What It Takes to Launch a Crypto Exchange
A centralised crypto exchange needs five things in place: a regulated operating company, enough capital to satisfy the licensing regime, a crypto-asset service provider authorisation or third-country equivalent, banking for the fiat on and off-ramp, and a live compliance stack covering AML/CFT, market abuse and operational resilience. We deliver all five.
The operating entity is a private limited company in the licensing jurisdiction. The form varies by country: an osaühing (OÜ) in Estonia, a společnost s ručením omezeným (s.r.o.) in Czechia, a limited liability company in Cyprus, a free-zone company in the UAE, or a Hong Kong limited company under the Companies Ordinance (Cap. 622). We structure the capital to satisfy both the regulator’s minimum (MiCA Annex IV Class 3 at €150,000 for a trading-platform operator, AED 800,000 or AED 1,500,000 at VARA, HK$5 million paid-up at the SFC, risk-based at CIMA) and the fixed-overhead cushion the file has to defend.
The licence is the gate, and obtaining it is what we do. Inside the EU and EEA, the authorisation is MiCA CASP for the operation of a trading platform for crypto-assets, granted under Regulation (EU) 2023/1114 Article 63. Outside the EU, the route is jurisdiction-specific: a VASP Licence under the Cayman Islands Virtual Asset (Service Providers) Act, a VARA Exchange Services category, an ADGM Operating a Crypto Asset Business permission, or an SFC Virtual Asset Trading Platform licence. Third-country firms cannot sustainably serve EU clients through reverse solicitation: the ESMA Guidelines confine the exemption to the context of the original transaction, so a recurring EU client base needs local CASP authorisation.
Banking comes with the build. A centralised exchange has two distinct banking needs: a fiat on/off-ramp for client deposits and withdrawals, and a treasury layer for FX, settlement, payroll and vendor payments. We arrange both with a licensed EU EMI or a credit institution, and we open that conversation early so the account is ready when the licence lands.
Custody is either in-house under the operating licence or outsourced to a regulated qualified custodian. We set up whichever fits your model. The matching engine and chain-analytics tooling are yours to choose, but the regulator assesses them as part of the operating-conditions review under MiCA Article 76 or its non-EU equivalent, and we prepare that part of the file with you.
Ongoing compliance is the permanent operating cost. The MiCA Title V conduct rules, Title VI market-abuse regime (Articles 86 to 92) and the Digital Operational Resilience Act run in parallel inside the EU, with equivalents at every comparable non-EU jurisdiction. We build the programme and hand it over running.
What We Deliver
| Component | What we do | Typical Timeline | More |
|---|---|---|---|
| Company formation | Form the regulated operating company in the licensing jurisdiction | 1 to 4 weeks | Company formation |
| Licensing (CASP / VASP) | Draft and file the application, deal with the regulator, obtain the licence | 4 to 12 weeks drafting; 3 to 12 months regulator review | Crypto licensing |
| Banking | Arrange the fiat on/off-ramp and treasury layer with a licensed EMI or credit institution | 2 to 6 weeks EMI; 8 to 16 weeks credit institution | Banking |
| Crypto-fiat settlement | Connect client fiat deposits and withdrawals to the licensed entity’s accounts | Runs with banking | Crypto-fiat settlement |
| Custody arrangement | Set up in-house custody or contract a regulated qualified custodian | 2 to 6 weeks for outsourced custody contracting | (handled in build) |
| Ongoing compliance | Build the AML/CFT programme, market-abuse surveillance, DORA ICT controls and reporting | Permanent operating cost | (handled in build) |
Choosing the Right Jurisdiction
Where you licence determines the regulatory framework, the capital floor, EU market access, banking accessibility and tax treatment. We help you pick, then we deliver there. For a centralised exchange the practical decision narrows to three clusters: the EU MiCA cluster for passportable access, the Middle East cluster for a regulated non-EU alternative, and the Caribbean and APAC clusters for tax efficiency or institutional gateway positioning.
The choice turns on a few questions: how the regulator treats exchange operations, the real capital and cost, banking accessibility, whether you need an EU passport, and the market your clients sit in. A platform serving EU retail clients after 1 July 2026 needs a MiCA CASP; a platform serving institutional clients in Asia or the GCC may not. The EU cluster trades cost against passporting upside; the Middle East cluster trades higher capital against banking access and a common-law overlay; the Caribbean cluster trades EU passporting against tax efficiency; the APAC cluster sits at the high-bar end on capital and process. We have vetted specialists in each of the jurisdictions we serve, so the option we recommend is one we can actually deliver.
