Legal Liability of Directors, Executives and Shareholders of Crypto Companies Under Turkish Law

The regulatory transformation of the Turkish crypto market has fundamentally changed the legal position of founders, directors and controlling shareholders of crypto companies.

Before 2024, many disputes involving cryptocurrency exchanges were primarily analysed through general contract law, consumer law, tort law and general corporate-law principles. Following Law No. 7518 and the secondary regulations issued by the Capital Markets Board of Türkiye (“CMB” or “SPK”), crypto-asset service providers have become regulated financial-market institutions subject to a specialised liability regime.

This distinction is particularly important for founders and investors.

A shareholder may initially believe that investing through a joint-stock company protects his or her personal assets from the company’s debts. A board member may similarly assume that customer claims can only be brought against the company itself.

Under the current Turkish crypto regulatory framework, neither assumption is always correct.

In serious cases involving customer assets, regulatory violations, mismanagement, cyber-security failures or misuse of company resources, liability can move from:

the crypto company → to its executives → to board members → and ultimately to controlling individual shareholders.

In exceptional cases, the consequences may include not only compensation claims but also administrative sanctions, criminal proceedings, seizure measures and even personal bankruptcy.

This article explains when those risks arise and, equally importantly, when an ordinary shareholder will normally remain protected by the corporate structure.

1. The Starting Point: Turkish Crypto Companies Must Operate as Joint-Stock Companies

Under Communiqué No. III-35/B.1 on the Establishment and Operating Principles of Crypto-Asset Service Providers, a crypto-asset service provider seeking CMB authorisation must generally be established as a Turkish joint-stock company.

Its shares must be registered shares, issued against cash, its capital must be fully paid in cash, and its ownership structure must be transparent.

This corporate structure is significant because the general rules governing Turkish joint-stock companies under the Turkish Commercial Code No. 6102 (“TCC”) remain relevant unless displaced by special capital-markets legislation.

Article 329 TCC establishes the fundamental principle:

A joint-stock company is liable for its debts with its own assets, while shareholders are generally responsible only for the capital they have undertaken to contribute to the company.

Therefore, the general rule remains:

A person does not become personally liable for every debt of a crypto exchange merely because that person owns shares in the company.

But crypto companies are subject to important statutory exceptions to that principle.

2. The Three Different Levels of Liability Must Be Distinguished

When analysing liability in a crypto company, three groups should not be confused:

1. The crypto-asset service provider itself

The company is normally the primary liable party.

2. Directors, executives and other personnel

Board members and executives may become personally responsible where damage is attributable to their own fault, management decisions or statutory violations.

3. Shareholders

Ordinary passive shareholders generally benefit from limited liability. However, controlling shareholders, de facto managers or shareholders who personally participate in unlawful conduct may face direct liability.

This distinction is crucial in litigation.

A claimant should not automatically sue every shareholder appearing in the trade registry.

Instead, the investigation should determine:

• who actually controlled the company;
• who controlled customer wallets;
• who authorised transfers;
• who controlled private keys;
• who approved related-party payments;
• who had access to company and customer funds;
• who received compliance and risk reports;
• who ignored warnings;
• who benefited from the disputed transactions; and
• whether formal directors were merely nominees while another shareholder exercised actual management power.

In major crypto collapses, the person with the greatest legal exposure is therefore not necessarily the person holding the formal title of CEO.

3. Primary Liability Normally Belongs to the Crypto Company

Article 99/B of the Capital Markets Law No. 6362 contains one of the most important provisions for crypto-related liability.

Crypto-asset service providers are responsible for damages resulting from:

• unlawful activities; and
• failure to fulfil obligations concerning cash payments or delivery of crypto assets.

If the damage cannot be recovered from the crypto-asset service provider, or it is clearly apparent that recovery will not be possible, personnel of the service provider may also become liable according to their fault and to the extent the loss can be attributed to them.

This creates a two-stage structure.

The normal position is:

Customer → Crypto Company

But where the company cannot compensate the loss:

Customer → Responsible Executives / Personnel

may become possible.

The question then becomes whether a particular director or executive can be personally connected to the loss.

4. Directors Cannot Treat Customer Crypto Assets as Company Assets

One of the most important protections introduced by the new legislation is the statutory separation of customer assets.

Article 35/C of the Capital Markets Law provides that customer cash and crypto assets are separate from the assets of the crypto-asset service provider.

The records must also reflect that separation.

