Introduction: Crypto Asset Regulation in Turkey

Türkiye has undergone one of the most significant transformations in its cryptocurrency regulatory framework in recent years.

For many years, crypto-asset trading existed in Türkiye without a comprehensive licensing regime specifically governing cryptocurrency exchanges and custody providers. This changed fundamentally in 2024, when Law No. 7518 amended Capital Markets Law No. 6362 and brought crypto asset service providers (“CASPs”) under the regulatory and supervisory authority of the Capital Markets Board of Türkiye (“CMB” or “SPK”).

Law No. 7518 entered into force on 2 July 2024. The reform established the statutory basis for regulating crypto trading platforms, custody services, crypto transfers and other crypto-asset services. The CMB subsequently completed a major part of the secondary regulatory framework on 13 March 2025, when two comprehensive communiqués entered into force.

The regulatory environment is therefore materially different from the Turkish crypto market that existed before July 2024.

A company wishing to establish a crypto exchange in Turkey, provide custody services to Turkish customers or commercially operate another regulated crypto-asset service must now consider a detailed framework involving:

• CMB establishment and operating permissions;
• minimum capital and capital adequacy;
• qualifying shareholder requirements;
• management and personnel qualifications;
• internal control and risk management;
• information systems and cybersecurity;
• independent audits;
• proof-of-reserves audits;
• custody arrangements;
• token listing and delisting procedures;
• market surveillance;
• customer asset segregation;
• anti-money laundering and KYC obligations;
• the Travel Rule;
• remote customer onboarding;
• restrictions applicable to foreign crypto platforms.

The CMB’s current institutional structure also reflects the importance of this market. Its Financial Technologies Department is expressly responsible for examining and authorising crypto asset service providers, supervising their capital and operational requirements and monitoring conduct capable of disrupting the secure and transparent functioning of crypto markets.

This article provides a comprehensive overview of Crypto Asset Regulation in Turkey as of July 2026, with particular emphasis on businesses seeking to establish or operate a crypto platform or custody provider in Türkiye.

1. Is Cryptocurrency Legal in Turkey?

Crypto assets are not subject to a general prohibition in Türkiye.

Buying, selling, transferring and holding crypto assets are not themselves prohibited merely because the asset is a cryptocurrency.

However, the legal framework distinguishes between:

crypto investment and trading activities, and

the use of crypto assets for payments.

Crypto trading and custody are now regulated primarily under Capital Markets Law No. 6362 and the CMB’s secondary legislation.

By contrast, the use of crypto assets as payment instruments remains restricted under the Regulation on the Disuse of Crypto Assets in Payments issued by the Central Bank of the Republic of Türkiye (“CBRT”).

The CBRT continues to list this Regulation within its current payment-services legislation in 2026.

Accordingly, the fact that crypto exchanges are now regulated by the CMB does not mean that cryptocurrency has become an unrestricted payment instrument in Türkiye.

2. Can Crypto Assets Be Used for Payments in Turkey?

As a general rule, no.

The CBRT Regulation provides that crypto assets may not be used directly or indirectly in payments, and services facilitating their direct or indirect use in payments may not be provided.

Payment service providers also cannot develop business models under which crypto assets are used directly or indirectly in providing payment services or issuing electronic money.

This distinction is essential for fintech companies.

A business may lawfully operate within the regulated crypto trading ecosystem while still being unable to use Bitcoin, Ethereum or another crypto asset as the settlement instrument for an ordinary commercial payment.

Therefore:

crypto trading regulation and payment regulation must be analysed separately.

For example, a regulated crypto platform should not assume that it can automatically integrate a “pay with crypto” function into merchant checkout systems.

3. The 2024 Reform: Law No. 7518

The central turning point in Turkish cryptocurrency law occurred on 2 July 2024.

Law No. 7518 amended Capital Markets Law No. 6362 and placed crypto asset service providers within the CMB’s regulatory jurisdiction.

The CMB confirmed that the reform covers environments in which activities such as:

• crypto-asset trading;
• exchange;
• transfer;
• custody required for those activities;
• custody and management of crypto assets;
• custody and management of private keys enabling transfers from crypto wallets

are carried out professionally, commercially or as a regular occupation.

This was a fundamental change.

Before the reform, operating a crypto trading platform did not involve the type of dedicated CMB licensing structure now applicable.

Following the reform, crypto exchanges effectively became regulated capital-markets institutions subject to detailed supervisory standards.

4. Main Crypto Regulations in Turkey

The statutory framework is principally based on Capital Markets Law No. 6362, as amended by Law No. 7518.

The two most important secondary regulations were published on 13 March 2025:

Communiqué No. III-35/B.1

Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers

This regulation deals principally with:

• establishment;
• operating permission;
• founders and shareholders;
• share transfers;
• managers and personnel;
• organisational structure;
• internal control;
• internal audit;
• risk management;
• information systems;
• technological infrastructure;
• document and record systems;
• independent audits;
• proof-of-reserves audits;
• suspension and termination of activities.

