# Crypto bot development company: how to evaluate a vendor

URL: https://fincodelabs.com/en/blog/crypto-bot-development-company · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Trading bots · Published: 2026-11-05 · Updated: 2026-11-05

How to evaluate a crypto bot development company: evidence to ask for, hosted or client-run deployment, contract terms, exchange API terms and bots to decline.

**Short answer:** To evaluate a **crypto bot development company**, ask for evidence you can check: a sample test report, a scope document and a look at its repository practice, not profit screenshots or badges. Then settle who hosts the software, who holds the keys and the code, and whether your exchange's API terms and your country's rules allow your model. No vendor can promise trading results, and automated trading can lose money.

Vendor pages in this market read alike: long lists of exchanges, strategy names and security claims, with no way to check them. The useful question is what each vendor can show you, and what your contract, your exchange's terms and your local rules allow.

This guide is for buyers assessing a company rather than one person; for an individual hire, see [crypto trading bot developer](https://fincodelabs.com/en/blog/crypto-trading-bot-developer). It names no vendors and ranks none. Disclosure: Fincode sells this kind of work, so this guide is not neutral on that point. Fincode builds from rules the customer wrote and does not supply strategies. Legal points are general information, not legal advice, and the documents cited were read on 4 November 2026.

## How to evaluate a crypto bot development company

Replace each marketing claim with a document or a test you can check yourself.

**From claim to evidence**

| Claim on the page | What to ask for | A good answer |
| --- | --- | --- |
| Profit figures or screenshots | Nothing: treat them as a warning sign | The vendor says it answers for software behavior, not results |
| Security badges or general security claims | The written key-handling procedure | Production keys stay with you, and access is named and limited |
| A long list of supported exchanges | Which venues were tested, in which environment and when | A dated test report per venue, with known gaps stated |
| Counts of clients or projects | A redacted sample deliverable and a reference you can contact | Documents that show failures as well as passes |
| AI-powered trading | What the model decides, what limits it and how it was tested | A plain description of the rule and its controls |
| Around-the-clock support | Hours, response times and exclusions in writing | A written service level that excludes trading decisions |

The same test applies whether a vendor says crypto bot development, cryptocurrency trading bot development or crypto algo trading software development.

## Evidence to ask for before you sign

Three documents show how a vendor works: a sample test report, a scope document and evidence of its repository practice.

### Sample test report

It should list each case, the environment, the date, the result and a log excerpt, including cases that failed and how they were fixed. The cases should cover restarts, partial fills, timeouts and limit breaches, the failure modes described in [trading bot development](https://fincodelabs.com/en/blog/trading-bot-development).

### Scope document

It names the venues, instruments and order types, lists exclusions and assumptions, and explains how a change is priced. Two vendors quoting different scopes are not comparable.

### Repository practice

Ask for a screen share of a sanitized project or a public sample. Look for version history with reviewed changes, automated tests on every change, pinned dependencies, tagged releases that can be rolled back and no secrets in the code. If you are replacing a vendor and already hold its code, a [code review, which Fincode also sells](https://fincodelabs.com/en/services/trading-bot-code-review), checks the same points in what you received.

### What does not count

Profit screenshots, badges, award lists and testimonials you cannot trace prove little. The CFTC's customer advisory of 25 January 2024 describes a commodity pool whose operator stole more than $1.7 billion in bitcoin from at least 23,000 people and created fake balances with demo accounts. Check instead who the people are, how old the website is, the legal entity and its registration.

## Hosted software or client-run deployment?

Client-run deployment keeps keys and servers with you, while vendor hosting trades that control for convenience and can change the legal position.

