# Custom trading software: when to build and what to ask

URL: https://fincodelabs.com/en/blog/custom-trading-software · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Trading bots · Published: 2026-11-06 · Updated: 2026-11-06

Custom trading software: build, buy or extend open source, which scopes need a license, what stays with you when you outsource and what to ask a vendor.

**Short answer:** **Custom trading software** makes sense when your rules, venues or controls do not fit existing products and you can say who will own, run and answer for the result. Make three decisions before asking for a quote: internal tool or client-facing platform; buy, extend open source or build; and who regulates you once other people's money is involved. A small vendor can build rule-based software, broker connectivity, order management and reporting; a full retail platform needs a large firm and a license. No vendor can promise trading results, and trades can lose money.

The word custom hides a range from one rule set on one account to a public brokerage. Those are different purchases, with different vendors and different legal exposure, so settle the scope before comparing vendors.

This guide names no development vendors and ranks none; for crypto-specific vendor evidence, see the [guide to evaluating a crypto bot development company](https://fincodelabs.com/en/blog/crypto-bot-development-company). Disclosure: Fincode sells this kind of work, so this guide is not neutral on that point. Fincode builds from rules the customer wrote, does not supply strategies and does not build licensed public platforms.

## Custom trading software: three decisions before any quote

Three answers decide the scope, the vendor you need and whether lawyers come before developers.

**The three decisions and what each one changes**

| Decision | Options | What the answer changes |
| --- | --- | --- |
| Who uses it? | Internal tool for your own account or desk, or a platform for clients | Client-facing adds accounts, permissions, support, platform API terms and often authorization |
| Where does the code come from? | Buy, extend open source or build | Who carries maintenance, and which license terms bind you |
| Whose money and orders? | Your own, or other people's | Whether a regulator's rules reach your software and your vendor |

> **Hypothetical scoping.** An asset manager wants rule-based orders on listed stocks through its broker, with end-of-day reports. That is an internal tool, but the orders carry clients' money, so the third decision matters before anyone quotes. Its checks: the broker's onboarding and tests, a non-display data license for the rule engine, and the firm rules below, which keep responsibility with the manager and not with the vendor. Offering the same tool to outside clients later would be a new scope and a new legal question.

Many custom algo trading projects are simpler: one desk or account, with rules the owner wrote. The rest of this guide shows what changes when they are not.

## Custom trading platform development: what each scope takes

Four of the five common scopes fit a small vendor; a public retail platform does not, because most of its weight is licensing, custody and supervision rather than code.

**Five scopes, who can usually build them and what triggers a check (this guide's reading of the texts cited below)**

| Scope | What it includes | Who can build it | Check first |
| --- | --- | --- | --- |
| Rule-based software for your own account | Your written rules, risk layer, order handling, logs | One developer or a small vendor | Platform terms and local rules; firm duties if you are regulated |
| Broker or exchange connectivity | REST, WebSocket or FIX adapters, test runs, certification | A small vendor, with the broker's onboarding | The broker's contract and conformance tests; see [broker API integration](https://fincodelabs.com/en/blog/broker-api-integration-fix-rest) |
| Order management for one desk | Order store, limits, state tracking, reconciliation, audit log | A small vendor | Handling other people's orders is a different service; see [order management systems](https://fincodelabs.com/en/blog/crypto-order-management-system) |
| Reporting and analytics | Read-only positions, fills, costs, dashboards | A small vendor | Market data license for display and redistribution |
| Full retail platform | Accounts, identity checks, custody, matching or routing, surveillance, support | A large firm, for an operator that holds the license | Authorization, capital and staffing before any code |

Capital rules show the gap. For a crypto-asset platform in Turkey, the 2026 minimum founding capital is TRY 250,000,000 (Capital Markets Board, SPK, Bulletin 2025/68, Decision 68/2461), before any software is paid for. What moves effort inside the smaller scopes is covered in [trading bot cost](https://fincodelabs.com/en/blog/trading-bot-cost) and [fintech app development cost](https://fincodelabs.com/en/blog/fintech-app-development-cost); no independent survey of prices was found, so this guide gives none.

