How to Start a Crypto Exchange: Licensing, Banking & Infrastructure

What You Need to Launch a Crypto Exchange

A centralised crypto exchange in 2026 needs five interlocking components: a regulated operating entity, sufficient capital under the licensing regime, a crypto-asset service provider authorisation or third-country equivalent, an EMI plus banking arrangement for fiat on and off-ramp, and a live compliance stack covering AML/CFT, market abuse, and operational resilience.

The operating entity is typically a private limited company in the licensing jurisdiction. The form varies: an osaühing (OÜ) in Estonia, a společnost s ručením omezeným (s.r.o.) in Czechia, a limited liability company in Cyprus, a free-zone company in the UAE, an exempted company in the Cayman Islands, or a Hong Kong limited company under the Companies Ordinance (Cap. 622). Capital structure must reflect both the home regulator's minimum (MiCA Annex IV Class 3 at €150,000 for a trading-platform operator, AED 800,000 or AED 1,500,000 at VARA, HK$5 million paid-up at the SFC, risk-based at CIMA) and the realistic fixed-overhead cushion the file will need to defend.

The licence is the gate. Inside the EU and EEA, the relevant authorisation is MiCA CASP for the operation of a trading platform for crypto-assets, granted under Regulation (EU) 2023/1114 Article 63. Outside the EU, the route is jurisdiction-specific: a VASP Licence under the Cayman Islands Virtual Asset (Service Providers) Act, a VARA Exchange Services category, an ADGM Operating a Crypto Asset Business permission, an SFC Virtual Asset Trading Platform licence, or equivalent. Third-country firms cannot sustainably serve EU clients through reverse solicitation; ESMA Guidelines ESMA35-1872330276-2030 (26 February 2025) confine the exemption to the context of the original transaction, which prevents any recurring relationship without local CASP authorisation.

Banking is the binding constraint, not the licensing one. A centralised exchange has two distinct banking needs: a fiat on/off-ramp (typically an EMI relationship, volume-led, optimised for client deposits and withdrawals) and a treasury and correspondent layer (covering FX, settlement, payroll, and vendor payments). Most failed launches under-spec the second.

Custody is either in-house (under the operating licence) or outsourced to a regulated qualified custodian. The matching engine, KYC/AML tooling, transaction-monitoring stack, and chain-analytics provider are out of scope for this page, but the regulator assesses them as part of the operating-conditions review under MiCA Article 76 or its non-EU equivalent.

Ongoing compliance is the permanent operating expense. The MiCA Title V conduct rules, Title VI market-abuse regime (Articles 86 to 92), and the Digital Operational Resilience Act run in parallel inside the EU; equivalents exist at every comparable non-EU jurisdiction.

The dependency sequence is the differentiator. Formation runs first, but capital can be paid up alongside director appointments. EMI pre-qualification should begin before capital is locked, because credible EMIs onboard CASPs once the application file is in the regulator's queue, not after authorisation. The licence application itself should not be filed until banking is at least pre-qualified, because the regulator asks, and a file without a credible answer extends the assessment cycle by months.

Infrastructure Checklist

Choosing the Right Jurisdiction

Jurisdiction choice determines the regulatory framework, the capital floor, EU market access, banking accessibility, and tax treatment. For a centralised exchange in 2026 the practical decision narrows to three clusters: the EU MiCA cluster for passportable access, the Middle East cluster for a non-EU regulated alternative, and the Caribbean and APAC clusters for offshore tax efficiency or institutional gateway positioning.

The decision framework runs across six axes: regulator posture toward exchange operations, capital and cost reality, banking accessibility, EU passporting potential, market access for the target client base, and operational headcount required. A trading platform serving EU retail clients post-1 July 2026 needs a MiCA CASP; a platform serving institutional clients in Asia or the GCC may not. The cluster logic is structural, not preferential: the EU cluster trades cost and regulator-throughput against passporting upside; the Middle East cluster trades higher capital against banking access and a clean common-law overlay; the Caribbean cluster trades EU passporting against tax efficiency and entity flexibility; the APAC cluster sits at the high-bar end on capital and process.

