The forex broker technology stack: eight layers and how they connect

What is a forex broker technology stack?

A forex broker technology stack is every system a brokerage needs between a client clicking “Deposit” and a trade being priced, executed, recorded and reported. The platform is one layer of eight, and most operational pain sits in the joins between layers.

Clients see a portal, a WebTrader and an app; your staff see a CRM, a manager terminal, a payment dashboard and a KYC queue. Underneath both sits the MetaTrader 5 server, which holds the trading accounts, groups, symbols and positions, and which every other layer has to agree with.

The practical test of a stack is simple: when a client makes a card deposit at 11 p.m. on a Sunday, does the money show in their MT5 balance without anyone touching it, does the CRM record which payment provider it came through, and can compliance see the KYC status that allowed it? If any of those answers is “someone checks it in the morning”, you have a layer that is not properly connected.

What does each layer of a broker stack do, and how does it connect to MT5?

Each layer has a single job and a specific way of reaching the MetaTrader 5 server. MetaQuotes publishes several programming interfaces for this, and knowing which one a vendor uses tells you how much access it needs. The table is the map we use when scoping a new brokerage.

Why is the MT5 trading server the centre of the stack?

The trading server is the centre because it is the only place where an account’s balance, open positions and margin are authoritative. Every other system holds a copy or a reference. If the CRM shows one balance and MT5 shows a lower one, MT5 wins, because that is the number the margin calculation and stop-out logic use.

MetaQuotes describes the platform as several cooperating servers rather than one box: a trade server, a history server and access points that clients connect to. It is also explicit that the broker runs it, not MetaQuotes. The company states that “MetaQuotes does not provide SaaS solutions”, and on its MT5 broker page that you “independently deploy our software on your own hardware”. That is why hosting is a layer in its own right, and why whoever holds the server licence carries the infrastructure responsibility.

From the server, your administrators set what MetaQuotes lists as trade conditions: “margin requirements, contract terms, credit limits, swaps”, as well as spreads, markups and commissions. In practice this is done through groups. A group is a set of accounts sharing leverage, stop-out level, symbols and commissions; retail, professional and swap-free clients usually each get one.

How do liquidity, bridges and price feeds connect to MetaTrader 5?

Liquidity connects to MT5 in one of three ways: through a third-party bridge, through a gateway built on the MT5 Gateway API, or through MetaQuotes’ own Ultency aggregation. All three solve the same two problems — getting executable prices into the server and passing client orders (or the net exposure from them) out to a liquidity provider.

MetaQuotes says the Gateway API “is used for MetaTrader 5 integration with other trading systems and creation of custom data feeds”. A bridge is the commercial product most brokers buy on top of that: it aggregates several providers, applies markups, decides which orders are routed out and which are kept in-house, and reports fills back to MT5. Ultency is MetaQuotes’ built-in alternative; the company says it gives access to “more than 30 liquidity providers” with latency “of up to 0.1 ms” (MetaQuotes’ own figure).

The choice follows your execution model: an A-book broker needs a fast bridge that is transparent about slippage, a B-book broker needs exposure reporting it trusts. Our A-book, B-book and hybrid execution guide goes through the trade-offs, and the MT5 liquidity bridge and price feed guides cover the plumbing.

Two details are easy to miss. First, symbol names and contract sizes must match exactly between MT5 and every provider; a gold contract of 100 ounces on one side and 1 ounce on the other will produce hedges a hundred times too large or too small. Second, plan for one provider failing; a single-provider setup with no fallback quote source is a continuity risk.

What does the CRM do in a forex broker technology stack?

The CRM is the operational hub: it creates clients, opens their MT5 accounts, records their documents and payments, pays IB commissions and gives staff a single view of each person. It reaches MT5 through the Manager API (which MetaQuotes says lets you build “custom administration and management utilities”) or through the Web API, which is “used for platform integration with web resources and other services of the company”.

What matters most in a broker CRM is its sync. When a deposit is approved, the CRM must post a balance operation to the correct MT5 account exactly once, and it must read back trades, equity and closed P&L so that IB commissions and client statements are calculated from the server’s numbers, not from a cached estimate. Ask any vendor what happens if the MT5 connection drops mid-deposit.

