# Trading app development company: licenses, data, testing

URL: https://fincodelabs.com/en/blog/trading-app-development · Publisher: Fincode (Fincode Yazılım ve Teknoloji A.Ş.), Istanbul, Turkey · Category: Fintech development · Published: 2026-11-06 · Updated: 2026-11-06

Hiring a trading app development company? Who must hold the license, how orders reach a licensed broker, data rights, tests to demand and red flags.

**Short answer:** A **trading app development company** builds the app, its backend and integrations, but it cannot supply the license: orders, client money and custody belong with a licensed firm (you or a partner) such as a broker, bank or crypto platform. Judge vendors on how they handle that partner's API and certification, market data rights, order and reconciliation tests and app store rules, and compare quotes against one written scope.

Pages selling stock trading app development solutions list features: charts, watchlists, identity checks, alerts. The budget and the launch date depend on other things: which licensed firm stands behind the orders, which market data the app may display, and how its records reconcile with that firm's records.

This checklist is for product and engineering leads choosing a trading app development service provider. Disclosure: Fincode sells this kind of work, so this guide is not neutral on that point. Official pages were read on 6 November 2026; this is not legal advice, and the rules depend on your jurisdiction.

## What a trading app development company builds, and what it cannot

A development company delivers software, while the regulated activities behind a trading app stay with a licensed firm whose type depends on what the app does.

**Trading app types and the licensed party behind them (general picture)**

| App type | What it does | Licensed party |
| --- | --- | --- |
| Market data or portfolio tracker | Shows prices and holdings users enter; sends no orders | None for trading; a data license governs what is displayed |
| Stock trading app | Sends orders to a broker | The broker, an investment firm (*yatırım kuruluşu*) in Turkish law |
| Crypto trading app | Orders and custody on a crypto platform | A crypto-asset service provider; in Turkey, with Capital Markets Board permission (Law No. 6362 Article 35/B) |
| Cash balance or payments | Holds or moves users' money | A bank, payment institution or e-money institution |
| Leveraged forex or CFD app | Margin trading in derivatives | A firm licensed under local derivatives rules |

App stores draw the same line. Apple's App Review Guidelines, read on 6 November 2026, say trading and investing apps should be "submitted by the financial institution performing such services" (3.2.1(viii)). Guideline 5.1.1(ix) asks the same of apps in highly regulated fields, crypto exchanges included, and 3.1.5(iii) allows crypto exchange transactions only where the app has the licensing to provide an exchange. An order-taking app is therefore usually published under the licensed firm's developer account.

## Do you need a broker license to launch a stock trading app?

If your company takes or transmits orders for other people, it usually needs an investment firm license; without one, you work through a licensed broker.

- **Turkey.** Receiving, transmitting and executing customers' orders are investment services under Article 37(1)(a) and (b) of Capital Markets Law No. 6362, reserved by Article 39(1) for investment firms permitted by the Capital Markets Board (SPK, also CMB). Unauthorized capital markets activity carries two to five years' imprisonment, and where leveraged trading abroad is offered to Turkish residents online, the SPK orders the content removed or access blocked (Law No. 6362 Articles 99(4) and 109(2)).
- **United States and United Kingdom.** The SEC's broker-dealer guide says most brokers and dealers must register with the SEC and join a self-regulatory organization such as FINRA. The FCA says nearly all UK financial service activities need its authorization or registration, and its Financial Services Register lists those firms (page updated 13 February 2026).
- **Money in Turkey.** Apart from the central bank, only banks, payment institutions, e-money institutions and PTT may provide payment services (Law No. 6493 Article 13). Payment and e-money institutions need permission from the Central Bank of the Republic of Türkiye (TCMB, also CBRT), and banks are licensed by the Banking Regulation and Supervision Agency (BDDK).

Check a partner on the register by legal name. On 6 November 2026, TCMB's register listed 20 payment institutions with the services each may provide, BDDK listed 67 banks, and the SPK's brokerage permit search filtered firms by permit type. The SPK said on 5 August 2024 that appearing on its list of operating crypto-asset service providers does not mean authorization. For readers in Turkey, Article 99/A of Capital Markets Law No. 6362 treats activity by foreign crypto-asset platforms directed at Turkish residents as unauthorized. The [guide to fintech licenses in Turkey](https://fincodelabs.com/en/blog/fintech-companies-in-turkey) shows how to read these registers.

