Introduction

The regulation of crypto assets in Türkiye has changed fundamentally since 2024.

Crypto exchanges, digital asset platforms and crypto custody businesses can no longer approach the Turkish market as ordinary technology companies operating outside financial-sector licensing rules.

With the enactment of Law No. 7518, which amended Capital Markets Law No. 6362 and entered into force on 2 July 2024, crypto asset service providers were placed under the regulatory and supervisory authority of the Capital Markets Board of Türkiye (“CMB” or “SPK”).

The regulatory framework became substantially more detailed on 13 March 2025, when the CMB introduced two major secondary regulations:

Communiqué No. III-35/B.1 on the Establishment and Operating Principles of Crypto Asset Service Providers, and

Communiqué No. III-35/B.2 on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers.

These regulations govern matters ranging from establishment and licensing to shareholders, management, internal control, cybersecurity, custody, token listings, crypto transfers and capital adequacy.

Accordingly, businesses seeking a Crypto Asset Service Provider license in Turkey now face a comprehensive financial regulatory process comparable in many respects to other licensed capital-market activities.

For 2026, the minimum establishment capital applicable to a crypto trading platform has increased to TRY 250 million, while a crypto custody institution is subject to a minimum establishment capital of TRY 630 million.

Capital, however, is only one element of the licensing process.

A successful application requires regulatory planning concerning corporate structure, qualifying shareholders, managers, technology, cybersecurity, custody, internal controls, customer asset protection, independent auditing, proof of reserves and anti-money laundering compliance.

This guide explains the principal CMB requirements applicable to Crypto Asset Service Provider licensing in Turkey as of July 2026.

1. What Is a Crypto Asset Service Provider in Turkey?

Turkish law uses the concept of a Crypto Asset Service Provider, generally abbreviated internationally as CASP.

Under the regulatory framework, the term encompasses institutions providing regulated services relating to crypto assets.

The CMB’s 2025 annual report describes crypto asset service providers as including:

• platforms;
• institutions providing crypto asset custody services; and
• other organisations designated to provide crypto-related services, including certain initial sale or distribution activities.

Platforms may carry out one or more activities involving crypto trading, initial sale or distribution, exchange, transfer, custody required by those activities and other services specified by the regulator.

From a practical perspective, the two principal categories are:

Crypto Asset Trading Platforms

These businesses provide an environment through which customers can buy, sell, exchange or transfer crypto assets.

Crypto Asset Custody Institutions

These institutions provide regulated custody of customers’ crypto assets and/or the private keys necessary to control those assets.

The distinction is particularly important because the regulatory capital requirements are different.

2. Who Regulates Crypto Asset Service Providers?

The principal regulator is the Capital Markets Board of Türkiye.

The CMB regulates:

• establishment;
• operating authorization;
• capital adequacy;
• shareholders;
• management;
• customer asset protection;
• information systems;
• market conduct;
• custody;
• token listings;
• audits.

The CMB’s secondary regulations expressly address these subjects.

However, CMB licensing is not the only regulatory layer.

The Financial Crimes Investigation Board (“MASAK”) supervises anti-money laundering and counter-terrorist financing obligations.

Consequently, CASPs must comply simultaneously with:

CMB/SPK financial regulatory requirements, and

MASAK AML/KYC requirements.

This distinction is essential because receiving a CMB operating permission does not remove or replace MASAK obligations.

3. Legal Basis of the Turkish Crypto Licensing Regime

The core legal framework consists of three levels.

Capital Markets Law No. 6362

Law No. 7518 amended Capital Markets Law No. 6362 in July 2024 and brought CASPs within CMB supervision.

Communiqué III-35/B.1

This regulation principally concerns the institutional structure of CASPs.

It regulates:

• establishment;
• commencement of operations;
• suspension and termination of activities;
• founders;
• shareholders;
• share transfers;
• managers;
• personnel;
• organisational structure;
• internal control;
• internal audit;
• risk management;
• information systems;
• technology infrastructure;
• document and record systems;
• independent audit;
• proof-of-reserves audit.

Communiqué III-35/B.2

This regulation focuses more heavily on operational and financial rules, including:

• services that CASPs may provide;
• crypto trading environments;
• custody;
• transfers;
• token listings;
• capital adequacy.

Both Communiqués were published and entered into force on 13 March 2025.

4. Is a CMB License Mandatory?

Yes.

Providing regulated crypto asset services in Türkiye requires compliance with the CMB authorization framework.

