White label crypto exchange: what it is, how it works and how to choose one

A white label crypto exchange is trading software that a vendor builds and maintains and another business brands and runs as its own exchange. It replaces the work of writing a matching engine, wallets and a back office, but it brings no liquidity, no bank accounts and no license. This guide explains the delivery models, the parts inside the software, the costs, the licenses an operator still needs and the checks to run on a vendor.

The software is usually the cheapest and fastest part of launching an exchange, while most of the time, money and risk sit in the regulated business around the software.

What a white label cryptocurrency exchange includes

In most industries, white label means that one company makes a product and another company sells it under its own brand. For crypto exchanges, the term covers a range of products. At one end, the operator buys a source-code license and hosts the software; at the other, the vendor runs everything and the operator supplies a logo, a domain and customers.

In every version, the operator does not write the trading software, because the vendor has already built it and usually runs it for other operators too. The operator gets these parts:

• web and mobile apps that carry the operator's brand
• a back office for operations and compliance staff
• the services that connect the apps, the matching engine, the wallets and the back office

The operator configures settings rather than writing code, such as the listed assets and trading pairs, the fee schedule, KYC tiers, withdrawal limits, fiat payment methods and the look of the apps.

Three delivery models

Vendors package white label exchanges in three main ways, and the delivery model decides who controls the code, who holds customer funds and who carries operational risk.

1. Licensed software (self-hosted)

The operator buys a license to the exchange software, sometimes with the source code, and deploys it on its own cloud account or servers, and the operator or a contracted team runs the platform. This model gives the most control and the most room to customize, and some regulators prefer it because the operator controls its own infrastructure and data. In return, the operator is responsible for security, uptime, upgrades and incident response, and must apply each patch the vendor releases.

2. SaaS (vendor-hosted)

The vendor hosts and runs the platform, often as one system shared by many operators. The operator pays a setup fee plus a monthly fee or a share of revenue. Launch is faster and the operator needs few engineers, but it depends on the vendor's security, product plans and survival as a business.

Operators should ask early whether the regulator in their target market accepts outsourced core systems. Under the EU's MiCA regulation, an operator licensed as a crypto-asset service provider may outsource critical functions to a vendor, but it stays fully responsible, so it needs documented oversight of the vendor and a written exit plan.

3. Brokerage and liquidity-as-a-service

In this model, the operator runs no order book. Its app shows prices and fills customer orders against a partner's liquidity, and the partner sometimes also provides custody through an API. Many fintech apps and neobanks add crypto trading this way. This route is the fastest, and the app never shows an empty order book, but the business is a brokerage, not an exchange. The operator earns the spread or fee that it adds to the partner's price.

These timelines cover integration and testing of the technology, not licensing, which often takes longer than the build.

The components inside the software

Whether an operator licenses or rents the platform, it should understand each component well enough to question the vendor.

Matching engine

The matching engine takes orders and pairs buyers with sellers by price, then by time. The engine must give the same result for the same input, run fast and stay correct under heavy load, because a bug in the matching engine fills trades at wrong prices. Questions for the vendor:

• What throughput and latency does the engine reach on the hardware you will run?
• How does the engine recover after a crash? A common design records every event in a log and replays it.
• Which order types work? A spot exchange usually needs limit, market, stop, stop-limit, post-only, immediate-or-cancel (IOC) and fill-or-kill (FOK) orders.

Wallets and custody

Most exchange hacks target the wallets. A sound design keeps most funds in cold storage or in wallets secured by multi-party computation (MPC), with a small amount in hot wallets for withdrawals, and automated sweeps move funds between the two. Questions for the vendor:

• How are keys generated and stored: hardware security modules, MPC or multisig?
• Who can approve a withdrawal?
• How do address allowlists and withdrawal delays work?
• Who runs the node for each blockchain?

Many operators connect a specialist custody provider to the white label stack instead of using the vendor's built-in wallet. The crypto wallet development guide covers custody design in more depth.

