Whether you start from a blank sheet or a white-label box, the hard part is the same everywhere: the regulated plumbing around the order book. This workspace compiles what we learned scoping and building exchanges across markets — use it before any vendor shows you a slide deck.
A vendor box gets you an order book fast — and stops there. Local payment rails, reporting formats, your own roadmap and your own token listings live outside the box. Teams discover this after signing, not before.
Per-transfer reporting, local KYC stacks, payment-rail limits — and in some markets per-trade tax withholding. The mechanics that make an exchange legal in its market exist in no off-the-shelf product. Someone builds them, every time.
The largest exchange security losses of recent years were custody-operations failures, not matching-engine failures. Cold-storage segregation, proof-of-reserves and incident playbooks belong in the design — not the post-mortem.
Every bidder will sell you their default. This workspace exists so you can walk into that conversation knowing the routes, the vendors, the licensing map and the honest corridors — ask any bidder to show you the path of one dollar through their platform.
Compiled from our exchange engagements and estimation library across markets. Vendor and regulatory facts current to mid-2026.
No forms, no email gate. Multi-select what will trade — the finder maps your answers onto the three routes we actually deliver, and says honestly when the answer is “decide in discovery”.
Corridors are indicative bands from module-level estimations of comparable builds; not a quote. The finder’s logic is the same one our architects argue about in discovery — just faster.
Money in, buy, sell, money out. Drag the amount, switch the market profile, then flip the white-label toggle and see which steps a vendor box actually covers — and which ones are your build list.
Every step is something the exchange operator must build, integrate or answer for. The steps a vendor skips in their demo are the ones you will be building — usually under deadline, after signing.
The market is real and often good. The mistake is not renting — it is not knowing where the box ends. Facts below are current to mid-2026; published pricing only.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| HollaEx | Hosted / on-prem exchange kit: spot, wallets, admin, open-source core | Revenue share on lower enterprise tier | from $700/mo; ent. ~$35K/yr +15% rev share |
| AlphaPoint | Institutional exchange + tokenization backend, deep customization | Custom quotes only | not published |
| B2Broker | Turnkey engine, liquidity aggregation, crypto-fiat gateway, CRM | Brokerage / FX DNA more than crypto-native | not published |
| ChainUP | Enterprise CEX/DEX/hybrid, perps, staking; liquidity network | SaaS cost grows steeply at scale | quote-based |
| Openware / OpenDAX | Open-source cloud-native stack; perpetual license, full source ownership | You own the code — and the maintenance burden | not published |
| PayBitoPro | Budget white-label, US-compliance marketing | Entry tier is thin; customization pushes tiers up fast | $149–12,000/mo |
| Shift Markets | WL exchange + integrated liquidity, brokerage tools | Quote-based; smaller footprint | not published |
| Devexperts (DXtrade) | Institutional multi-asset trading platform infrastructure | Trading-front DNA more than full CEX back-office | not published |
| Binance CaaS | Exchange-as-a-service on Binance infrastructure (replaced Binance Cloud, 2025) | You cannot list your own token or stablecoin in your own order books | rev-share |
| Exberry / Connamara EP3 | Standalone matching engines (SaaS / platform + clearing + surveillance) | Full-platform licensing — not a cheap drop-in | not published |
Cross-cutting: on every core, the engine and order books remain the vendor’s; jurisdiction mechanics are in no box. First-year white-label TCO seen across deals: $50–200K.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| Fireblocks | MPC wallet infrastructure + transfer network; 550M+ wallets served | Enterprise quotes; budget a six-figure annual line at scale | not published |
| BitGo | Qualified custodian, multi-sig + MPC, wallet-as-a-service; OCC trust charter | Custody vs wallet-tech product lines differ in regulatory cover — pick deliberately | not published |
| Copper | MPC custody + ClearLoop off-exchange settlement | MiCA authorization still pending mid-2026 | not published |
| Cobo | Custody + wallet-as-a-service; HK TCSP, MAS in-principle | APAC-centric licensing footprint | not published |
| Utila | Institutional MPC wallet ops incl. DeFi access | Younger vendor, shorter track record | not published |
Reference OPEX from deal research: MPC custody $50–250K/yr + $10–50K setup. Custody choice shapes the licence application — decide them together.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| Sumsub | IDV, liveness, KYB, AML screening, Travel Rule in one platform | Local ID stacks (e.g. national eKYC registries) are not native — pair locally | from $1.35/check, $149/mo min |
| Jumio | Enterprise IDV, broad document/biometric coverage | Sales-led, quote-based | not published |
| Onfido (Entrust) | IDV + biometrics inside the Entrust portfolio | Post-acquisition packaging is Entrust-driven — re-verify SLAs | not published |
| Shufti / Persona | Global IDV/AML; developer-first workflow builders | Thinner crypto-specific compliance modules | not published |
| Chainalysis | Most-deployed KYT: real-time monitoring + investigations | License is a top-3 compliance OPEX line | not published |
| Elliptic / TRM Labs | Broad-coverage screening; AI-driven threat intel | Often run as second provider | not published |
| Notabene | End-to-end Travel Rule SaaS aggregating major protocols | Reachability depends on the counterparty VASP’s network | not published |
Reference OPEX: KYT $30–120K/yr · Travel Rule $15–60K/yr · sanctions/PEP $10–40K/yr · KYC $1–3/check (cheaper via local-market IDV vendors). EU TFR threshold is now zero; several regulators require originator/beneficiary data with no de-minimis.