Customer assets cannot generally be seized for the debts of the crypto company, pledged for its debts, included in its bankruptcy estate or subjected to provisional measures because of company liabilities.

This rule has major consequences for director liability.

Suppose a platform has:

• TRY 100 million of its own capital; and
• TRY 2 billion worth of customer crypto assets.

The board cannot legally approach the TRY 2 billion customer pool as though it were corporate working capital.

For example, significant liability risks may arise if directors authorise customer assets to be used to:

• pay company salaries;
• meet tax liabilities;
• finance marketing expenses;
• cover operating losses;
• repay shareholder loans;
• provide liquidity to another group company;
• finance a founder’s personal investments;
• collateralise company borrowing;
• support proprietary trading positions; or
• cover a deficit created in another customer wallet.

Such conduct may go far beyond ordinary corporate mismanagement.

Depending on the facts, it may enter the territory of criminal embezzlement under the Capital Markets Law.

5. The Most Serious Risk: Embezzlement of Crypto Assets

Article 110/A of the Capital Markets Law introduced a specific offence concerning crypto-asset service providers.

Board chairpersons, board members and other personnel who appropriate money, assets or crypto assets entrusted to the service provider because of their duties, or assets that they are obliged to protect, keep or supervise, for themselves or another person may face imprisonment of eight to fourteen years, together with a judicial fine.

The court may also order compensation of the damage suffered by the crypto-asset service provider.

Where fraudulent conduct is used to conceal the embezzlement, the statutory sanctions are even more severe.

This makes control over customer wallets one of the most sensitive governance areas in the entire company.

A board member who knowingly approves the transfer of customer crypto assets to a founder-controlled wallet cannot necessarily defend the transaction by saying:

“The wallet belonged to another group company.”

The court will examine the economic substance of the transaction.

6. Controlling Shareholders Can Also Face Criminal Liability

The legislation goes considerably further than ordinary company law.

Article 110/A also addresses persons who legally or factually exercised management or control over a crypto-asset service provider whose activity licence has been revoked.

Where controlling individual shareholders cause the resources of the service provider or its customers to be used directly or indirectly for their own benefit or the benefit of others in a manner endangering the safe operation of the provider and causing damage, the conduct may be treated as embezzlement.

The provision prescribes imprisonment of twelve to twenty-two years for the conduct falling within this special rule and also contemplates joint recovery of the damage.

This provision is particularly important for founder-led crypto businesses.

A founder cannot necessarily avoid responsibility by resigning from the board while continuing to:

• control treasury wallets;
• instruct employees;
• authorise transfers;
• dominate directors;
• control banking credentials;
• determine which customers receive withdrawals;
• direct company funds to related businesses; or
• exercise de facto control over management.

In regulatory and criminal investigations, actual control can matter more than the title printed on a business card.

7. Personal Bankruptcy of Directors and Controlling Shareholders Is Possible

Perhaps the most extraordinary provision in the new Turkish crypto regime is Article 110/B of the Capital Markets Law.

Where decisions or transactions constituting crypto embezzlement under Article 110/A are identified, personal responsibility may be pursued against:

• the chairperson of the board;
• board members;
• other personnel; and
• individual shareholders who legally or factually exercised management or control.

Upon the CMB’s request, a court may order their personal bankruptcy for the purpose of satisfying customer losses from the identified embezzled amount.

Assets belonging personally to the individuals concerned may therefore become relevant.

Cash may be used directly, while other personal assets may be liquidated.

Customer losses are given priority from those assets, and if the available assets are insufficient, payments are distributed proportionately among customers.

This mechanism should not, however, be misunderstood.

A crypto company’s ordinary commercial failure does not automatically mean that its founders will personally go bankrupt.

Article 110/B is an exceptional mechanism connected particularly with conduct falling within Article 110/A.

There must therefore be a serious factual and legal basis for linking the relevant individual to the disputed decisions or transactions.

8. Directors Are Also Subject to General Turkish Commercial Code Liability

Crypto-specific legislation does not eliminate ordinary directors’ duties under company law.

Article 369 TCC requires board members and persons responsible for management to perform their duties with the care of a prudent manager and to protect the company’s interests in accordance with good-faith principles.

Article 553 then establishes the general liability regime.

Founders, board members, executives and liquidators may be liable to the company, shareholders and company creditors for losses caused by culpable violations of duties arising from law or the articles of association.

Accordingly, directors of a crypto company must not merely avoid fraud.