Liquidity

A new exchange has few traders, so spreads are wide, order books are thin, and traders leave. Vendors offer two fixes. A liquidity bridge copies the order books of larger exchanges, and when a user's order fills on the new exchange, the bridge places an opposite order, called a hedge, on a larger exchange. A market-maker integration lets a professional firm quote prices on the new exchange. Questions for the vendor:

• Who holds the hedge positions?
• What happens when one of the larger exchanges goes down?
• How much of the displayed order book can users trade at the shown prices? A good answer gives measured fill rates, not only the displayed depth.

KYC, AML and the travel rule

Most vendors connect identity checks, sanctions screening and transaction monitoring from third-party providers instead of building them. Check which providers are already connected, whether you can replace them, and how the platform shares travel rule data. The travel rule requires the names and account details of the sender and the recipient to travel with each transfer between crypto service providers. FATF Recommendation 16 sets this rule, and the EU's Transfer of Funds Regulation has applied it since 30 December 2024.

Admin back office

Compliance and support staff work in the back office. It holds user management, KYC review queues, withdrawal approvals, fee and pair settings, manual adjustments with an audit log, reconciliation reports and exports for regulatory reports. A weak back office raises staff costs and operational risk quickly, so test it as hard as the trading screens.

Apps and APIs

Expect a web trading screen, iOS and Android apps, and REST and WebSocket APIs for automated traders, because professional traders and market makers judge an exchange by its API. The crypto algo trading guide lists what those traders expect.

White label decentralized exchanges

Most of this guide covers a centralized exchange, where the operator holds user funds and runs an order book. A white label decentralized exchange (DEX) works differently: smart contracts settle trades, users keep their own keys, and liquidity comes from pools or an on-chain order book.

The vendor of a white label DEX supplies audited swap and pool contracts, a web app and often a router that finds the best price across pools. The operator deploys these under its own brand and sets its own fees. Questions for a DEX vendor:

• Can you share the audit reports?
• Who holds the admin keys?
• Can the contracts be upgraded, and by whom?
• How will the first liquidity reach the pools, since the software does not supply it?

The white label DEX guide and the decentralized exchange software guide compare DEX options and licenses.

A white label Bitcoin exchange is usually the centralized stack with Bitcoin as its main asset. The main difference is in the wallet layer: native BTC custody, UTXO handling, confirmation rules and optional Lightning support.

White label crypto exchange development vs. building from scratch

White label crypto exchange development still involves engineering work. The vendor or a contractor adapts the product to the operator's brand, assets, payment methods and jurisdictions. White label crypto exchange software development also covers integrations the vendor lacks, such as a local bank, a custody provider or a reporting format that one regulator requires.

A common path starts on a white label or licensed stack while the operator shows that it can attract and keep traders in its market. A rebuild comes later, when volume or product plans exceed what the vendor offers. The crypto exchange development guide covers custom builds, and the hybrid exchange development and P2P exchange development pages cover other designs.

Cost drivers, and why quotes vary

Vendors rarely publish prices, and quotes for the same scope can differ tenfold. Break the budget into these drivers:

• Delivery model. SaaS moves cost into monthly fees and revenue share, while a source-code license moves cost to the start.
• Chains and assets. Each blockchain needs a node, deposit detection, withdrawal logic and tests. A new token on an EVM chain the platform already runs costs little, but a new layer-1 chain costs much more.
• Product scope. Spot trading is the baseline, and margin, futures, staking, launchpads and OTC desks each add engineering work, risk controls and regulatory duties.
• Fiat payments. Bank and card integrations depend on partners that accept crypto businesses, and finding those partners is often the slowest task in the project.
• Custody. A third-party institutional custodian charges fees, but it can reduce the security burden and support a license application.
• Compliance tools. KYC checks and blockchain analytics are usually priced per check or per screened transaction, so their cost grows with the user base.
• Customization. Each change to vendor code is either a paid change request or a fork that the operator must maintain.

