Introduction

Establishing a crypto exchange in Turkey has changed fundamentally following the introduction of a comprehensive regulatory framework for crypto asset service providers.

Before July 2024, Türkiye did not operate a dedicated licensing regime comparable to the framework now applicable to cryptocurrency trading platforms. This changed with Law No. 7518 Amending the Capital Markets Law, which entered into force on 2 July 2024 and placed crypto asset service providers under the regulatory and supervisory authority of the Capital Markets Board of Türkiye (“CMB” or “SPK”).

The regulatory architecture was substantially completed on 13 March 2025, when two major communiqués entered into force:

Communiqué No. III-35/B.1 on the Establishment and Operating Principles of Crypto Asset Service Providers, and

Communiqué No. III-35/B.2 on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers.

These rules transformed crypto exchange activity from what was previously largely a technology-driven commercial business into a regulated financial-services activity requiring substantial capital, governance, internal control, technological infrastructure, custody arrangements and compliance systems.

For investors asking how to establish a crypto exchange in Turkey in 2026, the most important point is therefore that ordinary company incorporation is only the beginning.

A new crypto exchange must generally consider:

• CMB establishment permission;
• CMB operating permission;
• minimum regulatory capital;
• qualifying shareholder requirements;
• management qualifications;
• internal control and risk management;
• information systems;
• cybersecurity;
• crypto custody;
• customer asset segregation;
• token listing procedures;
• market surveillance;
• MASAK AML/KYC obligations;
• remote customer identification;
• Travel Rule compliance;
• Turkish personal data protection rules.

Furthermore, the 2026 regulatory thresholds are materially higher than the amounts originally introduced in 2025.

For 2026, the minimum establishment capital applicable to a crypto trading platform has been increased to:

TRY 250,000,000

The CMB’s official 2026 monetary-threshold decision expressly confirms this amount.

This article explains, step by step, how a new cryptocurrency exchange can be structured and licensed in Türkiye under the current regulatory framework.

1. Is Operating a Crypto Exchange a Regulated Activity in Turkey?

Yes.

Operating a crypto exchange is now a regulated activity under Turkish capital markets legislation.

The CMB has explained that activities involving crypto-asset:

• buying and selling;
• exchange;
• transfer;
• custody necessary for these activities;
• custody and administration of crypto assets;
• custody and administration of private keys providing the right to transfer assets from crypto wallets

fall within the regulated framework when carried out professionally, commercially or as a regular occupation.

Accordingly, a business cannot avoid regulation merely by describing itself as:

• a blockchain technology company;
• cryptocurrency marketplace;
• digital asset marketplace;
• wallet provider;
• Web3 application.

The legal analysis depends on the service actually provided.

Where customers can commercially buy, sell, exchange or transfer crypto assets through the company’s infrastructure, the platform is likely to fall within the CMB crypto asset service provider framework.

2. Who Regulates Crypto Exchanges in Turkey?

The principal regulator is the Capital Markets Board of Türkiye.

Following Law No. 7518, the CMB has authority to regulate and supervise crypto asset service providers under Capital Markets Law No. 6362.

The CMB has also established a dedicated Financial Technologies Department.

Its responsibilities include:

• determining establishment and operating principles for crypto asset service providers;
• reviewing applications;
• authorising providers;
• publishing regulatory lists;
• monitoring capital adequacy;
• supervising operational requirements;
• investigating conduct capable of disrupting the secure and transparent operation of crypto markets.

The Financial Crimes Investigation Board (“MASAK”) separately supervises anti-money laundering and counter-terrorist-financing obligations.

Therefore, establishing a crypto exchange involves at least two major compliance dimensions:

CMB financial-market regulation, and

MASAK AML/KYC regulation.

3. Main Legislation for Establishing a Crypto Exchange in Turkey

The principal legal instruments are:

Capital Markets Law No. 6362

As amended by Law No. 7518, the Capital Markets Law creates the statutory basis for regulation of crypto asset service providers.

Communiqué III-35/B.1

This regulates establishment and operating principles.

It covers matters including:

• establishment;
• operating permissions;
• shareholders;
• share transfers;
• managers;
• personnel;
• organisational structure;
• internal controls;
• risk management;
• internal audit;
• information systems;
• independent audits.

Communiqué III-35/B.2

This regulates operational requirements and capital adequacy.

It deals with matters including:

• crypto trading;
• custody;
• transfers;
• customer orders;
• settlement;
• token listing;
• initial sales and distributions;
• investment advisory limitations;
• capital requirements.

The CMB confirms that both communiqués entered into force on 13 March 2025.

4. First Step: Determine Exactly What Services the Exchange Will Provide

Before incorporating the company, founders should determine the exact scope of the proposed crypto business.

A crypto platform may intend to provide:

• fiat-to-crypto trading;
• crypto-to-crypto trading;
• crypto transfers;
• brokerage;
• order matching;
• wallet functionality;
• token listing;
• token distribution;
• custody;
• investment advisory services.

