CEX Listing Requirements: What the Security Review Checks

Video transcript

A listing application is also a security review. Reviewers want to know who controls your token, and whether your audit matches the deployed code.

Exchanges publish their process. Coinbase's guide routes applications through technical security review, CryptoSlate reports, and Kraken asks for security audit links.

Regulators are writing it into rules. The UK's listing rules apply from October 25, 2027, New York requires a per-coin risk assessment, and California requires a signed certification.

Start with admin powers. Expect questions on upgrades, pause, minting, freezing, forced transfers and fee changes, and on the multisig and timelock behind each.

An audit covers one commit. Listing teams want deployed code matched on every chain, every High and Critical fixed and reviewed, and the report on the auditor's own site.

Then the supply story. Label team and investor wallets, and document every chain and bridge. An exchange that lists a bridged copy trusts the setup behind it.

To prepare, publish verified source, write an admin powers table, move roles off single keys, map addresses to audited commits, and freeze the version you submit.

Guardian audits pair a manual team with Helix, our AI auditor, and only human-verified findings reach the report. Public reports sit on Guardian's portfolio for listing teams to check.

Read the full article for the complete checklist, or talk to Guardian before you apply.

A listing application is also a security review.

Coinbase's listing guide sends each application through legal, compliance and technical security teams, CryptoSlate reported in September 2025.

Regulators in New York, the UK, the DIFC and California have written a version of that review into listing rules and guidance. Here is what gets checked, and how to prepare.

How Listing Reviews Work

Exchanges publish their process, not their pass marks.

Coinbase's security check reviews "the contract code, design, and operational risks," per CryptoSlate's report on its guide. New blockchains also get a look at consensus, network resilience and governance.

Kraken's listings page says its Listings and Risk teams "assess security, regulatory posture, liquidity potential and market fit." The page also says:

• Applications include the contract address and "security audit links."
• No single factor is decisive, and concise, verifiable data speeds the review.
• Pre-TGE tokens can apply, but approval "is contingent on the final contract matching the version reviewed."
• Kraken never charges a listing fee and has no paid fast-track.

What Regulators Require

For these regulators, a security assessment is part of listing.

NYDFS says licensees must assess each coin's risks. The cybersecurity part covers "the confidentiality, integrity, and availability of all systems relating to each coin".

Under the FCA's rules, a retail UK platform's admission criteria must take into account "any known risks associated with the underlying technology", smart contracts included.

The FCA also expects the token's disclosure document to cover audits, and any vulnerability "to hacks or other disruption" (CRYPTO 3.3.10G).

California's form has an officer certify a risk assessment covering "risks related to code or protocol defects."

More detail: the FCA admission rules, the DFSA suitability test and California's certification.

Contract and Admin Powers

Start with privileged functions. For each chain, be ready to show:

• Upgrades: the proxy admin, its holder, threshold and timelock.
• Pause: who can pause transfers, and who can unpause.
• Mint: minter roles, caps, and who can add a minter.
• Freeze or blacklist: who can block an address, and under what process.
• Forced transfers or burns: any function that moves another holder's balance.
• Fees and limits: transfer taxes, trading restrictions and who can change them.

Then the keys behind them. Under CRYPTO 3.2.5R, UK admission criteria weigh "the resilience, technical functionality and credibility of the governance and operational arrangements".

Say which roles sit on a multisig, its threshold, how signers hold keys, and what can bypass the timelock.

If you renounced ownership, show it onchain for every proxy, on every chain.

Audit Evidence

An audit report covers one commit. A listing team needs to know it covers what is deployed.

• Commit match: deployed bytecode matches the audited commit on every chain.
• Scope: token, proxy, admin and bridge contracts were all in scope.
• Findings: every High and Critical fixed, with a fix review confirming it.
• Changes since: upgrades after the report, and who reviewed them.
• Provenance: the report sits on the auditor's own site, not only yours.

Our guide on how to check if a contract is really audited walks through these checks.

Supply, Distribution and Bridges

NYDFS licensees must assess "a concentration of coin holdings or control by a small number of individuals or entities."

The FCA expects disclosure of ownership concentration, and of options or lock-ups for existing owners.

Have a clean supply story:

• Total, circulating and maximum supply, reconciled to onchain balances.
• Team, treasury and investor wallets labeled, with vesting contracts linked.
• Every chain the token lives on, and which one is canonical.
• The bridge or messaging setup for each copy, and who can change it.
• Whether admin roles match across chains.

An exchange that lists a bridged copy trusts the setup behind it. Document how changes to that setup are reviewed.

Listing Prep Checklist

1. Publish verified source for every deployed contract, on every chain.
2. Write a one-page admin powers table: role, holder, threshold, timelock.
3. Move mint, upgrade and pause roles off single keys.
4. Get the report onto the auditor's site, with a fix review.
5. Map each deployed address to its audited commit.
6. Have every change since the report reviewed.
7. Label team, treasury and investor wallets; link vesting contracts.
8. Document every chain, bridge and cross-chain setting.
9. Name a security contact and a private channel for bug reports.
10. Freeze the version you submit, or tell the exchange before it changes.

For launch day itself, use our token launch security checklist.

How Guardian Helps

Guardian's smart contract audit runs three passes: design review, an invariant suite, then senior researchers attacking what is left.

Two independent teams cover the same scope, one manual and one running Helix, Guardian's AI auditor. Only human-verified findings reach the report.

An OpSec audit maps who can upgrade, pause, mint, set parameters or move funds, and how the keys behind each role are held.

Guardian publishes its public reports on its own portfolio, where a listing team can check them.

After listing, Managed Security reviews every deployment and configuration change as it lands.

Frequently Asked Questions

Do exchanges require a smart contract audit to list a token?

Kraken asks applicants for security audit links, and CryptoSlate reports that Coinbase's guide describes a security review of contract code. Kraken says concise, verifiable data speeds the review, so make sure the audit matches the deployed code.

What admin powers worry listing reviewers?

Any power that lets one party change what holders own: upgrades, pauses, minting, freezing, forced transfers and fee changes. Expect questions on who holds each role, behind what threshold and timelock, on every chain.

Can a token apply for listing before its TGE?

Kraken accepts applications before a token generation event. Approval is contingent on the final contract matching the version reviewed and meeting launch-ready security and liquidity standards. Freeze the version you submit, or tell the exchange about changes.

Do regulators set listing security rules?

Some do. NYDFS requires a per-coin risk assessment including cybersecurity. California requires a signed certification covering code or protocol defects. The UK's rules apply from October 25, 2027, and the DIFC requires each firm to assess suitability first.

Sources

• CryptoSlate: Coinbase publishes guide to crypto asset listing process to bolster transparency (September 15, 2025)
• Kraken: Get listed on Kraken (read November 6, 2026)
• NYDFS: Industry Letter, Guidance Regarding Listing of Virtual Currencies (November 15, 2023)
• FCA: PS26/9 Admissions and Disclosures and Market Abuse Regime for Cryptoassets, with made rules FCA 2026/37 (PDF, June 2026)
• DFSA Rulebook: GEN 3A.2.1, Only Suitable Crypto Tokens to be used in the DIFC (read November 6, 2026)
• DFPI: Covered Exchange Certification, form DFPI-DFAL CCR 1250 (New 03-26)
• Guardian: Smart Contract Audit
• Guardian: OpSec Audit