Jurisdiction Comparison
The three EU rows (Estonia, Czech Republic, Cyprus) all hold the MiCA Article 65 passport into the rest of the EEA; the three non-EU rows (UAE, Cayman Islands, Hong Kong) operate as third-country regimes without it. Capital floors, timelines and banking notes appear inline in the cells below.
| Jurisdiction | Regulator | Licence | Capital Requirement | Timeline | Banking Friendliness (1–10) |
|---|---|---|---|---|---|
| Estonia | Estonian Financial Supervision Authority (Finantsinspektsioon) | MiCA CASP, operation of a trading platform (Article 65 EU passport; 18-month grandfather to 1 July 2026) | €150,000 (Annex IV Class 3) or one quarter of prior-year fixed overheads, whichever is higher | 7 to 11 months | 6 |
| Czech Republic | Czech National Bank (ČNB) | MiCA CASP, operation of a trading platform (Article 65 EU passport; first six authorisations granted 11 February 2026) | €150,000 or 1/4 fixed overheads | 8 to 12 months | 6 |
| Cyprus | Cyprus Securities and Exchange Commission (CySEC) | MiCA CASP, operation of a trading platform (Article 65 EU passport; national-regime filing deadline 27 February 2026 has passed) | €150,000 or 1/4 fixed overheads | 9 to 12 months for new applicants | 6 |
| United Arab Emirates (Dubai) | Virtual Assets Regulatory Authority (VARA) | VASP Licence, Exchange Services category (no EU passport; third country to the EU) | AED 800,000≈ $218K with a VARA-licensed custodian, or AED 1,500,000≈ $408K with in-house custody, or 15 to 25 percent of fixed annual overheads | 4 to 7 months | 8 |
| Cayman Islands | Cayman Islands Monetary Authority (CIMA) | VASP Licence under the Virtual Asset (Service Providers) Act (2024 Revision) (no EU passport; Phase 2 Licence mandatory for trading-platform operators since 1 April 2025) | No statutory minimum; approximately US$100,000 paid-up practical floor; risk-based capital adequacy applies | 6 to 10 months | 4 |
| Hong Kong | Securities and Futures Commission (SFC) | Virtual Asset Trading Platform Operator licence under AMLO Part 5B (plus Type 1 / Type 7 SFO for security-token activity; no EU passport) | Paid-up capital HK$5,000,000≈ $640K (approximately €590,000); liquid capital the higher of HK$3,000,000≈ $384K or the basic amount under SF(FR)R | 9 to 15 months | 5 |
The cluster choice maps to your client base. An exchange serving EU retail and institutional clients should default to the EU MiCA cluster, with the larger EU economies available for prestige-market authorisation at higher cost and timeline. An exchange serving Middle Eastern, North African and South Asian clients should default to the UAE cluster, with VARA for retail-facing exchange services in Dubai and ADGM for institutional overlays. Cayman and Hong Kong sit at opposite ends of the offshore spectrum: Cayman for tax-efficient holding structures with operations elsewhere, Hong Kong as a high-bar gateway to mainland Chinese investment flows.
The grandfathering periods for the EU MiCA cluster run to 1 July 2026, so a national-regime exchange that has not filed a complete MiCA application by mid-2026 cannot continue. Two jurisdictions we deliver in are worth flagging for readers who arrived expecting them: Lithuania, whose national transition has closed and which now runs a new-applicant CASP queue at the Bank of Lithuania, and Poland, where the route depends on the current state of national MiCA implementation. We licence in both, alongside Cyprus, Gibraltar, Malta and Switzerland. If your preferred jurisdiction is on that list, we can file it for you.
We Form Your Company
Formation for a centralised crypto exchange is straightforward in form and consequential in substance, and we handle both. The route is a private limited company in the licensing jurisdiction. The choices that matter are share-capital structure, director and shareholder residence, registered office, group structure for multi-market operations and e-Residency where it applies. We make those calls with you and we file the incorporation ourselves.
Entity types vary by jurisdiction. Estonia uses the osaühing (OÜ); the Czech Republic uses the společnost s ručením omezeným (s.r.o.); Cyprus uses the limited liability company; the UAE uses free-zone companies (typically DMCC or IFZA, or a mainland LLC for VARA-licensed activity); Hong Kong uses the limited company under the Companies Ordinance (Cap. 622). Share-capital practice differs too. Estonia and Czechia accept nominal capital at formation, with the regulatory capital paid up before the licence application progresses. The UAE free zones and Hong Kong typically require the licensing capital paid up before or alongside the application. We sequence the capital deposit so it lands when the regulator needs to see it.