They must actively perform their corporate duties with sufficient care.

Examples potentially creating civil liability include:

• allowing an inadequately secured wallet infrastructure;
• ignoring repeated cyber-security warnings;
• failing to implement required internal control systems;
• approving transactions creating obvious conflicts of interest;
• permitting uncontrolled access to private keys;
• failing to supervise treasury operations;
• failing to react to unexplained wallet deficits;
• allowing related-party transactions that damage the company;
• ignoring regulatory capital deficiencies;
• concealing financial deterioration from the board;
• allowing regulatory reports to contain incorrect information; or
• continuing operations despite knowing that customer withdrawals cannot be met.

9. Delegating a Task Does Not Always Eliminate Board Liability

Many crypto companies have highly technical operations.

The board may therefore argue:

“Cybersecurity was the CTO’s responsibility.”

or:

“Wallet management had been delegated to the custody department.”

Delegation can be legally relevant, but it does not automatically eliminate liability.

Under Article 553 TCC, where duties are validly delegated pursuant to law, the delegating persons may avoid liability for the acts of the delegate unless they failed to exercise reasonable care in selecting that person.

The law also states that no person should be held liable for unlawful conduct outside his or her control merely by invoking a general duty of supervision.

The practical consequence is that courts should examine the role of each director individually.

A properly functioning non-executive board member may therefore have a stronger defence than an executive board member who personally controlled the wallet system.

However, delegation becomes a weak defence where there were repeated warning signs.

For example:

• internal audit reports identified deficiencies;
• customer complaints showed withdrawal problems;
• the risk department issued warnings;
• wallet reconciliations revealed shortages;
• auditors identified control weaknesses;
• the board received reports of suspicious transfers; and
• directors nevertheless failed to intervene.

10. Crypto Boards Have Specific Internal-Control Duties

The specialised SPK regime substantially increases the practical standard expected from directors.

Communiqué III-35/B.1 requires crypto-asset service providers to establish internal audit, internal control and risk-management units appropriate to the scope and structure of their activities.

Internal control is not merely an administrative formality.

The regulatory system is intended to ensure, among other things:

• compliance with legislation including MASAK rules;
• integrity of accounting and records;
• reliability of data;
• confidentiality, integrity and availability of information systems;
• prevention and detection of errors and fraud;
• prevention of illegal betting;
• detection of fraudulent activity; and
• monitoring of operational risks.

Policies and procedures must be documented and put into effect by board decision. The board must also designate a non-executive member without an executive unit reporting to him or her as the board member responsible for internal control.

This point can become decisive in litigation.

Where millions of dollars in customer crypto assets disappear, one of the first questions may be:

What did the board-approved internal-control policy actually require, and was it implemented?

11. Cybersecurity Can Create Management Liability

Crypto companies face a risk structure fundamentally different from ordinary commercial companies.

A single compromised private key may cause irreversible losses.

The regulatory framework therefore expressly requires risk management to consider, among other things:

• unauthorised changes to information systems;
• unauthorised access to assets;
• cyberattacks;
• inability of users to access systems;
• physical-security risks;
• information-security breaches; and
• unlawful employee conduct.

Where a risk occurs or a situation threatens customer assets or the company’s financial condition, the risk-management unit must prepare a report and submit it to the board as soon as possible.

This creates an important evidentiary question in director-liability litigation:

When did the board first know about the risk?

If a hack occurs unexpectedly despite a compliant and properly operated security system, personal director liability does not automatically follow.

But the position may be very different if:

• the board was warned about a critical vulnerability;
• multi-signature controls were disabled;
• a founder alone controlled private keys;
• employees shared wallet credentials;
• penetration-test findings were ignored; or
• no emergency response system existed.

12. Recovery Plans Are Also a Board-Level Issue

Communiqué III-35/B.1 requires crypto providers to prepare recovery plans addressing events that may lead to crypto-asset loss.

The plan must cover matters such as transferring assets from hot wallets to cold wallets, isolating affected systems, preserving records, identifying the cause of security weaknesses and transferring customer assets if the service provider can no longer continue operating.

The adequacy of the plan must be reviewed at least annually or earlier where the board considers it necessary.

Failure to establish or update such a system may therefore become important evidence when assessing managerial negligence.

13. Who Can Become a Board Member or Senior Executive?

The CMB regime also regulates who may manage these companies.

Under Communiqué III-35/B.1, a crypto-asset service provider must generally have at least three board members, and a majority must be graduates of four-year higher-education programmes.

