Perhaps it makes sense to insure the assets of users of the exchange? Because your deductions in the amount of 5% of the amount of profit may not be enough, for example, if the exchange is hacked several months after the exchange starts.
You are right, you need to allocate more than 5 percent to it, since your customers will be there, and losing them is bad for the company's future reputation.