## How orders reach the market through a licensed firm

An app that holds no money is a front end: it passes instructions to the licensed firm's systems, whose checks and records decide what happened.

**Three common set-ups**

| Set-up | Whose customer the user is | What the vendor builds | Settle first |
| --- | --- | --- | --- |
| Users connect their own broker accounts | The broker's | A third-party app on the broker's API | Whether passing users' orders on needs your own license; the broker's terms for third-party apps; token expiry and revocation |
| A licensed partner opens accounts for your users | The partner's; it runs identity checks, custody and execution | App, backend and partner integration | Onboarding, certification, branding, disclosures and data rights |
| You are the licensed firm | Yours | The app on your order system and back office | Your regulator's [outsourcing rules](https://fincodelabs.com/en/blog/outsource-software-development-compliance) |

On an exchange, the broker stays in the path. Borsa Istanbul's equity market procedure on algorithmic trading (revision 7, approved 28 March 2025) says a customer cannot send orders to the exchange without the member's systems, and members must tell the exchange in writing about any algorithmic order software they use: where it runs, who owns it, FIX or OUCH, and who tested it.

The engineering work sits at the broker's API: order states, rejects, partial fills and reconciliation, covered in [broker API integration with REST and FIX](https://fincodelabs.com/en/blog/broker-api-integration-fix-rest) and [order state machines](https://fincodelabs.com/en/blog/order-state-machine).

## Market data rights: what a trading app may display

Access to a price feed is not a right to show it in your app: the exchange's or vendor's license decides real-time or delayed display, per-user fees and labels.

- **Who signs:** your company, the broker partner or a data vendor. Ask in writing whether the partner's prices may appear in your branded app.
- **Use type:** display, non-display use by software and redistribution are licensed separately, as the guide to [stock market data APIs](https://fincodelabs.com/en/blog/stock-market-data-api) explains.
- **Per-user fees:** real-time fees often grow with users; the [fintech app development cost](https://fincodelabs.com/en/blog/fintech-app-development-cost) guide works through Borsa Istanbul's published distributor fees.
- **Labels and keys:** delayed prices say so, cached prices show their age, and vendor keys stay on the backend, never in the app.

> **Hypothetical screen and data map row.** Watchlist: last price and daily change from [licensed vendor], delayed by [the delay in your data agreement]; the screen states the delay and the time of the last update. One row per screen shows a missing license before design starts.

## Tests and reviews a trading app needs before launch

Ask for evidence of behavior on the partner's test environment, reconciliation against its records, a security review and an app store plan; a feature demo shows none of them.

**Acceptance tests for order flows**

| Test | Pass condition |
| --- | --- |
| Order request times out | Looks the order up by client order ID before any resend |
| Partial fill, then cancel | Position shows the filled quantity, whatever the cancel returned |
| Order rejected | User sees the broker's reason; no automatic retry |
| Session expires during order entry | No duplicate order after logging in again |
| Old app version, new backend | It works or asks the user to update |
| Partner certification | Passed under the partner's own process, with dated evidence |

For security, OWASP's mobile standard (MASVS) groups controls into eight areas, from storage to privacy (read 6 November 2026); budget an independent penetration test separately. Google Play's Financial Services policy, read the same day, requires a financial features declaration in Play Console for apps with financial features. Test environments also differ from live markets, as the guide to [paper trading APIs](https://fincodelabs.com/en/blog/paper-trading-api) shows.