**Two deployment models compared**

| Question | Client-run | Vendor-hosted |
| --- | --- | --- |
| Where API keys live | Your server or cloud account | The vendor's systems |
| Reach of a breach | Your own account | Possibly every customer's keys |
| Who patches and watches the servers | You, or a maintenance contract | The vendor |
| If the vendor closes | The software keeps running and you hold the code | The service may stop |
| Exchange terms | Usually own-account use | A multi-customer service may need the platform's approval |
| Regulation | Closer to plain software | Can look like handling orders for clients in some jurisdictions |

Client-run has real costs: someone must patch the server, read the alerts and rotate keys. If you choose hosting, ask for keys limited to read and trade with no withdrawal right, storage separated per customer and a written breach procedure. Kraken's API key guide, read 4 November 2026, advises minimum permissions and separate keys per purpose. See also [API key security for trading bots](https://fincodelabs.com/en/blog/api-key-security-trading-bots).

## Fixed scope or time and materials, and who holds the code

Choose the model by how stable your rules are, then make ownership, keys and API changes explicit whichever model you pick.

The general trade-offs are in [trading bot cost](https://fincodelabs.com/en/blog/trading-bot-cost). With a company, check these clauses as well:

- **Fixed scope:** what counts as a change, who pays when an exchange changes its API mid-project and whether testing time is protected.
- **Time and materials:** a budget cap, regular reports and the right to stop at any milestone and keep the code.
- **Payment:** tied to acceptance tests of software behavior, never to volume or trading results.
- **Code:** who owns it after final payment and where the repository lives.
- **People:** who writes the code, whether subcontractors are used and what happens if that person leaves.
- **Exit:** confidentiality for your rules, deletion of your data and a handover plan.

### Published price ranges are vendor claims

No independent survey of these prices was found, so treat published figures as what sellers advertise rather than as a benchmark. Two vendor marketing pages read on 4 November 2026 run from $3,000 to $5,000 for one strategy on one platform up to $60,000 to $150,000+ for a multi-strategy platform, and one of them calls its figures planning estimates. They are not quotes, and they overlap because the scopes do. The full table, its sources and subscription alternatives are in [crypto trading bot price](https://fincodelabs.com/en/blog/crypto-trading-bot-pricing).

## Exchange terms can block a business model

Read the platform's API agreement before paying for a build, because a contract can forbid a model that no law forbids.

> **Example, read on 4 November 2026.** Section 9.3 of the OKX TR API agreement (in Turkish, published 26 March 2026) restricts what users may do without OKX TR's written permission. The table paraphrases it. This is one platform's text, not a comment on that platform; other agreements differ and can change.

**Models under Section 9.3 of the OKX TR API agreement**

| Your model | What the section says |
| --- | --- |
| Bot trading your own account | Not a commercial sale, even if profitable |
| API services inside a commercial product or software-as-a-service platform | Written authorization first |
| Brokerage, signal service, strategy marketplace or managed trading service | Written authorization first |
| Running accounts or placing orders for third parties | Prior written approval |

Ask the vendor which clauses it read for your venues, and get any approval in writing before development starts. If your plan is to serve customers, a clause like this can decide the project.

## Rules for EU and Turkish buyers

The rules depend on what the software does and for whom, so take legal advice before any model that touches other people's accounts or orders.

**European Union.** Regulation (EU) 2023/1114 (MiCA), Article 3(1)(16), lists crypto-asset services including execution of orders on behalf of clients, reception and transmission of orders, advice and portfolio management, and Article 59 says they may not be provided in the Union without authorization. Article 61 lets a non-EU firm rely on a client's own exclusive initiative only if it does not solicit clients in the Union by any means. Whether a given product falls under these articles is a case-by-case question, and bespoke software for your own account is a different situation from a service offered to many clients.

**Turkey.** Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. The Capital Markets Board's announcement of 5 August 2024 says that appearing on its list of operating platforms does not mean authorization.

**Elsewhere.** Rules depend on your jurisdiction and the platform's terms, and a careful vendor sends you to a lawyer rather than reassuring you.

## Which bots a careful vendor declines

A careful vendor declines sniper, sandwich, MEV, wash-trading and volume bots, and says so before you ask.

