Crypto exchange: which authorisations you need

“Exchange” is one of the most ambiguous words in the crypto sector. Profoundly different models live under the same label: a simple currency-exchange service, a platform that holds clients’ funds and crypto, a system that collects orders and executes them, an infrastructure that trades tokens qualifying as securities. Each of these touches a different regulatory perimeter. The question “which authorisations does an exchange need” has no single answer: it depends on exactly what the exchange does. Here is how to reason it through.

It’s not the label that decides, it’s the activity

The guiding principle of Swiss supervision is technological neutrality: what counts is the economic activity and its substance, not the tool. For an exchange, the decisive questions are:

• Do you hold clients’ funds or crypto? Holding assets on behalf of third parties radically changes the regulatory profile.
• Do you exchange crypto against fiat money or between crypto? Exchange is typically financial intermediation.
• Are the tokens handled securities? If so, the rules on financial market infrastructure come into play.
• Do you take deposits from the public? If yes, you are brushing up against the banking perimeter.

Qualifying the activity comes before every other decision. The same project can have a free part and a regulated one: distinguishing them precisely is the first task.

The possible regulatory levels

Depending on the model, an exchange can sit at very different levels.

Anti-money laundering subjection (AMLA)

Almost every exchange that exchanges or transfers assets on behalf of third parties carries out financial intermediation and is subject to the AMLA (Anti-Money Laundering Act): client identification, clarification of the beneficial owner, transaction monitoring, reporting obligations. This entails affiliation with a self-regulatory organisation (SRO) or being brought under an entity that is already subject to supervision. It is the minimum level for the vast majority of models.

Custody and taking of funds

If the exchange holds clients’ funds in its own accounts or pools them, it may enter the perimeter of taking deposits, with implications for a banking licence or the fintech licence (which allows deposits of up to CHF 100 million to be accepted, provided they are neither invested nor remunerated). Custody of crypto on behalf of third parties must also be set up so that the assets remain segregable in the event of bankruptcy.

Trading of securities

If the tokens handled qualify as securities, the trading activity may require an authorisation as a DLT trading system or as a financial market infrastructure. This is the most demanding level, with high requirements for capital, organisation and governance.

The recurring requirements

Regardless of the level, a serious exchange must address:

• Anti-money laundering safeguards designed from the outset, not bolted on afterwards;
• Governance and control functions appropriate to the perimeter;
• Custody and key management, with segregation of clients’ assets;
• Fit and proper persons, meeting the required guarantee criteria;
• Stable banking relationships, increasingly hard to obtain without a clean regulatory structure.

The most expensive mistake

The most common failure of an exchange is neither technological nor commercial: it is regulatory. Starting out without having mapped the activity leads to two opposite outcomes, both costly: operating without a necessary authorisation or affiliation — with an obligation to cease the activity, sanctions and personal liability — or launching oversized procedures that burn through months and capital. The correct sequence is always: define the activity, identify the level, build the structure accordingly, then operate.

How SIH ONE approaches the topic

SIH ONE handles structuring and advisory: mapping the model, qualifying the tokens handled, identifying the authorisation perimeter, designing the corporate and governance structure, setting up the anti-money laundering safeguards. Where the activity requires a FINMA authorisation, an SRO affiliation or third-party custody, the regulated activities are handled by authorised partners. The goal is for you to know, before launching, which level you are in and what it entails.

This content is informational and does not constitute legal or regulatory advice. Every model must be verified in the specific case.

Are you designing an exchange and want to understand the perimeter before you start? Let’s talk: we map the activity and identify the right structure, with the right partners where authorisation is needed.