Board members and persons authorised to represent the provider without being board members must satisfy specified regulatory suitability requirements.

General managers and deputy general managers are subject to additional requirements.

They must generally have at least seven years of professional experience in fields such as:

• financial markets;
• information technology;
• information systems; or
• financial technologies.

The general manager must generally be employed exclusively for that position, reside in Türkiye and work full time. Appointments of general managers and deputy general managers require the CMB’s favourable opinion.

Consequently, management positions in a Turkish crypto company cannot be treated as purely ceremonial titles.

14. Directors Must Manage Conflicts of Interest

Conflicts of interest are particularly common in crypto groups.

The same founder may own:

• the crypto exchange;
• a token issuer;
• a market-making company;
• a software provider;
• a custody technology business; and
• an overseas liquidity provider.

This can create severe governance risks.

The crypto regulations require board members to disclose certain recent employment, capital or commercial relationships, as well as specified family relationships, with persons involved in transactions before the board. Such matters must be communicated to the board and reflected in the meeting minutes.

Related-party transactions should therefore receive heightened legal scrutiny.

A shareholder-controlled company should not be allowed to extract value from the exchange merely because both companies ultimately belong to the same founder.

15. Are Ordinary Shareholders Personally Responsible for Customer Losses?

Normally, no.

Suppose an investor purchases 5% of a Turkish crypto platform.

The investor:

• does not sit on the board;
• has no access to wallets;
• does not control management;
• does not instruct employees; and
• has no role in the disputed conduct.

If the platform later becomes insolvent, the investor does not automatically become liable for customer losses simply because he or she owns 5% of the company.

Article 329 TCC protects the basic principle of separation between corporate liabilities and shareholder assets.

However, the analysis changes where the shareholder personally commits an unlawful act.

Limited liability protects shareholders from company debts.

It does not provide immunity for the shareholder’s own:

• fraud;
• tort;
• embezzlement;
• misrepresentation;
• unlawful instruction;
• asset diversion; or
• other personally attributable conduct.

16. Control Is More Important Than Percentage Ownership

A common mistake is to assume that personal exposure begins at a specific share percentage.

Ownership percentage is relevant for regulatory purposes, but liability depends heavily on actual conduct.

A person owning 60% of a platform who never participates in management will not necessarily be liable for every management decision.

Conversely, a founder who owns only 20% but controls:

• board appointments;
• wallet credentials;
• financing;
• treasury decisions;
• senior executives; and
• related-party transactions

may effectively control the company.

Article 110/B expressly refers not only to formal management but also to individuals who legally or factually exercised management or control.

The concept of de facto control can therefore become central in litigation.

17. SPK Approval of Share Transfers Is Also Important

Shares in a regulated crypto company cannot always be transferred as freely as ordinary joint-stock company shares.

Certain acquisitions or disposals reaching or crossing regulatory thresholds — including 10%, 20%, 33% and 50% in specified circumstances — may require CMB approval.

Transfers involving privileged shares giving board representation rights may also trigger approval requirements irrespective of ordinary percentage thresholds. Other changes may require notification to the CMB.

This means that an investor buying a substantial stake in a crypto exchange should perform regulatory due diligence before signing an ordinary share purchase agreement.

A transaction that is valid commercially between the parties may still face serious regulatory problems if required CMB approval is ignored.

18. Shareholders Are Subject to Suitability Requirements

The CMB also examines who owns regulated crypto businesses.

The regulations impose suitability requirements concerning matters such as:

• bankruptcy and insolvency history;
• involvement in certain previously failed or licence-revoked financial institutions;
• financial strength;
• honesty and reputation;
• specified administrative sanctions; and
• regulatory history.

These requirements can also extend through ownership chains to shareholders of corporate shareholders holding significant interests or privileged governance rights.

Accordingly, using a holding company does not necessarily prevent regulators from examining the ultimate beneficial ownership structure.

19. Can the Corporate Veil Be Pierced?

Turkish law generally respects separate corporate personality.

Piercing the corporate veil is not the normal remedy merely because a company is unable to pay its debts.

Turkish legal doctrine and case-law generally treat disregard of separate legal personality as an exceptional mechanism, particularly where corporate personality is abused.

Recent Turkish legal scholarship also emphasises that piercing the veil should generally operate as a last-resort method rather than automatically attributing a subsidiary’s conduct to its controlling entity.

