360 Soft builds and upgrades crypto-asset trading and custody platforms whose compliance functions are designed in from the start: KYC/AML, wallet and custody controls, audit trails, regulatory reporting and market surveillance. Our team works in Turkey, where crypto-asset service providers are licensed by the Capital Markets Board (SPK) under Law No. 7518, and we adapt the same architecture to the rules of your own jurisdiction.
This page explains the regulatory background, who the service is for, the module scope, delivery models, implementation steps, KPIs, cost drivers and risks. For the wider picture, see our KYC/AML compliance software page.
Regulatory framework: an overview
Law No. 7518, in force since 2024, added crypto-asset provisions to the Turkish Capital Markets Law. Crypto-asset service providers (trading platforms and custodians) now require SPK authorisation and supervision. Establishment and operating principles, capital and organisational requirements, protection of client assets and operating rules are detailed in SPK secondary regulation, and TÜBİTAK plays a role in defining technical criteria for information systems.
On the anti-money-laundering side, crypto-asset service providers are obliged parties under MASAK rules: customer due diligence, suspicious transaction reporting, record keeping, internal controls and training, plus rules on transmitting originator and beneficiary information with crypto transfers (the travel rule). Outside Turkey, comparable frameworks include MiCA and the EU Transfer of Funds Regulation, FCA registration in the UK, FinCEN and state licensing in the US, and VARA, ADGM, CBUAE or SAMA-related rules in the GCC. Local rules in your country always apply; we build the software, while licence applications and legal opinions remain with you and your advisers.
Who it is for and which problems it solves
- New platforms preparing for a licence application that need a compliant architecture from day one
- Existing exchanges that must close gaps after new regulation (KYC depth, travel rule, segregation of client assets, reporting)
- Brokers, fintechs and banks adding crypto trading or custody to their products
- Custody providers that need strong key management, approval workflows and reconciliation
Scope
We cover the full platform or selected modules: customer onboarding, AML and sanctions controls, the trading core, wallet and custody, fiat rails, accounting and reconciliation, permissions and audit logging, reporting, and the web and mobile front ends.
How this differs from a white-label clone script
| Topic | Clone script | 360 Soft custom development |
|---|---|---|
| Source code | Often obfuscated or licensed | Full source code and IP assigned to you |
| Compliance modules | Generic or missing | Designed for your licence and regulator |
| Local integrations | Rarely available | Banks, identity providers, screening and reporting |
| Security review | Unknown history | Secure SDLC, code review and independent penetration testing |
Market integrity and surveillance data
Regulators increasingly expect platforms to detect market abuse such as wash trading, spoofing, layering and pump-and-dump schemes. We store order-book events, trades, cancellations and account relationships in a form that can be queried later, and add surveillance rules and alerts that compliance officers can review, document and escalate.
Module scope in detail
| Module | Content |
|---|---|
| Customer onboarding | Identity verification, NFC chip reading, liveness, address and source-of-funds checks |
| Risk scoring | Customer and transaction risk models, enhanced due diligence triggers |
| Sanctions and list screening | Sanctions, PEP and adverse-media screening at onboarding and on an ongoing basis |
| Transaction monitoring (AML) | Rule- and scenario-based alerts, case management, suspicious activity reporting |
| Blockchain analytics integration | Wallet and transaction risk scores from analytics providers |
| Travel rule | Exchange of originator and beneficiary data with other providers |
| Order matching engine | Order book, matching, fee schedules, market-making accounts |
| Wallet and custody | Hot/warm/cold wallets, MPC or HSM key management, withdrawal approvals |
| Fiat and bank integrations | Deposits and withdrawals, virtual IBANs, payment providers |
| Accounting and reconciliation | Client asset segregation, on-chain versus ledger reconciliation |
| Permissions and audit trail | Role-based access, four-eyes approvals, tamper-evident logs |
| Reporting | Regulatory, management and audit reports |
Technology stack
Typical choices include Go, Java or.NET for low-latency services, Node.js or Python for integrations, PostgreSQL and a time-series store, Kafka for event streams, Kubernetes for deployment, React and Flutter or native apps for front ends, and HSM or MPC solutions for key management. The final stack is selected together with your team.
Experience
The Coinone cryptocurrency exchange platform is one of our references.
