Building and Running a Crypto Exchange in 2026.

The most useful mental model for exchange operation is that you are running three distinct businesses that share a brand, a balance sheet, and a login page — and that each has its own success metrics, failure modes, and staffing needs.

The technology business operates the matching engine, market data feeds, APIs, wallets, and clients. Its metrics are latency, uptime, and throughput; its failure mode is a public outage during volatility, remembered for years, screenshot by screenshot. This is where founders from software backgrounds feel at home, which is precisely why it absorbs a dangerous share of early attention relative to the other two.

The financial business manages customer assets, corporate treasury, banking relationships, payment rails, and risk. Its metrics are solvency, segregation, reconciliation accuracy, and counterparty exposure. Its failure mode is terminal — exchanges do not survive asset losses, banking cutoffs, or reconciliation scandals, regardless of how good the technology was. This is the business most new operators understaff.

The marketplace business solves the two-sided problem: traders come for liquidity, liquidity comes for traders, and neither arrives first voluntarily. Its metrics are depth, spread, and volume authenticity on every listed pair. Its failure mode is the slow one — a venue that never achieves real liquidity does not crash, it just becomes a ghost town with excellent uptime.

The core of a spot exchange is conceptually simple: a central limit order book per trading pair, and a matching engine that pairs incoming orders against resting ones under price-time priority.

Order types are product decisions. Limit, market, stop, post-only, IOC, FOK, reduce-only. Your order-type coverage quietly defines which trader segments can operate on your venue at all — and institutional connectivity conversations begin with this list.

Latency and fairness are the same subject. The matching engine's speed matters less than its consistency and the fairness of access to it. Professional flow evaluates venues on deterministic behavior under load, honest timestamping, and equal API access.

Market data is a product, not exhaust. Order book snapshots, incremental feeds, trade tapes, and candles are consumed by traders and algorithmic systems. Market makers quote wider on venues whose data feeds hiccup, because stale data is inventory risk.

The book is the product. Traders do not choose exchanges — they choose order books. Every operational function in this guide exists to make the books on your venue better than the same pair's books elsewhere for some definable population of traders.

Trading fees are the primary revenue of most venues, and the fee schedule is simultaneously your pricing, your liquidity policy, and your competitive positioning.

The maker-taker principle. Makers add resting liquidity, takers remove it. Charging takers more than makers, and often paying makers rebates at the top tiers, reflects the economic reality that resting liquidity is the product the venue sells and taker flow is the customer consuming it.

Tiering is segmentation. Volume tiers price-discriminate between retail (fee-insensitive, UX-sensitive), active traders (fee-sensitive, tool-sensitive), and professional flow (rebate-sensitive, latency-sensitive). A venue's fee schedule is a machine that converts subsidized professional liquidity into monetizable retail flow.

The cold-start distortion. Zero-fee volume is disloyal by construction, attracts wash-heavy flow that pollutes your reported statistics, and trains your early user base that your product is worth nothing. The historically successful pattern is targeted generosity: aggressive maker rebates and negotiated MM economics to build depth, near-standard taker fees from day one.

A worked unit economic. A pair clearing $10M in daily volume at a blended 7 bps of net fee yield produces roughly $7,000/day, ~$2.5M/year, from that single book. Run this per pair and the catalogue stops being a marketing artifact and becomes a portfolio.

Every new venue faces the same chicken-and-egg: traders will not come to empty books, and nothing fills books except traders.

Stage one: contracted liquidity. Before any public launch, professional market makers are engaged, with inventory deposited and obligations contracted, to guarantee that the first trader to arrive sees a functioning market. This is not optional and not organic.

Stage two: anchor pairs, not catalogue breadth. The bootstrap concentrates on a handful of pairs made genuinely deep, rather than a hundred pairs made uniformly thin. A hundred thin books demonstrate only that the operator does not understand the business.

Stage three: the flow thesis. Whose flow you can win and why — and the answer must be structural rather than promotional. Local fiat rails the incumbents lack, a license they cannot obtain, an asset class they will not touch. Promotions rent flow; structure keeps it.

Stage four: the authenticity discipline. Inflated volume is detectable by aggregators' trust scoring, by professional desks (who read depth, not volume), and eventually by regulators. Publish honest statistics from day one and let them be small.

From the venue side of the table, market makers are simultaneously your suppliers, your largest customers, and occasionally your adversaries — and the formal program you design for them determines which of those dominates.