## Buy, extend open source or build?

Buy when a product already models your rules, extend open source when both its engine and its license fit your plan, and build only what neither covers.

- **Buy.** Your data and keys may sit with the seller, and the seller's roadmap becomes yours. Rights by form of sale are compared in [trading bot for sale](https://fincodelabs.com/en/blog/trading-bot-for-sale).
- **Extend.** You inherit an engine and a duty to keep up with its upgrades, plus its license.
- **Build.** You get order types, venues and controls that nothing else offers, and every API change becomes your cost.

**Licenses on project repositories read 5 November 2026; examples only, not recommendations, in alphabetical order**

| License | Examples | What to check |
| --- | --- | --- |
| Apache-2.0 | [Hummingbot](https://github.com/hummingbot/hummingbot), [LEAN](https://github.com/QuantConnect/Lean) | Permissive: keep the license and notices |
| Apache 2.0 with Commons Clause | [vectorbt](https://github.com/polakowo/vectorbt/blob/master/LICENSE.md) | No right to sell a product or service whose value derives substantially from it, hosting and support fees included |
| GPL-3.0 | [backtrader](https://github.com/mementum/backtrader), [Freqtrade](https://github.com/freqtrade/freqtrade) | You can keep a private modified copy without publishing it. Anyone who receives a copy gets the whole work under GPL-3.0, so it cannot be resold as closed code |
| LGPL-3.0 | [NautilusTrader](https://github.com/nautechsystems/nautilus_trader) | Lighter copyleft: section 4 lets you combine it with your own code on terms you choose, if you keep its notices and users can modify and relink the library part |
| MIT | [CCXT](https://github.com/ccxt/ccxt) | Permissive: keep the notice |

Have the license checked before you commit, especially if the result goes to clients; repository status and other checks are in [open source crypto trading bots](https://fincodelabs.com/en/blog/open-source-crypto-trading-bot). GPL-3.0 itself says that interaction over a network with no transfer of a copy is not conveying, which is one more reason to ask how your product reaches users.

## Who regulates you once other people's money is involved?

Outsourcing moves the coding, not the duty: regulated firms stay responsible for software someone else wrote, and serving clients can itself need authorization.

**What selected texts say, read 5 November 2026. General information, not legal advice**

| Text | Binds | What it says |
| --- | --- | --- |
| EU: RTS 6 Article 4 (as adopted) | Investment firms in algorithmic trading | The firm stays fully responsible when it outsources or procures software, and must hold enough knowledge and documentation to comply |
| UK: FCA review, February 2018 | Firms in the review's scope | IT outsourcing leaves regulatory duties with the firm; firms should keep an inventory of algorithms with owners, testing and controls |
| US: FINRA Notice 16-21, effective 30 January 2017 | FINRA members, for equity, preferred and convertible debt strategies | Whoever directs a third party's custom build must be registered as a Securities Trader (new registrants pass the SIE and Series 57; the rule now sits in [FINRA Rule 1220(b)(4)](https://www.finra.org/rules-guidance/rulebooks/finra-rules/1220)), and the firm stays responsible for the algorithm |
| US: SEC Rule 15c3-5 | Brokers and dealers with market access | Financial and regulatory risk controls sit under their direct and exclusive control, with a limited allocation exception |
| EU: MiFID II Article 5 | Investment services as a regular business | Prior authorization |
| EU: MiCA Articles 3(1)(16) and 59 | Crypto-asset services in the Union | Operating a trading platform, handling client orders, advice and portfolio management need authorization |
| Turkey: Law No. 6362 Articles 37 and 39 | Investment services | Board permission is required, and only investment firms may provide them |

US broker-dealers also need registration under Exchange Act [Section 15(a)](https://www.law.cornell.edu/uscode/text/15/78o). None of these texts bars a regulated firm from hiring a small vendor; they decide who answers for the result. A private person trading their own account is not the addressee of the firm rules above, though market abuse rules still apply, and rules depend on your jurisdiction. For readers in Turkey, Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. If clients will use the software, take legal advice before scoping it.