Delivery models
| Model | When it fits |
|---|---|
| Gap analysis | You have a platform and need to know what is missing for compliance |
| Custom development project | A new platform or a major rebuild with fixed scope and milestones |
| Module integration | Adding specific modules (e.g. travel rule, AML monitoring) to an existing platform |
| On-premise or private cloud | Hosting must meet data-residency or regulator expectations |
| Managed service | We run, monitor and maintain the platform under an SLA |
| Additional team | Our engineers join your team, remote, on-site or hybrid |
Process steps and typical timelines
| Step | Content | Typical duration |
|---|---|---|
| 1. Discovery and gap analysis | Regulatory requirements, current state, priorities | 2–4 weeks |
| 2. Architecture and requirements | Target architecture, security model, data flows | 2–4 weeks |
| 3. Priority modules | Onboarding, AML, reporting | 6–12 weeks |
| 4. Trading core and wallet | Matching engine, custody, reconciliation | 8–16 weeks |
| 5. Security validation | Code review, penetration test, key ceremony | 2–4 weeks |
| 6. Documentation | Technical and procedural documentation for audits | 2–3 weeks |
| 7. Go-live and support | Phased launch, monitoring, 7/24 support if required | ongoing |
SLA and KPI examples
| Indicator | What it shows |
|---|---|
| Platform availability | Uptime against the agreed SLA |
| Order processing latency | Time from order receipt to matching |
| Onboarding time | Time from sign-up to approved account |
| AML alert handling time | Time to review and close alerts |
| Reconciliation difference | Gap between on-chain balances and the internal ledger |
| Security finding closure time | Time to fix findings by severity |
| Incident response time | Time to react to security or operational incidents |
What drives the cost
| Factor | Why it matters |
|---|---|
| Scope | Full platform or selected modules |
| Supported assets and networks | Each chain needs node, wallet and monitoring work |
| Key management method | HSM, MPC or multisig differ in effort and licensing |
| Third-party services | Identity, analytics, screening and travel-rule providers |
| Hosting | Public cloud, private cloud or on-premise |
| Security and testing intensity | Audits, penetration tests, bug bounty |
| Support level | Business hours or 7/24 operations |
In-house team, freelancers or outsourcing
| Criterion | In-house | Freelancer | 360 Soft team |
|---|---|---|---|
| Crypto and compliance know-how | Takes time to hire | Varies widely | Brought into the project |
| Security assurance | Depends on seniority | Hard to verify | Secure SDLC and independent testing |
| Continuity | Depends on retention | High risk | Replacement process for staff |
| Source code and IP | Owned | Must be contracted carefully | Assigned to you by contract |
| Cost structure | Fixed salaries | Hourly | Project scope or monthly team |
Risks and mitigation
| Risk | Mitigation |
|---|---|
| Loss of assets from hot wallets | Minimal hot balances, MPC/HSM, withdrawal limits, multi-party approvals |
| Insider misuse | Role separation, four-eyes principle, privileged access monitoring |
| Account takeover | Strong MFA, device binding, withdrawal whitelists and cool-off periods |
| Use of the platform for money laundering | Risk-based KYC, transaction monitoring, blockchain analytics, travel rule |
| Sudden load spikes | Horizontal scaling, load testing, circuit breakers |
| Reconciliation differences | Automated daily reconciliation and alerts |
| Regulatory change | Configurable rules and modular architecture |
| Third-party dependency | Abstraction layers and secondary providers |
Security, data protection, NDA and IP
We work under a B2B service agreement with an NDA and IP assignment: source code and deliverables belong to you. For EU/UK clients we sign a GDPR Data Processing Agreement with Standard Contractual Clauses (or the UK IDTA); we also comply with KVKK, the Turkish data protection law. Production keys and customer data are handled under least-privilege access, with logging and, where needed, on-site or client-controlled environments.
Selection checklist
- Does the partner understand the licensing regime that applies to you?
- Will you receive the full source code and IP?
- How are private keys generated, stored and approved for use?
- Are travel rule, AML monitoring and sanctions screening covered?
- Is there independent penetration testing before go-live?
- How is client-asset reconciliation performed and reported?
- What happens if a key engineer leaves the project?
Illustrative scenario
Illustrative scenario – not a client case. A regional trading platform must meet new licensing requirements. A gap analysis shows missing travel-rule support, manual reconciliation and incomplete audit logs. We deliver the travel-rule integration, automated reconciliation, role-based approvals for withdrawals and a reporting module first, then refactor the wallet layer to MPC. Measured in the project: reconciliation differences, alert handling time and audit-log coverage.
Frequently asked questions
Do you file the licence application for us?
No. Licence applications and legal opinions remain with you and your legal advisers. We build and document the software and support you with technical answers during the process.
Can you upgrade our existing platform for compliance?
Yes. We start with a gap analysis and then add or rework modules such as KYC, AML monitoring, travel rule, reconciliation and audit logging.
Is a mobile app included?
It can be. We build web, iOS and Android front ends or integrate the compliance functions into your existing apps.
Which organisations does Law No. 7518 cover?
In Turkey it covers crypto-asset service providers such as trading platforms and custodians, which require Capital Markets Board authorisation. In other countries the local framework applies.
How are MASAK or other AML obligations met in software?
Through customer due diligence at onboarding, risk scoring, sanctions screening, transaction monitoring with case management, suspicious activity reporting and record retention.
What is the difference between a clone script and custom development?
A clone script is a generic product with limited compliance features and often unclear code ownership. Custom development gives you source code, IP and modules designed for your regulator.
How are wallets and private keys secured?
With a hot, warm and cold wallet structure, HSM or MPC key management, withdrawal limits, whitelists and multi-party approvals.
Do you support the travel rule?
Yes. We integrate travel-rule protocols or providers so that originator and beneficiary data are exchanged with counterpart providers.
Who owns the source code?
You do. The B2B agreement assigns the IP of project deliverables to you.
How quickly can a team start?
Typically within 1–2 weeks, with team sizes from a single engineer to 200+ people.
Talk to us about your crypto platform
Share your target jurisdiction, current platform and timeline, and we will propose a scope and a team. Call or WhatsApp +90 850 335 10 87, write to info@360-soft.com, message us on WhatsApp or use our contact page. Related: KYC/AML compliance software · NFC identity verification · Offshore development center in Turkey · Hire a software development team · Türkçe