The client portal is usually part of the CRM. It is where clients register, upload documents, deposit, withdraw, open additional accounts and see their IB link. Risk warnings, restricted-country lists and legal documents live here too, because regulators, payment providers and app reviewers look at it first. Our forex CRM software page describes the options: FXUP has its own CRM and also works with partner CRMs, and we propose whichever fits your onboarding, payment and IB set-up; the MT5 Manager API and MetaTrader 5 Web API guides explain the two connection methods in more depth.

Where do KYC, AML and payment providers fit?

KYC, AML and payments sit behind the CRM rather than beside the trading server. The CRM decides whether a client may deposit or trade based on their verification status, calls the KYC vendor or the payment provider, and only then instructs MT5. Keeping that order prevents the classic failure where a client trades with money from an unverified account.

The legal duties behind KYC depend on your licence, but the UK Money Laundering Regulations 2017 are a clear example of what the systems must support. Regulation 28 requires a firm to “identify the customer”, “verify the customer’s identity” and “assess, and where appropriate obtain information on” the purpose and intended nature of the business relationship. Regulation 40 requires records sufficient “to enable the transaction to be reconstructed”, generally kept for five years after the relationship ends. In stack terms, every document, screening result and payment must stay retrievable after the client leaves.

Payments have their own security regime. The PCI Security Standards Council says PCI DSS “provides a baseline of technical and operational requirements designed to protect payment account data”, and it applies to entities that store, process or transmit cardholder data. Most brokers stay out of scope with hosted payment pages, so card numbers never touch their servers.

How do the WebTrader and mobile apps connect to the stack?

Front ends connect either through MetaQuotes’ own terminals or through a branded application that talks to the server via the MT5 Web API. The standard MetaTrader 5 apps carry MetaQuotes’ branding; branded front ends put your name on the screen and let you control the login flow, languages and portal links.

Our own front ends work this way: a Flutter interface and a Go back end connected through the MetaTrader 5 Web API, with charts, MT5-formula indicators, market and pending orders, SL/TP, partial close and history, in English, Turkish and Arabic (right-to-left). You can try them on a real MT5 demo environment: the WebTrader demo and the mobile app demo.

Mobile apps add a layer that founders often forget: the app stores. Apple’s App Review Guideline 3.2.1(viii) says trading apps “should be submitted by the financial institution performing such services and must have necessary licensing and permissions in the locations where you make them available”. That is why we publish branded apps from the client’s own App Store and Google Play developer accounts, and why the countries you make the app available in should match the countries your licence covers. The forex mobile trading app and branded WebTrader pages go into the detail.

If you want to see how a branded front end would sit on your current server, send us your server name and brand colours on Telegram and we will show you a mock-up against the demo environment.

How do money and orders move through the stack?

Two flows explain almost everything about how a broker stack holds together: a deposit and an order. If you can trace both on paper, naming the system and API at each step, you understand your stack; any gap you find is where reconciliation problems will appear.

1. Client requests a depositThe client picks a method in the portal; the CRM checks KYC status and creates a pending transaction with a unique reference.
2. PSP processes the paymentThe client is redirected to the payment provider’s hosted page. The PSP confirms the result to the CRM by callback, not just by the client returning to the portal.
3. CRM credits MT5On a confirmed callback the CRM posts one balance operation to the right MT5 account through the Manager or Web API and stores the MT5 deal ticket against the transaction.
4. Client places an orderFrom the WebTrader or app the order reaches the trade server, which checks margin, symbol settings and group rules before accepting it.
5. Server routes the orderDepending on the group’s execution settings, the order is filled internally or passed through the bridge or gateway to a liquidity provider, and the fill price comes back to MT5.
6. Everything reconcilesThe CRM reads deals back for statements and IB commissions, and end-of-day totals should match in every system.

Who controls each layer under an own licence, a white label and a grey label?

Control depends on who holds the MetaTrader 5 server licence. With your own licence you control every layer and carry every responsibility. With a white label, a provider holds the server under its MetaQuotes agreement and gives you a dedicated environment. With a grey label you share the provider’s server.