- **Wash-trading and volume bots** manufacture false activity. On 9 October 2024 the SEC charged firms that presented themselves as market makers, along with crypto promoters, alleging wash trading and bots that at times generated billions of dollars of artificial volume a day. MiCA Article 91 prohibits orders that give false or misleading signals about supply, demand or price.
- **Sandwich and other front-running MEV bots** trade around other users' pending transactions. Ethereum's documentation says sandwiched users face increased slippage and worse execution.
- **Sniper bots** race to buy newly launched tokens ahead of other buyers.
- **Signal, copy trading, managed account and profit-share products** go beyond software and in many places need a license a development company does not hold.

Ask each vendor what it has refused and why. A vendor with these on its menu has told you how it treats rules, which is relevant to how it will treat yours.

## Questions for a crypto algo trading software development company

Put the same questions to every vendor in writing, because written answers can be compared and later enforced.

1. Who writes the code, and who reviews it?
2. Which test environment exists for each of our venues, and what can it not show?
3. Where do keys live during development and after go-live?
4. Which API terms did you read for our model, and what did they say?
5. Who maintains the software when an exchange changes its API, and at what cost?
6. What do we receive at each milestone, and can we leave with it?
7. What have you declined to build?

To see how one seller states its terms, read Fincode's [how we work](https://fincodelabs.com/en/how-we-work) and [security](https://fincodelabs.com/en/security) pages and apply the same questions. Whoever builds it, the software only executes rules, and trades can lose money.

## Frequently asked questions

### How much does crypto bot development cost?

It depends on scope. Published ranges read in November 2026 run from a few thousand dollars to over $150,000, but they are vendor marketing rather than a survey, so compare quotes only on the same written scope.

### Is a company safer than a freelancer?

Not automatically. A company can offer continuity and a contract counterparty, but the same evidence applies: test reports, scope documents, repository practice and key handling.

### Should a vendor host my crypto bot?

Only if you accept that its systems hold your keys and that the service may stop if the vendor does. Client-run deployment keeps both with you, at the cost of running the server yourself.

### Can I resell a bot built on an exchange API?

Read the API agreement first. Some, such as OKX TR's, require written authorization for commercial products, SaaS and orders for third parties, while trading your own account is not a sale.

### Can a development company promise profits?

No. It can answer for implementing and testing your rules correctly, not for market results. Treat any promise of returns as a reason to walk away.

### Do I need a license to sell crypto trading software?

It depends on what the software does and where you sell it. Plain software and a service that handles clients' orders are treated differently in many places, so ask a lawyer in your jurisdiction.

## Sources

- [CFTC Release 8854-24 (25 January 2024): Customer Advisory: AI Won't Turn Trading Bots into Money Machines](https://www.cftc.gov/PressRoom/PressReleases/8854-24)
- [SEC press release 2024-166 (9 October 2024): charges on wash trading and crypto market manipulation](https://www.sec.gov/newsroom/press-releases/2024-166)
- [OKX TR API agreement, Section 9.3 (Turkish, published 26 March 2026)](https://web3.okx.com/tr/help/okx-api-agreement)
- [Regulation (EU) 2023/1114 (MiCA): Articles 3, 59, 61 and 91](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R1114)
- [Capital Markets Law No. 6362, consolidated text, Article 99/A (Turkish)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf)
- [SPK (Capital Markets Board): Announcement on crypto-asset service providers, 5 August 2024 (Turkish)](https://spk.gov.tr/duyurular/basin-duyurulari/2024/kripto-varlik-hizmet-saglayicilara-iliskin-duyuru_05082024)
- [Kraken: API key permissions (minimum permissions, separate keys)](https://docs.kraken.com/exchange/guides/rest/api-keys)
- [Ethereum.org documentation: Maximal extractable value (sandwich trading)](https://ethereum.org/developers/docs/mev/)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/crypto-bot-development-company

Cite as: Fincode, "Crypto bot development company: how to evaluate a vendor", updated November 5, 2026, https://fincodelabs.com/en/blog/crypto-bot-development-company