Case Study — Crypto Exchange Architecture & Regulatory Licensing

Institutional-Grade Crypto Exchange for CryptalDash

Engineering a full-stack regulated cryptocurrency exchange — matching engine, BIP39 custody, KYC/AML, affiliate infrastructure, and GFSC regulatory licence. Delivered 2018–2020.

Executive Summary

Between 2018 and 2020, Touch-Fire engineered and deployed a comprehensive, institutional-grade cryptocurrency exchange solution for CryptalDash. The mandate required balancing deep-tier trading performance with robust digital asset custody, cross-chain modularity, and tight regulatory compliance.

The project culminated in a sophisticated trading ecosystem powering multi-venue routing, featuring advanced merchant and affiliate tools, utilizing top-tier key management protocol, and successfully clearing the rigorous bar for regulatory licensing under the Gibraltar Financial Services Commission (GFSC).

24 months Full-stack delivery lifecycle
M+ TPS Matching engine throughput
GFSC Gibraltar regulatory licence secured
3-tier KYC verification levels

Technical Architecture

At the core of the CryptalDash infrastructure is a proprietary, ultra-low latency matching engine designed for institutional-grade throughput.

  • Order Book Mechanics: Built to handle millions of transactions per second, executing real-time order matching with sub-millisecond throughput. Price-time priority CLOB with support for limit, market, and institutional order types.
  • Liquidity Aggregation: Designed with multi-venue market depth routing capabilities to consolidate liquidity across major global exchanges — routing client orders to the best available price across internal books and external venues simultaneously.

To secure user funds without sacrificing operational fluidity, Touch-Fire designed a sophisticated balance-update and dual-token custody infrastructure using industry-standard deterministic key management.

  • Deterministic Wallets (BIP39): Industry-standard mnemonic seed phrasing and hierarchical deterministic structures for robust, auditable key management across all supported chains.
  • Batch Key Generation: Private keys are generated in batches of one million using isolated temporary nodes, encrypted with a master public encryption key, written directly to the database, and the temporary node is entirely destroyed — leaving no recoverable plaintext key material in memory.
  • Secure Deposit Sweeping: Deposit services track blockchain networks via isolated watchlists. Asset flows are monitored dynamically and automatically swept into high-security wallets on a rolling hourly cycle, minimizing the attack surface of any individual key.

The sweeping pipeline moves assets through a tiered custody architecture:

Deposit Address → Hot Wallet → Trezor Cold Wallet

Balances above configurable thresholds are automatically swept to cold storage, keeping the attack surface of the hot wallet minimized to operational liquidity only.

To meet international regulatory standards, a custom automated Know Your Customer (KYC) onboarding engine was integrated directly into the exchange profile system — removing manual bottlenecks from the compliance workflow without sacrificing regulatory rigour.

  • Tiered Verification: A three-level account verification model maps withdrawal limits to user validation status. Tier 1 enables basic trading; Tier 2 requires secondary document verification; Tier 3 unlocks full institutional limits with enhanced due diligence.
  • Compliance Verification: Automated forms capture personal information, secondary ID verification, geolocated utility bills, and algorithmic "Selfie with Main ID" checks — with automated flagging of inconsistent submission data for human review.

Affiliate Dashboard: Engineering Zero-Cost User Acquisition

To drive zero-cost user acquisition, the product management team specified a custom affiliate infrastructure designed to allow users to sign up as affiliates, generate unique referral links, track multi-tier commission statistics, and settle trading commissions dynamically.

+-------------------------------------------------------------------------+ | Affiliate Tree Architecture | | | | [ Referrer User ] ----> Generates Code (Base URL + AffCode) | | | | | v (Registers via Link) | | [ Tier 1 Referral ] --> Earns Tier 1 Commission on Trading Fees | | | | | v (Registers via Tier 1 Link) | | [ Tier 2 Referral ] --> Earns Tier 2 Commission on Trading Fees | +-------------------------------------------------------------------------+

Database Architecture: Why Pre-Order Tree Traversal Won

To maintain absolute data integrity and scalability, the backend team evaluated two database structures for tracking referral hierarchies. SQL Views on a flat relational table (TRNReferralLvl) failed scalability stress testing under high-volume affiliate tree queries. The team selected Pre-Order Tree Traversal via purpose-built database tables (STACommissionType, STACommissionGrp, and ASSCommissionGrpRate):

Evaluation Criteria Option 2: Relational Table (SQL Views) Option 4: Pre-Order Tree Traversal
Traceability Passed Passed
Debugging Complexity Passed Passed (via STAUser & ASSUserReferral)
Scalability Under Load Failed Passed

Affiliate Dashboard API Endpoints

The affiliate frontend (screens SCR_AffiliateLink, SCR_CommisionGroup, SCR_AffDailyCommission) consumes data via four optimised, authenticated endpoints:

GET /admin/userreflink Fetches the affiliate's unique referral code base URL
GET /admin/affstat Returns aggregated stats: referred_users, tier1_commission, tier2_commission, ytd_total_payout
GET /admin/referrals Paginated, incremental Tier 1 referral listings
POST /admin/payouthist Rolling 30-day payout transaction ledger

Regulatory Framework: The Gibraltar Licence

A critical component of the CryptalDash engagement was Touch-Fire's active involvement in drafting and presenting the technical documentation for the Gibraltar Financial Services Commission regulatory panel.

GFSC Regulatory Compliance

Our engineering team mapped every layer of the ITIL framework — from Change Management and Release Management policies through to Malware Protection, Logging policies, and Data Retention schemas. By delivering a thoroughly auditable blueprint of the matching engine, the database balance-update services, and the segregated hot/cold wallet management workflows, Touch-Fire provided the essential regulatory confidence needed to clear the Gibraltar financial regulatory panel — resulting in the successful acquisition of the exchange operating licence.

The regulatory documentation covered the full operational lifecycle of the platform — from onboarding and KYC to trade execution, custody management, and incident response — providing the panel with a complete, end-to-end view of the exchange's technical controls.

Results & Impact

Successfully deployed from scratch over a focused 24-month lifecycle (2018–2020), delivering a fully operational institutional-grade exchange in a period of intense competitive and regulatory pressure in the digital asset industry. Achieved institutional-grade security that passed external third-party penetration testing and international regulatory audits. The BIP39 key management architecture and cold wallet sweeping pipeline were specifically cited as evidence of robust operational security by the regulatory reviewers. Handed off a complete, self-sustaining white-label token economy and multi-currency environment capable of running global retail and affiliate operations — including the Pre-Order Tree affiliate engine, tiered KYC, and multi-venue Smart Order Routing.

Related Capabilities

Touch-Fire's full-stack exchange expertise — matching engine, custodial key management, compliance workflows, and regulatory documentation — is available for new exchange builds, platform modernisation, and licensing support engagements.

Sub-millisecond CLOB matching with multi-venue Smart Order Routing and institutional order types. Our track record of building compliance infrastructure for Tier-1 regulatory licensing engagements. End-to-end regulated exchange solutions for digital asset and traditional financial markets.

Building a Regulated Crypto Exchange?

Touch-Fire has a live track record of delivering institutional-grade exchange infrastructure — matching engines, BIP39 custody, KYC/AML workflows, and regulatory documentation — that has satisfied Tier-1 financial regulators. Talk to us about your exchange build.

Contact us to discuss your exchange requirements.