A business should not assume that incorporation under the Turkish Commercial Code is sufficient to commence crypto operations.

There is an important legal distinction between:

incorporating a company,
obtaining establishment permission, and
obtaining permission to conduct regulated activities.

The CMB maintains separate documentation for establishment applications and operating permission applications.

Accordingly, founders should not launch customer-facing crypto services merely because a Turkish company has been registered.

5. Establishment Permission vs Operating Permission

Understanding this distinction is one of the most important aspects of Crypto Asset Service Provider licensing in Turkey.

Establishment Permission

The CMB first considers whether the proposed institution may be established within the regulated CASP framework.

The application examines matters such as:

• corporate structure;
• shareholders;
• founders;
• articles of association;
• financial capacity;
• proposed services.

Operating Permission

The institution must then demonstrate that it actually possesses the organisation, capital, personnel, internal systems, technological infrastructure and compliance architecture required to perform the regulated activity.

Therefore:

establishment approval is not equivalent to an operating licence.

The practical importance of this distinction can be seen in CMB decisions during 2026. For example, the CMB approved the establishment of a new Yapı Kredi crypto trading platform in March 2026, and later approved establishment applications for additional platforms such as Fiba and Goldtag in June 2026. These were establishment decisions rather than automatic permission to commence regulated trading.

6. Corporate Form Required for a CASP

A regulated CASP must comply with the corporate requirements of the CMB framework.

For newly established crypto trading platforms and custody businesses, the expected corporate form is a Turkish joint-stock company, or anonim şirket (A.Ş.).

The corporate structure should be designed around the regulatory application from the beginning.

Relevant issues include:

• registered shares;
• cash consideration for shares;
• transparent ownership;
• compliant articles of association;
• a permitted corporate purpose;
• an identifiable ultimate controlling structure.

Creating an ordinary limited liability company and attempting to convert the entity after product launch can cause significant licensing delays and restructuring costs.

7. Minimum Capital for a Crypto Trading Platform in 2026

Financial capacity is one of the most important CMB licensing requirements.

The original 2025 minimum establishment capital for crypto trading platforms was TRY 150 million.

However, the CMB revalued the relevant monetary thresholds for 2026.

For the period 1 January 2026 – 31 December 2026, the minimum establishment capital under Article 34/1 of Communiqué III-35/B.2 is:

TRY 250,000,000

The amount is expressly stated in CMB Bulletin 2025/68.

Therefore, older publications referring to TRY 150 million should not be relied upon when planning a new CASP application in 2026.

8. Minimum Capital for Crypto Custody Institutions

The regulatory threshold for custody providers is substantially higher.

The original 2025 minimum establishment capital was TRY 500 million.

For 2026, this has increased to:

TRY 630,000,000

under Article 34/2 of Communiqué III-35/B.2.

This reflects the greater institutional risk associated with holding substantial amounts of customer crypto assets and controlling private-key infrastructure.

9. Additional Equity Requirement for Custody Institutions

Custody businesses may also become subject to additional equity requirements depending upon the size of customer assets under custody.

For 2026, where customer assets held by the custody institution exceed TRY 1.25 billion, an additional equity requirement calculated at 1.5% applies to the relevant excess amount under the regulatory framework.

The CMB’s 2026 threshold decision also increases the equity level above which this additional requirement is no longer imposed to TRY 1.9 billion.

This illustrates a broader regulatory principle:

the financial requirements of a CASP can increase as the institution grows.

Investors should therefore prepare regulatory-capital projections rather than considering only initial licensing capital.

10. Capital Must Be Real Financial Capacity

Regulatory capital should not be treated simply as a registration figure appearing in the trade registry.

The CMB expects a regulated institution to possess genuine and sustainable financial capacity.

A business plan should therefore separately budget for:

• regulatory capital;
• technology development;
• cybersecurity;
• custody;
• compliance personnel;
• independent audits;
• accounting;
• MASAK systems;
• customer support;
• operational expenses;
• business continuity.

Using nearly all available funding merely to satisfy the minimum capital threshold while leaving insufficient resources for operations would undermine the practical viability of the institution.

11. Founder and Shareholder Requirements

The CMB licensing process examines not only the institution but also its owners.

Current CMB establishment documentation specifically requires separate declarations concerning prospective:

• individual shareholders; and
• corporate shareholders.

The CMB application package also requires notarised declarations and undertakings.

Regulatory examination may involve:

• financial standing;
• reputation;
• criminal history;
• bankruptcy or insolvency;
• direct and indirect shareholding;
• ultimate beneficial ownership;
• control relationships;
• source of investment capital.