Communiqué No. III-35/B.2

Communiqué on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers

This regulation principally governs:

• permitted crypto services;
• trading;
• transfers;
• custody;
• customer orders;
• token listing;
• initial sale and distribution activities;
• capital adequacy;
• platform operations.

Both regulations entered into force through publication in Official Gazette No. 32840 on 13 March 2025.

5. What Is a Crypto Asset Service Provider?

The Turkish regulatory structure uses the concept of a crypto asset service provider, commonly abbreviated internationally as CASP.

The most commercially important categories are:

Crypto Asset Trading Platforms

These businesses provide environments for buying and selling crypto assets and may perform related regulated activities where authorised.

Crypto Asset Custody Providers

These institutions provide custody for customers’ crypto assets or private keys and perform associated custody functions.

The exact permission required depends on the services the company intends to provide.

A business should therefore avoid assuming that a general “crypto licence” automatically authorises every possible blockchain-related financial service.

The CMB grants permissions according to the activities covered by the regulatory framework.

6. CMB Licensing Is Now Mandatory

Crypto asset service providers must obtain the relevant permissions from the CMB.

The CMB maintains specific application procedures for:

• establishment of new crypto trading platforms;
• establishment of custody providers;
• operating permissions;
• activity permissions.

The CMB expressly states that applications must be submitted using its current forms and documentation standards. Applications containing missing documents or failing to comply with the required format will not be processed.

The regulatory process therefore involves more than registering a Turkish company and developing an exchange website.

It is a formal financial-services licensing process.

7. Establishment Permission and Operating Permission Are Different

One of the most important points for investors is the distinction between:

permission to establish the company, and

permission to commence regulated activity.

Receiving CMB approval to establish a crypto company does not necessarily mean that the company is immediately authorised to accept customers and commence trading.

The company must subsequently satisfy the operational conditions required under the secondary legislation.

These include matters such as:

• capital adequacy;
• personnel;
• management;
• technological infrastructure;
• custody;
• internal systems;
• AML controls;
• audit readiness;
• customer asset controls.

The CMB’s application page maintains separate application documentation for establishment and operating permission processes.

8. Company Type Required for a Crypto Platform

A Turkish crypto platform seeking CMB authorisation must be structured in accordance with the corporate requirements established by the crypto regulations.

A central feature of the regulatory model is the joint-stock company structure (anonim şirket – A.Ş.).

The articles of association, trade name, share structure and activities must comply with CMB requirements.

For investors, this means that an ordinary limited liability technology company should not simply begin operating a crypto exchange and assume that it can later regularise the activity.

The corporate structure should be designed for CMB licensing before launch.

9. Minimum Capital for a Crypto Exchange in Turkey in 2026

Capital requirements are one of the most important barriers to entry into the Turkish regulated crypto market.

The original March 2025 framework established a minimum establishment capital requirement of TRY 150 million for platforms.

However, CMB monetary thresholds are subject to regulatory revaluation.

For 2026, the CMB’s published monetary thresholds increased the minimum establishment capital for crypto platforms to:

TRY 250,000,000

The same regulatory update also increased several other monetary thresholds under the crypto communiqués.

Accordingly, a business plan based on the original TRY 150 million figure is no longer sufficient for a new platform project in 2026.

Furthermore, establishment capital should not be confused with the total financial resources needed to operate a compliant crypto exchange.

The company must also fund:

• technology;
• cybersecurity;
• staffing;
• CMB compliance;
• MASAK compliance;
• custody arrangements;
• independent audits;
• proof-of-reserves audits;
• market surveillance;
• customer support;
• operational continuity.

A commercially realistic project will therefore normally require resources significantly beyond the statutory minimum.

10. Minimum Capital for Crypto Custody Providers

Custody providers face even higher financial requirements.

The original 2025 rules specified TRY 500 million as the minimum establishment capital for a crypto custody provider.

Following the CMB’s monetary revaluation, the 2026 minimum establishment capital for crypto custody institutions is TRY 630 million.

Additional equity requirements may also apply according to the amount of customer assets under custody.

Consequently, crypto custody in Türkiye is designed as an institutional financial activity requiring substantial financial strength.

This regulatory structure is intended to reduce the risk that customer crypto assets are entrusted to lightly capitalised technology businesses.

11. Capital Adequacy Does Not End After Licensing

A CASP cannot simply satisfy initial capital at establishment and then disregard its financial position.

Communiqué III-35/B.2 includes continuing capital adequacy rules.

The financial requirements may depend upon matters such as:

• the institution’s activities;
• customer asset size;
• operational risk;
• custody exposure.