Jurisdiction Comparison

The three EU rows (Estonia, Czech Republic, Cyprus) all hold the MiCA Article 65 passport into the rest of the EEA; the three non-EU rows (UAE, Cayman Islands, Hong Kong) operate as third-country regimes without it. Banking-friendliness scores and grandfathering / authorisation pipeline notes appear inline in the cells below.

The cluster choice maps to the client base. An exchange serving EU retail and institutional clients should default to the EU MiCA cluster: Estonia and Czechia for cost-leadership and regulator quality, Cyprus only for firms already in-flight under the national regime, the larger EU economies (Germany, France, Italy, Spain) for prestige-market authorisation at materially higher cost and timeline. An exchange serving Middle Eastern, North African, and South Asian clients should default to the UAE cluster, with VARA for retail-facing exchange services in Dubai and ADGM for institutional and structural overlays. Cayman and Hong Kong sit at opposite ends of the offshore spectrum: Cayman for tax-efficient holding structures with operations elsewhere, Hong Kong as a high-bar gateway to mainland Chinese investment flows.

Estonia and Czechia represent the credible EU floor on cost and regulator quality; their grandfathering periods run to 1 July 2026, which means a national-regime exchange that has not filed a complete MiCA application by mid-2026 cannot continue. Cyprus is past its filing deadline, which removes it as an option for new entrants until the regulator clears its backlog. Two adjacent jurisdictions are worth surfacing for readers who arrived expecting them but are not in the table for partner-coverage reasons: Lithuania, whose five-month transition expired 1 June 2025 and which now operates a new-applicant CASP queue at the Bank of Lithuania; and Poland, which has no national MiCA implementation following two presidential vetoes and a failed parliamentary override (243 of 263 votes, April 2026).

Setting Up Your Company

Company formation for a centralised crypto exchange is straightforward in form and consequential in substance. The standard route is a private limited company in the licensing jurisdiction. The substantive choices are share-capital structure, director and shareholder residence, registered office, group structure for multi-market operations, and the question of e-Residency where it applies.

Entity types vary by jurisdiction. Estonia uses the osaühing (OÜ); the Czech Republic uses the společnost s ručením omezeným (s.r.o.); Cyprus uses the limited liability company; the UAE uses free-zone companies in the relevant free zone (typically DMCC, IFZA, or a mainland LLC for VARA-licensed activity); the Cayman Islands uses the exempted company; Hong Kong uses the limited company under the Companies Ordinance (Cap. 622). Share-capital practice varies sharply. Estonia and Czechia accept nominal capital at formation, with the regulatory capital paid up before the licence application progresses. The UAE free zones, the Cayman Islands, and Hong Kong typically require the licensing capital to be paid up before or alongside the licence application.

Director and shareholder substance matters. EU MiCA NCAs apply fit-and-proper assessment to directors and substantial shareholders, and they apply substance tests to the management of the operating entity: a registered office that is in fact occupied, a senior-management function that is in fact resident, an MLRO who is in fact accountable. The UAE and Hong Kong apply equivalent standards under their respective frameworks. The Cayman Islands applies the regulated economic-substance regime and the new minimum three-director requirement (including one independent director) introduced under the VASP Act 2024 Revision.

In our experience, the most common formation mistake on multi-jurisdictional exchange structures is layering a holding entity into a jurisdiction that the home NCA later treats as an indirect parent for substance-assessment purposes. The result is a regulator-level redesign mid-application, which adds three to six months to the launch envelope. A simpler structure, an operating entity in the licensing jurisdiction and a single layer of holding above it, with substance in both places, survives most fit-and-proper reviews.

e-Residency in Estonia is operationally useful for non-resident founders managing the operating entity remotely; it does not substitute for the substantive presence the regulator expects from the management function. See the full European company formation guide for the entity-level details and the Estonia formation guide for the e-Residency workflow.

Licensing Requirements

A centralised crypto exchange operating in the EU needs MiCA CASP authorisation for the operation of a trading platform for crypto-assets. Capital is €150,000 paid up under Annex IV Class 3 of Regulation (EU) 2023/1114, or one quarter of prior-year fixed overheads, whichever is higher. Outside the EU, the route depends on the jurisdiction's specific framework.

