What Institutional Investors Require From a Crypto Exchange in 2026

The Institutional Floodgates Are Open — But Not for Every Exchange

The numbers tell the story. Institutional crypto assets under management crossed $500 billion in late 2025. Traditional finance giants — BlackRock, Fidelity, Goldman Sachs, BNY Mellon — aren’t “exploring” crypto anymore. They’re deployed. Their clients expect crypto exposure as a standard portfolio allocation.

But here’s what most exchange operators miss: institutional money doesn’t flow through just any exchange. Institutions have compliance departments, risk committees, and due diligence processes that would make most startup founders weep. They evaluate 20-50 exchanges before selecting the 2-3 they’ll actually use.

The exchanges that pass institutional due diligence enjoy a transformative advantage: deep liquidity, massive volume, premium fees, and credibility that attracts even more institutional capital. The ones that don’t? They’re stuck competing for retail scraps.

We’ve helped dozens of Codono-powered exchanges pass institutional due diligence processes. Here’s exactly what institutions look for — and what disqualifies an exchange immediately.

The Non-Negotiables: Fail Any of These and You’re Disqualified

1. Regulatory Licensing

This isn’t a “nice to have.” It’s the first checkbox on every institutional due diligence form. No license = no institutional business. Period.

What institutions require:

• A recognized financial license in at least one major jurisdiction. MiCA authorization in the EU, MSB registration with FinCEN in the US, FCA registration in the UK, MAS license in Singapore, VARA license in Dubai — the specific license depends on your market, but you need one.
• Active compliance program — not just a license on paper, but demonstrable evidence that you maintain compliance. This means a named compliance officer, written policies, regular audits, and ongoing training.
• Regulatory reporting capabilities — institutions need to know that your exchange files the required regulatory reports (SAR, CTR, transaction reporting). If regulators come asking questions, the exchange needs to have answers ready.

How Codono helps: Our KYC/AML system provides the compliance infrastructure that licensing authorities require. Automated transaction monitoring, risk scoring, and regulatory reporting are built into the platform. You get the tools to obtain and maintain a license — not just check a box.

2. Segregated Client Funds

Institutions learned from FTX. Their number one concern isn’t market risk — it’s counterparty risk. They need ironclad assurance that client funds and exchange operating funds are completely separate.

Requirements:

• Segregated bank accounts for client fiat deposits. Not commingled with operating funds. Not in the same account with different internal ledgers. Physically separate accounts at regulated banks.
• Segregated crypto custody — client crypto assets held in separate wallets from exchange operational wallets. Multi-signature wallets with institutional-grade key management.
• Proof of Reserves — regular (ideally real-time) attestation that client assets are fully backed. Third-party audits from recognized firms (Armanino, Mazars, Deloitte). Self-reported “proof” doesn’t count anymore.
• No rehypothecation — client assets are not lent out, used as collateral, or commingled in any way unless the client has explicitly opted into a lending or earn program with full risk disclosure.

3. Enterprise-Grade Security

Institutional security requirements go far beyond “we have 2FA.” They expect a security posture comparable to traditional financial institutions.

The security checklist:

• Cold storage for 95%+ of assets — only operational minimums in hot wallets. Cold storage with geographic distribution, air-gapped signing, and multi-party computation (MPC) or multi-sig.
• SOC 2 Type II compliance — the gold standard for operational security. Institutions want to see the audit report. If you don’t have SOC 2, you’re at a massive disadvantage.
• Penetration testing — annual third-party pen tests from recognized firms, with remediation evidence for any findings.
• Insurance coverage — crypto custody insurance from a recognized carrier. The coverage amount matters less than having it at all — it signals institutional seriousness.
• Incident response plan — documented, tested, and rehearsed. What happens when there’s a breach? Who gets notified? What’s the containment procedure? Institutions ask for this document during due diligence.
• DDoS protection — enterprise-grade CDN and DDoS mitigation. An exchange that goes down during a market event is an exchange that loses institutional trust permanently.

Codono’s security architecture addresses these requirements at the platform level — cold storage integration, encryption at rest and in transit, role-based access control, and audit logging are standard.

Trading Infrastructure Requirements

4. Deep Liquidity and Tight Spreads

Institutions trade large. A fund rebalancing might need to execute $10M in a single session. If your order book can’t absorb that without 5% slippage, you’re not ready for institutional volume.