The underlying objective is to prevent regulated crypto institutions from being controlled by financially unsuitable or opaque owners.

12. Foreign Shareholders and International Investors

Foreign investors may participate in Turkish CASPs, subject to the same regulatory principles.

However, foreign ownership does not permit the platform to avoid Turkish licensing requirements.

International investors should expect to establish the ownership chain clearly and provide evidence concerning:

• foreign corporate shareholders;
• ultimate beneficial owners;
• directors;
• financial resources;
• group structure;
• regulatory history.

Where documents originate abroad, Turkish notarisation, apostille, certified translation or equivalent authentication requirements may become relevant.

A transparent international holding structure will generally be easier to explain to the regulator than opaque nominee arrangements.

13. Share Transfers After Authorization

Regulatory scrutiny continues after the initial licence is obtained.

Changes in share ownership may trigger CMB approval or notification requirements.

This is particularly important for:

• venture capital rounds;
• private equity investments;
• strategic partnerships;
• founder exits;
• mergers and acquisitions;
• group reorganisations.

Investment documentation should therefore contain regulatory closing conditions where necessary.

A share transfer should not automatically close merely because the commercial parties have signed the transaction agreement.

14. Management and Organisational Requirements

CASPs must establish a genuine financial-institution governance structure.

Management should be capable of understanding and supervising risks relating to:

• crypto trading;
• custody;
• cybersecurity;
• liquidity;
• customer assets;
• AML;
• operational resilience;
• market integrity.

The CMB’s own summary of Communiqué III-35/B.1 confirms that the regulation expressly deals with CASP managers, personnel and organisational structures.

This means governance cannot exist only on paper.

The board and senior management should understand the institution’s technology and risk exposure.

15. Internal Control Requirements

The CMB framework requires CASPs to establish appropriate internal control systems.

Internal control should monitor whether actual operations comply with:

• CMB regulations;
• company policies;
• customer asset rules;
• listing standards;
• transfer procedures;
• wallet security;
• AML controls;
• access restrictions.

An internal control system might review, for example:

• who can approve customer withdrawals;
• who controls privileged wallets;
• whether customer assets reconcile with platform records;
• whether token listing procedures were properly followed;
• whether suspicious activity was escalated.

Internal controls should be integrated into daily operations rather than created shortly before an audit.

16. Risk Management Requirements

Crypto businesses face distinctive financial and technological risks.

Risk management should therefore consider matters including:

• hacking;
• private-key compromise;
• operational interruption;
• liquidity risk;
• fraud;
• market manipulation;
• counterparty risk;
• token-specific risk;
• cybersecurity incidents;
• vendor risk;
• business continuity.

Communiqué III-35/B.1 expressly includes risk management among the regulated internal systems applicable to CASPs.

For licensing purposes, generic risk policies copied from an ordinary technology company will generally be insufficient.

17. Internal Audit

Internal audit is another important part of the CMB governance architecture.

Its purpose is to independently test whether the company’s systems and controls actually function as intended.

Audit areas may include:

• customer onboarding;
• asset segregation;
• wallet controls;
• transaction authorisation;
• compliance;
• information security;
• accounting;
• outsourcing.

Audit findings should be capable of being reported to senior management and the board and should produce remediation where necessary.

18. Information Systems and Technological Infrastructure

Crypto licensing is deeply connected with technology.

A CASP is expected to establish secure and auditable information systems before commencing operations.

Communiqué III-35/B.1 specifically regulates the information systems and technological infrastructure of crypto asset service providers.

The architecture should address matters including:

• encryption;
• access control;
• customer authentication;
• privileged access;
• private-key management;
• transaction signing;
• network security;
• logging;
• monitoring;
• backup;
• cybersecurity;
• business continuity;
• disaster recovery.

Technology cannot therefore be separated from regulatory compliance.

For a CASP, the source code, wallet design and operational systems can become part of the licensing risk.

19. Cybersecurity as a CMB Licensing Requirement

Cybersecurity is particularly important because a successful cyberattack can cause direct loss of customer assets.

A crypto platform should be capable of preventing and responding to:

• account takeovers;
• insider attacks;
• malware;
• API compromise;
• private-key theft;
• database attacks;
• unauthorised withdrawals;
• denial-of-service events.

The information-security framework should therefore be designed with a financial-institution standard of resilience.

Launching first and attempting to retrofit security before an operating-permission application is a high-risk strategy.

