Crypto Exchange Development Cost in 2026: Build, Licensing and Security
The short answer: what a crypto exchange costs
These are 2026 development costs for a US company working with a vendor, including QA, DevOps and project management. They exclude licensing, legal work and running costs, which we price separately below because they behave differently: development is mostly a one-off, compliance is a permanent operating cost. The ranges come from estimates we prepare, proposals we compete against, and the codebases we inherit when an exchange or trading app is already live and unstable.
If you are building a wallet, an NFT product or another dApp rather than a trading venue, our guide to blockchain app development cost fits better. This page stays on exchanges: places where users trade one asset for another and the operator has to keep the books, the keys and the regulators happy.
Everything on licensing, KYC and AML here is general information to help you budget, not legal advice. Requirements depend on your exact business model, the states you serve and how you hold customer funds, and they change often. Talk to a US fintech or crypto lawyer before you commit to a scope.
Four exchange models, four price bands
"Build a crypto exchange" can mean customizing someone else's platform for three months or engineering a trading venue for eighteen. The difference is how much of the money flow you own: matching orders, holding keys, moving fiat, and answering for all of it to regulators.
1. White-label exchange: $60,000–150,000 plus fees
You license a ready exchange platform (matching engine, wallets, admin panel) and pay a team to brand it, connect your KYC provider, payment rails and liquidity, and adapt the apps. The upfront number looks friendly. The fine print matters more: monthly license fees or revenue share, who controls the private keys, whether the source code is escrowed, and whether you can export users and balances if you leave. We read these contracts before we estimate, because a platform that can't be extended turns every later feature into a vendor change request.
2. Brokerage app on a licensed partner: $150,000–350,000
Users buy, sell, send and hold crypto in your app, while a regulated infrastructure provider (Zero Hash, Paxos and similar crypto-as-a-service companies) handles custody, liquidity and, depending on the arrangement, much of the licensing coverage. You build the product: onboarding with KYC, funding through cards or ACH, portfolio and price screens, recurring buys, transfers, notifications, support tooling and an admin back office. This is the model behind many fintech and neobank crypto features, and for most US startups it is the most sensible way to test demand.
3. Custom custodial exchange: $400,000–1.2 million
Your own order book and matching engine, market data over websockets, hot and cold wallet infrastructure (or an MPC custody provider wired into your ledger), deposits and withdrawals across several chains, fiat on and off ramps, a double-entry internal ledger, fee tiers, advanced order types, a public API for trading bots, market-maker onboarding, and a back office for compliance, risk and support. Usually 7,000–14,000 hours. The matching engine gets the attention, but in our estimates the ledger, wallet operations and reconciliation take more hours than matching does. A balance that is off by one satoshi is a bug. A balance that is off by one bitcoin is an incident.
4. Decentralized exchange: $100,000–400,000 plus audits
An AMM or on-chain order book, the web front end, wallet connections, liquidity incentives, an indexer for charts and history, and deployment on one or more chains. There is no custody or fiat back office, which keeps development cheaper. The trade-off: smart contract audits (often from about $30,000 to well over $100,000 depending on code size and the firm), public and irreversible bugs, and liquidity you have to attract. A full comparison of dApp budgets sits in our blockchain app development cost guide.
Where the hours go in a custom exchange
Take a mid-sized custodial exchange: web plus mobile apps, five chains, fiat via ACH and cards, third-party custody tech, around 9,000 hours. Founders expect the trading screen and the matching engine to dominate. They don't.
The pattern is the same one we see in any system that moves money: the happy path is a fraction of the work. The rest is what happens when a deposit confirms on-chain but the node you read from is behind, when a withdrawal is broadcast and stuck in the mempool, when a websocket drops during a fast market and the app shows a stale price. Real-time connections are a cost driver on their own. When we worked on the Android app of the KickEX crypto exchange, a large part of the stabilization work was making the socket connection follow the app lifecycle correctly, which meant refactoring the architecture to MVVM and moving from RxJava to Kotlin Coroutines. That is the kind of work that never appears in a first estimate and always appears in the second one.
