Deep dive
Brokerage-style launch or full exchange
Most new crypto apps launch as a brokerage: customers buy and sell at quoted prices, and the platform fills orders with liquidity partners in the background. This avoids building and operating a matching engine and order book on day one, and it is the model behind the MVP estimate here. A full exchange with its own order book, market makers and APIs for professional traders belongs in the scale tier, once volume justifies it.
Custody follows the same logic. An MPC provider or licensed custodian holds keys with policies you define: which wallets can send, to whom, with which approvals. You keep control of rules and user experience without designing key management from scratch.
Regulation as of October 2026
In the EU, the Markets in Crypto-Assets Regulation (MiCA) transitional period ended on 1 July 2026, so crypto-asset service providers need MiCA authorisation to serve EU customers, and the Transfer of Funds Regulation applies the travel rule to crypto transfers. In the UK, firms register with the FCA for anti-money laundering today; the FCA opened its authorisation gateway for the new cryptoasset regime in September 2026, with the regime due to take effect in October 2027.
In the US, crypto businesses typically need FinCEN registration and state money transmitter licences, with New York requiring its own BitLicense. The GENIUS Act of 2025 created a federal framework for payment stablecoins, and Congress has been working on a broader market structure law, the CLARITY Act, which passed the House in 2025; check its status before you plan your product. In India, exchanges must register with FIU-IND under anti-money laundering rules, and crypto gains carry a flat 30% tax with 1% tax deducted at source on transfers. In the UAE, VARA regulates virtual asset providers in Dubai, alongside federal and free-zone regulators. This is general information, not legal advice.
Deposits, withdrawals and the ledger
Each customer gets deposit addresses on supported chains. Indexers watch the chain, and a deposit is credited once it reaches the confirmation threshold for that chain and passes screening. Withdrawals go through risk checks, travel rule messaging where required, custody policy approval and broadcast, with status shown to the user at each step.
Every one of these events writes balanced entries to a double-entry ledger. Reconciliation jobs compare the ledger with custodian balances and on-chain data continuously, and any mismatch stops withdrawals for the affected asset until it is explained.
- Set confirmation thresholds per chain and review them after network incidents.
- Require address allowlists and delays for first withdrawals to new addresses.
- Keep most funds in cold or policy-locked wallets; top up hot wallets automatically.
Security and incident readiness
Assume attackers will try account takeover, phishing, SIM swaps, API abuse and insider threats. Use phishing-resistant multi-factor authentication such as passkeys, withdrawal delays after security changes, device binding, strict admin access with approvals and full audit logs. Separate production cloud accounts for custody-adjacent services.
Write and rehearse incident plans: how to pause withdrawals, rotate keys, contact the custodian and inform customers and regulators. Our cybersecurity services team can run tabletop exercises before launch.
Scaling and running costs
Growth adds advanced trading, more assets and earn products where they are permitted. Scale adds an own matching engine, institutional services, a self-custody wallet and new jurisdictions, each of which may need its own licence and entity. Keep jurisdiction-specific rules, limits and disclosures in configuration so expansion does not mean rewriting core services.
Running costs include custody and node providers, blockchain analytics, KYC checks, travel rule messaging, payment fees, cloud and security tooling. Plan roughly 15-20% of the build cost per year for maintenance and support, plus compliance staff, who are often the largest ongoing cost.