Director and shareholder substance matters, and we make it real rather than nominal. EU MiCA NCAs apply fit-and-proper assessment to directors and substantial shareholders, plus substance tests to the management of the operating entity: a registered office that is in fact occupied, a senior-management function that is in fact resident, an MLRO who is in fact accountable. The UAE and Hong Kong apply equivalent standards. Because we work through vetted specialists in-country, the presence the regulator expects is genuine.
We have formed and licensed exchanges across multiple jurisdictions, and the most common structuring mistake we see is layering a holding entity into a country the home NCA later treats as an indirect parent for substance purposes. That triggers a regulator-level redesign mid-application and adds months. We build the simpler structure that survives fit-and-proper review: an operating entity in the licensing jurisdiction and a single layer of holding above it, with real substance in both.
e-Residency in Estonia is useful for non-resident founders managing the entity remotely, but it does not substitute for the substantive presence the regulator expects from the management function. See our European company formation and Estonia formation pages for the detail.
We Obtain the Licence
This is the core of what we do. We draft the application, file it with the regulator, answer the regulator’s questions directly, and obtain the authorisation. A centralised crypto exchange operating in the EU needs MiCA CASP authorisation for the operation of a trading platform for crypto-assets. Capital is €150,000 paid up under Annex IV Class 3 of Regulation (EU) 2023/1114, or one quarter of prior-year fixed overheads, whichever is higher. Outside the EU, the route depends on the jurisdiction.
The MiCA CASP regime. Under Regulation (EU) 2023/1114 a centralised exchange falls within Article 3(1)(16) point (ii), the operation of a trading platform for crypto-assets. The procedure sits in Articles 62 and 63: a complete file goes to the home Member State’s national competent authority (NCA); the NCA has 25 working days to assess completeness, then 40 working days to decide, with the clock stopping for information requests. Operating conditions for trading platforms sit in Article 76: governance, fair access, transparent listing criteria, market-abuse prevention, settlement, and pre and post-trade transparency. The service class under Annex IV is Class 3, at the €150,000 paid-up minimum. We assemble the complete file so it survives the completeness check on first submission.
We structure the service bundle with you. The typical bundle is operation of a trading platform (the headline service), exchange of crypto-assets for funds and for other crypto-assets (almost always bundled), custody and administration on behalf of clients (where the exchange holds client assets in-house), and execution of orders on behalf of clients. At Class 3 the whole bundle sits under the same €150,000 floor, so we recommend taking the full bundle up front: re-applying to add a service later is materially slower than including it in the initial file.
The transitional cliff. MiCA Article 143(3) grandfathers pre-30-December-2024 national-regime CASPs to a maximum of 1 July 2026, and only where the home Member State opted for the full 18 months. Several states ran shorter transitions that have already closed. The practical point: a legacy national VASP that has not filed a complete MiCA application in time must either authorise under MiCA or wind down its EU client base. If you are in that position, we can move quickly.
Cross-border passporting under MiCA Article 65 is by notification, not automatic on authorisation. Once we obtain your CASP authorisation, we file the passport notification with your home NCA before you commence services in another EU Member State, selecting between a branch and cross-border provision of services. You may operate in the host state once the notification process completes.
Third-country routes. Outside the EU, the principal routes are VARA’s Exchange Services category in Dubai, the ADGM Operating a Crypto Asset Business permission, the SFC VATP licence under AMLO Part 5B in Hong Kong, and the Cayman VASP Licence. The UK regime is forthcoming under SI 2026/102. Reverse solicitation cannot substitute for local authorisation: the ESMA Guidelines define solicitation broadly and confine further same-type marketing to the context of the original transaction. We obtain the right licence for the market you actually serve.
Applications fail most often on the governance file. An MLRO who cannot articulate the firm’s risk appetite in the regulator’s vocabulary, or a board that does not survive fit-and-proper scrutiny, costs more time than any technical gap. We prepare that file with you and stand behind it. See our crypto licensing and crypto exchange licensing pages for the regime-by-regime detail.
Banking
Banking is often the hardest part of an exchange launch, so we arrange it as part of the build. A centralised exchange needs two distinct banking layers: a fiat on/off-ramp for client deposits and withdrawals, typically with a licensed EU EMI, and a treasury layer for FX, settlement, payroll and vendor payments. We set up both, and we open the conversation while the licence application is still with the regulator so the accounts are ready when authorisation lands.
The on/off-ramp carries the volume: client euros, pounds and dollars in and out. A licensed EU EMI suits that volume because it can issue dedicated IBANs, handle SEPA Instant flows and run KYC/AML tooling that scales with deposit count. A credit institution suits the treasury layer, where the exchange’s own operating cash, FX hedging and settlement legs run on smaller transaction counts but need broader correspondent reach. We match each layer to the right type of institution rather than forcing everything through one provider.