| Vendor | Out of the box | Watch-out | Published pricing (typical) |
|---|---|---|---|
| MoonPay | Widest-known widget on/off-ramp, cards + wallets | Highest fees of the majors | ~4.0–5.5% |
| Ramp Network | Widget on/off-ramp with cheap bank rails | Regional coverage narrower than MoonPay | SEPA ~0.49% · card ~2.9% |
| Transak | On/off-ramp incl. local rails; locally registered in several markets | Coverage gaps by state/market — verify yours | ~1–3% |
| Banxa | Listed provider, broad payment-method coverage | Mid-pack pricing | card ~2.99–3.99% · SEPA ~1.99% |
| Mercuryo | On/off-ramp with strong SEPA Instant rails | Card side is pricey | SEPA ~1.95% · card ~3.95% |
Pattern from deals: ramp aggregators are the MVP fast-track; direct banking rails come later and are never advertised — a discovery item, not a checkbox.
| Vendor | Out of the box | Watch-out | Published pricing |
|---|---|---|---|
| B2C2 | Institutional OTC liquidity / electronic LP | OTC LP model, not designated MM on your books by default | not published |
| GSR / Wintermute | Global algorithmic market making across CEX + DEX venues | Prioritize larger venues and tokens | not published |
| FalconX | Prime brokerage: execution, credit, custody access | Prime-broker model rather than order-book MM | not published |
| Flowdesk | Market-making-as-a-service; client keeps funds ownership | Retainer economics vary widely | not published |
| Nasdaq SMARTS | Multi-asset trade surveillance for the largest venues | Big-institution pricing and implementation weight | not published |
| Solidus Labs / Eventus | Crypto-native and mid-market surveillance (wash trading, spoofing, cross-venue) | Coverage DNA differs — crypto-native vs multi-asset | not published |
Reference: MM retainers ~$10–50K+/mo, quote-based. A pragmatic MVP alternative is a vendor liquidity bridge — with an exit plan to direct arrangements.
In our module-level gap analysis of a white-label-based offer against a full institutional scope, the box genuinely covered about 11% of the modules, partially covered a third, and left the majority to custom build. The box is not a scam — it is a start. Price the other 89% before you sign.
Aggregate third-party TCO seen across exchange deals: one-off $85–270K, annual $293K–1.47M. Vendor facts current to mid-2026; verify at contract time.
Each route below is a real delivery we would sign up for. The matrix shows the trade-offs; the watch-outs are the ones we say in the room.
The engine, order books and admin come from the box. Your market layer — local rails, reporting, tax mechanics, your listings policy — is built beside it.
Your contracts, data model and code from day one; vendor components behind adapters ship the MVP at near-box speed. Implementations degrade — contracts never do: every rented piece stays swappable.
You build the engine the vendors spent years hardening. Total control, total responsibility — justified when derivatives mechanics or exotic market structure genuinely demand it.
| Route 1 · Vendor + layer | ★ Route 2 · Composable | Route 3 · Custom | |
|---|---|---|---|
| Ownership & IP | |||
| Code & contracts ownership | ✕vendor’s core | ✓yours from day one | ✓total |
| Own-token / listings freedom | ◖vendor policy applies | ✓yours | ✓yours |
| Delivery characteristics | |||
| Time to first trade | ✓fastest | ✓near-vendor | ✕slowest |
| Market layer (rails, reporting, tax) | ✕custom on every route | ✕custom on every route | ✕custom on every route |
| Risk & growth | |||
| Vendor lock-in | ✕structural | ✓every piece swappable | ✓none |
| Scales past MVP without rebuild | ◖until the ceiling | ✓by design | ✓by design |
| Watch-outs — the trade-off you accept | |||
| The honest one | re-platforming later costs more than Route 2 would have | adapter discipline or it quietly becomes Route 1 | pays us more, delays your launch |
Live in weeks on a major exchange’s infrastructure. Ruled out for most: you cannot list your own token or stablecoin in your own order books, and the economics are permanent rev-share. Parked for franchise-style ventures.
Full source ownership at licence-price zero. Ruled out as a primary route: you inherit the maintenance burden on day one without the vendor’s hardening cadence. Viable inside Route 2 as one adapter among several.
