Operating a crypto exchange in the US requires navigating a multilayer regulatory framework involving state money transmission licenses, federal securities oversight, FinCEN registration, and banking partnerships. Unlike jurisdictions with unified digital asset regimes, US exchanges face fragmented supervision where the classification of each listed asset determines which agency has jurisdiction. This article walks through the entity structure choices, license stacking requirements, and the technical compliance workflows that distinguish US operations from offshore alternatives.
Regulatory Stack and Jurisdictional Triggers
US exchanges must register as money services businesses with FinCEN under the Bank Secrecy Act. This registration activates AML and KYC obligations, including Suspicious Activity Report filing and Currency Transaction Report generation for fiat movements above $10,000.
Beyond federal FinCEN registration, most states treat crypto exchanges as money transmitters. New York’s BitLicense remains the most prescriptive state regime, requiring bonding, cybersecurity audits, and quarterly reporting. Exchanges typically pursue one of three licensing strategies: obtain licenses in all relevant states (40+ applications), operate only in states with exemptions or lighter regimes, or partner with a licensed custodian that holds the state licenses and processes fiat settlement.
The securities dimension activates when an exchange lists tokens classified as securities under the Howey test. The SEC has not issued a comprehensive digital asset framework, but enforcement actions since 2020 have established that exchanges listing tokens with securities characteristics must either register as national securities exchanges under the Exchange Act or operate through an alternative trading system registered with FINRA. Most large US platforms avoid this by limiting listings to Bitcoin, Ethereum, and a curated set of tokens they classify as nonsecurities based on internal legal review.
CFTC jurisdiction applies to derivatives products. If an exchange offers Bitcoin or Ethereum futures, perpetual swaps, or options, it must register as a designated contract market or swap execution facility. Spot Bitcoin and Ethereum trading falls under CFTC commodity authority but does not trigger derivative registration unless leverage or margined products are involved.
Entity Structure Choices
Exchanges serving retail US customers typically establish a Delaware C corp as the parent, with operating subsidiaries for each functional layer. A common structure separates the exchange platform (order matching and custody) from a separate broker dealer entity if securities are involved.
The exchange subsidiary holds state money transmitter licenses. It maintains omnibus fiat accounts at partner banks, which require the exchange to pass anti money laundering audits and maintain minimum net worth thresholds. Banking relationships remain the operational bottleneck. Most US banks limit crypto exposure, forcing exchanges to work with a small set of crypto friendly institutions or use intermediary payment processors that add cost and settlement latency.
Custody of customer crypto assets occurs either onchain through the exchange’s own wallet infrastructure or via third party qualified custodians. The choice impacts insurance, accounting treatment, and whether assets appear on the exchange’s balance sheet. Self custody requires robust cold storage, multisig controls, and regular proof of reserves disclosures. Third party custody shifts those controls to a licensed custodian, simplifying some compliance obligations but introducing counterparty risk and additional fees.
Order Book Mechanics and Market Surveillance
US exchanges implement continuous order books with central limit order matching. The matching engine processes orders in price time priority, though some platforms add pro rata allocation at the same price level for large block trades.
Market surveillance systems monitor for wash trading, spoofing, layering, and front running. These systems flag anomalous patterns such as self trades between accounts with linked identities, order cancellation rates above thresholds (e.g., 90% cancellation within seconds), or coordinated activity across multiple accounts. The exchange must document investigation and escalation procedures, typically routing flagged behavior to a compliance team that determines whether to file a SAR or suspend accounts.
Trade reporting varies by asset class. Bitcoin and Ethereum spot trades do not flow to a consolidated tape, so price discovery remains fragmented across venues. Exchanges can choose to publish real time trade data via APIs, but no regulatory mandate standardizes this. For any listed securities tokens, the exchange must report trades to FINRA’s Trade Reporting Facility within specified timeframes.
Fiat On Ramp and Settlement Cycles
Fiat deposits enter through ACH, wire transfer, or debit card rails. ACH deposits typically post to customer accounts within one to three business days but remain subject to holds while the exchange waits for the ACH network’s settlement finality (typically five business days). Exchanges manage this timing gap by either restricting withdrawals until ACH clears or extending provisional credit with withdrawal limits.