This means that rapid customer growth can also create additional regulatory capital requirements.

Investors should therefore build regulatory capital forecasting into the company’s long-term business plan.

12. Founder and Shareholder Requirements

A licensed crypto service provider is not treated like an ordinary startup for shareholder purposes.

Founders and qualifying shareholders must satisfy regulatory eligibility standards.

The CMB examines issues including:

• shareholder identity;
• financial strength;
• reputation;
• criminal history;
• bankruptcy and insolvency history;
• direct and indirect ownership;
• ultimate control;
• source of capital.

The CMB’s current establishment application package includes separate notarised declarations for both individual and corporate proposed shareholders.

Accordingly, international investors should create transparent ownership structures.

Complex nominee arrangements, uncertain beneficial ownership or unexplained sources of investment funds can create significant regulatory difficulties.

13. Share Transfers After Licensing

Regulatory scrutiny does not end when the initial shareholders are approved.

Changes in ownership of a crypto asset service provider may also require CMB approval depending on the nature of the transaction.

This becomes particularly important for venture capital investments and subsequent financing rounds.

A crypto startup cannot necessarily issue or transfer shares with the same flexibility as an ordinary software business.

Investment documents should therefore contain regulatory closing conditions where necessary.

A transaction may require:

• CMB approval;
• updated shareholder documentation;
• revised organisational records;
• proof of investor eligibility.

M&A planning for regulated crypto companies should therefore begin with regulatory analysis before commercial completion.

14. Management and Personnel Requirements

The CMB crypto framework also regulates directors, managers and key personnel.

A licensed CASP must maintain a management and organisational structure appropriate to the nature and scale of its regulated business.

This includes qualified personnel for matters such as:

• compliance;
• information systems;
• internal control;
• risk management;
• internal audit;
• operations.

The regulatory model reflects the principle that a crypto exchange is no longer merely a software platform.

It is a regulated financial institution handling customer assets and transaction data.

15. Internal Control, Risk Management and Internal Audit

Communiqué III-35/B.1 expressly regulates the internal systems that crypto asset service providers must establish.

The CMB’s own summary of the regulation identifies:

• internal control;
• internal audit;
• risk management;
• information systems;
• technology infrastructure

as central elements of the regulatory framework.

These functions should not exist merely on paper.

They must correspond to the institution’s actual operational risks.

For a crypto platform, risk management may need to address:

• wallet security;
• private key compromise;
• operational failures;
• cyberattacks;
• liquidity risk;
• counterparty risk;
• market integrity;
• fraud;
• unauthorised transfers;
• business continuity.

16. Information Systems and Cybersecurity

Cybersecurity is one of the most heavily regulated areas of crypto service provision.

A crypto platform controls systems through which customers may hold substantial financial value.

The CMB therefore regulates technology infrastructure and subjects CASPs to information-system requirements and audits.

The CMB’s Information Systems Department is specifically tasked with regulating and auditing the information systems of crypto asset service providers and reviewing independent information-system audit findings.

A compliant information-security framework should consider matters such as:

• private key security;
• wallet architecture;
• privileged user access;
• encryption;
• transaction signing;
• multi-factor authentication;
• cybersecurity monitoring;
• penetration testing;
• backup;
• disaster recovery;
• incident response;
• business continuity;
• software-change management.

Cybersecurity is therefore not simply a technical risk.

It is a regulatory obligation.

17. Crypto Custody Rules

Custody is a central feature of the new Turkish crypto regime.

Customer assets and platform assets must be separated and tracked appropriately.

The regulatory framework establishes detailed requirements concerning:

• custody organisations;
• platform wallets;
• customer-level records;
• hot wallets;
• cold wallets;
• asset reconciliation;
• transfer security.

The CMB’s 2025 activity report confirms that Communiqué III-35/B.2 introduced rules for separating customer assets from platform assets, customer-level tracking and security requirements concerning hot and cold wallet use.

A platform therefore cannot treat customer crypto holdings as though they were its own operational inventory.

18. Platform-Custodian Agreements and the 2026 Transition

Custody remains one of the most important ongoing transitional issues in the Turkish crypto market.

On 26 March 2026, the CMB extended the timetable concerning:

• the deadline for platforms to sign and submit custody agreements; and
• the period for CASPs appearing on the transitional operating list to obtain their authorisation certificates.

Rather than fixing a new calendar date immediately, the CMB decided that the relevant periods would be determined after CMB-authorised custody institutions begin providing crypto custody services to platforms on a sufficiently widespread basis.

This is highly significant when assessing the current legal position as of July 2026.

The Turkish crypto licensing system is fully established in legislation, but parts of the transition into the permanent custody and authorisation structure remain operationally ongoing.

19. The CMB “Operating List” Is Not a Licence

This is one of the most important points for investors and customers.