Calculate your exchange budget
Choose the exchange model, platforms, chains and the US license route. The calculator estimates development hours with QA and project management, converts them to cost at the regional rate you pick, and adds pre-launch security testing, a rough licensing budget and the first year of running costs, so you see the year-one number rather than only the build.
Crypto exchange: development and year-one cost
Hours are typical medians from our estimates, not a quote. KYC uses a published rate of about $1.85 per verified user; your vendor contract will differ. Licensing figures are rough budgeting ranges for legal work, application fees, bonds and compliance setup, not legal advice, and exclude net worth or capital requirements.
Two things usually stand out when people play with it. First, switching the license route from partner coverage to nationwide licenses changes the year-one total more than any feature does. Second, custody is the most expensive checkbox in engineering terms: running your own hot and cold wallets means key ceremonies, signing services, withdrawal approval flows, monitoring and a security review of all of it. That is why so many exchanges, large and small, buy custody technology rather than build it.
Built by Gilzor
Results we’ve shipped
Talk to the people who build it. Tell us about your project and get a free estimate of scope, timeline and cost.
US licensing and compliance: the second budget
A reminder before the numbers: this is general information for budgeting, not legal advice. The structure below is what US founders typically run into when they talk to counsel. Your lawyer decides what actually applies to you.
| Requirement | What it is | Typical cost driver | Time |
|---|---|---|---|
| FinCEN MSB registration | Federal registration as a money services business (Form 107). FinCEN has treated exchangers of convertible virtual currency as money transmitters since its 2013 guidance. Renew every two years. | The filing itself has no fee. The cost is the Bank Secrecy Act program behind it: AML policy, a compliance officer, training, independent testing, SAR and CTR filing. | Register within 180 days of establishing the business |
| State money transmitter licenses | Most states license custodial crypto activity as money transmission, one license at a time. More than 30 states have adopted the CSBS Money Transmission Modernization Act in full or in part, which makes requirements more uniform but not identical. | Legal work per state, application and investigation fees, surety bonds that scale with volume, minimum net worth, audited financials, annual exams and renewals | Months per state; often 12–24 months for broad coverage |
| New York BitLicense | NYDFS license for virtual currency business with New York residents, separate from a money transmitter license | $5,000 application fee; industry estimates put total compliance cost in the hundreds of thousands to over $1 million | Commonly 12–24 months |
| California DFAL license | The Digital Financial Assets Law requires a DFPI license to serve California residents. Applications opened March 2026; firms that had not applied by July 1, 2026 had to stop serving Californians. | $7,500 application fee plus the DFPI's review costs, capital and bonding, ongoing reporting | Review ongoing for many applicants in 2026 |
| KYC and customer due diligence | Identity verification, sanctions screening, beneficial ownership for business accounts | Per-verification fees (Sumsub publishes $1.35–1.85 per check with monthly minimums), plus manual review staff | Integration: weeks; operations: permanent |
| Transaction monitoring and Travel Rule | Blockchain analytics for wallet risk, suspicious activity detection, and passing originator and beneficiary data on transfers of $3,000 or more | Annual analytics contracts (usually quoted, not listed), Travel Rule tooling, analyst time | Integration: weeks; operations: permanent |
| Securities and derivatives questions | Listing tokens that may be securities brings in the SEC; margin, futures or perpetuals bring in the CFTC | Legal analysis per asset and per product; can rule out features entirely | Before you build the feature |
The engineering consequence is the part founders underestimate. Every row above becomes software: onboarding flows that collect the right data per state, a ledger that can produce regulator reports, case management for analysts, a rules engine that holds a withdrawal for review, audit logs that nobody can edit, geofencing for states you are not licensed in yet. In the calculator this is the compliance back office checkbox. In a real project it is often 10–15% of the build and a permanent slice of the roadmap.