### A reconciliation check you can run yourself

Ask for the app's order log and the broker's fill report from the partner's test environment. This script (synthetic data, Python 3.11) flags missing or reused IDs, malformed quantities, fills the app never sent and overfills.

```python
import math
import re
from decimal import Decimal

QTY = re.compile(r"[0-9]{1,12}(\.[0-9]{1,8})?")

def qty(value):
    text = str(value).strip()
    if not QTY.fullmatch(text) or Decimal(text) == 0:
        raise ValueError(f"bad quantity {repr(value)}")
    return Decimal(text)

def cid(row):
    v = row.get("client_order_id")
    if v is None or (isinstance(v, float) and math.isnan(v)):  # blank cell in pandas
        return ""
    return str(v).strip()

def reconcile(orders, fills):
    problems, sent, filled = [], {}, {}
    for n, o in enumerate(orders, 1):
        k = cid(o)
        if not k:
            problems.append(f"app row {n}: no client order ID")
        elif k in sent:
            problems.append(f"{k}: ID used twice")
        else:
            try:
                sent[k] = qty(o.get("qty"))
            except ValueError as e:
                sent[k] = None
                problems.append(f"{k}: {e}")
    for f in fills:
        k = cid(f)
        if k not in sent:
            problems.append(f"{k or '(no ID)'}: fill the app never sent")
            continue
        try:
            filled[k] = filled.get(k, Decimal(0)) + qty(f.get("qty"))
        except ValueError as e:
            problems.append(f"{k}: fill has {e}")
    for k, q in filled.items():
        if sent[k] is not None and q > sent[k]:
            problems.append(f"{k}: filled {q} of {sent[k]}")
    return problems

def rows(*pairs):
    return [{"client_order_id": i, "qty": q} for i, q in pairs]

app = rows(("A-1", "10"), ("A-2", "5"), ("A-2", "5"), ("", "3"), ("A-3", "1e400"))
fills = rows(("A-1", "6"), ("A-1", "4"), ("A-2", "7"), ("B-9", "2"), (None, "1"))
for p in reconcile(app, fills):
    print(p)
```

Output:

```
A-2: ID used twice
app row 4: no client order ID
A-3: bad quantity '1e400'
B-9: fill the app never sent
(no ID): fill the app never sent
A-2: filled 7 of 5
```

A clean run prints nothing; the guide to [client order IDs](https://fincodelabs.com/en/blog/client-order-id) explains why the ID matters.

## Trading app cost drivers, without invented prices

Cost follows the partner route, the data license and the evidence you require, so no single price for a trading app holds up.

**What moves effort for a trading app**

| Driver | Lower effort | Higher effort |
| --- | --- | --- |
| Partner route | Users connect their own accounts | Partner onboarding, certification and account opening |
| Instruments and orders | One market; market and limit orders | Several markets, options or margin, conditional orders |
| Data | Delayed prices from one source | Real-time depth with per-user entitlements |
| Records | Application logs | Audit trail and daily reconciliation with the partner |

Recurring data, partner, store and hosting fees come on top, as the cost guide above lists. Ask bidders for person-days per work package, with assumptions and exclusions written out.

## How to compare trading app development companies

Send every bidder the same written scope, then compare assumptions, exclusions and test evidence rather than feature lists.

1. Which licensed partner does the plan assume, and what may a third-party front end do under its agreement?
2. Who publishes the app, and who controls that developer account after delivery?
3. Where do partner credentials and data vendor keys live?
4. What happens to an order whose status is unknown?
5. Who pays when the partner's API changes after launch?
6. What is excluded: data fees, certification, penetration testing, store submission?

**Red flags**

| Red flag | Why it matters |
| --- | --- |
| A software vendor offering the license, brokerage or liquidity in the package | The license belongs to the firm doing the regulated activity; get its legal name and check the register |
| Copy trading, signals or stock picks as standard modules | Advice and portfolio management rules can apply |
| Binary options on the feature list | Google Play does not allow apps that let users trade them |
| Market data described as free for your commercial app | Free access is rarely a display license |
| Requests for production keys or users' credentials during development | Development runs on test environments |
| Promised returns or trading volume | A developer answers for software behavior, not markets |

One seller's stated limits, for comparison: Fincode's [fintech app development service](https://fincodelabs.com/en/services/fintech-app-development) covers data and analysis apps for iOS and web, and does not run a platform placing orders for other people, hold customer money or build signal, copy trading or advice features. Fincode's [project and product analysis](https://fincodelabs.com/en/services/project-and-product-analysis) covers feasibility, data and API requirements and development scope in a written report.

