How to Integrate Private Swaps into a Crypto Exchange (Operator Playbook)
Users ask for a Private Mode, support tickets pile up, and your public swap still feels “too visible” on-chain. The fix is not a privacy manifesto. It is a product decision plus a clean private crypto swap API integration: pick a routing model, wire quote to create to status without leaking hops, keep KYC and AML gates, then launch with honest ETAs and a support playbook. Use this operator checklist to integrate private swaps into a crypto exchange without breaking compliance or trust.
TL;DR / Quick take: Treat Private Mode as a discretionary coin-to-coin path beside Public Mode (and OTC for large deals). Choose multi-hop CEX, XMR shield, or privacy-pool APIs by ETA, coverage, and who owns stuck orders. Integrate server-side only, hide route internals, keep KYC gates, and soft-launch behind a feature flag with hold/refund runbooks.
A private swap routes funds through multi-hop or shielded steps so source and destination wallets are harder to link on public ledgers. It remains your feature under your rules – partners may still screen or hold. See also how to add liquidity to a new crypto exchange and the crypto exchanger aggregator how-to.
1. Decide when private swaps belong in your product
Write one product sentence before you touch an API: Private Mode is for discretion between wallets, not for time-critical trading. Keep Public / standard swaps (and OTC when needed) as the default for speed and certainty.
| Need | Prefer | Why |
|---|---|---|
| Discretion / unlinkability | Private Mode | Multi-hop or shielded intermediate |
| Speed / locked output | Public / standard (fixed-rate if available) | Often minutes; fixed rates usually sit on the public path |
| Large or bespoke size | OTC desk | Human negotiation plus compliance paperwork |
Vendor docs commonly cite private multi-hop completion around 15-45 minutes (quote duration often near 60). Public single-hop CEX paths are often cited around 3-30 minutes. Fixed-rate locking is frequently unavailable on private multi-hop routes – send users who need a guaranteed receive amount to the public fixed-rate path.
Do this: ship Public Mode first, then add Private Mode as an explicit toggle with longer ETA copy. Do not market Private Mode as “instant” or as a replacement for OTC on large tickets.
2. Choose routing model: multi-hop CEX, XMR shield, or privacy-pool API
Disambiguate early. “Private swap” is not one technology. Score partners on ETA, coverage, partner AML behavior, custody, and who owns stuck-order support.
| Criterion | Multi-hop CEX | XMR shield | Privacy-pool / ZK |
|---|---|---|---|
| Unlinkability | High (2+ hops) | Very high (privacy-coin hop) | High (pool / ZK) |
| Typical ETA | ~15-45+ min (vendor-typical) | Often longer | ZK-proof latency |
| Liquidity | CEX books | Corridor-limited | Pool-dependent |
| Compliance | Partner CEX AML | Partner + XMR policy | Protocol + your gates |
| Integration | Partner API | Partner API + honest UX | Deeper protocol / UX |
Verdict: Most teams start with a multi-hop CEX private API for clearer coverage and ops. Add an XMR-shield corridor only if you can staff refund playbooks. Treat ZK / privacy-pool mode as a later, user-initiated option.
Do this: pick one primary model and document hold SLAs. Do not expose hop names in the UI or crown one vendor as the only “private” stack.
3. Integrate quote → create → status without leaking route internals
Treat the partner API as a black box that returns a price and later a payout. Your job is a branded status experience. Keep API keys on the server only. An API (application programming interface) is a machine-to-machine contract: quote, create, then status.
- Cache token lists server-side; do not hit the partner token endpoint on every page view.
- Request a quote with a private / public mode flag; show receive amount, rate, fees, min/max before Confirm.
- Validate addresses and amounts; send required user-context headers (IP, user-agent, timezone) from the backend.
- Create the exchange with quote id, destination, and an Idempotency-Key so retries do not double-book.
- Show a unique deposit address and exact amount with expiry (partner flows often use ~30 minutes).
- Monitor status with webhooks plus polling (~10s UI open, ~30s backgrounded) until finished, failed, refunded, or hold.
- Map statuses to plain language (waiting, processing, anonymizing, under review, completed). Some flows use an ANONYMIZING stage.