The core exchange. You grant economics — top-tier or negative maker fees, rebates, API and colocation privileges. They accept obligations: quoting defined pairs within maximum spreads at minimum sizes for minimum uptime, measured continuously. If obligations are not measured, or measurement has no consequences, you do not have an MM program — you have a discount club.

Diversity is resilience. A venue dependent on one desk for most of its depth has handed that desk pricing power over the relationship and existential power over the product. Mature programs maintain several desks per anchor pair with overlapping obligations.

Watch the conflicts. Desks that also trade proprietarily on your venue have information advantages. Desks that quote your venue and your competitors will allocate inventory to whoever treats them best this month. And an in-house market making desk — the house trading against customers on its own book, with the house's information — is the deepest conflict in the industry.

Listings are the most visible decisions a venue makes, a real revenue line, and the fastest way to destroy accumulated trust.

Pipeline. Inbound applications, outbound courtship of assets your traders want, and market intelligence on what is gaining traction where. The listings team's job is not processing applications — it is curating a catalogue that serves the venue's flow thesis.

Evaluation. A written framework covering the token's legal character (the securities question first and always), team and entity diligence, tokenomics and unlock schedule, existing market quality, liquidity arrangements, security review, and community authenticity. A listings framework that has never rejected a paying applicant is a price list wearing a policy costume.

Pricing. Listing fees are legitimate — they cover integration, legal review, and market launch costs. The defensible structure prices the service rather than the access, and often includes liquidity commitments: many venues in 2026 require listing projects to arrive with contracted market making and deposited inventory.

Delisting discipline. The catalogue must also shrink. A published delisting policy, periodic reviews, and clean execution is operational hygiene, and its existence disciplines the listings side too.

Institutional flow — funds, prop desks, corporates, family offices — is the highest-quality volume a venue can win. It is also the most demanding to onboard.

Legal and regulatory standing. Which entity will the institution contract with, licensed where, supervised by whom. Institutions increasingly cannot, by their own mandates, connect to unlicensed venues.

Custody and asset protection. Cold storage architecture, key management governance, insurance coverage and its real limits, third-party custody options, and proof-of-reserves practices. The institution's operational due diligence team will go deep here, and glossy answers fail.

Connectivity and market access. Institutional-grade APIs (REST and websocket at minimum, FIX for the traditional crowd), sandbox environments, complete order type coverage, sub-accounts, role-based permissions, whitelisted withdrawal addresses.

Credit and settlement. Post-trade settlement, off-exchange settlement where assets stay with a custodian while trading happens on your book, and credit relationships that let funds trade without prefunding. This is what unlocks the largest flow.

The DDQ is the sales cycle. Institutional onboarding runs 3–9 months from first contact to first trade. The venues that win industrialize this: a maintained DDQ answer library, pre-packaged evidence, and a deal owner who drives the institution's process.

Fiat rails are the least glamorous and most existential part of the exchange stack — and the part nearest to our own core practice.

The problem shape. Exchanges are high-risk customers for banks, categorically. The venue needs operating accounts, segregated customer fiat accounts, and payment processing across every currency corridor it serves, at volumes that attract exactly the de-risking reflexes that make crypto banking hard everywhere. Banking relationships are a permanent operational function, not a launch task.

The redundancy rule. No serious venue runs a currency corridor through a single institution. Banking partners change policy, get acquired, or exit crypto categorically — usually with notice measured in weeks. The operating standard is at least two live institutions per major corridor plus a warm application pipeline.

Match the institution to the corridor. The banking map for exchanges in 2026 is a patchwork: EMIs and specialist payment institutions for European corridors, licensed regional banks for APAC under local frameworks, and a small set of crypto-native banking providers whose entire business is this category. Matching a venue's profile to institutions that will actually approve and keep it is a research problem that never finishes.

Fiat rails as competitive strategy. Local instant payment rails, in local currency, with reliable same-day settlement, in a market where global incumbents offer only card deposits and international wires, is one of the strongest flow theses available to a regional venue.

Whether you are pre-launch and mapping corridors, scaling and hitting volume ceilings, or recovering from an offboarding — tell us your corridor map and licensing posture and we will tell you what is realistic.

Licensing determines which customers you may serve, which institutions will bank you, and which markets you may market into. It is the exchange's single largest strategic constraint.

The European Union. MiCA created a unified licensing regime: authorization as a crypto-asset service provider in one member state passports across the bloc, with capital, custody, market abuse and supervision requirements. Expensive to enter, uniform once entered, and increasingly closed to venues serving EU customers from outside it.

