actual flow rather than quoted as a headline number.
The eight-tier topology running in production. Every arrow is a policy someone has to write, test and be able to defend to an auditor — none of it comes with a custody vendor, and none of it is in a white-label box.
A flagged deposit that lands in the omnibus vault has contaminated the pool — on UTXO chains permanently. Isolating it per user, before the sweep, is the difference between one frozen balance and a custody-wide taint problem.
Every sweep and every refill costs native gas on its own network. Without a dedicated funded tier, treasury automation stops silently at the worst possible moment — during the volume spike that triggered it.
Automation that keeps topping up a draining float will drain it faster. After repeated emergency refills the system suspends itself and asks a human, instead of executing the incident.
This is the layer no vendor box ships and no custody provider replaces — a provider's native rebalancing typically covers a pair of vaults. Everything past that is policy code someone writes. Where a regime sets a hard cold-storage ratio — Hong Kong requires 98% of client virtual assets in cold storage, with compensation arrangements over 50% of cold and 100% of hot holdings — this diagram stops being an engineering artefact and becomes licence evidence.
Key management on the stand runs through a simplified provider service without MPC, so the environment stands up quickly across many assets. In production it is replaced by an MPC custody provider through configuration — the interface does not change. Market data on the stand is a controlled feed; production connects to live venues and to your own liquidity arrangements.
We show a stand rather than a live venue on purpose. The exchanges we built earlier belong to their owners and several no longer operate. Screenshots of dead products prove nothing; we would rather run the architecture in front of you and walk the production integrations case by case.
Sequencing: phase zero maps jurisdiction, instruments, custody and banking partners into an architecture decision record. Phase one is the tradable venue — spot core, ledger, custody, treasury, compliance, back office. Phase two adds derivatives, risk, liquidity connectivity and institutional APIs on a core already proven in operation.
Section 01 says the large losses were custody-operations failures rather than matching-engine failures. That is easy to write and worth nothing on its own. This is the operational answer: who can move funds, what stops them, what happens in the first thirty minutes, and how you prove solvency to a regulator who is not taking your word for it.
The third one is the one teams forget. A four-eyes rule that a single admin can disable is theatre.
Every control above exists in a system we run in production. Section 09 shows where each one sits in the topology.
An incident plan that lives in a document nobody has rehearsed is not a plan. This is the shape we build and drill.
| Window | What happens | What has to exist beforehand |
|---|---|---|
| Detection continuous |
Triggers, not intuition: withdrawal rate above the rolling baseline, balance drift between chain state and ledger, a screening hit on an outbound path, signing requests outside the expected pattern, RPC or node behaviour that stops matching the network. | Alert thresholds defined per asset and per network, routed to a human who is awake in that timezone. |
| First 30 minutes contain |
Halt external flow at the granularity of the problem — one asset, one network, one operation — while internal transfers and trading keep clearing. Freeze treasury automation so it stops refilling a vault that is being emptied. Snapshot ledger state before anything is remediated. | A kill switch that is granular and rehearsed. A blunt “stop everything” button costs you the incident and the business day. |
| Hours 1–4 establish facts |
Reconstruct from the ledger and the audit trail: what moved, on whose authority, through which policy. Separate customer-asset impact from operational-asset impact, because the regulator and your users are asking different questions. | An immutable audit trail that records the authorising identity and reason code, not just the transaction. |
| Regulatory clock jurisdiction-set |
Notification obligations start running from detection in most regimes — not from the point you understand the cause. The first notification is usually made before the facts are complete, and it has to be accurate about what is and is not yet known. | A named accountable person, a pre-agreed template, and counsel who has seen the draft before the incident. |
| Resumption gated |
Restart behind explicit gates: reconciliation clean, root cause identified, control changed. Not “it seems fine now”. Each gate is signed off by a named role. | Written resumption criteria agreed while nobody is panicking. |
| Rehearsal quarterly |
Tabletop the scenarios that actually happen: a drained hot wallet, a compromised operator account, a custody provider outage, a chain reorg, a bad listing. Measure time-to-containment and fix whatever was slow. | Calendar time and executive attendance. Without the second, the first is a workshop. |
Ask every bidder for their incident runbook and the date of their last rehearsal. Most will send you a security architecture diagram instead — that is the answer to a different question, and the substitution tells you what you need to know.