20. Customer Asset Segregation

One of the most important regulatory principles concerns the separation of customer assets from the institution’s own assets.

The CMB framework is intended to ensure that customer crypto holdings are not treated as the trading platform’s own commercial inventory.

CASPs therefore require systems capable of identifying:

• platform assets;
• customer assets;
• customer-by-customer balances;
• relevant blockchain wallets;
• custody positions.

This requires coordination between:

• accounting;
• blockchain records;
• internal ledgers;
• custody systems.

An exchange should be capable of demonstrating at any time which assets belong to which customers.

21. Crypto Custody Requirements

Custody is one of the most technically complex parts of the Turkish licensing regime.

The regulatory system distinguishes between the trading platform and the authorised custody structure.

A platform seeking operating authorization must therefore design custody from the beginning rather than treating it as an issue that can be solved after licensing.

The importance of custody is also reflected in the current transition arrangements.

On 26 March 2026, the CMB extended the timetable concerning the deadlines for platforms to execute and submit custody agreements and the period for entities on the transitional operating list to obtain authorization certificates. Rather than fixing an immediate new date, the CMB decided that the relevant periods would be determined after CMB-authorised custody institutions begin providing custody services to platforms on a sufficiently widespread basis.

This remains a critical current compliance issue as of July 2026.

22. First Crypto Custody Operating Permissions in 2026

A significant development occurred in June 2026.

In CMB Bulletin 2026/34, the CMB approved operating-permission applications allowing:

• Akbank T.A.Ş.;
• Türkiye Garanti Bankası A.Ş.; and
• Yapı ve Kredi Bankası A.Ş.

to act as crypto asset custody institutions.

This is particularly important for the practical development of the permanent CASP licensing system because wider availability of authorised custody services is directly connected with the transition timetable announced by the CMB in March 2026.

23. Proof-of-Reserves Audits

One of the distinctive requirements of the Turkish crypto framework is proof-of-reserves auditing.

The CMB adopted detailed audit principles in May 2025.

Under those rules, proof-of-reserves audits are carried out periodically and include review of customer crypto balances, platform wallet addresses and custody models.

The CMB principles require auditors to examine enough crypto assets to cover at least 80% of total customer crypto balances while including at least the ten assets with the largest balances.

The relevant assets included within the audit must be verified, and reporting must compare customer records with the assets evidenced through the applicable systems.

Proof of reserves is therefore not merely a marketing feature in Türkiye.

It is part of the formal regulatory audit structure.

24. Proof of Reserves Is Not the Same as Financial Audit

These concepts should be distinguished.

A financial audit examines the institution’s financial statements and accounting environment.

A proof-of-reserves audit focuses specifically on the existence and reconciliation of customer crypto assets.

A CASP may therefore be subject to several different forms of assurance, including:

• financial audit;
• information systems audit;
• proof-of-reserves audit;
• internal audit.

Founders should budget for these continuing compliance costs before applying.

25. Record-Keeping Requirements

A regulated CASP must maintain reliable records.

The CMB framework expressly regulates document and record systems.

Records may need to cover:

• customer accounts;
• orders;
• transaction history;
• crypto transfers;
• wallet addresses;
• custody records;
• internal approvals;
• listing decisions;
• complaints;
• compliance investigations.

The fact that a transaction exists on a public blockchain does not replace the institution’s regulatory record-keeping obligations.

The company must still connect blockchain activity with identifiable customer and accounting records.

26. Crypto Asset Listing Requirements

Listing a token on a Turkish platform is not merely a commercial decision.

Communiqué III-35/B.2 expressly regulates the listing of crypto assets on platforms.

The institution should maintain written policies covering:

• admission criteria;
• legal classification;
• technology risk;
• conflicts of interest;
• liquidity;
• project risks;
• ongoing monitoring;
• delisting.

The exchange should also evaluate whether a crypto asset may legally qualify as another type of regulated capital-market product.

A product described as a “token” does not automatically fall outside securities or capital-markets regulation.

27. Market Surveillance

Crypto platforms are expected to protect market integrity.

This means they should not only monitor AML risks but also identify suspicious trading patterns capable of manipulating market prices.

Potential concerns include:

• wash trading;
• artificial volume;
• coordinated trading;
• pump-and-dump activity;
• abusive order placement;
• unusual price movements.

Market-abuse surveillance and AML monitoring are separate compliance functions.

A transaction may be suspicious from a market-integrity perspective even where it does not involve money laundering.

28. Restrictions on Leveraged Crypto Products

Foreign crypto groups should be especially careful when importing their international product catalogue into Türkiye.