That is also why the license route should be decided before development starts. Operating under a licensed partner's coverage means building to their onboarding and reporting requirements. Getting your own licenses means building all of it yourself and passing a state examiner's review of your controls. The same product built for the two routes looks different underneath.
Security: what the industry numbers say
Exchanges are the most targeted businesses in crypto, and the losses are concentrated. According to Chainalysis' 2026 Crypto Crime Report, $3.4 billion was stolen from crypto services and users in 2025. The February 2025 hack of the Bybit exchange's Ethereum cold wallet, about $1.5 billion, was the largest single theft in crypto history and accounted for more than 40% of the year's total. Chainalysis attributes the majority of 2025 losses to North Korea-linked groups, whose attacks were fewer but far larger.
For a budget, that translates into line items rather than adjectives:
- External penetration testing of apps, APIs and infrastructure before launch and at least yearly, often $15,000–60,000 per round for an exchange-sized scope.
- Smart contract audits for anything on-chain, with a fix and re-audit round planned in.
- Custody design review: key generation, signing policies, withdrawal approvals, who can move cold funds and how. Bybit's loss came through the signing process around a cold wallet, not a broken blockchain.
- SOC 2 once banks, partners or institutional clients ask for it. A first Type II report, with readiness work and the auditor, commonly lands in the tens of thousands of dollars before internal effort.
- Bug bounty and monitoring after launch, plus an incident response plan someone has actually rehearsed.
Hidden costs nobody puts in the first estimate
| Cost | Typical size | When it hits |
|---|---|---|
| Maintenance and upgrades | 15–20% of the build cost per year | Chain upgrades and forks, node software, SDK and OS releases, partner API versions |
| Compliance staff | A BSA officer plus analysts as volume grows; often the biggest running cost of a licensed exchange | From the first customer, growing with alerts and onboarding volume |
| KYC and analytics fees | About $1.35–1.85 per verification at published rates, plus annual analytics contracts | Every new user, every risky transfer |
| Infrastructure and nodes | From a few thousand dollars a month for a brokerage app to tens of thousands for a high-throughput exchange | Grows with chains, market data and traffic spikes on volatile days |
| Liquidity and market making | Spreads, rebates or retainers for market makers; inventory for instant swaps | From day one; an empty order book drives users away |
| Partner and custody fees | Monthly minimums, per-transaction fees or basis points on assets under custody | Monthly, scaling with volume |
| License maintenance | Renewals, state exams, audited financials, bond premiums | Annually, per state |
| App store review | Apple's guidelines allow crypto exchange apps only where the app has the appropriate licensing, and Google Play has its own licensing requirements in many countries | Every release; plan for rejections when licensing documents are incomplete |
Banking deserves its own sentence. Fiat rails depend on a bank or payments partner willing to serve a crypto business, and that partner will run its own due diligence on your AML program and controls. When a bank relationship ends, the fiat side of the product stops. A second rail is worth planning even if you don't build it on day one.
What we see in estimates and first calls
A few patterns repeat often enough that we ask about them before we put any number on paper:
- The product is scoped before the license route. Teams spec a custodial exchange, then learn from counsel that they will launch through a partner, and half the spec changes. A short business analysis phase that maps who holds funds, in which states, under whose license, saves weeks of rework.
- "Like Binance, but smaller." The reference app has years of features. An MVP that does spot trading on a handful of assets, with excellent deposits, withdrawals and support, beats a feature list nobody can finish. Our MVP development cost guide covers how to cut scope without cutting quality.
- Real-time is treated as a UI detail. Price feeds, order updates and balances over websockets need reconnection logic, backpressure and lifecycle handling on mobile. We fix these problems in inherited apps through our tech troubleshooting work, and they are rarely cheap to retrofit.
- The ledger is an afterthought. Balances stored as mutable numbers, without double-entry history, make reconciliation and regulator reporting painful and incidents hard to investigate. Retrofitting a ledger costs several times what building it first does.
