Crypto exchange and custodial wallet QA
FintechAssuranceLabs tests crypto exchanges and custodial wallets where a defect moves client assets: order matching and trading fees, deposits across chain reorganisations, withdrawal limits, custody segregation, and staking reward accruals. The test evidence maps to MiCA, FinCEN, New York, and Canadian requirements. The segment includes products like Coinbase, Kraken, and Binance, which combine trading, custody, and staking.
What breaks in crypto exchanges and where it costs money
An exchange earns trading fees on every fill and a commission on staking rewards, both on top of client assets it holds in custody, so a defect in either line is closed with the exchange's own funds.
- Taker fee rounded up on every partial fill. A market order fills against 12 resting orders, and the fee service charges the taker rate on each fill, rounding each fee up to the asset's smallest unit instead of computing one fee on the total. The correction is a refund run across all affected trades. MiCA requires crypto-asset service providers to publish their pricing, costs, and fees policies (Article 66(4)) and trading platforms to keep fee structures transparent, fair, and non-discriminatory (Article 76(13), Regulation (EU) 2023/1114). In New York, the total fees on each transaction are part of the record a licensee keeps for seven years (23 NYCRR 200.12).
- Deposit credited before the chain reorganises. The deposit service credits the client after one confirmation, a reorganisation replaces the block, and the deposit transaction never reaches the canonical chain. By then the client has sold the credited coins and withdrawn the proceeds. The exchange owes that withdrawal from its own holdings, because a New York licensee holds virtual currency of the same type and amount it owes each customer (23 NYCRR 200.9(b)), and a MiCA custodian keeps a register of positions per client (Article 75(2)).
- Staking commission deducted twice. The reward job deducts the exchange's commission from the validator reward, and the crediting service deducts the same commission again from each client share. Every staking client is under-credited each reward period, and the register of positions no longer matches each client's rights under Article 75(2). In the reverse defect, rewards allocated from a stale balance snapshot pay clients who already unstaked, and the overpayment comes out of the exchange's own holdings.
- Withdrawal limit checked before the balance is locked. Two withdrawal requests sent in parallel read the same available balance and the same remaining daily limit, and both pass. The signing service broadcasts both, and neither can be reversed on chain. The second withdrawal is paid with crypto-assets held for other clients, which New York prohibits except at the direction of the person the assets are held for (23 NYCRR 200.9(c)) and which breaks the segregation of client holdings under MiCA Article 75(7).
Licence status and the evidence regulators ask for
Crypto exchanges and custodial wallets are licensed or registered in each jurisdiction they serve: MiCA authorisation in the EU, FinCEN registration and state licences in the US, and FINTRAC registration plus securities dealer registration or a pre-registration undertaking in Canada.
EU: national competent authority under MiCA
Every MiCA transitional period for crypto-asset service providers (CASPs) ended by 1 July 2026, so an exchange serving EU clients needs a CASP authorisation (MiCA testing requirements). The competent authority reviews technical documentation of ICT systems and security arrangements (Article 62(2)(j)) and the segregation procedure for client crypto-assets and funds (Article 62(2)(k)). A trading platform's systems handle peak order and message volumes, reject orders above pre-determined volume and price thresholds, and are fully tested for both (Article 76(7)(b), (d), and (e)). CASPs are also financial entities under DORA, and crypto transfers carry originator and beneficiary information under Articles 14(1) and 14(2) of Regulation (EU) 2023/1113. Evidence we produce: order rejection results per trading pair, peak volume test results, register-of-positions reconciliations, and travel rule payload captures.