A one-off publication is marketing. Recurring publication on a fixed schedule, with a third party attesting to the method, is evidence. Decide the cadence before launch — retrofitting it onto a ledger that was not designed for snapshots is expensive.
Point-in-time balance snapshots, an address registry that is complete by construction, and an append-only history you can replay. These are architecture decisions in phase one, not a reporting feature bolted on in phase three.
It says nothing about undisclosed off-balance-sheet obligations, encumbered assets, or the hour after the snapshot. Say so publicly. A venue that explains the limits of its own proof is more credible than one that overstates it.
In regimes that mandate a cold-storage ratio for client assets, the vault topology in section 09 and the reserve proof are the same evidence viewed from two directions — design them together.
“On a white-label, hitting its ceiling” is one of the five starting points in section 03 — and the one with the most at stake, because you are moving a live venue with real customer money rather than starting clean. Nothing here is theoretical: it is the sequence that keeps a venue trading through the switch.
Do this first. It is a week of reading and it decides everything after.
Migration cost is the real price of the cheapest route. Section 02 puts it plainly: re-platforming later costs more than owning the contracts from day one would have. If you are reading this section because you are already on a box, that number is no longer hypothetical for you — and it is the strongest argument you have in your next vendor negotiation.
Sequencing, dual-run duration and the reconciliation gate are scoped in discovery against your contract terms and your custody arrangement — those two constrain the plan more than the engineering does.
A per-feature price list on a public page is theatre: padded or wrong, and your scope is neither ours nor your competitor’s. These are the corridors our estimation library actually produces.
A short discovery maps your requirements onto the module decompositions behind these corridors. You get a phased plan with hour ranges per module, written assumptions, and gates where you can stop. The corridor becomes a number you can defend to your board.
Bring your vendor shortlist — we map it module-by-module (covered / partial / missing) and tell you which route wins on your constraints, even if that route is not ours.
Scope it in discovery →All bands are indicative, derived from module-level estimations of comparable builds at a stated blended rate; not a quote. Annual third-party OPEX (custody, KYT, travel rule, surveillance, market data) is budgeted separately — reference lines in section 06. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com
The hard part is never the order book. It is the regulated plumbing around it: vault topology, sweep and rebalancing policy, ledger consistency, withdrawal authority, and the compliance surface wrapped around all of it. A vendor box covers the book and stops there; the market layer is a custom build on every route, including the cheapest one.
Custodial wallet stack alone — MPC custody, AML pipeline, back office, before the venue itself — runs $290–380K. Third-party OPEX (custody, KYT, travel rule, market data) is budgeted separately.
Haust Network — trading venue on a zk-rollup L2. Uniswap-v3-based venue with concentrated liquidity and custom liquidity incentives, cross-chain liquidity via AggLayer, account abstraction in Rust across ERC-4337 / 6900 / 7579, lending on an Aave-v3 base. Mainnet live since October 2025; 10.4M wallets and 15.4M transactions through the testnet phase; engagement running since 2024 and extended by the client into a second product.
Eight further engagements — a licensed bank's digital-asset platform, multi-chain custody, market making, order execution, an institutional exchange architecture review — are described without client names. Named references under mutual NDA.
A short discovery maps your requirements onto the module decompositions behind these corridors. You get a phased plan with hour ranges per module, written assumptions, and gates where you can stop. Phase one is the tradable venue: spot core, ledger, custody, treasury, compliance, back office. Phase two adds derivatives, risk, liquidity connectivity and institutional APIs on a core already proven in operation.
Bring your vendor shortlist. We map it module by module — covered, partial, missing — and tell you which route wins on your constraints, even when that route is not ours.