The United Kingdom. Its own registration and authorization track, with a financial promotions regime that constrains how venues may market to UK customers including from offshore. Serving the UK casually from elsewhere stopped being viable some time ago.

APAC. The most heterogeneous region and, for many venues, the most commercially important. Several financial centers run mature licensing regimes with meaningful capital, custody, and conduct requirements. The pattern for APAC-focused venues is a hub license plus a carefully lawyered market-access map.

The United States. A famously demanding overlay of federal and state requirements. Serving US persons is a deliberate, expensive strategy with dedicated infrastructure, or it is a line in your geoblocking policy that you actually enforce.

The offshore tier. Lighter-touch licensing jurisdictions still exist and still host significant venues, but their strategic value has been repriced: institutions increasingly cannot connect to them, banks increasingly will not serve them, and major-market customers increasingly cannot legally be marketed to from them.

The operator's playbook: define the customer map you actually need, license the hub that unlocks the most of it per unit of capital, geoblock honestly everywhere you are not licensed to be, and treat every subsequent license as a product launch with its own business case. The license must precede the marketing.

Compliance is a stack of operating systems, and venues get evaluated on whether the stack actually runs or merely exists in a policy document.

Customer onboarding. Identity verification tiered by risk and product access, sanctions and PEP screening at onboarding and continuously thereafter, EDD for the profiles that warrant it. The mature answer is tiering: light friction for low limits, real diligence as limits and products scale.

Transaction monitoring, on-chain and off. Fiat-side monitoring inherits banking AML practice. Crypto-side adds blockchain analytics: screening deposits for exposure to sanctioned addresses, stolen funds, mixers, and darknet flows. Every serious venue runs commercial chain-analytics tooling wired into operations.

The travel rule. Transfers between venues above thresholds carry originator and beneficiary information obligations in a growing majority of serious jurisdictions.

Market surveillance. Monitoring your own order books for manipulation, wash trading, spoofing and layering, and insider patterns around listings, with the ability to investigate, act, and document. Under MiCA-era rules this is an explicit legal duty.

The regulator is a counterparty, not an adversary. Assign the relationship an owner, rehearse incident notification, and never let the regulator learn something about your venue from the press.

Custody is the function where exchange failures become historic. The post-2022 industry rebuilt its practices around a simple demand: prove the assets exist, prove they are segregated, and prove the operator cannot quietly spend them.

Wallet architecture. Hot wallets (minimal balances, automated withdrawal processing), warm wallets (operational buffers with human-in-the-loop controls), and cold storage (the overwhelming majority of customer assets, air-gapped, multi-signature or MPC-controlled, with governance no single person can defeat). The catastrophic failures were rarely cryptography and nearly always process.

Segregation. Customer assets held separately from corporate assets, on-chain and on the books, with continuous reconciliation. Rehypothecation without explicit informed customer opt-in is the specific practice that turned exchange failures into criminal cases. Customer assets are a bailment, not a balance sheet resource.

Proof of reserves. Periodic attestations, Merkle-tree liability proofs against on-chain asset evidence, third-party attestations. Publish on a schedule, with methodology, including the limitations.

Third-party custody as a product tier. For institutional customers, self-custody by the venue is often the objection, not the answer. Mature venues offer integration with independent custodians and off-exchange settlement so institutional assets never sit on the venue at all.

Every new venue faces the make-or-buy decision on its core technology, and the honest answer depends on which of the three businesses you intend to compete on.

White label platforms compress time-to-market from years to months and remove the hardest engineering. Costs are structural: platform fees forever, dependence on the provider's roadmap and uptime, thin differentiation on anything the platform standardizes, and, in liquidity-included models, rented depth with the provider's spread economics living inside your customers' prices.

Building buys control of latency, order types, risk engine behavior, and institutional connectivity, at the price of a serious engineering organization and a security burden that never ends. Defensible when the venue's flow thesis requires capabilities platforms do not sell; vanity when it does not.

The hybrid reality. Most successful venues are hybrids: core matching built or heavily customized, with custody technology, chain analytics, surveillance, KYC, and market data infrastructure bought from specialist vendors. The architecture decision that ages best is not build versus buy but which components are your competition and which are your plumbing.

Derivatives are where crypto trading volume actually lives — and the move up the stack converts your marketplace business into a risk management business.

A spot venue matches buyers and sellers of assets that settle immediately; its worst technology day is an outage. A derivatives venue extends leverage, which means every position is a credit exposure, and the venue's solvency depends on its risk engine: margin methodology, liquidation machinery, index price construction, and the insurance fund.