Different services may create different regulatory obligations.

For example, operating a trading platform is legally different from establishing a standalone crypto custody institution.

This matters significantly because custody providers are subject to separate and substantially higher minimum capital requirements.

For 2026, the minimum establishment capital is:

TRY 250 million for a crypto trading platform, and

TRY 630 million for a crypto custody provider.

Therefore, founders should define the business model before determining corporate capital and technological infrastructure.

5. Establish the Company as a Turkish Joint-Stock Company

A regulated crypto trading platform must be structured as a Turkish joint-stock company, known as an anonim şirket or A.Ş.

The regulatory framework requires a platform to satisfy corporate conditions including:

• incorporation as a joint-stock company;
• registered shares;
• shares issued against cash;
• regulator-compliant articles of association;
• a transparent ownership structure;
• eligible founders;
• an appropriate board structure.

Earlier CMB establishment principles expressly required the company’s trade name to include the expression “kripto varlık alım satım platformu”, and required its corporate purpose to be focused on crypto trading and associated regulated activities.

The current establishment application should therefore be prepared directly around the CMB regulatory model rather than by first incorporating an ordinary software company and attempting to restructure it later.

6. Minimum Capital for a Crypto Exchange in Turkey in 2026

The financial requirement is one of the most important barriers to market entry.

When the secondary rules were introduced in March 2025, the minimum establishment capital for platforms was TRY 150 million.

However, the CMB updated the relevant monetary thresholds for 2026.

Under the CMB’s 31 December 2025 decision concerning 2026 monetary limits, the minimum establishment capital under Article 34/1 of Communiqué III-35/B.2 is:

TRY 250,000,000

for crypto asset trading platforms.

This amount should not be interpreted as the complete cost of establishing an exchange.

The company will also require resources for:

• software infrastructure;
• cybersecurity;
• qualified personnel;
• office operations;
• independent audits;
• CMB compliance;
• MASAK compliance;
• market surveillance;
• customer support;
• custody;
• legal expenses;
• accounting;
• business continuity.

Consequently, the commercially realistic funding requirement will generally be materially higher than the legal minimum capital.

7. Capital Adequacy Must Continue After Licensing

Regulatory capital is not merely an entry requirement.

Communiqué III-35/B.2 also creates continuing capital adequacy rules.

A platform must therefore monitor its financial strength throughout operations.

Rapid growth in customer balances, business volume or operational exposure may create increased financial and compliance obligations.

From an investment perspective, this means the founders should prepare both:

initial establishment funding, and

long-term regulatory capital planning.

A business plan that commits almost the entire TRY 250 million to technology development or marketing without preserving regulatory financial capacity may create serious difficulties.

8. Who Can Be a Shareholder of a Turkish Crypto Exchange?

The CMB does not examine only the company.

It also examines its owners.

Applicants must provide detailed documentation concerning prospective shareholders. The CMB’s current application page includes separate notarised declarations concerning proposed individual and corporate shareholders.

Regulatory review may concern:

• criminal history;
• bankruptcy;
• insolvency;
• financial standing;
• business reputation;
• ownership in failed financial institutions;
• ultimate beneficial ownership;
• source of funds;
• direct and indirect control.

This means shareholders should be selected before the application based not only on their ability to invest capital, but also on regulatory suitability.

9. Foreign Shareholders Can Invest in a Turkish Crypto Exchange

Foreign ownership is not automatically prohibited.

International crypto groups, funds and corporate investors may potentially participate in Turkish crypto companies subject to the CMB’s shareholder eligibility requirements.

However, foreign investors should prepare for enhanced documentary requirements.

Documents may need to establish:

• corporate existence;
• directors;
• ultimate ownership;
• financial strength;
• regulatory background;
• source of funds;
• direct and indirect controlling persons.

Foreign documents may also need to satisfy Turkish notarisation, apostille, translation or authentication requirements depending on their origin and use.

A transparent shareholder structure is generally preferable to complicated chains involving multiple offshore holding companies.

10. Share Transfers After Licensing Require Regulatory Planning

A crypto exchange should not be treated like a conventional startup when raising investment.

Post-establishment changes in share ownership can create CMB approval or notification obligations.

This is particularly important for:

• venture capital rounds;
• strategic investments;
• M&A transactions;
• founder exits;
• group reorganisations.

Investment agreements should therefore contain regulatory conditions precedent where necessary.

A transaction should not be closed merely because the shareholders signed the share purchase agreement.

CMB approval requirements should first be identified.

11. Prepare the CMB Establishment Application

The CMB maintains a dedicated application process for new crypto asset service providers.

Its current application page includes documents for new platform and custody-provider establishments, including:

• establishment permission petition;
• notarised declarations;
• declarations concerning proposed individual shareholders;
• declarations concerning proposed corporate shareholders;
• notarised undertakings;
• supporting-document lists.

The CMB expressly warns that applications containing missing documents or failing to comply with the required format will not be processed.