The CMB currently publishes a “List of Operating Entities” (Faaliyette Bulunanlar Listesi).

However, the CMB expressly states that this is a transitional list.

Most importantly, the CMB warns that:

the fact that a company appears on this list does not mean that it has been authorised under the applicable legislation.

This distinction has major consequences for due diligence.

An investor should never conclude:

“The company appears on the SPK website, therefore it already has a full crypto licence.”

Instead, the investor should determine:

• whether the company is on the transitional list;
• whether establishment permission has been granted;
• whether operating permission has been granted;
• whether custody arrangements are completed;
• whether the final authorisation certificate has been obtained;
• whether regulatory deficiencies remain outstanding.

20. Establishment Approval Is Already Being Granted to New Platforms

The market is no longer limited to companies that existed before the 2024 reform.

The CMB has begun considering applications for new crypto platforms under the permanent regulatory framework.

For example, in its 26 March 2026 bulletin, the CMB approved an application to establish a new crypto asset trading platform under the Yapı Kredi group.

This provides practical confirmation that the new establishment route is operational.

Accordingly, foreign and domestic investors can consider establishing new regulated platforms, provided that the CMB’s requirements are satisfied.

21. Token Listing Requirements

A crypto exchange cannot simply list every token its commercial team believes will attract customers.

Communiqué III-35/B.2 regulates the principles governing the listing of crypto assets on platforms.

A compliant platform should establish formal procedures concerning:

• initial token review;
• technological characteristics;
• project risks;
• liquidity;
• legal classification;
• conflicts of interest;
• continued listing;
• delisting.

The platform must also manage the risk that a purported “crypto token” may legally constitute another type of regulated financial instrument.

The CMB’s Financial Technologies Department is expressly responsible for evaluating certain crypto asset distributions and crypto issuances involving capital market instruments.

Therefore, token classification should involve both technical and legal analysis.

22. Market Surveillance and Market Abuse

Turkish crypto regulation now goes beyond licensing.

Platforms are expected to monitor trading behaviour and protect market integrity.

The CMB’s 2025 report confirms that the secondary regulations require platforms to establish price-surveillance systems and mechanisms for detecting transactions capable of disrupting the market.

This is particularly important for conduct such as:

• wash trading;
• artificial price creation;
• coordinated manipulation;
• suspicious trading patterns;
• abuse of privileged information.

Crypto compliance teams should therefore include market-surveillance capabilities in addition to ordinary AML monitoring.

AML surveillance and market-abuse surveillance address different legal risks.

23. Leveraged and Credit Crypto Trading

The Turkish regulatory approach is restrictive concerning speculative high-risk structures.

The CMB’s secondary framework prohibits:

• leveraged crypto transactions;
• credit-based transactions; and
• derivatives within the prohibited structures specified by the regulation.

The CMB’s official 2025 activity report expressly identifies the prohibition of leveraged, credit and derivative transactions among the key elements of Communiqué III-35/B.2.

A foreign exchange therefore cannot simply copy its international product catalogue into Türkiye.

Features available globally may need to be removed or redesigned for Turkish customers.

24. Crypto Investment Advice

Providing investment advice is also regulated.

Platforms should distinguish between:

• general market information;
• educational material;
• research;
• personalised investment advice.

The current CMB monetary thresholds provide that, for the regulated investment-advisory service contemplated by the crypto framework, the customer must have a minimum crypto-asset value at the platform of TRY 60 million under the 2026 threshold.

This demonstrates that personalised crypto investment advice is not intended to become an unrestricted retail service.

Platforms should carefully review:

• recommendation engines;
• AI-generated suggestions;
• personalised token recommendations;
• portfolio-allocation tools.

A feature marketed as “AI guidance” may still raise investment-advisory questions depending on its operation.

25. Proof-of-Reserves Audits

Proof-of-reserves is a particularly important part of the Turkish framework.

Communiqué III-35/B.1 requires relevant CASPs to undergo reserve-proof audits in accordance with the applicable rules.

The CMB adopted further principles in May 2025 concerning how these audits are to be performed, including requirements involving information-system auditors.

Proof-of-reserves should not be treated merely as a marketing statement.

In the Turkish regulatory system, it forms part of the supervised audit environment.

A regulated platform should be capable of demonstrating consistency between:

• customer records;
• wallet assets;
• custody information;
• liabilities;
• blockchain records where applicable.

26. Independent Audit and Record Keeping

CASPs are also subject to independent audit and document-retention obligations under the regulatory framework.

A crypto platform should therefore maintain a reliable audit trail concerning:

• customer accounts;
• orders;
• transactions;
• transfers;
• wallet movements;
• accounting;
• custody;
• internal approvals.

Blockchain transparency does not eliminate the need for conventional financial records.

Indeed, regulatory supervision requires the company to connect on-chain activity with customer-level and accounting records.