A product lawfully offered in another jurisdiction may not be permissible under the Turkish CASP framework.

The CMB regime contains restrictions concerning leveraged, credit-based and certain derivative structures in crypto markets.

A platform should therefore separately analyse products such as:

• margin trading;
• perpetual products;
• crypto derivatives;
• credit-funded crypto positions.

A global platform may need a Türkiye-specific product offering.

29. Investment Advisory Services

Crypto investment advice can also fall within a regulated framework.

For 2026, the CMB increased the relevant minimum customer crypto-asset value for the investment-advisory framework under Article 15/1 of Communiqué III-35/B.2 to:

TRY 60,000,000

The previous base amount was TRY 50 million.

This is particularly relevant to platforms implementing:

• personalised portfolio recommendations;
• AI-generated trading suggestions;
• automated asset allocation;
• individual token recommendations.

Calling a service an “AI assistant” does not necessarily prevent the service from constituting regulated investment advice.

30. Automated Crypto Transfer Approval Threshold

Another monetary threshold was revalued for 2026.

Under Article 30/3 of Communiqué III-35/B.2, the maximum customer transfer request capable of being approved through fully automated processes is:

TRY 1,250,000

for 2026.

This illustrates how detailed the operational regulatory framework has become.

Crypto platforms should ensure their withdrawal and transfer architecture is updated annually where relevant thresholds are revalued.

31. MASAK Compliance Is Separate From CMB Licensing

A CMB operating licence does not eliminate the institution’s obligations under anti-money laundering legislation.

CASPs are subject to Turkish AML requirements administered by MASAK.

MASAK updated its dedicated Crypto Asset Service Providers Guide on 30 September 2025.

The updated guide addresses, among other things:

• customer identification;
• customer due diligence;
• remote identification;
• enhanced measures;
• Travel Rule requirements;
• crypto transfer restrictions;
• politically exposed persons;
• suspicious transaction reporting;
• compliance programmes.

Therefore, the CMB and MASAK compliance workstreams should be developed together.

32. Know Your Customer Requirements

Customer identification is a fundamental requirement for a Turkish CASP.

A compliant KYC programme may need to identify and verify:

• individual customers;
• corporate customers;
• representatives;
• beneficial owners.

The institution should also perform customer risk classification.

Higher-risk relationships may require additional information and enhanced review.

For crypto businesses, risk analysis may consider:

• geographic exposure;
• transaction patterns;
• wallet risk;
• business activity;
• sanctions;
• PEP status;
• source of funds.

A successful onboarding experience should therefore balance customer convenience with legally sufficient verification.

33. Remote Customer Identification

Crypto platforms largely operate digitally.

Türkiye therefore permits remote customer identification within the applicable regulatory framework.

MASAK’s updated guidance expressly addresses remote identification for CASPs.

Remote onboarding should not be understood as simply asking a customer to upload an identity document.

The process must implement legally compliant verification and fraud-prevention controls.

The product and compliance teams should therefore design the onboarding system together.

34. Travel Rule Compliance

The Crypto Travel Rule is now an important component of Turkish AML compliance.

The Travel Rule requires regulated providers to obtain and transmit specified information concerning parties to crypto transfers in accordance with the applicable thresholds and procedures.

MASAK’s current CASP guide expressly includes Travel Rule compliance among the matters regulated for crypto asset service providers.

Accordingly, the technical transfer infrastructure should be capable of dealing with:

• originator data;
• beneficiary data;
• counterparty service providers;
• wallet information;
• compliance screening.

A crypto transfer cannot always be treated as merely “send asset to blockchain address.”

35. Politically Exposed Persons and Enhanced Measures

CASPs should also establish controls for politically exposed persons (“PEPs”).

MASAK’s current guidance expressly includes PEP relationships and enhanced due diligence within the crypto compliance framework.

Relevant procedures may involve:

• identifying PEP status;
• senior-level approval;
• source-of-funds checks;
• enhanced monitoring;
• periodic review.

Similar enhanced measures may be required for other higher-risk relationships.

36. Suspicious Transaction Reporting

Crypto asset service providers must also detect and report suspicious transactions.

Potential indicators may involve:

• fraud;
• ransomware payments;
• darknet activity;
• unexplained high-value transfers;
• sanctions evasion;
• rapid layering between wallets;
• suspicious use of multiple customer accounts.

A CASP therefore needs both technological transaction-monitoring systems and trained compliance personnel capable of interpreting alerts.