The following figures are a reasoned estimate, not a quote. For a small spot exchange on a SaaS or licensed stack, technology setup often costs from tens of thousands to a few hundred thousand US dollars, followed by monthly fees. In the first year, legal work, licensing, compliance staff, audits, insurance and regulatory capital usually cost more than the technology. A build from scratch needs a team of about eight to twelve people, including engineers, product and security staff, for twelve months, which at typical salaries costs well over one million US dollars before launch.

Licenses an operator still needs

Buying software does not make a business a licensed exchange, and a vendor that suggests otherwise is a warning sign. Some vendors work with licensed partners or help with applications, but the license still belongs to the operating company, whose managers must pass fit-and-proper tests and run real compliance functions.

• European Union. The MiCA regulation requires crypto-asset service providers (CASPs) to hold authorization from a national authority, and the CASP rules have applied since 30 December 2024. The last national transition periods ended on 1 July 2026, so an exchange without authorization must stop serving EU customers. Through MiCA's passport, one authorization covers the whole European Economic Area (EEA). A trading platform sits in MiCA's highest capital class, with a minimum of €150,000.
• United States. Exchanges usually register with FinCEN as a money services business. Most states also require a money transmitter license, and New York requires a BitLicense. The GENIUS Act of July 2025 created federal rules for payment stablecoins. Congress has not yet passed a market structure law, which would decide whether the SEC or the CFTC oversees each type of crypto asset. The main bill, the CLARITY Act, failed a Senate procedural vote in September 2026.
• United Kingdom. Exchanges now register with the FCA under the money laundering rules, and crypto marketing must follow the financial promotions rules. A full FCA authorization regime starts on 25 October 2027, and the FCA application window opened on 30 September 2026.
• United Arab Emirates. Dubai's Virtual Assets Regulatory Authority (VARA) licenses exchanges in Dubai, except in the Dubai International Financial Centre (DIFC), which has its own regulator. Abu Dhabi Global Market licenses them through its own regulator, the FSRA.
• Singapore. The Monetary Authority of Singapore licenses digital payment token services under the Payment Services Act.

The crypto exchange license guide compares licenses by jurisdiction, and the crypto exchange license requirements page explains the order of company setup, licensing and banking.

How to evaluate a white label crypto exchange vendor

1. Ask which exchanges run the software in production. Open accounts on those live exchanges and trade, because a demo environment proves little.
2. Collect security evidence. Ask for recent independent penetration tests, smart contract audits where contracts exist, a description of key management and a full account of past incidents.
3. Load-test the matching engine. Run your own scripts against a staging copy with realistic order mixes, including bursts of cancellations.
4. Read the exit terms in the contract. Check data export formats, source-code escrow, help during a move to another platform, and what happens if the vendor is sold or closes.
5. Check the compliance integrations. List the KYC, sanctions, blockchain analytics and travel rule providers that are live, and confirm that you can replace each one.
6. Map who holds funds. For each step, write down whose keys, whose bank accounts and whose legal entity touch customer assets.
7. Test the back office with your compliance lead. Run a mock suspicious-activity case and a mock reconciliation from start to finish.
8. Price the full life of the contract. Add setup, monthly fees, revenue share, charges per chain, change requests and the cost of a later migration.

Risks to plan for

• Custody failure. A hot-wallet breach has ended many exchanges, so keep hot balances small and require several approvals for large withdrawals.
• Thin liquidity. A copied order book can show many orders, but the hedges on other exchanges can fail, for example when an exchange goes down, leaving the operator with open positions that lose money on price moves. Check real fill prices and the profit or loss on the hedges every day.
• Proof of solvency. Since the FTX collapse in 2022, users and regulators expect proof that customer assets are separate and fully backed. Plan proof-of-reserves and liabilities reports from the start.
• Banking concentration. The loss of one bank can stop all fiat deposits and withdrawals, so open accounts with more than one bank.
• Vendor lock-in. An operator that cannot export its users, balances and trade history in a usable format cannot leave the vendor.
• Listing risk. A token that later proves to be an unregistered security or a scam brings legal and reputational damage, which a written listing policy reduces. The crypto exchange listing guide covers listings from the token issuer's side.

Frequently asked questions