We Build the Compliance Stack
Compliance is a permanent operating responsibility, not a one-time licensing event. We build the programme and hand it over running. For a MiCA CASP operating a trading platform, the perimeter runs across AML/CFT (the EU Travel Rule under Regulation (EU) 2023/1113), market abuse (MiCA Title VI), operational resilience (DORA), and ongoing supervisory reporting.
AML/CFT. EU CASPs are obliged entities under the EU’s anti-money-laundering framework. The EU Travel Rule (Regulation (EU) 2023/1113) imposes data-collection obligations on every crypto-asset transfer involving a CASP, with no de minimis threshold. The MLRO function is a permanent senior-management appointment, and the AML/CFT manual is a living document the NCA can request at any time. We draft the manual, appoint the MLRO and put the programme in place.
Market abuse. MiCA Title VI (Articles 86 to 92) extends the EU’s market-abuse regime to all crypto-assets admitted to trading on a CASP-operated platform. The prohibitions track the Market Abuse Regulation: insider dealing, unlawful disclosure of inside information and market manipulation. Article 92 obliges CASPs to detect and report suspected market abuse to the NCA, which means a 24/7 surveillance capability, in-house or through a regulated third party. We specify and stand up that capability.
Operational resilience. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied to CASPs since 17 January 2025. DORA covers ICT risk management, incident reporting, resilience testing and ICT third-party risk management, with the register of contractual arrangements reported annually. We map your obligations and build the controls to meet them.
Prudential and supervisory reporting. Capital adequacy is reviewed annually against the higher of the Annex IV minimum and one quarter of fixed overheads, alongside an annual audit. Outside the EU, equivalents apply: VARA imposes a quarterly capital-adequacy return; the SFC imposes monthly liquid-capital reporting under the SF(FR)R. We set up the reporting calendar so nothing is missed.
Realistic Timeline
The realistic end-to-end timeline from formation to operational launch is six to eighteen months. The variance comes from the jurisdiction, the completeness of the file at first submission, and whether banking runs in parallel with licensing or downstream of it. We run the workstreams in parallel and assemble a complete file, which is what keeps the timeline at the lower end of the band.
End-to-End Timeline
| Phase | Timeline | Notes |
|---|---|---|
| Company formation | 1 to 4 weeks | Varies by jurisdiction; e-Residency-led formation is faster |
| Banking | 2 to 16 weeks, in parallel | EMI at the lower end, credit institution at the upper end; we start it alongside the file |
| Licensing application drafting and filing | 4 to 12 weeks drafting; 3 to 12 months regulator review | MiCA CASP at the higher end; legacy VASP regimes at the lower end |
| Pre-launch readiness | 2 to 6 weeks | Governance sign-off, MLRO induction, IT readiness review, external-audit engagement |
| Total to operational launch | 6 to 18 months realistic | The dependency sequence drives the variance more than the regulator’s pace |
What compresses the timeline: banking started early, pre-drafted compliance documentation, a clean fit-and-proper file for directors and substantial shareholders, and a regulator chosen for its throughput. What expands it: regulator backlog, banking sequenced after licensing rather than in parallel, a parent-company structure the home NCA decides to assess for indirect substance, and an MLRO appointed late. We control every one of those variables that is within our control.
Frequently Asked Questions
How long does a MiCA CASP authorisation take in 2026?
Realistic timelines for a complete MiCA CASP application range from six to twelve months between filing and authorisation, with active EU NCAs running at the lower end of that band. The procedural clock is set by Articles 62 and 63 of Regulation (EU) 2023/1114: 25 working days for the NCA to assess completeness, plus 40 working days for the substantive decision, with the clock stopping for additional information requests. Real timelines exceed the procedural minimum because complete files are rare on first submission and stop-clocks compound. Pre-drafted governance, AML/CFT, and ICT files reduce the gap between procedural minimum and actual time-to-grant.
Can I run a crypto exchange under a pre-MiCA national VASP after 1 July 2026?
Generally no. MiCA Article 143(3) sets a hard ceiling on 1 July 2026 for any pre-30-December-2024 national-regime crypto-asset service provider. After that date, EU client services require an authorisation under MiCA. Several Member States ran shorter transitions that expired earlier: the Netherlands at 30 June 2025, Lithuania at 1 June 2025, Spain at 30 December 2025, and Germany, Austria, and Ireland at 31 December 2025. The implication: a legacy national VASP today must either obtain MiCA CASP authorisation in time or wind down its EU client base.