What institutions evaluate:

• Order book depth — how much volume sits within 0.1%, 0.5%, and 1% of the mid price? Institutions typically want at least $500K within 0.5% for major pairs.
• Spread consistency — tight spreads during normal hours AND during volatility. Fair-weather liquidity is worthless for institutional traders who need to execute during market stress.
• Execution quality — institutions measure fill rates, slippage, and price improvement. They have tools that compare execution quality across exchanges in real time.
• Market impact — for a $1M market order, how much does the price move? Institutional execution teams benchmark this metric obsessively.

How to solve this: The liquidity engine is critical here. New exchanges can aggregate liquidity from multiple sources to provide institutional-grade depth from launch. Market maker programs (discussed in our API trading guide) build organic liquidity over time.

5. Advanced Order Types

Retail traders need market and limit orders. Institutional traders need much more:

• Iceberg orders — large orders broken into visible and hidden portions. Essential for executing size without moving the market.
• TWAP orders — Time-Weighted Average Price execution that spreads a large order over a defined time period.
• Stop-loss and take-profit — standard, but must work reliably during high-volatility events (when they matter most).
• OCO (One-Cancels-Other) — paired orders where execution of one automatically cancels the other.
• Post-only orders — guaranteed to be maker orders (not taker). Essential for market makers managing their fee structure.
• Bracket orders — entry order with attached stop-loss and take-profit. Used for automated risk management.

The spot trading engine and futures platform need to support these natively. Institutions won’t use an exchange that only offers basic order types.

6. FIX Protocol Support

The Financial Information eXchange (FIX) protocol has been the standard for institutional trading communication for 30 years. Traditional finance runs on FIX. Crypto exchanges that speak FIX can plug into existing institutional infrastructure seamlessly.

Why FIX matters:

• Institutions already have FIX-based execution management systems (EMS) and order management systems (OMS)
• Connecting to a new exchange via FIX takes days. Building a custom API integration takes weeks.
• FIX demonstrates institutional readiness — it signals that your exchange is serious about institutional business

Not every exchange needs FIX from day one. But if institutional volume is in your roadmap, FIX support should be planned.

Operational Requirements

7. Sub-Account Architecture

Institutional clients don’t operate with single accounts. Fund managers need:

• Master/sub-account structure — one institutional client with multiple sub-accounts for different trading strategies, funds, or portfolios.
• Per-sub-account permissions — different API keys, different trading permissions, different withdrawal limits per sub-account.
• Unified reporting — aggregate reporting across all sub-accounts for the master account, plus individual sub-account statements.
• Cross-margin capability — optional pooled margin across sub-accounts for capital efficiency.

8. Comprehensive Reporting and Audit Trail

Institutions have reporting obligations. Quarterly reports to LPs, annual audits, tax filings, regulatory reporting. Your exchange needs to provide:

• Trade history exports — every trade with timestamp, price, quantity, fee, and order type. CSV and API access.
• Balance snapshots — historical balance at any point in time. Essential for NAV calculation and audit.
• Fee reports — detailed breakdown of fees paid by period, pair, and type.
• Tax reporting — transaction data formatted for tax compliance (cost basis, realized gains/losses).
• Audit trail — every action taken on the account (logins, order placements, withdrawals, settings changes) with timestamps and IP addresses.

9. Dedicated Account Management

Institutional clients expect white-glove service:

• Named account manager — a single point of contact who understands their needs and can escalate issues.
• Direct engineering line — for API issues, institutions want to talk to an engineer, not a tier-1 support agent.
• Onboarding assistance — help with API integration, testing, and go-live.
• Regular account reviews — quarterly meetings to discuss volumes, issues, and new feature requests.

Compliance and Legal Requirements

10. KYC/KYB for Institutional Clients

Institutional KYC (Know Your Business/KYB) is fundamentally different from retail KYC:

• Corporate documentation — articles of incorporation, certificate of good standing, shareholder register, board resolutions authorizing trading activity.
• Ultimate Beneficial Owner (UBO) identification — identify and verify every individual who owns 10%+ of the entity.
• Authorized signatories — verify that the people setting up the account are authorized to do so.
• Source of funds documentation — institutions must demonstrate the legitimate origin of their capital. Fund prospectuses, audited financial statements, or bank reference letters.
• Ongoing monitoring — annual re-verification of corporate status, UBO changes, and sanctions screening.