The MiCA CASP regime, the EU framework. Under Regulation (EU) 2023/1114 a centralised crypto exchange falls within Article 3(1)(16) point (ii), the operation of a trading platform for crypto-assets. The authorisation procedure sits in Articles 62 and 63: a complete application file is filed with the home Member State's national competent authority (NCA); the NCA has 25 working days to assess completeness; the NCA then has 40 working days to take a decision (the clock can stop for additional information requests). Operating conditions for trading platforms sit in Article 76: governance, fair access, transparent listing criteria, market-abuse prevention, settlement, and pre and post-trade transparency. The applicable service class under Annex IV is Class 3, with the €150,000 paid-up minimum.

The typical service-class bundle for an exchange is operation of a trading platform (the headline service), exchange of crypto-assets for funds and exchange of crypto-assets for other crypto-assets (almost always bundled), custody and administration on behalf of clients (where the exchange holds client assets in-house rather than at a qualified custodian), and execution of orders on behalf of clients (where the exchange routes client orders rather than only matching). The bundle drives the capital tier: at Class 3, all of the foregoing fall under the same €150,000 floor. In practice, most operators take the full bundle because re-applying to add a service later is materially slower than including it in the initial file.

The transitional cliff. MiCA Article 143(3) grandfathers pre-30-December-2024 national-regime CASPs to a maximum of 1 July 2026, but only if the home Member State opted for the full 18 months. The Member States at the 18-month maximum include France, Luxembourg, Malta, Estonia, Czech Republic, Cyprus, Italy, and Bulgaria. The Netherlands ran a six-month transition that expired 30 June 2025; Lithuania ran a five-month transition that expired 1 June 2025; Spain ran a twelve-month transition that expired 30 December 2025; Germany, Austria, and Ireland ran twelve-month transitions that expired 31 December 2025. Poland has no national MiCA implementation following two presidential vetoes and a failed parliamentary override.

Cross-border passporting under MiCA Article 65 is by notification, not automatic on authorisation. An authorised CASP files a notification with its home NCA before commencing services in another EU Member State, selecting between freedom of establishment (a branch) and freedom to provide services on a cross-border basis. The home NCA transmits the notification to the host NCA, and the CASP may begin operating in the host state only after the notification process completes.

Third-country routes. Outside the EU, the principal routes for an exchange are VARA's Exchange Services category in Dubai, the ADGM Operating a Crypto Asset Business permission, the SFC VATP licence under AMLO Part 5B in Hong Kong, and the Cayman VASP Licence under the Virtual Asset (Service Providers) Act. The UK route is forthcoming: the authorisation gateway opens 30 September 2026 to 28 February 2027 under SI 2026/102, with the new regime commencing 25 October 2027. Reverse solicitation cannot substitute for local authorisation. The ESMA Guidelines ESMA35-1872330276-2030 (published 26 February 2025, applicable from 27 April 2025) define solicitation broadly and confine further same-type marketing to the context of the original transaction.

Applications fail most often on the governance file. An MLRO who cannot articulate the firm's risk appetite in the regulator's vocabulary, or a board composition that does not survive fit-and-proper scrutiny, costs more time than any single technical gap. See the crypto licensing hub for the full jurisdictional matrix, and see the crypto exchange licensing guide for exchange licence costs, capital floors and timelines compared regime by regime.

Banking

Banking is the binding constraint on most exchange launches, not licensing. A centralised exchange needs two distinct banking layers: a fiat on/off-ramp for client deposits and withdrawals (typically an EMI relationship) and a treasury and correspondent layer for FX, settlement, payroll, and vendor payments. Most failed launches under-spec the second.

A centralised exchange's volume sits in the on/off-ramp: client euros, pounds, and dollars in and out. The EMI archetype is well-suited to that volume because it can issue dedicated IBANs, handle SEPA Instant flows, and run modern KYC/AML tooling that scales with deposit count. The traditional bank archetype is better suited to the treasury layer because the exchange's own operating cash, FX hedging activity, and settlement legs with counterparties run on smaller transaction counts but require broader correspondent-banking reach. In our experience, operating models that ran out of runway during licensing typically did so because they tried to put everything through one provider.