We use one definition consistently: an MT5 grey label is a brokerage set up inside another company’s licensed MetaTrader 5 server: you get your own client groups and your brand on the WebTrader, mobile apps, CRM and client portal, while the MT5 server licence stays with the provider. Grey label is an industry term, not a MetaQuotes product.

The white label position needs care. Whether a new MT5 white label is available depends on MetaQuotes’ current approach, and trade press reported in 2022 that MetaQuotes had tightened its conditions — TradeInformer, on 3 October 2022, wrote that “MetaQuotes has stopped approving white labels for new customers.” So we check the current position for each case rather than promising it; our MetaQuotes white label policy guide keeps the sources together. MT4 is simpler: MetaQuotes says MT4 licences “are no longer available for purchase”. If you specifically need MT4, write to us and we will check availability for your case.

Which regulations shape each layer of the stack?

Regulation reaches the stack layer by layer: product rules land in the server’s group settings, identity rules in the CRM and KYC vendor, payment rules in the PSP integration, and operational resilience rules in hosting and vendor contracts. The examples are EU and UK texts; your regulator may differ.

Take the ESMA measures on CFDs announced on 27 March 2018: retail leverage limits starting at “30:1 for major currency pairs”, a margin close-out at “50% of minimum required margin” and “negative balance protection on a per account basis”. Every one of those becomes an MT5 group or symbol setting, and getting one wrong on a single group is a breach for every client in it. For DORA, ESMA says the regulation “entered into force on 16 January 2023 and will apply as of 17 January 2025”; its pillars include ICT third-party risk with “key contractual provisions”, which is why EU brokers now ask their technology vendors for exit plans and incident notification terms.

In what order should you assemble a forex broker technology stack?

Build from the licence and the server outwards, and leave front-end polish until the money flows work. The order below is the one we follow on most projects; skipping ahead usually means redoing the CRM integration once the server groups change.

1. Fix the legal and server routeDecide where you are licensed, which clients you will serve and whether you start on an MT5 grey label, an MT5 white label or your own MT5 licence. Everything else follows from this.
2. Design groups and symbolsWrite down each client category’s leverage, stop-out, commission and symbols before anyone configures the server.
3. Connect liquidity and the price feedContract a provider, align symbols and contract sizes, and test fills and slippage in a demo group.
4. Connect the CRM to MT5Account creation, balance operations, trade read-back and IB rules; test a half-failed deposit is not credited twice.
5. Add KYC and paymentsPlug in the KYC vendor and PSPs through the CRM, with verification gates before deposit and withdrawal.
6. Brand the front endsWebTrader, mobile apps and portal on your domain and developer accounts, with risk warnings and restricted countries in place.
7. Rehearse and go liveStaff run real-money tests end to end and check reports against MT5 before the first client is onboarded.

Where do forex broker stacks usually break?

Stacks usually break in the integrations, not the products. These four patterns cover most of the late-night messages we get from brokers whose vendors were never properly joined up.

How does FXUP fit into a forex broker technology stack?

FXUP builds and operates the layers between the MT5 server and your clients, and connects them to whichever server, liquidity and payment providers you use. That covers grey and white label setups, branded front ends, the broker CRM, liquidity provider integration, copy trading and PAMM, and licensing support. As a consulting firm we also handle the MetaQuotes requirements and application for clients who want their own MT5 licence, for a fee; in the applications we handle, MetaQuotes charges a monthly fee by tier (Entry, Standard or Enterprise) and asks for three months upfront on Entry. A grey label is typically live in about one to two weeks and a white label in about two to four weeks, depending on documents, liquidity onboarding and approvals.

We are an independent technology provider: FXUP is not affiliated with MetaQuotes, and we do not act as a broker or hold client money. We do not publish prices; our forex brokerage technology cost guide explains what drives the cost of each layer and how to compare quotes line by line, and if you message us with your route and layers we will send current figures for your set-up.

If you already run some of these layers and want to know what to keep and what to replace, message us on WhatsApp with a list of your current vendors. We will tell you where we see integration risk, even if the answer is that you need nothing from us.

Questions buyers ask

Not covered here? Ask us on WhatsApp, message @FXUPCK on Telegram or write to [email protected].