Integration with providers like Sumsub handles both retail and institutional KYC flows, including corporate document verification and UBO screening.

11. Travel Rule Compliance

The FATF Travel Rule requires exchanges to share originator and beneficiary information on transactions above thresholds ($1,000 in many jurisdictions). Institutions care about this because:

• Non-compliant exchanges risk losing banking relationships
• Regulatory scrutiny on non-compliant exchanges can freeze operations
• Institutional compliance teams must verify that counterparties comply

Your exchange needs integration with a Travel Rule solution (TRISA, Notabene, or similar) and the technical ability to transmit and receive Travel Rule data with counterparty exchanges.

12. Legal Framework

Institutions need legal certainty about their relationship with your exchange:

• Terms of service reviewed by counsel and acceptable to institutional compliance teams
• Service Level Agreements (SLAs) — uptime guarantees, support response times, data availability commitments
• Liability clarity — what happens if there’s a security breach? A flash crash? System downtime during a critical trade? These scenarios need clear contractual answers.
• Jurisdiction and dispute resolution — specified governing law and arbitration process

The Institutional Due Diligence Process: What to Expect

Here’s what the actual process looks like when an institutional client evaluates your exchange:

Phase 1: Initial Screening (1-2 weeks)

• Regulatory status check
• Website and public documentation review
• Preliminary security assessment
• Volume and liquidity analysis

Phase 2: Detailed Due Diligence (4-8 weeks)

• Security questionnaire (often 200+ questions)
• Compliance documentation review
• Technology assessment (API capabilities, uptime history)
• Financial health assessment (proof of reserves, insurance)
• Reference checks with existing institutional clients

Phase 3: Legal Review (2-4 weeks)

• Terms of service negotiation
• SLA agreement
• Data processing agreements (GDPR if applicable)
• Insurance certificate review

Phase 4: Technical Integration (2-4 weeks)

• API integration and testing
• Sub-account setup
• Reporting configuration
• Go-live with small initial volumes

Total timeline: 2-4 months from first contact to first trade. This is why starting your institutional readiness work early matters. You can’t rush due diligence.

Building an Institutional-Ready Exchange: Priority Order

If institutional business is on your roadmap, here’s how to prioritize:

Phase 1: Foundation (Months 1-3)

1. Obtain regulatory license in at least one jurisdiction
2. Implement segregated fund accounting
3. Deploy enterprise security architecture (cold storage, multi-sig, access controls)
4. Build comprehensive KYC/KYB system with corporate onboarding

Phase 2: Infrastructure (Months 3-6)

5. Ensure deep liquidity across major trading pairs
6. Implement advanced order types (iceberg, TWAP, bracket)
7. Build sub-account architecture with permissions
8. Create comprehensive reporting and export tools

Phase 3: Polish (Months 6-9)

9. Obtain SOC 2 Type II certification
10. Implement FIX protocol support
11. Build institutional onboarding materials and due diligence response templates
12. Hire institutional sales and account management team

Phase 4: Scale (Months 9-12)

13. Pursue crypto custody insurance
14. Establish OTC desk for large block trades
15. Build institutional prime brokerage features
16. Create API co-location options for low-latency access

The ROI of Institutional Readiness

Is all this effort worth it? Consider the math:

• A single institutional market maker generates $5-50M/day in volume
• At 0.02% average fee capture, that’s $1,000-$10,000/day in fee revenue from ONE client
• Institutional clients have 95%+ retention rates (they don’t switch exchanges casually)
• Institutional volume attracts more institutional volume (liquidity begets liquidity)

One institutional relationship can transform your exchange’s economics overnight. Five can make you profitable. Ten can make you a market leader in your region.

Start Building for Institutions Today

You don’t need to have everything on this checklist before engaging with institutional prospects. But you need to show a credible roadmap and have the foundation in place.

Codono’s exchange platform provides the technology foundation for institutional readiness: multi-signature custody, compliance infrastructure, deep liquidity integration, advanced order types, comprehensive API, and the security architecture that institutional due diligence demands.

You provide the licensing, the compliance team, and the relationships. We provide the technology that makes it all work.

Ready to build an institutional-grade exchange? Request a demo or view our pricing.

---

The Codono Team has helped 100+ licensed exchange operators achieve institutional readiness. These requirements are drawn from real due diligence processes we’ve helped our clients navigate.