27. AML Regulation of Crypto Asset Service Providers

Crypto platforms are subject to a second major regulatory layer outside CMB supervision:

anti-money laundering regulation administered by MASAK.

Crypto asset service providers are obliged entities under Turkish AML legislation and must comply with Law No. 5549 and related regulations.

The Turkish AML Compliance Programme Regulation expressly includes crypto asset service providers among institutions required to establish a compliance programme.

A compliant programme includes areas such as:

• internal policies;
• risk management;
• monitoring and control;
• compliance officer functions;
• training;
• internal audit.

Crypto licensing and AML compliance therefore operate in parallel.

Receiving CMB permission does not satisfy MASAK obligations.

28. KYC Requirements

Know Your Customer procedures are particularly important in the crypto sector.

A regulated crypto platform should identify and verify its customers and apply enhanced controls where the risk profile requires them.

Relevant processes may include:

• identity verification;
• beneficial owner identification;
• source-of-funds analysis;
• customer risk scoring;
• sanctions screening;
• politically exposed person screening;
• transaction monitoring.

MASAK’s updated Crypto Asset Service Providers Guide, published on 30 September 2025, provides detailed guidance concerning customer due diligence and enhanced measures.

The regulatory philosophy is explicitly risk-based.

Higher-risk customer relationships should therefore receive stronger scrutiny.

29. Remote Customer Identification

Digital onboarding is essential for crypto platforms.

In June 2025, MASAK amended its remote identification rules specifically to regulate remote customer verification by crypto asset service providers.

The amendments entered into force through MASAK General Communiqué No. 28, published on 12 June 2025.

The current rules allow CASPs to conduct remote identification using the methods established for regulated capital-market institutions, subject to the specific verification requirements applicable to crypto providers.

This means onboarding cannot be reduced to simply uploading an identity document.

The platform must establish a legally compliant identity-verification process.

30. The Crypto Travel Rule in Turkey

Türkiye has also implemented Travel Rule requirements for crypto transfers.

The principle requires specified information concerning the originator and beneficiary of a crypto transfer to accompany the transaction within the applicable regulatory structure.

MASAK’s September 2025 crypto guide specifically addresses:

• the Travel Rule;
• customer information;
• crypto transfer restrictions;
• transfer timing requirements;
• transaction limits.

The compliance programme must therefore cover not only fiat deposits and withdrawals but also wallet-to-wallet crypto transfers.

Platforms need systems capable of determining:

• who is sending the asset;
• who is receiving it;
• whether the counterparty is another regulated service provider;
• what information must accompany the transaction;
• whether enhanced controls are required.

31. Suspicious Transaction Reporting

Crypto asset service providers are subject to suspicious transaction reporting obligations.

A platform must therefore be capable of detecting transactions that may relate to:

• laundering of criminal proceeds;
• terrorist financing;
• sanctions evasion;
• fraud;
• illicit darknet activity;
• account takeovers;
• layering through multiple wallets.

MASAK’s updated guidance expressly addresses suspicious transaction reporting and the obligation to provide information and documents to authorities.

Automated blockchain analytics can be useful, but the legal obligation remains with the regulated institution.

32. Politically Exposed Persons and Enhanced Due Diligence

MASAK’s current crypto guidance also addresses relationships with politically exposed persons (“PEPs”) and other high-risk customers.

A compliant platform should therefore maintain procedures for:

• identifying PEPs;
• identifying associated persons where required;
• senior-management approval;
• enhanced monitoring;
• source-of-funds review.

The same principle applies to high-risk geographic exposure and technologically elevated risk.

MASAK updated its enhanced-measures guidance in September 2025, expressly including crypto-asset-service-provider relationships and technology risks.

33. Sanctions Compliance

Crypto firms must also consider asset-freezing and sanctions obligations.

MASAK’s AML Compliance Programme Regulation requires institution policies to address risks connected with asset-freezing decisions under Turkish counter-terrorism and proliferation-financing legislation.

The Regulation also specifically refers to monitoring sender and beneficiary information appearing in crypto transfer messages.

A crypto platform should therefore integrate sanctions screening into:

• onboarding;
• deposits;
• withdrawals;
• wallet transfers;
• ongoing customer monitoring.

34. Foreign Crypto Exchanges Targeting Turkey

Foreign crypto exchanges face significant territorial restrictions.

Capital Markets Law No. 6362 treats activity by an overseas platform directed toward persons resident in Türkiye as unauthorised crypto asset service provision unless the Turkish regulatory framework is satisfied.

The legislation specifically provides that a foreign platform will be considered to be targeting residents in Türkiye where it engages in activities such as:

• opening a workplace in Türkiye;
• establishing a Turkish-language website;
• directly conducting marketing toward Turkish residents;
• using Turkish-resident persons or institutions for promotion or marketing.

