A business comparing crypto exchange infrastructure should begin with the operating model it needs, then compare documented responsibilities, integrations, custody arrangements, controls, and jurisdiction-specific evidence. Use the same requirements for each candidate, and treat claims that are not supported by relevant, current documentation as unresolved rather than as established capabilities.
Define the exchange infrastructure model you need
“Exchange infrastructure” can refer to different arrangements. A business may be assessing an exchange operator, software for running an exchange, or connectivity to a trading environment. These scopes are not interchangeable. Some cryptoasset service providers combine trading, custody, lending, market-making, and other services, while other arrangements separate functions across firms. Do not assume that a provider offering one component also performs the others. [claim_id: claim_1e8ba9ede5b224c014f2]
Start by describing the activity the business expects the proposed system to support. Specify whether the arrangement includes trading, custody, customer-facing software, connectivity, or a combination. Then identify which legal entity or service provider is responsible for each function. A conceptual map of an exchange environment can include participants and access interfaces connected to trading systems, alongside custody, settlement, data, and external-service relationships; the actual arrangement varies by provider. [claim_id: claim_253e4f4fd363ce714041]
Turn that description into requirements. Separate mandatory capabilities from preferences, and define what evidence would satisfy each requirement. A feature name alone is not proof that two offerings provide the same service. Record the relevant system boundary, user responsibilities, dependencies, and exclusions before comparing candidates.
For a market access arrangement, ask whether participants interact directly with a trading platform or through a cryptoasset service provider. Then trace what happens after access: which system records orders, who holds assets, and where settlement occurs. These questions describe different functional roles; they should not be collapsed into a single label such as “exchange.” [claim_id: claim_51950261bb6c82db29ef]
Compare architecture, integrations, and operational fit
For each candidate, request current technical documentation covering interfaces, integration options, data access, dependencies, and customer-side work. Record the document date and version when provided. Map the documented components to your requirements, and mark missing information as unresolved instead of inferring how an undocumented component behaves.
Assess performance and resilience against the business’s stated operating requirements. Request evidence tied to the proposed service, configuration, workload, and conditions. Distinguish a provider’s description from independently verified evidence, and record the scope, date, and limitations of any assessment. Evidence about one configuration does not establish how every configuration will behave. If relevant evidence is unavailable, note that gap rather than estimating performance or treating a general assurance as a guarantee.
Clarify operational boundaries before procurement. Ask who is responsible for configuration, monitoring, maintenance, support, incident communication, and changes that could affect an integration. Request applicable support terms and change-management documentation. The comparison should show what the provider documents, what your team must handle, and what remains unspecified; do not assume a service level that has not been evidenced.
Settlement is also a distinct function to examine. In general financial-market infrastructure concepts, settlement systems and central securities depositories have roles distinct from trading, with guidance addressing linked settlement obligations and custody-related risk. This is a conceptual distinction, not a classification of every crypto exchange. For the proposed arrangement, establish which entity or system records and completes settlement, and verify the relevant responsibilities and dependencies in its documentation. [claim_id: claim_6848f93bb0e6994ea41c]
Assess custody, security, and recovery evidence
Ask who controls assets and keys in the proposed arrangement, and which actions the business or its customers can authorize. The answer may depend on how trading, custody, and other functions are organized across firms and services. Request current documentation identifying the responsible entity, custody and settlement arrangements, functional boundaries, applicable terms, and evidence for operational or protection claims. [claim_id: claim_3f1efd11995457d68bfd] [claim_id: claim_02d25a0f87b7293820c4]
Evaluate security claims by evidence type. A provider’s description is an assertion; an independent assessment is a different kind of evidence. For each assessment, record its date, scope, covered services, exceptions, and whether it applies to the specific arrangement being considered. Do not treat an assessment of one system or period as proof that every component is secure or that incidents cannot occur.
Request documentation of incident handling and business continuity, including responsibilities assigned to the provider and the customer. Check what the procedures cover and which conditions or dependencies might limit them. Ask for documented recovery processes and their limitations, but do not imply that assets or access can always be restored. Record unresolved scenarios rather than promising recovery.
If the proposed service involves collateralized positions, examine the specific design rather than assuming collateral removes risk. A common decentralized collateral model can depend on smart contracts, price oracles, collateral-ratio rules, and liquidation processes. It can still face oracle, contract, governance, liquidity, collateral-price, and bad-debt failures. [claim_id: claim_crypto_collateral_model]
Evaluate compliance and jurisdiction fit before selection
Define the proposed arrangement before evaluating its jurisdiction fit. Identify the entities involved, the services each would perform, the customer types, and the jurisdictions in scope. A general description of infrastructure does not establish a provider’s regulatory status, legal availability, or compliance obligations for a particular arrangement.
Verify licensing, registration, regulatory status, availability, and applicable requirements against authoritative sources for each relevant jurisdiction. Check that the evidence applies to the specific entity, service, and customer type—not merely to a brand or a different offering. If the evidence does not resolve the question, record it for qualified legal review rather than drawing a conclusion from marketing materials.
Where applicable under local implementation of the FATF standards, virtual-asset service providers are expected to implement preventive measures that include customer due diligence, record keeping, suspicious-transaction reporting, and originator and beneficiary information handling for applicable transfers. FATF standards do not, by themselves, establish the exact legal duties, thresholds, data handling, licensing, or permitted services in a particular jurisdiction. [claim_id: claim_vasp_preventive_measures]
Obtain qualified legal and tax review where applicable. This comparison is not a legal or tax determination, and evidence for one jurisdiction should not be treated as proof of compliance or availability elsewhere.
Build a like-for-like provider comparison
Use the same requirements and evidence requests for every candidate. A matrix can keep the record focused:
| Criterion | What to record | Evidence to request |
|---|---|---|
| Operating model | Functions included and responsible entities | Scope, architecture, and service documentation |
| Integrations | Interfaces, data access, dependencies, and customer-side work | Current technical documentation and relevant demonstrations |
| Performance and resilience | Requirement, test conditions, result, scope, and limits | Evidence tied to the proposed service and configuration |
| Custody and control | Who controls assets and keys; allocation of responsibilities | Current custody, settlement, and key-control documentation |
| Security and continuity | Controls, assessment scope, exceptions, incident handling, and continuity | Dated documentation, assessment details, and procedures |
| Jurisdiction fit | Entity, service, customer type, and location | Authoritative jurisdiction-specific evidence and qualified review |
| Commercial terms | Fees, exclusions, conditions, and included services | Current provider fee schedule and commercial terms |
Label each entry consistently as documented, independently verified, provider-asserted, or unresolved. Record the source and date. If two offers differ in scope or conditions, do not compare them as though they describe the same service. Verify current fee schedules and commercial terms before comparing fees; incomplete information cannot support a conclusion about which offer costs less.
Before selection, check that every mandatory requirement has evidence or an explicitly accepted open item. Confirm that the evidence is current and applies to the proposed entity, service, and configuration. Record unresolved risks and decision criteria. Without adequate, current, comparable evidence, this process can support a shortlist and further diligence, but not a provider ranking or an assurance of suitability.
Sources and references
- Virtual Assets — Financial Action Task Force; retrieved 2026-10-19.
- Understanding Stablecoin Technology and Related Security Considerations — National Institute of Standards and Technology; retrieved 2026-10-18.