In crypto disputes, however, claimants may investigate veil-piercing arguments where facts show that:

• corporate and personal assets were systematically mixed;
• the company was used merely as the founder’s personal wallet;
• related entities had no genuine operational independence;
• assets were deliberately transferred to avoid creditors;
• customer funds were moved to shareholder-controlled companies;
• corporate records were intentionally manipulated; or
• separate corporate personality was used abusively to defeat customer claims.

The important point is that veil piercing should not be confused with Article 110/B.

Article 110/B provides a specific statutory personal-liability mechanism for crypto cases falling within its scope.

That may be significantly stronger than relying only on general veil-piercing doctrine.

20. Administrative Liability Must Also Be Considered

Civil liability is only one component of the regulatory risk.

Article 99/B provides that violations of Articles 35/B and 35/C and CMB regulations issued under the crypto regime may trigger administrative fines under the Capital Markets Law.

Regulatory investigations may therefore examine:

• board decisions;
• internal-control records;
• information-security reports;
• customer complaint records;
• wallet reconciliations;
• audit reports;
• custody arrangements;
• capital adequacy;
• advertisements;
• token-listing procedures; and
• ownership changes.

A board member should therefore assume that an important decision made today may later be reconstructed from company records during an SPK investigation.

21. Operating Without Authorisation Can Lead to Criminal Liability

An even greater risk arises where crypto services are provided without the required regulatory authorisation.

Article 109/A of the Capital Markets Law provides criminal sanctions for persons conducting unauthorised crypto-asset service-provider activities and for responsible officers of legal entities involved in such activity.

The statutory penalty is imprisonment from three to five years together with a judicial fine calculated between five thousand and ten thousand days.

Accordingly, founders cannot safely assume that incorporating an ordinary technology company and describing its services as “software” will eliminate licensing risks if the economic substance of its activities constitutes regulated crypto-asset services.

22. Practical Scenario: The Founder Transfers Customer USDT to His Other Company

Consider the following example.

A Turkish crypto exchange holds USDT worth TRY 600 million for customers.

The company’s founder owns 70% of the platform.

He also owns a separate technology company.

The crypto platform experiences a cash-flow crisis.

The founder instructs the CFO to transfer TRY 150 million worth of customer USDT to a wallet controlled by his technology company, claiming that the assets will be returned within two months.

The board is informed but does not formally object.

The technology company later becomes insolvent.

Customers request withdrawals but the exchange cannot satisfy them.

This situation potentially raises several separate issues.

Liability of the Crypto Company

The platform itself may be liable for failing to deliver customer crypto assets under Article 99/B.

Liability of Directors

Directors who approved or knowingly tolerated the transaction may face civil liability under the Capital Markets Law and the TCC.

Liability of the Founder

Because the founder controls the platform and the recipient company and allegedly directed the transaction, special provisions concerning controlling shareholders may become relevant.

Criminal Liability

If the statutory elements are satisfied, use of entrusted customer assets for another person’s benefit may raise Article 110/A issues.

Personal Bankruptcy

Where Article 110/A transactions are established and the statutory conditions are satisfied, the CMB may seek personal responsibility under Article 110/B.

The existence of a joint-stock company therefore does not necessarily protect the founder’s personal assets in such a scenario.

23. Practical Scenario: The Platform Is Hacked Despite Strong Security

Now consider a different case.

Hackers exploit a previously unknown vulnerability and steal customer crypto assets.

The company had:

• professional custody architecture;
• properly functioning multi-signature controls;
• independent security testing;
• internal audit;
• risk-management procedures;
• documented incident-response procedures; and
• immediate board intervention.

Article 99/B recognises liability of crypto providers in relation to losses arising from information systems, cyberattacks, information-security breaches and employee conduct, while also distinguishing certain interruptions occurring without the provider’s fault.

However, personal liability of each board member should not automatically follow merely because a cyberattack occurred.

The investigation should determine:

• whether the director was personally at fault;
• whether the loss was within his or her responsibility;
• whether legal and regulatory obligations had been complied with; and
• whether the event could reasonably have been prevented.

This illustrates why company liability and director liability are not identical concepts.

24. What Evidence Matters in a Director or Shareholder Liability Case?

In serious crypto disputes, evidence should focus on actual control and decision-making.