The CMB expressly confirmed these criteria when implementing the 2024 transitional framework.

This is one of the most important rules for international exchanges.

A company cannot assume:

“Our servers and legal entity are abroad, so Turkish licensing law does not apply.”

Regulatory jurisdiction depends heavily on whether the company targets the Turkish market.

35. Reverse Solicitation and Foreign Platforms

Turkish rules distinguish active targeting from situations in which a Turkish resident independently chooses to use an overseas service.

However, reliance on a reverse-solicitation theory should be approached cautiously.

Where the overseas business uses Turkish marketing, Turkish advertising, Turkish representatives or a Turkish-language website, the law provides clear indicators that the service is directed toward Türkiye.

International platforms considering Turkish customer access should therefore review:

• website languages;
• mobile app localisation;
• Turkish influencer campaigns;
• Turkish affiliate programmes;
• social media advertising;
• local customer support;
• Turkish offices;
• sponsorships.

Marketing strategy can determine regulatory exposure.

36. Crypto ATMs

The 2024 reform also addressed physical crypto transaction infrastructure.

The CMB required the termination of Turkish-resident ATM and similar electronic transaction devices enabling customers to convert crypto assets into cash, cash into crypto assets or conduct crypto transfers outside the applicable regulated structure.

Therefore, physical crypto kiosk or ATM business models should not be launched without specific Turkish regulatory analysis.

37. Foreign Crypto Licence Does Not Passport Into Turkey

There is no general system comparable to an EU financial-services passport under which a foreign crypto licence automatically authorises services in Türkiye.

A licence from:

• the European Union;
• United Kingdom;
• United States;
• UAE;
• Switzerland;
• Singapore

does not by itself provide permission to actively offer regulated crypto services to Turkish residents.

Where the business targets Türkiye, the requirements of Turkish Capital Markets Law and CMB regulations must be independently satisfied.

International expansion strategies should therefore treat Türkiye as a separate regulated jurisdiction.

38. Personal Data Protection

A crypto platform also processes substantial personal data.

Relevant information may include:

• customer identity;
• contact information;
• financial records;
• wallet addresses;
• transaction histories;
• device information;
• IP addresses;
• authentication data;
• risk and fraud indicators.

Accordingly, Law No. 6698 on the Protection of Personal Data (“KVKK”) applies alongside financial regulation.

Platforms should establish legally compliant procedures concerning:

• privacy notices;
• processing purposes;
• data retention;
• processors;
• information security;
• customer requests;
• data breaches;
• international transfers.

AML requirements may provide legal grounds or statutory obligations for certain processing, but this does not eliminate the need for a properly structured privacy programme.

39. Crypto Marketing and Customer Disclosures

Crypto assets are inherently volatile.

A regulated platform should therefore communicate risks clearly and avoid misleading customers.

Marketing should not create an impression that:

• returns are guaranteed;
• tokens are risk-free;
• a CMB licence guarantees the value of assets;
• appearing on a regulatory list constitutes governmental approval of a token.

This is particularly important because the CMB itself expressly warns that appearance on the transitional CASP operating list does not mean that the company has received regulatory authorisation.

Compliance departments should therefore review:

• advertisements;
• influencer campaigns;
• referral promotions;
• token launch materials;
• social media communications.

40. Buying an Existing Turkish Crypto Platform

Rather than establishing a platform from the beginning, investors may consider acquiring an existing Turkish crypto business.

This may be commercially attractive, but due diligence must distinguish between companies that are:

• merely on the transitional operating list;
• establishment-approved;
• operating-authorised;
• awaiting custody arrangements;
• subject to regulatory deficiencies.

The CMB’s current list itself expressly states that listing is not equivalent to authorisation.

A buyer should review at least:

Regulatory status:
What permissions have actually been obtained?

Capital adequacy:
Does the company satisfy 2026 requirements?

Custody:
What custody arrangements exist?

MASAK compliance:
Is the AML programme operational?

Technology:
Have information systems been audited?

Proof of reserves:
Have required audits been completed?

Customer assets:
Are records properly reconciled?

Token listings:
Does the platform maintain compliant listing procedures?

Foreign group relationships:
Are outsourcing and technology arrangements properly documented?

Regulatory correspondence:
Has the CMB identified deficiencies?

In crypto M&A, regulatory due diligence can be more important than ordinary corporate due diligence.

41. Criminal and Administrative Risk of Unauthorised Crypto Services

Unauthorised crypto asset service provision can lead to serious consequences.

The 2024 reform introduced specific enforcement mechanisms concerning unauthorised crypto activities.

The CMB has authority to investigate unauthorised crypto service providers, and its Enforcement Department expressly lists unauthorised crypto asset service provision among the activities subject to enforcement review.

Foreign platforms targeting Türkiye without the appropriate structure can also fall within the unauthorised activity provisions.

