For more than a century, exchanges have governed markets as much as they have operated them. While creating liquidity, they have also functioned as private lawmakers within a public regulatory framework by establishing listing standards and disclosure obligations, monitoring issuers, enforcing market rules, and contributing to investor confidence. In a recent paper, however, I identify a fundamental asymmetry: Cryptoexchanges have done well on the liquidity-creation side but largely failed at institutionalized lawmaking. They provide the marketplace without assuming comparable responsibility for the rules and safeguards that sustain it.

Current regulatory debates tend to focus on familiar issues: registration, custody, disclosure, conflicts of interest, and market abuse. These are undoubtedly important. But they mainly ask how cryptoexchanges should be regulated. A more fundamental question is what responsibilities should follow from the functions cryptoexchanges already perform. If they are in many ways like traditional exchanges, why do cryptoexchanges not assume comparable responsibility for the integrity of the markets they create?

FTX illustrates the consequences of this governance gap. Its collapse was a story of fraud, but it also exposed a deeper structural problem. FTX combined functions that traditional financial markets ordinarily separate: It operated a trading venue while also acting as custodian, broker, dealer, market maker, lender, and token issuer. FTX’s bundled architecture did not merely accompany its failure; it gave the platform enormous discretion over customer assets while magnifying conflicts of interest and institutional opacity. The conviction of Sam Bankman-Fried on seven fraud and conspiracy counts, together with FTX’s court-approved reorganization plan to return up to $16.5 billion to creditors, illustrates the harms that bundled intermediation and institutional opacity can produce.

The problem is not simply one of registration. Registering a cryptoexchange does not automatically create governance. Registration can bring an entity within a regulatory perimeter without determining how a platform should govern listings, manage conflicts among its multiple functions, monitor issuers, or protect the integrity of its market. FTX U.S. itself held a money-services business registration and, through its acquisition of LedgerX, controlled a CFTC-registered derivatives clearing organization. Yet neither regulatory status addressed the broader problem of bundled functions or the undisclosed intra-group lending that contributed to FTX’s collapse.

Traditional exchanges help govern capital markets. A listed company does not simply gain access to liquidity. It becomes subject to listing standards, disclosure obligations, surveillance, and ongoing oversight. A cryptoasset listed on a cryptoexchange generally is not subject to equivalent governance requirements. Listing criteria are often opaque, governance disclosures are inconsistent, and investors frequently receive limited assurance about governance structures, protocol risks, or ongoing compliance after listing.

This distinction is particularly significant because it shows that blockchain technology has not eliminated intermediation but transformed it. Regulators are converging on a similar diagnosis from a different angle. The Financial Stability Board (FSB) describes these bundled platforms as “multifunction crypto-asset intermediaries,” warning that combining functions ordinarily separated in traditional finance can amplify vulnerabilities associated with conflicts of interest, inadequate controls, poor disclosure, and operational opacity. I describe cryptoexchanges as “imperfect cryptogatekeepers,” intermediaries with the power to screen market access, select cryptoassets for listing, and shape the information available to investors, but without the governance obligations traditionally associated with that role. This framing complements the FSB’s diagnosis by focusing on the governance and securities-law dimensions it leaves unaddressed.

From Registration to Governance

In the article, I propose four gatekeeping functions:

• Listing governance. Cryptoexchanges already decide which cryptoassets reach their users. That gatekeeping power should carry corresponding disclosure obligations concerning token concentration, governance rights, voting and upgrade mechanisms, and treasury controls, so that decentralization claims can be checked against actual governance arrangements.
• Independent cryptoaudits. Cryptoexchanges cannot credibly monitor all of these risks themselves. Independent specialists (cryptoauditors) capable of assessing code, governance structures, asset custody and segregation, treasury management, and operational security can supply assurance that conventional financial audits do not. These are precisely the categories of risk implicated by failures ranging from FTX’s internal-control breakdown to the operational vulnerabilities exposed by the $1.5 billion Bybit hack.
• Digital compliance. Because cryptoexchanges sit at a critical point through which transactions and assets move, compliance should extend beyond baseline know-your-customer rules to transaction- and business-level monitoring and implementation of FATF’s Travel Rule, thereby extending traceability across platforms rather than within a single venue.
• Institutional oversight. None of the above works if it is self-certified and unsupervised. I propose a cryptointermediary registry, not simply a database of registered entities, but an oversight mechanism for evaluating cryptoexchanges’ listing standards, audit requirements, and delisting procedures against publicly defined benchmarks. The aim is to make governance commitments verifiable rather than merely claims on a website.

This does not mean transforming cryptoexchanges into traditional securities exchanges. It means aligning their governance responsibilities with the market functions they already perform. The underlying principle is straightforward: Those who provide the infrastructure for a market should also bear responsibility for its integrity.

The broader lesson extends beyond cryptoassets. Financial markets depend not only on technological innovation but also on institutions capable of producing trust, accountability, and credible governance. DeFi has demonstrated that liquidity can be created without traditional market infrastructure. It has not yet demonstrated that markets can sustain investor confidence and integrity without institutions capable of governing them. The question for policymakers, therefore, is not simply how to register cryptoexchanges, but how to attach governance responsibilities to the market power they already exercise.

Vanessa Villanueva Collao is a Wagner Fellow at the Pollack Center for Law and Business at NYU School of Law. This post is based on her paper, “Cryptoexchanges as Imperfect Cryptogatekeepers in Decentralized Finance,” forthcoming in the American Business Law Journal and available here. The underlying research for the paper was supported by the Australian Government through the Australian Research Council (ARC Laureate Fellowship FL200100007).