AML automation should assist professional judgment rather than replace it.

37. Personal Data Protection

CASPs also process substantial amounts of personal data.

Typical information may include:

• identity information;
• photographs and verification data;
• financial information;
• wallet addresses;
• transaction history;
• device information;
• IP addresses;
• fraud indicators;
• compliance records.

Therefore, Law No. 6698 on the Protection of Personal Data (“KVKK”) must be considered alongside CMB and MASAK regulation.

A platform should establish:

• privacy notices;
• legal grounds for processing;
• retention rules;
• data security;
• processor agreements;
• data subject procedures;
• international transfer mechanisms where required.

Compliance information obtained for AML purposes may be subject to specific retention and confidentiality considerations.

38. Foreign Crypto Platforms Targeting Turkey

Foreign exchanges should not assume that operating through an overseas company eliminates Turkish regulatory jurisdiction.

The CMB’s July 2024 implementation announcement identified activities indicating that an overseas crypto platform is targeting persons resident in Türkiye.

These include:

• establishing a workplace in Türkiye;
• operating a Turkish-language website;
• conducting promotional or marketing activity directly toward Turkish residents;
• carrying out marketing through persons or organisations located in Türkiye.

A foreign platform should therefore review Turkish-facing activity before launch.

Using Turkish influencers, affiliates, customer support or marketing may create regulatory exposure even where the platform’s servers remain outside Türkiye.

39. A Foreign Crypto Licence Does Not Automatically Apply in Turkey

A licence issued abroad does not automatically create Turkish authorization.

For example, a company licensed under another jurisdiction’s crypto regime cannot assume that its authorisation provides a passport into Türkiye.

Where services are directed toward Turkish residents, the Turkish CMB framework must be separately analysed.

This is particularly relevant for groups licensed in jurisdictions such as:

• EU Member States;
• the United Kingdom;
• the UAE;
• Switzerland;
• Singapore;
• the United States.

International licensing should be approached jurisdiction by jurisdiction.

40. The CMB “Operating Entities List” Is Not a Licence

This is one of the most important current due diligence issues.

The CMB maintains a Faaliyette Bulunanlar Listesi, translated broadly as the List of Operating Entities.

However, the CMB expressly describes this list as a temporary list established under provisional Article 11 of Capital Markets Law No. 6362.

Most importantly, the CMB states clearly that inclusion in the list does not mean that the relevant entity has been authorised under the applicable legislation.

Therefore, investors and customers should never use public-list inclusion alone as proof that a CASP holds final operating permission.

41. Why the Transitional List Matters in M&A

This distinction becomes critical when purchasing an existing Turkish crypto company.

A target may:

• appear on the transitional list;
• have applied for operating permission;
• have establishment approval;
• be awaiting custody arrangements;
• hold final permission for a particular activity.

These are different regulatory statuses.

Due diligence should therefore request:

• CMB decisions;
• applications;
• deficiency letters;
• custody documentation;
• regulatory correspondence;
• audit reports.

The legal value of a target company’s regulatory position depends upon what authorisations it actually holds.

42. The Current Transitional Position in 2026

The Turkish licensing regime is now permanent in legislation, but certain transitional implementation issues remain.

On 26 March 2026, the CMB postponed the determination of deadlines concerning:

• submission of platform custody agreements; and
• the period for entities on the transitional list to obtain their authorization certificates.

The CMB decided that these periods would be determined after authorised custody providers begin providing custody services to platforms on a widespread basis.

The June 2026 authorisations of Akbank, Garanti and Yapı Kredi as crypto custody institutions represent an important practical step in that direction.

Businesses should therefore verify the latest CMB announcements at the date of any transaction or application.

43. Application Documentation

The CMB requires CASP applications to use its current application forms.

The regulator expressly warns that applications containing missing information or documentation, or documents that do not conform to required formats, will not be processed.

Current establishment documentation includes matters such as:

• establishment application;
• notarised declarations;
• individual shareholder declarations;
• corporate shareholder declarations;
• notarised undertakings;
• supporting documents.

For regulated financial licences, document quality is therefore part of the application strategy.

An incomplete file does not merely create inconvenience; it may prevent the application from entering substantive review.

44. Practical CMB Licensing Process

A CASP licensing project can broadly be structured as follows.

Step 1 – Determine the Regulated Services

Identify whether the project involves a platform, custody institution or other regulated crypto activity.

Step 2 – Design the Ownership Structure

Identify founders, shareholders and ultimate beneficial owners.