Important evidence may include:

• trade registry records;
• shareholder ledgers;
• board minutes;
• delegated authority documents;
• signature circulars;
• company bank records;
• blockchain wallet addresses;
• private-key governance procedures;
• wallet access logs;
• multi-signature approval records;
• internal emails;
• WhatsApp or messaging correspondence;
• risk-management reports;
• internal audit reports;
• independent audit findings;
• regulatory correspondence;
• CMB filings;
• MASAK correspondence;
• customer withdrawal records;
• related-party transaction documents;
• cryptocurrency transfer hashes;
• accounting ledgers;
• shareholder-loan accounts;
• dividend distributions;
• management-service agreements; and
• transactions involving affiliated entities.

Blockchain evidence can be particularly powerful.

Corporate defendants may dispute who approved a bank transfer, but blockchain analysis can often establish exactly:

• when the assets moved;
• from which wallet;
• to which wallet;
• through which intermediate addresses; and
• whether the assets ultimately reached wallets connected with insiders or related companies.

25. How Can Directors Reduce Their Personal Risk?

For legitimate crypto businesses, the objective should not be merely to satisfy regulatory paperwork.

Directors should be capable of proving that governance actually functioned.

A robust governance programme should therefore include:

• genuine separation of customer and company assets;
• strict private-key governance;
• multi-signature transaction controls;
• board-approved transfer limits;
• independent internal audit;
• functioning internal control;
• independent risk management;
• documented related-party transaction procedures;
• conflict-of-interest policies;
• regular wallet reconciliations;
• capital-adequacy monitoring;
• formal escalation procedures;
• cybersecurity testing;
• recovery plans;
• incident-response protocols;
• documented consideration of regulatory warnings; and
• accurate board minutes.

A director who disagrees with a high-risk transaction should also ensure that the objection is properly documented rather than merely expressed informally.

In subsequent litigation, a written dissent can be significantly more valuable than the statement:

“I told the founder that I disagreed.”

26. What Should Investors Check Before Becoming a Shareholder?

A prospective investor in a Turkish crypto company should conduct considerably more due diligence than would normally be performed for an ordinary technology startup.

Particular attention should be paid to:

• CMB regulatory status;
• ownership approval requirements;
• capital adequacy;
• customer asset reconciliation;
• custody structure;
• hot-wallet exposure;
• shareholder loans;
• related-party transfers;
• financial statements;
• reserve verification;
• internal-control reports;
• regulatory correspondence;
• ongoing customer complaints;
• suspicious withdrawal restrictions;
• cybersecurity incidents;
• pending investigations;
• founder access to customer wallets; and
• whether any customer assets have been used for company financing.

An investor purchasing a controlling stake may inherit not only commercial risk but also a highly regulated governance position.

27. A Shareholder Agreement Cannot Eliminate Statutory Liability

Founders sometimes attempt to allocate responsibility contractually.

For example, a shareholders’ agreement may provide:

“Shareholder A shall have no responsibility for compliance or customer assets.”

Such a clause may regulate recourse rights internally between shareholders.

It cannot, however, necessarily eliminate liability imposed by mandatory legislation.

Similarly, an agreement between founders cannot prevent:

• the CMB from imposing regulatory measures;
• prosecutors from investigating suspected crimes;
• customers from invoking statutory rights; or
• a court from determining personal responsibility under applicable law.

Internal indemnification arrangements and statutory liability are therefore different matters.

Conclusion: Limited Liability Still Exists — But Crypto Regulation Can Reach the People Behind the Company

The central principle of Turkish corporate law remains intact:

An ordinary shareholder of a joint-stock company is not personally responsible for company debts merely because he or she owns shares.

Crypto regulation, however, creates powerful exceptions.

Following the amendments introduced by Law No. 7518 and the CMB’s secondary legislation, directors, executives and controlling shareholders must consider several overlapping layers of responsibility.

A board member may face personal exposure where customer losses are attributable to his or her culpable conduct.

A controlling shareholder may face substantially greater risk where that shareholder actually manages the business or causes company or customer resources to be diverted for personal or third-party benefit.

At the extreme end of the spectrum, conduct involving customer assets may result in:

civil compensation liability, administrative sanctions, criminal prosecution for crypto-asset embezzlement and, in qualifying circumstances, personal bankruptcy under Article 110/B of the Capital Markets Law.

The practical question in every case is therefore not simply:

“Who owns the crypto company?”

The more important questions are:

Who controlled the money? Who controlled the wallets? Who made the decision? Who received the benefit? Who knew about the risk? And who failed to intervene?

Those questions will increasingly determine where liability ultimately falls in Turkish crypto litigation.