## What to ask a trading software development company

Ask for the records a regulated firm would need, because they show how a vendor works even when the rules do not bind you. The questions are the same for a stock trading software development company or any other trading software development service provider.

**A buyer's template built from FINRA Regulatory Notice 15-09 (26 March 2015)**

| Practice the Notice describes | Ask the vendor for |
| --- | --- |
| Change process with test review and approvals | Three recent change records, with who approved each |
| Code versions archived and retrievable | Tagged releases, and a demonstration of restoring an old one |
| Summary a non-programmer can read | A plain description of what the software does |
| Quick disable with a minimal number of steps | A live stop, counting the steps |
| Testing independent of code development | Who tests, and who they answer to |
| Test environment segregated from production | The environment list, and what each cannot show |
| Records of tests and defect fixes | A sample report that includes a failure and its fix |
| Pilot of limited size, raised as results are confirmed | A rollout plan with limits you set |
| Monitors, alerts and reconciliation | The alert list and a reconciliation run |
| Limits on code access | Who can reach the code and production, and how that is logged |

The Notice addresses FINRA member firms and calls its list non-exhaustive; here it is only a template. A vendor that can produce these records also helps a regulated buyer hold the documentation RTS 6 Article 4 expects. To see how one seller writes scope, read [how Fincode works](https://fincodelabs.com/en/how-we-work) and the [algorithmic trading](https://fincodelabs.com/en/services/algorithmic-trading) and [exchange API integration](https://fincodelabs.com/en/services/exchange-api-integration) pages, and hold them to this table too; naming an exchange or data source in this guide does not mean Fincode integrates it or has built on it.

## Custom software for the stock market: data and API terms

Read the data and API terms before paying for a build, because a contract can forbid what the software is meant to do.

- **Exchange data.** Nasdaq's US policy treats machine use as non-display usage, and Borsa Istanbul's FAQ lists automated and algorithmic trading systems among non-display uses that need a direct agreement. See [stock market data API](https://fincodelabs.com/en/blog/stock-market-data-api) and [Borsa Istanbul API](https://fincodelabs.com/en/blog/borsa-istanbul-api-market-data).
- **Free datasets.** Binance's Vision Dataset Terms, updated 26 August 2026, bar use in commercial trading bot platforms and other commercial financial products.
- **API agreements.** Sections 9.3 and 9.4 of the OKX TR API agreement, read 5 November 2026, require written approval to offer the API inside a commercial product, to trade for third parties or to redistribute market data, and allow market data only for personal, non-commercial trading and account management.
- **Brokers.** API access and account types vary by broker and country, so read the broker's terms first.

## How to compare quotes, and the red flags

Compare quotes only against one written scope, and treat a promise about returns or licenses as a reason to stop.

1. Send every vendor the same scope: venues, instruments, order types, data sources, limits, reports, who uses the software and what is excluded. Ask for effort by work package.
2. Ask who pays for API changes, data fees, broker certification and maintenance.
3. Ask which deliverable a low quote leaves out.

**Red flags and why they matter**

| Red flag | Why it matters |
| --- | --- |
| Promised returns, or backtests offered as proof | A vendor answers for software behavior; the [CFTC's 25 January 2024 advisory](https://www.cftc.gov/PressRoom/PressReleases/8854-24) treats high promised returns as a fraud warning |
| A retail platform with the license included | Authorization belongs to the operator; buying software does not transfer it |
| Uptime or latency figures with no method | Ask how, when and from where they were measured |
| Requests for withdrawal rights or your funds | Trading software needs read and trade permission only |
| No test records, or only clean runs | The failures are what you are paying to have handled |
| A top-10 list published by the vendor itself | It is advertising; check documents instead |

## Frequently asked questions

### How much does custom trading software cost?

It depends on scope, venues, data licenses, certification and maintenance. No independent survey was found and published figures are seller claims, so compare quotes against one written scope.