Through Jagelski & Partners’ partner network, businesses placed more than fourteen billion euros in client turnover across banking and EMI relationships in 2025. Placement runs as pre-qualification across the network rather than sequential applications: the firm's analysts assess the client profile against the live appetite of more than 90 institutions, surface the credible matches, and run the placement in parallel. In our experience, exchange operators that secure a tier-1 EMI relationship before the licence is granted shorten the path to live trading by six to ten weeks, because the regulator's banking question is answered when the file is read, not after.

Jagelski & Partners is paid by the institution, not by the client. We do not charge an onboarding fee. The pricing on the client's account-opening documentation is the institutional rate. There is no markup layered on top of institutional pricing.

Ongoing Compliance

Ongoing compliance is a permanent operating expense, not a one-time licensing event. For a MiCA CASP operating a trading platform, the compliance perimeter runs across AML/CFT (5AMLD, 6AMLD, the EU Travel Rule under Regulation (EU) 2023/1113), market abuse (MiCA Title VI), operational resilience (DORA), and ongoing prudential and supervisory reporting cycles.

AML/CFT. EU CASPs are obliged entities under the Anti-Money Laundering Directives (5AMLD and 6AMLD, soon to be superseded by the AML Regulation and the Sixth Directive package). The EU Travel Rule (Regulation (EU) 2023/1113) imposes data-collection obligations on every crypto-asset transfer involving a CASP, with no de minimis threshold. The MLRO function is a permanent senior-management appointment, and the AML/CFT manual is a living document the NCA can request at any time.

Market abuse. MiCA Title VI (Articles 86 to 92) extends the EU's market-abuse regime to all crypto-assets admitted to trading or for which a request for admission has been made on a CASP-operated trading platform. The substantive prohibitions track the Market Abuse Regulation: insider dealing (Article 90), unlawful disclosure of inside information (Article 89), market manipulation (Article 91). Article 92 places obligations on CASPs to detect and report suspected market abuse to the NCA. The practical implication is a 24/7 surveillance capability, either in-house or through a regulated third party.

Operational resilience. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has been applicable to CASPs since 17 January 2025 under Article 2(1)(f). DORA covers ICT risk management, incident reporting, digital operational resilience testing (including threat-led penetration testing for significant CASPs), and ICT third-party risk management. The register of information of ICT contractual arrangements is reported annually.

Prudential and supervisory reporting. Capital adequacy is reviewed annually against the higher of the Annex IV minimum and one quarter of fixed overheads. The NCA requires an annual audit (entity-level financial statements plus regulatory return). Outside the EU, equivalents exist: VARA imposes a quarterly capital-adequacy return; the SFC imposes monthly liquid-capital reporting and a six-monthly assets review under the SF(FR)R.

Frame compliance as a recurring fraction of revenue, not a project line. For a mid-sized centralised exchange, the realistic annual cost runs €400,000 to €1,500,000 across the MLRO and compliance team, surveillance tooling, DORA testing, external audit, and regulatory levies.

Realistic Timeline and Costs

The realistic end-to-end timeline from formation to operational launch is six to eighteen months. The realistic professional-fee envelope is €30,000 to €100,000 plus minimum capital plus banking float. In our experience, the variance comes from jurisdiction, the completeness of the file at first submission, and whether banking runs in parallel with licensing or downstream of it.

End-to-End Timeline and Cost Range

What compresses the envelope: pre-qualified banking before capital is locked, pre-drafted compliance documentation (AML/CFT manual, governance policies, MLRO appointment), a clean fit-and-proper file for directors and substantial shareholders, and a chosen NCA with a published throughput record. What expands it: regulator backlog (Cyprus through 2026; ČNB on a 240-plus application pipeline), banking sequenced after licensing rather than in parallel, a parent-company structure that the home NCA decides to assess for indirect substance, and an MLRO appointed late.

The realistic envelope expands when banking is treated as a downstream task and contracts when it runs in parallel with capital deposit and file drafting. The single largest compressor is starting the banking conversation early enough to surface the institution's appetite before the file is filed.

Frequently Asked Questions

References