Wire transfers settle same day or next business day but incur higher fees. Some exchanges offset this by offering lower trading fees for users funding via wire to encourage faster settled funds.
Fiat withdrawals reverse the process. The exchange debits the customer’s platform balance and initiates an ACH or wire from its omnibus bank account. Withdrawal request to fiat receipt typically spans one to three business days for ACH, same day for wires initiated before bank cutoff times.
Crypto deposits and withdrawals settle onchain according to each blockchain’s finality model. Exchanges set confirmation thresholds (e.g., six confirmations for Bitcoin, 35 for Ethereum Classic) balancing deposit speed against reorganization risk. Deposit addresses are typically generated per customer, with the exchange’s backend sweeping incoming funds to consolidated hot or cold wallets after confirmations complete.
Worked Example: Listing a New Asset
An exchange evaluating whether to list a new token performs a legal analysis to determine securities classification. The legal team reviews the token’s launch, fundraising history, governance structure, and ongoing promotional activity. If the analysis concludes the token passes the Howey test (investment of money in a common enterprise with expectation of profit from others’ efforts), listing it triggers SEC registration requirements the exchange likely cannot satisfy without becoming a national securities exchange or ATS.
If the token is classified as a nonsecurity commodity, the compliance team evaluates sanctions risk, checks whether the token or its developers appear on OFAC lists, and assesses whether the blockchain has adequate decentralization to avoid single point control risks.
The technology team evaluates node infrastructure requirements. The exchange must run full nodes to validate transactions and generate deposit addresses. For EVM chains, integration may reuse existing Ethereum infrastructure. Non EVM chains require separate node clusters, monitoring, and wallet integration.
The finance team models liquidity. The exchange seeds initial order book depth either by market making internally (if permitted under its regulatory structure) or by incentivizing external market makers through fee rebates. Listing occurs once legal, compliance, technology, and liquidity thresholds are met, typically a process spanning weeks to months depending on the token’s complexity.
Common Mistakes and Misconfigurations
- Assuming FinCEN registration satisfies state requirements. FinCEN registration is federal; state money transmitter licenses are separate and must be obtained individually.
- Treating all tokens as commodities. Securities classification determines regulatory obligations. An internal legal opinion is not binding on the SEC.
- Underestimating bank account lead times. Securing a banking partner can take six months or longer. Lost banking access halts fiat operations.
- Insufficiently documented AML procedures. Generic policies fail audits. Procedures must specify thresholds, escalation paths, and recordkeeping with enough detail that a new compliance officer could execute them.
- Commingling customer and corporate funds onchain. Proper segregation requires separate wallet infrastructure, not just separate addresses within the same wallet system.
- Failing to update proof of reserves after large withdrawals. Stale attestations erode trust and may violate platform commitments if disclosures promise regular updates.
What to Verify Before You Rely on This
- Current money transmitter license requirements in your target states. Some states have amended exemptions or introduced new registration tiers.
- The SEC’s latest enforcement priorities and settlement terms. The agency’s position on specific tokens evolves through public statements and court filings.
- Banking partner terms, including reserve requirements, transaction limits, and termination clauses. These agreements are confidential and vary significantly.
- Insurance coverage limits and exclusions for both fiat and crypto holdings. Standard policies often exclude certain attack vectors.
- Confirmation thresholds recommended by each blockchain’s developer community. Reorganization risk profiles change with hash rate and validator set shifts.
- OFAC sanctions lists. These update frequently, and exchanges must screen against the current list, not a cached version.
- Whether your exchange structure permits internal market making or if you must rely exclusively on third party liquidity providers.
- Tax reporting obligations under current IRS guidance, including Form 1099 thresholds and information return deadlines.
Next Steps
- Map your target state footprint and initiate money transmitter license applications in priority jurisdictions. Budget 6 to 18 months for approvals.
- Establish relationships with crypto friendly banks or payment processors. Request detailed integration specs and settlement timelines.
- Build or license market surveillance infrastructure that meets the technical requirements outlined in recent SEC and CFTC settlements, focusing on real time flagging and audit trail completeness.
Category: Crypto Regulations & Compliance
