Legally setting up a crypto exchange is a sequence, not a single licence: choose the jurisdiction, obtain the trading-platform authorisation, build the corporate and custody structure, secure banking, and stand up compliance — in that order, because each step constrains the next. The exchange licence is the heaviest crypto authorisation in most regimes, carrying the highest capital and the strictest custody and market-integrity rules. OBOLUS runs the whole path end-to-end on a fixed-fee package, from jurisdiction selection to a banked, authorised, compliant venue.
1. Choose the jurisdiction
The base decides everything downstream: capital, reach, banking access and credibility. A MiCA CASP authorisation passports across the EEA with own-funds from €50,000 to €150,000 by service class (Art. 67). Dubai's VARA offers an activity-based VASP licence; Abu Dhabi's ADGM a common-law FSP with capital around USD 250,000 or an operating-expenditure multiple. Kazakhstan's AIFC sets the higher of USD 200,000 or 12 months' working capital; Hong Kong's VATP regime requires HK$5m paid-up plus HK$3m liquid capital. Match the base to your markets and the capital you can sustain — compare them in the Jurisdiction Navigator.
2. Obtain the exchange licence
The application is front-loaded. Regulators want a credible business plan, fit-and-proper controllers, a functioning AML/CFT and Travel Rule programme, demonstrable control and segregation of client assets, and capital evidenced against the regime's floor. Under MiCA there is a statutory clock — a reasoned decision within 40 working days of a complete application (Art. 63) — though preparing a complete dossier is the longer part. Our licensing practice runs this stage end-to-end.
3. Build the structure
The corporate structure has to carry the licence, the custody arrangements and the group's tax position. That usually means a licensed operating entity with real substance in the chosen hub, a clear ownership chain, and segregation of client assets from the firm's own — held so that they are protected if the operator fails. Get this wrong and it surfaces later as a regulatory or insolvency problem.
4. Secure banking and on/off-ramps
Banking is the step that sinks more launches than licensing. A licence without a banking or EMI relationship is half a business, so we line up fiat on/off-ramps and safeguarding arrangements alongside the application rather than after it. Substance in the licensing jurisdiction and a clean compliance story are what make banks say yes.
5. Stand up compliance
From day one the exchange needs a working compliance function: KYC/KYB onboarding, transaction monitoring (KYT), sanctions screening, the FATF Travel Rule, suspicious-activity reporting and — in the EU — DORA operational resilience, which has applied since 17 January 2025. Regulators test whether the programme functions, not whether it exists on paper.
Timeline and sequencing
The instinct is to run these steps one after another; the reality is that they overlap. Jurisdiction selection and structuring can proceed together, because the base determines the entity. Banking and compliance build should begin during the licence application, not after it, because both take months and both are tested as part of authorisation. A realistic launch plan treats the licence application as the spine and hangs structuring, banking and compliance off it in parallel, so that the day the authorisation lands the venue can actually trade. Under MiCA the regulator's clock is statutory — a reasoned decision within 40 working days of a complete application — but assembling that complete application is the part that determines your real timeline.
Custody and market integrity
Two themes dominate exchange supervision everywhere: how client assets are held, and how the market is kept fair. On custody, regulators expect segregation of client assets from the operator's own, robust key management, and arrangements that protect customers if the operator fails. On market integrity, they expect surveillance for manipulation and wash trading, clear listing and delisting policies, and conflict-of-interest controls — especially where the operator also makes markets. Designing these in from the start is far cheaper than retrofitting them under a regulator's gaze, and they are increasingly what banking partners diligence too.
Common forks
- Licence-first, banking-never. Sequencing banking after authorisation can leave an authorised venue that cannot move fiat.
- Over- or under-scoping. Licensing for activities you will not run wastes capital; missing one means a variation later.
- Thin substance. Nominal presence fails both the regulator and the bank.
- Treating compliance as paperwork. A template AML programme that does not function is a fast route to enforcement.
FAQ
How much capital does a crypto exchange need?
It depends on the jurisdiction: from €50,000–€150,000 under MiCA by class, around USD 250,000 (or an OPEX multiple) at ADGM, USD 200,000 or 12 months' working capital at AIFC, and HK$5m paid-up plus HK$3m liquid at a Hong Kong VATP. Confirm the figure for your model.
What is the right order to do things in?
Jurisdiction, then licence, then structure, then banking, then compliance — but banking and compliance work should start in parallel with the application, not after it.
Can one firm handle all of it?
Yes. OBOLUS runs jurisdiction selection, licensing, structuring, banking onboarding and compliance end-to-end on a fixed-fee package, plus government fees at cost.
Tell us the exchange model and target markets, and we will map the jurisdiction, licence, structure and banking in about 30 minutes. The first call is free and under NDA.