## Frequently asked questions

### How much does it cost to build a stock trading app?

It depends on the partner route, data license, markets and test evidence. Ask bidders for person-days per work package against one written scope, listing recurring data and partner fees separately.

### Can a trading app development company provide the brokerage license?

No. The license belongs to the firm that takes, transmits or executes orders or holds client money, so a vendor integrates such a partner or builds for one. Check the partner's legal name in its regulator's register.

### Can a trading app hold users' cash in Turkey?

Only through a licensed provider: Law No. 6493 Article 13 names banks, payment institutions, e-money institutions and PTT as payment service providers. Payment and e-money institutions need TCMB permission, and banks are licensed by BDDK.

### Who should publish a trading app on the App Store?

Usually the licensed firm. Apple's guideline 3.2.1(viii), read on 6 November 2026, says trading and investing apps should be submitted by the financial institution performing the services, with the licenses needed where the app is available.

## Sources

- [Turkish legislation database: Capital Markets Law No. 6362, consolidated text, Articles 35/B, 37, 39, 99(4), 99/A and 109(2) (Turkish)](https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6362.pdf)
- [TCMB: Law No. 6493 on payment and securities settlement systems, payment services and electronic money institutions, consolidated text, Articles 3, 13, 14 and 18 (Turkish)](https://www.tcmb.gov.tr/wps/wcm/connect/e43f22de-0731-4dd7-bb43-5c843e981221/6493+Say%C4%B1l%C4%B1+Kanun.pdf?MOD=AJPERES)
- [TCMB: Payment institutions register with permitted services, read 6 November 2026 (Turkish)](https://www.tcmb.gov.tr/wps/wcm/connect/TR/TCMB+TR/Main+Menu/Temel+Faaliyetler/Odeme+Hizmetleri/Odeme+Kuruluslari)
- [BDDK: List of banks, 67 authorized institutions, read 6 November 2026 (Turkish)](https://www.bddk.org.tr/Kurulus/Liste/77)
- [SPK (Capital Markets Board): Brokerage firm activity permits search, filters by firm, status and permit type, read 6 November 2026 (Turkish)](https://spk.gov.tr/faaliyet-izinleri/araci-kurumlar)
- [SPK: Announcement on crypto-asset service providers, 5 August 2024 (Turkish)](https://spk.gov.tr/duyurular/basin-duyurulari/2024/kripto-varlik-hizmet-saglayicilara-iliskin-duyuru_05082024)
- [Borsa Istanbul: Procedure on algorithmic trading and BISTECH PTRM pre-trade risk management in the Equity Market, revision 7, approved 28 March 2025 (Turkish)](https://www.borsaistanbul.com/files/pay-piyasasinda-algoritmik-islemler-ve-bistech-ptrm-islem-oncesi-risk-yonetimi-proseduru.pdf)
- [Apple: App Review Guidelines (last updated 16 October 2026), 3.1.5(iii), 3.2.1(viii) and 5.1.1(ix), read 6 November 2026](https://developer.apple.com/app-store/review/guidelines/)
- [Google Play Console Help: Financial Services policy, read 6 November 2026](https://support.google.com/googleplay/android-developer/answer/9876821)
- [SEC: Guide to Broker-Dealer Registration (April 2008), read 6 November 2026](https://www.sec.gov/about/reports-publications/divisionsmarketregbdguidehtm)
- [FCA: Financial Services Register, page last updated 13 February 2026](https://www.fca.org.uk/firms/financial-services-register)
- [OWASP MAS: Mobile Application Security Verification Standard (MASVS), control groups](https://mas.owasp.org/MASVS/)

> This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the [editorial policy](https://fincodelabs.com/en/editorial-policy).

---

Published by Fincode (Fincode Yazılım ve Teknoloji A.Ş.), a software company in Istanbul, Turkey: https://fincodelabs.com/en/blog/trading-app-development

Cite as: Fincode, "Trading app development company: licenses, data, testing", updated November 6, 2026, https://fincodelabs.com/en/blog/trading-app-development