Institutional engines (SaaS or licensed) are excellent — and only ~10% of the scope. Sensible inside Route 2 or 3; not a route by itself. Parked.
Budget figures are indicative corridors at a blended rate, before the market layer; the matrix criteria mirror the ones we use in delivery grammar internally: time-to-market, IP control, lock-in, scaling ceiling.
Twenty-plus regimes, one table. The dates matter: several markets closed their transition windows this year — sequencing the licence is now part of the build plan, not an afterthought.
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| EU / EEA | MiCA — CASP authorisation | One licence passports to 30 states. Transition ended 1 Jul 2026; ~204 CASPs authorised, unlicensed firms must exit. |
| Norway | Crypto Asset Act (MiCA via EEA) | Same CASP regime, offset transition (hard stop 30 Jun 2026); local venues already authorised. |
| UK | FCA — FSMA regime, QCATP category | Brand-new full regime: final rules Jun 2026, application window Sep 2026–Feb 2027, fully live Oct 2027. |
| Switzerland | FINMA — FinTech / securities-firm + DLT facility | Reputation-grade; dedicated crypto-institution licence category expected from 2027. |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| USA | FinCEN MSB + SEC/CFTC + state MTLs; NY BitLicense | Highest-cost patchwork (45+ state licences). Stablecoin law in force; market-structure bill cleared committee, not yet law mid-2026. |
| Canada | CSA/CIRO — investment-dealer registration | Platforms regulated as securities dealers; 4-tier custody framework (2026). Strict. |
| Brazil | BCB — VASP authorisation | Effective Feb 2026: capital ~$2–7M, monthly proof-of-reserves, existing firms deadline 30 Oct 2026. |
| Mexico | Fintech Law (ITF) | Grey-light: regulated entities restricted from public crypto offering; exchanges operate under AML reporting. |
| El Salvador | CNAD — DASP | $2K min capital, 0% digital-asset tax, 3–6 month timeline; scrutiny rising. |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| UAE — Dubai | VARA — VASP Exchange Services | Most active licensing hub; retail OK; derivatives rulebook live Mar 2026; ~45 VARA VASPs. |
| UAE — ADGM / DIFC | FSRA FSP / DFSA | Common-law frameworks; institutional focus; 25+ / 10+ licensees. |
| Bahrain | CBB — Crypto-Asset Licence | Fastest GCC route; often obtained first while other applications run in parallel. |
| Turkey | CMB — CASP licence | Capital ~$4.1M; unlicensed operation criminal; firms unlicensed by 30 Jun 2026 face liquidation. |
| Nigeria | SEC — ISA 2025 registration | Exchanges inside capital-markets law; NGN 2bn capital floors; compliance deadline mid-2027. |
| Kenya / South Africa | VASP Act 2025 / FSCA CASP | Kenya operationalising 2026; South Africa most mature African pipeline (310 approved). |
| Market | Regime · licence | What is distinct · 2026 status |
|---|---|---|
| Singapore | MAS — MPI (DPT services) | High bar, top credibility; 37 active holders; overseas-only DTSP licences effectively not issued. |
| Hong Kong | SFC — VATP licence | 13 platforms; 2025/26 circulars allow shared global order books with affiliates; retail with safeguards. |
| Japan | FSA registration + JVCEA | Regime mid-upgrade: 2026 FIEA amendment moves crypto into securities law; flat 20% tax from 2028. |
| South Korea | FSC/FIU — VASP + VAUPA | Real-name bank accounts; effectively closed to foreign platforms without local structure. |
| Australia | AFSL (Digital Asset Platforms) + AUSTRAC | Licensing cliff: existing platforms had to lodge AFSL applications by 30 Jun 2026. |
| India | FIU-IND registration (PMLA) | AML-registration regime (54 entities), not a market-structure licence; 30% tax + 1% TDS; travel rule with no de-minimis. |
| Kazakhstan | AIFC — AFSA trading-facility licence | ~$200K capital, ~6–7 months; crypto legal inside the AIFC perimeter; active regional hub. |
Summary only, not legal advice; regimes verified against primary and legal-industry sources, mid-2026. Your counsel owns the licence; we build to its conditions.
A per-feature price list on a public page is theatre: padded or wrong, and your scope is neither ours nor your competitor’s. These are the corridors our estimation library actually produces.
A short discovery maps your requirements onto the module decompositions behind these corridors. You get a phased plan with hour ranges per module, written assumptions, and gates where you can stop. The corridor becomes a number you can defend to your board.
Bring your vendor shortlist — we map it module-by-module (covered / partial / missing) and tell you which route wins on your constraints, even if that route is not ours.
Scope it in discovery →All bands are indicative, derived from module-level estimations of comparable builds at a stated blended rate; not a quote. Annual third-party OPEX (custody, KYT, travel rule, surveillance, market data) is budgeted separately — reference lines in section 04. © 2007–2026 Innowise · innowise.work · case studies · contact@innowise.com