Therefore, a “launch first and obtain permission later” strategy creates substantial legal risk.

42. Current Transitional Position in July 2026

Understanding the current market requires distinguishing the permanent legal regime from the transitional implementation process.

The permanent framework exists:

• Law No. 7518 has been in force since July 2024;
• Communiqués III-35/B.1 and III-35/B.2 have been in force since March 2025;
• establishment and operating applications are regulated;
• CMB supervision is active;
• MASAK rules apply.

However, the CMB continues to publish the “Operating Entities” list as a transitional list, and the March 2026 CMB decision postponed final deadlines concerning custody agreements and authorisation certificates until authorised custodians begin supplying services on a sufficiently widespread basis.

This means that regulatory status must be checked individually for each company.

Older statements such as “all exchanges on the CMB list are licensed” are legally inaccurate.

43. How to Establish a Crypto Exchange in Turkey

A new crypto platform project can broadly be structured as follows.

Step 1 – Regulatory Classification

Determine exactly which services will be offered.

These may include:

• trading;
• exchange;
• transfers;
• custody;
• initial sale or distribution services;
• other regulated crypto activities.

Step 2 – Corporate Structuring

Establish the appropriate Turkish joint-stock company and create a transparent ownership structure.

Step 3 – Founder and Shareholder Review

Confirm that founders, shareholders and controllers satisfy CMB eligibility requirements.

Step 4 – Capital Preparation

For a new platform, plan around the current TRY 250 million 2026 minimum establishment capital, as well as continuing capital adequacy requirements.

Step 5 – Establishment Application

Submit the current CMB establishment application forms and supporting documents.

Step 6 – Governance

Appoint qualified management and create appropriate organisational units.

Step 7 – Internal Systems

Establish:

• internal control;
• risk management;
• internal audit;
• compliance.

Step 8 – Information Systems

Build CMB-compliant technological and cybersecurity infrastructure.

Step 9 – AML Programme

Create a MASAK-compliant KYC, transaction monitoring and suspicious transaction reporting programme.

Step 10 – Custody

Establish the required custody architecture and agreements.

Step 11 – Audit

Complete required information systems, independent and proof-of-reserves audits.

Step 12 – Operating Permission

Apply for CMB permission to commence the regulated activities.

44. Crypto Compliance Checklist for Turkey

Before launching a crypto business in Türkiye, companies should review at least the following:

CMB Classification

Does the business constitute a crypto asset service provider?

Establishment Permission

Has the required CMB establishment approval been obtained?

Operating Permission

Does the institution have authority to provide the specific proposed service?

Capital

Does the platform satisfy the applicable current capital requirement?

Ownership

Are shareholders and ultimate controllers eligible?

Management

Does the institution have qualified management and personnel?

Custody

Are customer assets held and reconciled in accordance with CMB requirements?

Information Systems

Is the platform technically compliant and audit-ready?

Cybersecurity

Are private keys and wallet infrastructure adequately protected?

Token Listing

Has the platform established compliant listing and delisting procedures?

Market Surveillance

Can manipulative or suspicious trading activity be identified?

Proof of Reserves

Are applicable reserve-proof audits completed?

AML/KYC

Is the MASAK compliance programme operational?

Travel Rule

Can originator and beneficiary information be transmitted and monitored?

Remote Onboarding

Does customer identification satisfy current MASAK requirements?

Sanctions

Are customer and transaction screening systems operational?

KVKK

Is customer data processed lawfully?

Foreign Activity

Does the business avoid unauthorised targeting of Turkish residents from abroad?

Frequently Asked Questions About Crypto Regulation in Turkey

Are cryptocurrencies legal in Turkey?

Crypto ownership and trading are not generally prohibited. However, crypto asset service providers are regulated by the CMB, while crypto assets remain restricted from direct or indirect use in payments.

Who regulates crypto exchanges in Turkey?

The principal regulator is the Capital Markets Board of Türkiye (CMB/SPK). Crypto asset service providers were brought under CMB regulation through Law No. 7518 in July 2024.

Does a crypto exchange need a licence in Turkey?

Yes. Regulated crypto asset services require the appropriate CMB establishment and operating permissions.

What is the minimum capital for a crypto exchange in Turkey in 2026?

The current 2026 minimum establishment capital for a crypto trading platform is TRY 250 million.

What is the minimum capital for a crypto custody company?

The 2026 minimum establishment capital for a crypto custody institution is TRY 630 million, with additional capital requirements potentially applying depending upon customer assets under custody.

Is every company on the SPK crypto list licensed?

No.

The CMB expressly states that the current “List of Operating Entities” is transitional and that appearance on the list does not mean the institution has been authorised under the applicable regulations.

Are leverage and crypto derivatives allowed?