### Can a small company build a custom trading platform?

For internal use, often yes. A public retail platform also needs a licensed operator, custody and supervision, which a small software vendor cannot supply.

### Do I need a license to build trading software?

Writing software is usually not the licensed part; operating it for clients can be. The answer depends on your jurisdiction and what the software does, so take legal advice for anything that touches other people's accounts or orders.

### Can a vendor sell me a modified open-source bot as my own?

Only as far as the license allows. Under GPL-3.0 you can keep a private modified copy, but anyone who receives a copy gets the whole work under GPL-3.0, so it cannot be resold as closed code.

### Who is responsible if vendor-built software misbehaves?

For regulated firms, the texts above keep responsibility with the firm. A contract can allocate costs between the parties, but it does not move those duties.

## Sources

- [FINRA Regulatory Notice 15-09: Guidance on Effective Supervision and Control Practices for Algorithmic Trading (26 March 2015)](https://www.finra.org/rules-guidance/notices/15-09)
- [FINRA Regulatory Notice 16-21: Qualification and Registration of Associated Persons Relating to Algorithmic Trading](https://www.finra.org/rules-guidance/notices/16-21)
- [Commission Delegated Regulation (EU) 2017/589 (RTS 6), Article 4, as adopted](https://www.legislation.gov.uk/eur/2017/589/article/4/adopted)
- [FCA: Algorithmic Trading Compliance in Wholesale Markets (February 2018)](https://www.fca.org.uk/publication/multi-firm-reviews/algorithmic-trading-compliance-wholesale-markets.pdf)
- [17 CFR 240.15c3-5: Risk management controls for brokers or dealers with market access (Cornell LII)](https://www.law.cornell.edu/cfr/text/17/240.15c3-5)
- [ESMA interactive single rulebook: MiFID II Article 5, requirement for authorisation](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mifid-ii/article-5-requirement-authorisation)
- [ESMA interactive single rulebook: MiCA Article 3, definitions](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-3-definitions)
- [ESMA interactive single rulebook: MiCA Article 59, authorisation](https://www.esma.europa.eu/publications-and-data/interactive-single-rulebook/mica/article-59-authorisation)
- [Capital Markets Law No. 6362, consolidated text, Articles 37, 39 and 99/A (Turkish)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf)
- [SPK Bulletin 2025/68, 31 December 2025: amounts for 2026 (Turkish)](https://spk.gov.tr/data/695546ca8f95db281807a9c3/2025-68.pdf)
- [Binance Vision Dataset Terms, updated 26 August 2026](https://github.com/binance/binance-public-data/blob/master/TERMS_AND_CONDITIONS.md)
- [OKX TR API agreement, Sections 9.3 and 9.4 (Turkish)](https://web3.okx.com/tr/help/okx-api-agreement)
- [Nasdaq: US Equities and Options Data Policies (non-display usage)](https://www.nasdaqtrader.com/content/AdministrationSupport/Policy/USEquitiesandOptionsDataPolicies.pdf)
- [Borsa Istanbul: FAQ on data distribution and index licensing, non-display use (Turkish)](https://borsaistanbul.com/sss/veri-dagitim-ve-endeks-lisanslama)
- [GNU General Public License v3.0, text as published in the Freqtrade repository](https://github.com/freqtrade/freqtrade/blob/develop/LICENSE)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/custom-trading-software

Cite as: Fincode, "Custom trading software: when to build and what to ask", updated November 6, 2026, https://fincodelabs.com/en/blog/custom-trading-software