Workflow:
Decide Private Mode fit → pick routing model → map KYC/AML gates → quote (private) → create (idempotent) → deposit → poll/webhook status → launch checklist.
| Do | Do not |
|---|---|
| Server-side keys; Idempotency-Key | Call the partner API from the browser with secrets |
| Live quote panel before Confirm | Let users submit blindly |
| Mode, ETA band, fees, support id | Show hop path or provider names |
| Stop polling on terminal statuses | Poll every second forever |
| Treat hold as compliance escalation | Tell users how to “bypass” AML review |
A white-label stack (ready-made exchange software you brand as your own) can shorten wallets, UI, and status wiring. After you lock the routing model, review White Label Exchange solutions. Do this: hide route ranking and hop details. Do not promise best fill just because a route is private.
4. Keep compliance, KYC gates, and risk controls
KYC (know your customer) is identity checks. AML (anti-money laundering) is screening for risky patterns. Private Mode must hit the same gatekeeper pipeline as public swaps. Embed hooks in the lifecycle; bolt-on compliance fails under load and audit.
- KYC / KYB tier gates before Private Mode unlock or above amount thresholds.
- Sanctions and address screening on deposit and withdraw addresses.
- Amount and velocity limits at quote and create time.
- Geo and license rules via feature flags per market.
- Travel Rule triggers where your jurisdiction requires counterparty data.
- Audit trail of quote id, user id, decisions, overrides, and partner status.
- Partner due diligence on who screens, refund policy, and hold SLA.
Soft blocks and hold statuses often mean AML or KYC review. Slow the poll, escalate to support, and never invent hop details. Partner CEXs can still hold mid-flow. See the crypto exchange compliance checklist for founders. Do this: write macros for “under review” and refunds before go-live. Do not sell Private Mode as “no KYC / no AML” or as a way around sanctions screening.
5. Launch checklist: UX copy, SLAs, support, go-live tests
Ops quality decides whether Private Mode becomes retention or a ticket factory.
- Feature flag + market allowlist per jurisdiction.
- Compliance-reviewed copy for the Public vs Private toggle: what it does, longer time, possible partner review.
- ETA and fee disclosure on quote (band such as 15-45+ minutes, not “instant”).
- Order detail page with support id and plain-language status.
- Runbooks for deposit expiry, under/overpayment, partner outage, AML hold, and refunds.
- Monitoring on completion rate, p95 time-to-complete, and hold rate.
- Mystery-shop 3-5 top pairs in sandbox, then small live swaps.
- Support macros for “still anonymizing” and “under review,” plus a hold escalation drill.
- Soft-launch behind the flag; expand only after fail/refund drills pass.
Do this: treat go-live as a checklist gate. Do not open Private Mode globally on day one without allowlists and hold playbooks.
What to do next
Lock the product sentence (Private Mode for discretion, Public for speed, OTC for size). Score one routing model, map KYC/AML gates before code, wire quote → create → status on the server, and run the launch checklist. More guides: White Label Exchange blog. To evaluate a branded stack with swap modes and compliance hooks, start from Explore Solutions.
Reviewed by: White Label Exchange Editorial (practitioners in white-label exchanges, exchangers, P2P, and aggregators).
Data integrity: ETA bands, status patterns, and multi-hop AML caveats attributed to public partner docs checked on 2026-07-17 (Houdini Swap docs, GhostSwap partner brief, Baltex API guide, Gizmolab, Errna). Operational guidance only – not legal or investment advice.
Frequently asked questions
What is a private swap on a crypto exchange?
A mode that routes funds through multi-hop or shielded steps so source and destination are harder to link on public ledgers. Ship it under your KYC, AML, and sanctions controls.
Private vs public swap routing – what should operators offer?
Offer both. Public favors speed (often minutes) and may support fixed rates. Private multi-hop favors discretion (often 15-45+ minutes per vendor docs) and usually cannot lock a fixed receive amount.
How long do private swaps take?
Vendor docs commonly cite about 15-45 minutes for multi-hop routes; quote duration fields often sit near 60 minutes. Show an ETA band and live status – never promise “instant.”
Do private swaps remove KYC or AML?
No. Your platform and partner CEXs may still screen, hold, or require verification. Design gates, audit trails, and hold macros – do not pretend screening disappears.
Should we expose the hop path to users?
No. Show mode, ETA, fees, deposit instructions, and status. Keep hop names and provider weighting off the client and the UI.
API integration or white-label widget first?
Widget for fastest UI; full API when you need branded status, custom gates, and support ownership. Keep credentials server-side; add webhooks plus polling fallback.
When is OTC better than Private Mode?
Choose OTC for large size, custom settlement, or heavy compliance paperwork. Keep Private Mode for discretionary retail or mid-size coin-to-coin swaps.