- Load testing is skipped. Exchanges get their highest traffic on the days the market moves hardest. If the matching engine, websockets and withdrawal queue haven't been tested at several times normal load, launch day is the test.
QA on exchange work is about money paths: every deposit state, every withdrawal state, every fee calculation, on every chain. Our internal benchmark is that only 5% of tasks sent to QA come back to developers, and on financial flows our QA team adds test cases rather than relaxing that bar.
Which exchange model fits your plan?
Five questions about your users, markets and resources. The result points to the model that fits and the budget band that goes with it.
Find your crypto exchange model
How to reduce the cost without risking the exchange
- Decide the license route firstPartner coverage, own licenses in a few states, or nationwide. It decides your architecture, your back office and your timeline more than any feature.
- Buy custody, build the productMPC custody providers and regulated custodians solve key management far more cheaply than an in-house wallet team. Build your own only when custody is the product.
- Launch with spot trading on a few assetsFive well-supported assets with fast deposits and withdrawals beat fifty with stuck transfers. Each chain adds integration, node and monitoring cost.
- Go cross-platform for the appsA shared codebase for iOS and Android cuts app cost noticeably for a brokerage-style product. Native pays off for pro trading apps with heavy charts and real-time data. Our mobile app development cost guide has the trade-offs.
- Build the ledger and reconciliation firstCorrect balances and an audit trail make every later feature, report and incident cheaper.
- Use vendors for KYC, analytics and Travel RuleThese are commodity services with per-check pricing. Your engineering time goes further on the trading experience.
Skipping external security testing or the custody design review to hit a launch date. An exchange can recover from a slow feature roadmap. It rarely recovers from losing customer funds. If the budget is tight, cut assets, order types or platforms, not security work.
Team rates: who builds it and what it costs
The same 4,500-hour brokerage app lands at very different prices depending on who builds it. Using 2026 vendor rates for a senior-weighted team:
| Region | Typical vendor rate | 4,500-hour build | Overlap with US hours |
|---|---|---|---|
| US onshore | $120–160/h | $540,000–720,000 | Full |
| Latin America (nearshore) | $50–75/h | $225,000–337,500 | 6–9 hours |
| Central & Eastern Europe (offshore) | $50–75/h | $225,000–337,500 | 2–4 hours with the East Coast on a shifted schedule |
| South & SE Asia (offshore) | $30–50/h | $135,000–225,000 | 0–2 hours |
On exchange work, compare teams on what they have shipped with real money flowing through it and how they test it, not only on rate. Our nearshore software development rates guide breaks rates down by country, and if you're shortlisting vendors we keep a list of fintech mobile app development companies in the USA. For card checkout and payout flows around the exchange, see payment gateway integration cost.
FAQ
How much does it cost to build a crypto exchange in 2026?
How long does it take to develop a crypto exchange?
What licenses does a crypto exchange need in the US?
Is a white-label crypto exchange worth it?
What are the ongoing costs of running a crypto exchange?
Can I reduce cost by building a DEX instead of a centralized exchange?
Where Gilzor fits
We build and stabilize web and mobile products for startups and SMBs from Poland and Cyprus, including fintech and crypto trading apps, through our mobile app development and web development services. For US clients we're an offshore team with two to four overlap hours with the East Coast. We don't give legal advice, so we work alongside your counsel and licensed partners: every estimate we send names the exchange model, the modules, the compliance features and the security testing it includes, so you can compare it line by line with any other quote.
No sales pitch
Get a straight answer for your project
Tell us what you’re building. We’ll reply with options, a rough cost and timeline. If we’re not the right fit, we’ll say so.
CTO of Gilzor. Responsible for architecture and the engineering standards our teams work by.
LinkedIn →Gilzor · Mobile Development partner
Need a team for your mobile app?
Services
Mobile DevelopmentNative and cross-platform iOS and Android apps, from MVP to scale.→By company type
Selected projects
The team behind them