Step 3 – Verify Financial Eligibility

Ensure investors possess both the regulatory suitability and financial capacity necessary for the project.

Step 4 – Prepare Capital

For 2026, plan for at least TRY 250 million for a platform or TRY 630 million for a custody institution, subject to additional requirements.

Step 5 – Prepare the Establishment Application

Use the CMB’s current documents and forms.

Step 6 – Incorporate the Appropriate Entity

Complete the corporate establishment consistently with the regulatory approval process.

Step 7 – Establish Management and Governance

Appoint appropriate directors, managers and responsible personnel.

Step 8 – Establish Internal Systems

Create internal control, risk management and internal audit functions.

Step 9 – Build Information Systems

Implement secure, auditable trading, wallet and transaction infrastructure.

Step 10 – Establish Custody

Implement legally compliant custody arrangements.

Step 11 – Establish MASAK Compliance

Create KYC, AML, PEP, sanctions, Travel Rule and suspicious transaction systems.

Step 12 – Complete Required Audits

Ensure the institution can satisfy information-system, independent and proof-of-reserves audit requirements.

Step 13 – Apply for Operating Permission

Submit the operational file showing actual regulatory readiness.

Step 14 – Commence Regulated Activity Only After Authorization

The institution should not treat establishment approval as permission to begin customer-facing regulated operations.

45. CASP Licensing Checklist for Turkey

Before filing a Crypto Asset Service Provider licence application in Turkey, founders should verify the following:

Corporate Form:
Is the company structured as the appropriate Turkish joint-stock company?

Capital:
Does the institution satisfy the applicable 2026 capital requirement?

Shareholders:
Are direct and indirect shareholders suitable?

Ultimate Ownership:
Can the ultimate controlling persons be clearly identified?

Management:
Are qualified managers and personnel in place?

Internal Control:
Has a functioning control system been established?

Risk Management:
Does the institution monitor crypto-specific financial and operational risks?

Internal Audit:
Can controls be independently tested?

Information Systems:
Is the infrastructure secure and auditable?

Cybersecurity:
Are wallet and key-management risks properly controlled?

Custody:
Has the institution established a compliant custody model?

Customer Asset Segregation:
Can customer assets be clearly distinguished from company assets?

Proof of Reserves:
Can the institution satisfy the CMB audit framework?

Token Listing:
Are formal listing and delisting procedures operational?

Market Surveillance:
Can suspicious or manipulative trading behaviour be detected?

MASAK:
Is the AML programme fully operational?

Remote KYC:
Does onboarding comply with applicable identification requirements?

Travel Rule:
Can required information accompany crypto transfers?

KVKK:
Is customer data lawfully processed and protected?

Frequently Asked Questions About CASP Licensing in Turkey

Who licenses Crypto Asset Service Providers in Turkey?

The Capital Markets Board of Türkiye regulates and authorises CASPs under Capital Markets Law No. 6362 and Communiqués III-35/B.1 and III-35/B.2.

What is the minimum capital for a crypto platform in 2026?

The minimum establishment capital for a crypto trading platform is TRY 250 million in 2026.

What is the minimum capital for a crypto custody institution?

The minimum establishment capital for a custody institution is TRY 630 million for 2026.

Are there additional capital requirements for custody businesses?

Yes. For 2026, the relevant customer-asset threshold triggering the 1.5% additional equity rule is TRY 1.25 billion, while the equity threshold at which that additional requirement ceases is TRY 1.9 billion.

Is CMB establishment permission enough to begin operating?

No. The CMB framework separates establishment and operating-permission processes.

Does every company on the CMB Operating Entities List have a licence?

No. The CMB expressly states that the list is temporary and that inclusion does not mean that an institution has been authorised.

Have any crypto custody institutions received operating permission?

Yes. In June 2026, the CMB approved Akbank, Türkiye Garanti Bankası and Yapı ve Kredi Bankası to operate as crypto asset custody institutions.

Does a CASP need proof-of-reserves audits?

The CMB’s regulatory framework requires periodic proof-of-reserves auditing and has published detailed principles governing the audit process.

Are CASPs subject to MASAK?

Yes. MASAK’s current CASP guidance covers customer identification, remote onboarding, enhanced measures, the Travel Rule, PEPs, suspicious transaction reporting and compliance programmes.

Can foreign shareholders own a Turkish CASP?

Foreign investment may be possible, but the Turkish entity, ownership structure and qualifying shareholders remain subject to CMB requirements.

Can a foreign crypto exchange simply use its overseas licence in Turkey?