US: FinCEN and state regulators
FinCEN guidance FIN-2019-G001 of 9 May 2019 states that persons accepting and transmitting convertible virtual currency register with FinCEN as money services businesses with AML program, recordkeeping, and reporting duties, and a transmittal of $3,000 or more can trigger the Funds Travel Rule of 31 CFR 1010.410(f) (FinCEN guidance). New York's virtual currency rule requires penetration testing of a licensee's electronic systems at least annually and vulnerability assessment at least quarterly (23 NYCRR 200.16). Under California's Digital Financial Assets Law, on or after July 1, 2026, a person engages in digital financial asset business activity with a California resident only if licensed, exempt, or awaiting a decision on an application submitted on or before July 1, 2026 (Financial Code section 3201 as amended by AB 1934, Chapter 945, Statutes of 2024). Evidence we produce: penetration test reports with retest results under security testing, reconciliations of customer balances to wallet holdings, and transaction monitoring rule tests.
Canada: FINTRAC, securities regulators, and CIRO
Dealers in virtual currencies are money services businesses under the PCMLTFA and register with FINTRAC, with identification at $1,000 and large virtual currency receipt reports at $10,000 (FINTRAC testing requirements). A crypto asset trading platform also seeks dealer registration with the provincial securities regulators, and under CSA Staff Notice 21-332 of 22 February 2023, an unregistered platform files a pre-registration undertaking to keep operating while its application is pending. For CIRO dealer members operating these platforms, the interim custody terms and conditions described in CIRO Notice 26-0033 of 3 February 2026 limit internal custody to 20% of the value of crypto assets held for clients and the firm's own account, and cap Tier 3 and Tier 4 custodians at 75% and 40%. The notice also requires SOC 2 or ISAE 3000 Type 2 reports from approved custodians and expects annual independent penetration testing for custodians outside Tier 1. Evidence we produce: custody share calculations after price moves, and penetration test results for internal custody systems.
Regulatory sources on this page were checked on 2026-09-16.
Crypto exchange test scenarios
- Fees on fragmented fills. Market orders filling against 1, 2, and 12 resting orders, with fees compared to the published maker and taker schedule, including a fee tier change at a 30-day volume boundary.
- Matching engine rules. Price-time priority, self-trade prevention, post-only orders that would cross the book, and a cancel arriving mid-fill.
- Price bands through every channel. Orders at and above each price band and maximum order size through the web interface, the REST API, and the WebSocket API, against Article 76(7)(d) of MiCA.
- Deposits across a reorganisation. Deposits credited at each chain's confirmation threshold, then a block invalidated on a local regtest network with
invalidateblock, checking that the credit reverses and the funds stay locked until finality. - Concurrent withdrawals. Parallel withdrawal requests against the same balance and daily limit, and a retry after a signer timeout with the same idempotency key.
- Stuck transactions. A replacement transaction for a stuck withdrawal that does not create a second payout, and the client withdrawal fee compared with the network fee paid.
- Custody segregation and limits. Client register totals against on-chain holdings per asset after hot-to-cold sweeps and gas top-ups, and the internal custody share recalculated after a price move against the 20% CIRO limit.
- Staking accruals. Rewards per epoch with the commission deducted once, balances locked during unbonding, rewards stopping at the unstake request, and a simulated slashing event allocated to the staking clients.
- Travel rule before broadcast. Withdrawals to another CASP with each field of Articles 14(1) and 14(2) of Regulation (EU) 2023/1113 missing in turn, blocked before signing, plus the EUR 1,000 self-hosted address checks on withdrawals (Article 14(5)) and deposits (Article 16(2)), and the US $3,000 Funds Travel Rule threshold.
- Peak load at listing events. Order and message volumes at a new token listing, with matching latency recorded under trading platform testing.
Integrations and protocols to cover
- Blockchain nodes. Bitcoin Core and Ethereum JSON-RPC for deposit detection and confirmations, node provider webhooks, testnets, and local regtest networks.
- Custody and signing. MPC and HSM signing services, PKCS#11 interfaces, approval quorum policy engines, and hot, warm, and cold wallet sweep jobs.
- Trading APIs. REST and WebSocket order entry and market data, and FIX for institutional order entry.
- Staking. Validator clients, staking provider APIs, and the Ethereum Beacon API for reward and slashing events.
- Travel rule messaging. IVMS 101 payloads exchanged with other CASPs through travel rule networks, and blockchain analytics APIs that score wallet addresses.