The CMB framework restricts leveraged, credit-based and derivative crypto transactions within the regulated platform structure.

Does Turkey apply the Crypto Travel Rule?

Yes. MASAK’s current crypto guidance specifically covers Travel Rule compliance, transfer restrictions, timing and limits.

Can crypto companies onboard customers remotely?

Yes, subject to the remote identification rules introduced for crypto asset service providers in 2025.

Can a foreign crypto exchange target Turkish customers?

A foreign platform targeting Turkish residents can be regarded as conducting unauthorised crypto asset service activity. A Turkish-language website, Turkish workplace or marketing aimed at Türkiye are specifically identified as indicators of targeting the Turkish market.

Can cryptocurrency be used to buy goods and services?

The CBRT Regulation prohibits the direct or indirect use of crypto assets in payments and the provision of services designed for such use.

Conclusion: The Future of Crypto Asset Regulation in Turkey

Crypto Asset Regulation in Turkey has changed fundamentally.

Türkiye is no longer a jurisdiction in which a cryptocurrency exchange can operate merely as an ordinary technology company.

Since 2 July 2024, crypto asset service providers have been brought within Capital Markets Law No. 6362 and placed under the regulatory and supervisory authority of the Capital Markets Board of Türkiye.

The regulatory transformation accelerated in March 2025 with the introduction of Communiqués III-35/B.1 and III-35/B.2.

Together, these regulations created a comprehensive framework concerning:

• establishment;
• operating authorisation;
• shareholders;
• managers;
• corporate organisation;
• internal control;
• risk management;
• information systems;
• independent audits;
• proof of reserves;
• crypto trading;
• custody;
• transfers;
• token listings;
• capital adequacy.

For businesses considering a crypto exchange license in Turkey, financial capacity is particularly important.

The minimum establishment capital applicable to a platform has increased to TRY 250 million for 2026, while the minimum establishment capital applicable to a crypto custody institution is TRY 630 million.

However, capital is only one part of regulatory readiness.

A Turkish crypto asset service provider must also develop institutional governance and technological infrastructure capable of protecting customer assets and supporting regulatory oversight.

The CMB framework requires customer and platform assets to be separated, customer positions to be tracked and custody systems to comply with detailed security requirements. Platforms must also establish mechanisms capable of detecting conduct that threatens market integrity.

At the same time, MASAK compliance has become a central component of Turkish crypto regulation.

CASPs are required to establish AML compliance programmes and implement controls relating to customer identification, remote onboarding, enhanced due diligence, suspicious transaction reporting, sanctions, Travel Rule information and crypto transfer restrictions.

International crypto companies must pay particular attention to Türkiye’s cross-border rules.

A company does not escape Turkish regulation merely because its headquarters or servers are abroad.

Where an overseas crypto platform actively targets residents of Türkiye, the activity may constitute unauthorised crypto asset service provision. Turkish-language websites, Turkish workplaces and marketing activity directed toward Türkiye are expressly recognised as indicators of such targeting.

Another point should be emphasised for investors conducting due diligence in 2026:

being listed on the CMB’s current “Operating Entities” list is not the same thing as holding final regulatory authorisation.

The CMB itself expressly describes this as a transitional list.

Moreover, on 26 March 2026, the CMB extended the timetable concerning custody agreements and the final authorisation certificates of businesses on the transitional operating list. The relevant deadlines will be determined after authorised custody providers begin offering crypto custody services to platforms on a sufficiently widespread basis.

Therefore, the legal status of each Turkish crypto company should be verified individually.

For investors, founders and international crypto groups, the most effective market-entry strategy is to design the corporate structure, CMB licensing strategy, custody model, technology infrastructure, AML system and customer architecture together from the beginning.

Businesses seeking to:

• establish a crypto exchange in Turkey;
• obtain a Turkish crypto licence;
• establish a crypto custody company;
• acquire an existing Turkish crypto platform;
• offer crypto services to Turkish customers;
• launch a token through a Turkish platform;
• provide institutional crypto infrastructure in Türkiye

should carry out a detailed regulatory assessment before committing substantial capital or launching customer-facing activity.

The Turkish crypto market remains commercially significant, but the regulatory direction is clear:

crypto asset services are becoming institutional financial services subject to capital-markets supervision, financial-crime controls, technological standards and continuing regulatory oversight.

Companies that treat Turkish crypto regulation as part of their core business architecture rather than as an after-launch compliance exercise will be better positioned to enter and remain in the market.

Legal Disclaimer: This publication provides general information regarding cryptocurrency and crypto asset regulation in Türkiye as of July 2026. It does not constitute legal advice. CMB capital thresholds, transitional periods, custody requirements, MASAK obligations and other regulatory standards may change. Each crypto asset service, token, custody arrangement or cross-border business model should be assessed individually under the legislation and regulatory decisions applicable at the relevant time.