What capital do I need to start a crypto exchange in the EU?
For an exchange operating a trading platform under MiCA, the prudential minimum is €150,000 paid up under Annex IV Class 3 of Regulation (EU) 2023/1114, or one quarter of prior-year fixed overheads, whichever is higher. The capital must be held as own funds, an insurance policy meeting MiCA Article 67(4), or a guarantee from a credit institution or investment firm. Per ESMA Q&A 2349 (27 February 2026), the calculation starts from total overhead expenses, both fixed and variable, on the applicable accounting framework basis, and only the deductions listed in Article 67(3)(a) to (d) may be subtracted; the list is exhaustive. Capital is consumed by losses and must be rebuilt within 30 days.
Can my exchange serve EU clients from a third country without an EU licence?
Only in narrow, exceptional circumstances. MiCA Article 61 contains a reverse-solicitation exemption, but ESMA Guidelines ESMA35-1872330276-2030 (26 February 2025, applicable from 27 April 2025) define solicitation broadly and confine further same-type marketing to the context of the original transaction. Targeted advertising, EU-language websites, country-code top-level domains for EU Member States, EU-based influencers, sponsorship of EU events, and affiliate or referral programmes that direct EU traffic all defeat the exemption. An offshore exchange cannot scale a recurring EU-client business through reverse solicitation. The route to sustained EU service is CASP authorisation in an EU or EEA Member State.
Why is exchange banking so hard, and what changes when I have a MiCA CASP?
Exchange banking is hard because exchanges combine high transaction velocity, retail counterparty exposure, and crypto activity that many institutions still classify as elevated risk. A MiCA CASP authorisation changes the conversation. A licensed EU EMI or credit institution can now underwrite the entity as a regulated CASP under a known EU framework, with a known MLRO, a known compliance perimeter, and an NCA-assessed AML/CFT programme. Realistic timelines for a licensed CASP are two to six weeks for an EMI relationship and eight to sixteen weeks for a credit institution. We open the banking conversation while the application file is still with the regulator, so the account is ready when the licence lands.
What is the difference between a CASP licence to operate a trading platform and a CASP licence for custody?
They are different services within the same authorisation regime, with different capital floors and operating-conditions requirements. Operation of a trading platform falls under MiCA Article 3(1)(16) point (ii) with operating conditions in Article 76 and an Annex IV Class 3 capital minimum of €150,000. Custody and administration on behalf of clients falls under Article 3(1)(16) point (i) with operating conditions in Article 75 and an Annex IV Class 2 capital minimum of €125,000. Most exchanges hold both because in-house custody is a common operational choice; a trading-platform CASP without custody must outsource to a qualified custodian. We structure the service bundle with you so the initial file covers everything you will need.
Do I need to be physically present in the licensing jurisdiction?
Yes, in substance, even where the legal form is permissive. EU MiCA NCAs apply substance tests to the authorisation file: a registered office that is in fact occupied, a senior-management function that is in fact resident, an MLRO who is in fact accountable in the jurisdiction. The substance assessment is qualitative, not quantitative. Outside the EU, VARA requires a Dubai-resident senior executive officer; the SFC requires Hong Kong-resident responsible officers; CIMA requires three directors including one independent director under the VASP Act 2024 Revision. We have vetted specialists in-country in every jurisdiction we serve, so the substance the regulator expects is real, not a paper arrangement.
What does Tomberg & Partners actually do for a crypto exchange?
We deliver the build end to end. We form the operating company, draft and file the MiCA CASP application, deal with the regulator directly, arrange banking with a licensed EU EMI or credit institution, and stand up the compliance stack. We do this through a controlled network of in-country lawyers, accountants and licensed specialists we work with directly, plus our own in-house team. We never hand you to an unverified third party. You deal with one accountable firm from the first call to the day you go live. Book a free consultation and we will scope your build and quote it.
Let's Build Your Exchange
We form the company, obtain the licence, arrange the banking and build the compliance stack, then stand behind the outcome. One accountable firm, vetted specialists in-country, never offloaded to strangers. Tell us what you are building and we will scope it.
Banking & Payments
A company and a licence still need a bank account
Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.
Related Services
- Crypto Licensing (VASP / CASP / MiCA), MiCA CASP authorisation across the EU and offshore jurisdictions we serve
- Company Formation, the regulated operating company in the licensing jurisdiction
- Crypto and Fiat Settlement, the crypto-to-fiat on and off-ramp and exchange banking architecture
- Lithuania Crypto Licensing, the MiCA CASP route under the Bank of Lithuania
- European Company Formation, EU and EEA entity formation including MiCA passporting routes