The components that matter: initial and maintenance margin tiered by position size, a liquidation engine that de-risks incrementally rather than market-dumping, index prices from multiple external venues so your book cannot be manipulated into triggering your own liquidations, funding rate mechanics, and an insurance fund sized and disclosed honestly.

The regulatory overlay. Leveraged products for retail attract the strictest treatment in nearly every licensed jurisdiction. The common pattern is derivatives offered from a different entity and license than spot.

Derivatives reward venues that already have deep spot markets, real surveillance, and institutional-grade operations — and punish venues that reached for them as a growth hack ahead of those foundations.

Exchanges are the most attacked civilian infrastructure on the internet — holding bearer assets, reachable from anywhere, with theft that settles instantly and irreversibly.

Key governance as the crown jewels: multi-party control with no single point of human failure, hardware-isolated signing, ceremony procedures that assume any individual can be compromised, withdrawal pipelines with velocity limits, anomaly detection, and human review tiers that cap the blast radius of any single failure.

The assumption of compromise: segmentation, least privilege, monitored egress, and rehearsed incident response — drilled, timed, with a communications plan.

Continuous external adversaries on the payroll: penetration testing, red teams, and a bug bounty sized to compete with what the black market pays for the same findings.

The six-hour rule. Within six hours of confirming a material security event, the venue has halted affected flows, notified its regulator and key banking partners directly, and published a first honest statement. Every post-mortem of a venue that died from a survivable breach features silence as the fatal decision.

The liquidity mirage. Launched with rented or manufactured depth, never converted it to organic flow. The most common death and the slowest.

The banking cutoff. Lost the single institution carrying a critical fiat corridor, could not replace it inside the notice period. Cause: treating banking as a launch task instead of a permanent function with redundancy.

The compliance debt collapse. Grew fast on light onboarding, then met a regulator, a banking partner audit, or an institutional DDQ that read the growth for what it was. Remediation cost arrives all at once, retroactively.

The security event. Recovery depends almost entirely on pre-incident preparation.

The risk engine failure. A derivatives venue that met its first real cascade with an undersized insurance fund, a manipulable index, or a liquidation engine that fed the spiral.

The regulatory ambush. Operated for years in a market whose rules were ambiguous, treated the ambiguity as permission.

The founder-shaped hole. Key governance, banking signatory power, or regulatory approvals concentrated in one person, whose departure, incapacity, or misconduct takes the venue with them.

The common thread is that none of these deaths comes from the technology business. They come from the financial and marketplace businesses — the ones this guide keeps insisting are the actual job.

A short list of numbers separates venues that are compounding from venues that are decaying, and reviewing them monthly at leadership level is the cheapest governance an exchange can buy.

Market quality per anchor pair: spread, depth at ±1% and ±2%, and the share of depth carried by your top desk — the concentration number that measures how rented your liquidity still is.

Volume authenticity: the ratio of volume to depth and to active traders, tracked against the aggregators' trust scoring of your venue.

Corridor health: deposit and withdrawal success rates, settlement times, and the redundancy status of every fiat corridor.

Compliance throughput: onboarding conversion by tier, alert backlogs, and regulator or banking-partner request turnaround.

Concentration risks, all of them: share of volume from top ten accounts, share of assets in hot wallets, share of revenue from the largest line, share of fiat flow through the single largest institution. Every exchange death announced itself in advance through one of these concentration numbers.

An operator's team can, in principle, build everything above in-house. The case for outside advisory is concentrated at the transitions: launching, entering a new corridor or license, moving up to derivatives or institutional flow, recovering from a banking or listing setback.

What Xavion Capital does in this domain: market structure and liquidity design (MM program architecture, launch liquidity, fee and rebate economics); listings and launch advisory (framework design for venues, negotiation support for projects); institutional onboarding readiness (custody, connectivity, and transparency posture to the standard the DDQs actually test); and banking and payment rails placement — the corridor mapping, institution matching, and redundancy building that is the deepest part of our practice and the problem exchanges bring us most.

We are advisors and introducers on your side of each table: we do not operate a venue, a desk, or a fund, and our network of institutions and counterparties is matched to each client's actual profile rather than published as a list, because appetite is confidential and shifts monthly.

Tell us what you operate or plan to operate, which corridors and licenses you have, and what is breaking or scaling next. We will tell you plainly what is realistic, what it costs, and in what order to do it.