- Fiat rails. SEPA credit transfers in ISO 20022 pain.001 and pacs.008, Nacha ACH files, wires, and card acquirer APIs for card purchases of crypto, where cardholder data stays out of test environments.
- Identity and screening. KYC vendor APIs and sanctions screening APIs at onboarding and at withdrawal.
Crypto exchange and wallet testing delivers the "Deposit and withdrawal test suite per supported chain" and "Staking reward accrual checks" for these integrations.
Related
Standards
Services
- Ledger and reconciliation testing
- Trading and investment platform testing
- Crypto exchange and wallet testing
- KYC, AML and fraud testing
- Mobile banking and finance app testing
- Performance and load testing
- Operational resilience testing
- Security testing
- Test automation
- Audit and certification test evidence
- QA audit and test strategy
- Dedicated fintech QA team
Guides
Sample deliverable
Sample, synthetic data
| ID | Source pair and instrument or asset | Internal quantity or amount | External quantity or amount | Difference (internal minus external) | Break classification and cause |
|---|---|---|---|---|---|
| POS-01 | Internal position ledger vs custodian settled position file: Equity A shares | 1,200 shares | 1,000 shares | +200 shares | Timing break, expected: a 200-share buy executed on trade date settles on T+1 and is absent from the settled position file until the next file |
| POS-02 | Internal position ledger vs clearing position file: Equity B shares | 500 shares | 1,000 shares | -500 shares | Corporate action break, open: the clearing file applies a 2-for-1 split on the effective date and the internal ledger has no split entry |
| POS-03 | Portfolio ledger vs custodian holdings file: Fund A units | 1,250.457362 units | 1,250.457 units | +0.000362 units | Rounding break inside the 0.001-unit tolerance: the portfolio ledger stores units to 6 decimal places and the custodian file to 3 |
| POS-04 | Hot wallet ledger vs blockchain node balance: Testnet coin A on a public testnet | 2.500000 coin A | 2.000000 coin A | +0.500000 coin A | True break, defect: deposit DEP-7713 was credited after 1 confirmation against a configured threshold of 12, and a chain reorganisation removed the transaction from the canonical chain |
| POS-05 | Hot wallet ledger vs blockchain node balance: Testnet coin A on a public testnet | 50.000000 coin A | 49.999580 coin A | +0.000420 coin A | True break, defect: the network fee for withdrawal WD-2291 was paid from the hot wallet and has no ledger entry |
| POS-06 | Tracker holdings from imported exchange history vs self-custody wallet node balance: Testnet coin B | 1.0000 coin B | 0.9995 coin B | +0.0005 coin B | True break, defect: the import records the exchange withdrawal at the gross amount and drops the 0.0005 coin B withdrawal fee, so the lot quantity is overstated by 0.0005 coin B and later disposals consume units the wallet does not hold |
| POS-07 | EWA advance ledger vs employer payroll deduction file: employee EMP-0042, pay period PP-18 | 350.00 XTS | 300.00 XTS | +50.00 XTS | Timing break, expected: advance ADV-5520 was requested after the payroll cut-off and the employer file deducts it in pay period PP-19 |
| POS-08 | Revenue-share remittance ledger vs expected remittance recalculated from processor revenue feed: agreement RBF-0310, month M-06 | 1,200.00 XTS | 1,160.00 XTS | +40.00 XTS | Calculation break, defect: the remittance applies the 8% share to 15,000.00 XTS gross revenue, while the agreement defines the share on 14,500.00 XTS revenue net of refunds |
Amounts use XTS, the ISO 4217 code reserved for testing; Equity A, Equity B, Fund A, and testnet coins A and B are generic test instruments with no market value, and all employee, agreement, deposit, and withdrawal IDs are invented.
Questions
How do crypto exchanges make money?
How does a crypto exchange work?
How does crypto staking work?
Scope testing for your exchange
Send your supported chains, trading products, and licence map, and we return a test scope with the evidence each regulator on that map asks for.
Scope your testing