A foreign licence does not automatically create Turkish authorisation. In particular, actively targeting Turkish residents may trigger Turkish regulatory requirements.

Conclusion: Obtaining a Crypto Asset Service Provider License in Turkey

The establishment of a Crypto Asset Service Provider in Turkey is now a comprehensive capital-markets licensing project.

Türkiye’s regulatory structure has evolved rapidly since Law No. 7518 entered into force on 2 July 2024.

The introduction of Communiqués III-35/B.1 and III-35/B.2 in March 2025 created a detailed regulatory framework covering virtually every major component of institutional crypto activity, from incorporation and shareholder eligibility to information systems, custody and proof-of-reserves auditing.

For investors, the first major consideration is financial capacity.

As of 2026:

crypto trading platforms require minimum establishment capital of TRY 250 million, while

crypto custody institutions require minimum establishment capital of TRY 630 million.

Custody institutions can also become subject to additional equity obligations as customer assets under custody increase.

Financial capital, however, represents only one component of CMB readiness.

A CASP must also demonstrate a suitable shareholder structure, qualified management, functioning internal control, internal audit and risk management systems, appropriate information technology, cybersecurity and customer-asset protection.

Custody has become particularly central to the permanent regulatory model.

The CMB’s March 2026 decision confirms that transitional deadlines for custody agreements and authorisation certificates are linked to the widespread availability of CMB-authorised crypto custody services.

The regulatory landscape advanced significantly again in June 2026, when Akbank, Türkiye Garanti Bankası and Yapı ve Kredi Bankası received CMB approval to operate as crypto asset custody institutions.

For applicants, this means that the custody structure should not be treated as a secondary matter.

It is an integral component of operating permission.

The same applies to technology.

The CMB framework directly regulates information systems and technological infrastructure. A CASP must therefore be capable of demonstrating secure wallet architecture, appropriate access controls, cybersecurity resilience, effective transaction monitoring, record integrity and operational continuity.

Proof-of-reserves auditing creates another important layer.

Under the CMB’s detailed audit principles, customer crypto holdings and platform records are periodically examined against the underlying asset position, with specific requirements concerning audit scope, wallet verification and reporting.

At the same time, a CASP must operate within the MASAK framework.

CMB authorisation and MASAK compliance are complementary rather than alternative regimes.

The institution must therefore establish an AML architecture covering customer identification, remote KYC, enhanced due diligence, PEP screening, suspicious transaction reporting and the Crypto Travel Rule.

International investors must also take a territorial approach to Turkish crypto regulation.

A foreign entity should not assume that an overseas licence permits it to actively serve Turkish residents.

Marketing activity aimed at Türkiye—including Turkish-language services and promotional activity directed toward residents—can create Turkish regulatory exposure.

Due diligence is equally important when acquiring an existing Turkish platform.

As of July 2026, the CMB continues to maintain a transitional Operating Entities List, but expressly warns that inclusion on that list does not constitute regulatory authorisation.

An investor should therefore determine the target company’s exact regulatory position:

Does it merely appear on the transitional list?

Has it obtained establishment permission?

Has it filed an operating application?

Does it have a compliant custody arrangement?

Has final operating authorisation been granted?

These questions can fundamentally affect the value and legal viability of the investment.

For companies seeking to obtain a CASP license in Turkey, establish a crypto exchange, establish a crypto custody provider, acquire an existing crypto platform or expand an international crypto group into Türkiye, the licensing process should be approached as an integrated project combining:

corporate law, capital markets regulation, shareholder structuring, technology, custody, cybersecurity, AML/KYC, data protection and audit readiness.

The most important practical principle is straightforward:

Do not build the complete crypto business first and attempt to fit the licence around it later.

The regulated service, ownership structure, capital plan, wallet architecture, custody arrangement and compliance functions should be designed together from the beginning.

Early regulatory planning can reduce the risk of expensive restructuring, incomplete CMB applications, delayed market entry and regulatory enforcement.

As Turkish crypto regulation continues moving from its transitional phase toward the permanent licensing environment, institutional quality and compliance readiness will increasingly determine which platforms are capable of remaining in the market.

Legal Disclaimer: This publication provides general information concerning Crypto Asset Service Provider licensing and regulation in Türkiye as of July 2026. It does not constitute legal advice. CMB capital thresholds, custody arrangements, transitional deadlines, MASAK requirements and other regulatory standards may change. Each proposed crypto platform, custody institution or cross-border crypto business should be assessed individually under the legislation and regulatory decisions applicable at the relevant time.