Since July 1, 2026, the issue of paperwork in crypto exchange has become much more serious: the MiCA transitional period in the EU has ended, and operating with European clients without authorization is no longer permitted. For a service owner, legal documents for a crypto exchange have long ceased to be a mere formality. The bank will review them first, followed by the liquidity provider. Below, we break down the package step by step, from the terms published on the website to the license.

What Determines the List of Documents for a Crypto Exchange

There is only one honest answer to the question of what documents are required for a crypto exchange: it depends on the type of exchange. Everything is determined by the jurisdiction, the range of services, and where the clients come from. Crypto-to-fiat exchange, crypto-to-crypto exchange, asset custody, and transfers are considered different services under European regulations, with different requirements. A service that simply exchanges USDT for BTC and a service offering cards and custody operate in completely different worlds, even though their websites may look almost identical.

Terms of Use

If you rank the documents for a cryptocurrency exchange by importance, the Terms of Use will be at the top. This is the agreement with the client: who provides the service, when the exchange rate is fixed, what limits and fees apply, and what happens if there is an error in the address or network. A clause granting the right to suspend an order while checks are being carried out is essential. Without it, any freeze looks arbitrary, and angry reviews on exchange monitoring platforms are likely to follow.

Privacy Policy

An exchange collects a lot of data: passport details, selfies, addresses, IP addresses, and transaction history. The policy should clearly state what is stored, why it is stored, for how long, and to whom it is transferred, for example, to a KYC provider. If some clients are from the EU, the GDPR applies, and as the European Commission points out, fines can reach EUR 20 million or 4% of annual global turnover.

AML/KYC Policy of a Crypto Exchange

This is the public-facing part of compliance. There is no need to disclose monitoring scenarios, but clients should know the rules of the game: what limits apply without verification, what documents may be requested, and when a transaction may be stopped and questions asked about the source of funds. This section should also state that the service refuses to work with persons on sanctions lists and with high-risk jurisdictions.

Refund and Transaction Cancellation Policy

A blockchain transaction cannot be reversed, so this policy deals with other situations. What happens if the client sends less than the required amount, selects the wrong network, the order expires, or the exchange rate moves outside the specified range? The policy should specify deadlines, refund fees, and the procedure: which address the funds will be returned to, in which coin, and after what checks. Cases where funds cannot be returned quickly because an AML review is in progress should be addressed separately.

Cookie Policy

Analytics, advertising pixels, and online chat: almost all of these leave data in the browser. In the EU, Article 5(3) of the ePrivacy Directive requires user consent for this, with the exception of technologies that are strictly necessary to provide the requested service. This is why websites display a consent banner with options (the one everyone closes without looking) and provide a page listing the cookies used and their purposes.

Corporate and Registration Documents

Registering a cryptocurrency business starts with choosing a country, and this determines almost the entire document package. The first documents required to open a crypto exchange appear long before the website itself: articles of association, a resolution appointing the director, an extract from the company register, and information about beneficial owners. The bank will also request a business plan, a funds flow diagram, and information about the source of capital. For the EU, there is one detail that is often overlooked: MiCA requires the place of effective management to be within the Union and at least one director to be an EU resident.

Internal AML Compliance Documents

Clients never see them, but regulators and partner banks are among the first to request them. The basic set includes a risk assessment, internal control rules, KYC and enhanced due diligence procedures, monitoring scenarios, procedures for reporting suspicious transactions, record-keeping requirements, and employee training. The Travel Rule should be covered separately. According to FATF data for 2026, 83% of surveyed jurisdictions had adopted Travel Rule legislation, compared with 73% a year earlier.

Does a Crypto Exchange Need a License?

It depends on where the company is based and where its clients are located, but the overall trend is clear. In the EU, a license for a crypto exchange means CASP authorization under the MiCA regulation, and exchanging crypto for fiat or other crypto falls into the class requiring capital of at least EUR 125,000. The transitional period ended on July 1, 2026. On June 23, ESMA also stated that unauthorized providers must immediately stop onboarding new EU clients and advertising to them. In the rest of the world, cryptocurrency business licensing remains uneven: FATF notes that many countries have yet to turn their rules into effective supervision. But a bank will still ask what legal basis you have for operating.

What Should Be Published on a Crypto Exchange Website

At a minimum, both clients and reviewers will look for:

• Terms of Use and Privacy Policy;
• AML/KYC Policy, Refund Policy, and Cookie Policy;
• company details and license information, if applicable;
• fees, limits, and the complaints procedure.

The last point is not optional in the EU. MiCA requires providers to disclose their pricing policy and maintain a complaints-handling procedure, while those exchanging assets against their own capital must publish quotes or the methodology used to calculate the exchange rate.

Why You Cannot Simply Copy Another Exchange’s Documents

The temptation is understandable: open a competitor’s website, change the name, and you are done. The problem is that someone else’s text describes someone else’s company, operating in a different jurisdiction, with a different KYC provider and different limits. The very first bank review may reveal that the policy refers to legislation that does not even apply to your business. And in a dispute with a client, these exact provisions will be examined, and “we copied them from another exchange” is not an argument.

Conclusion

The document package is built on three layers: public policies, corporate documents, and internal AML compliance, plus a license wherever one is mandatory. Ideally, the legal framework for a crypto exchange should be developed specifically for its business model together with a lawyer rather than copied from a template. The BoxExchanger platform helps with the technical side of launching a service, but the documents still need to be drafted for the specific company.

The information presented in this article is for informational purposes only and does not constitute a guide to action, financial advice, or investment advice. Cryptocurrency investments involve a high level of risk, and every investor should conduct their own analysis, assess their financial capabilities, and consult professional financial advisors before making investment decisions.