Therefore, application preparation should be completed before filing rather than through repeated incomplete submissions.

12. Establishment Permission Is Not the Same as Operating Permission

This is one of the most important legal distinctions.

A company that obtains permission to establish a crypto exchange does not automatically become entitled to launch commercial trading.

The regulatory structure separates:

Establishment Permission

The CMB permits establishment of the institution based on its corporate, shareholder and proposed organisational structure.

Operating Permission

The CMB subsequently assesses whether the company has completed the operational requirements necessary to provide crypto services.

The CMB’s current application page expressly maintains separate sections for establishment applications and operating-permission applications.

This means:

Incorporating the company is not enough.

Receiving establishment approval is not enough.

The exchange should commence customer-facing regulated activity only after the necessary operating authorisation becomes legally effective.

13. New Crypto Exchange Establishments Are Possible

The permanent framework is being used for new entrants.

For example, in March 2026, the CMB approved the establishment application for a new platform under the Yapı Kredi group using the proposed trade name Yapı Kredi Kripto Varlık Alım Satım Platformu A.Ş.

This is significant for investors because it demonstrates that the Turkish regulatory framework is not limited only to exchanges that were already operating before the 2024 reforms.

New regulated crypto exchange projects can be submitted.

14. Management Structure

The exchange must establish a management structure proportionate to the scale and risk of the business.

This should include appropriate responsibility for:

• executive management;
• compliance;
• risk management;
• internal control;
• information systems;
• security;
• finance;
• operations.

The board should not function like the board of an early-stage software startup whose main responsibility is fundraising and product strategy.

It is the governing body of a regulated financial institution.

Management must therefore understand:

• financial regulation;
• crypto-market risk;
• cybersecurity;
• customer asset protection;
• compliance.

15. Internal Control System

A Turkish crypto exchange should establish an independent and effective internal control system.

The function should monitor whether day-to-day operations comply with:

• CMB regulations;
• internal policies;
• customer asset rules;
• AML procedures;
• risk-management controls;
• security requirements.

Examples of matters requiring internal controls include:

• withdrawal authorisation;
• token listing;
• customer asset reconciliation;
• employee access to wallets;
• privileged system access;
• suspicious transactions;
• conflicts of interest.

Internal control should therefore be designed before the operating application.

16. Risk Management System

A crypto exchange faces risks substantially different from an ordinary securities broker.

The risk management function should consider at least:

• cyberattack risk;
• wallet compromise;
• private key loss;
• liquidity risk;
• operational risk;
• token volatility;
• market manipulation;
• fraud;
• counterparty exposure;
• outsourcing risk;
• business continuity.

Communiqué III-35/B.1 specifically includes internal control, internal audit and risk management among the regulatory functions applicable to CASPs.

A generic corporate risk policy is therefore unlikely to be sufficient.

17. Internal Audit

Internal audit provides an additional line of defence.

Its purpose is to test whether the institution’s operations and controls are genuinely functioning.

An internal audit programme may examine:

• KYC procedures;
• withdrawal approvals;
• customer asset segregation;
• wallet management;
• employee access;
• cybersecurity;
• risk limits;
• financial controls.

Audit findings should be capable of being escalated to senior management and the board.

18. Build the Information Systems Before Applying for Final Operating Permission

Technology is a regulatory requirement.

The CMB’s Information Systems Department is responsible for regulating and auditing the information systems of crypto asset service providers and evaluating independent information-system audit reports.

A platform should therefore establish banking-grade and capital-markets-grade technology rather than a standard consumer application.

Important areas include:

• identity and access management;
• customer authentication;
• privileged access;
• transaction signing;
• database security;
• network security;
• encryption;
• logs;
• intrusion monitoring;
• cyber-incident response;
• disaster recovery;
• backup;
• business continuity.

The technological infrastructure should be operational and auditable.

19. Hot Wallet and Cold Wallet Architecture

Crypto custody creates unique security risks.

A platform generally needs to balance liquidity against security through the use of hot wallets and cold wallets.

Communiqué III-35/B.2 introduced specific principles concerning hot and cold wallet use and customer-asset security. The CMB’s official 2025 activity report confirms that the regulation addresses customer/platform asset separation, customer-level tracking and security requirements concerning hot and cold wallets.

Hot wallets provide operational liquidity but are generally exposed to greater cyber risk.

Cold wallets improve protection but may reduce immediate accessibility.

The wallet architecture should therefore be designed according to regulatory and operational risk principles.

20. Customer Assets Must Be Separated From Platform Assets

One of the most important investor protection principles is asset segregation.

Customer crypto assets should not be treated as the exchange’s own assets.

The CMB framework requires:

• separation between platform assets and customer assets;
• customer-level tracking;
• reconciliation;
• appropriate custody controls.

This affects:

• accounting;
• wallet architecture;
• custody contracts;
• daily reconciliation;
• internal control.

A platform should always be capable of determining which crypto asset belongs to which customer.

21. Crypto Custody Arrangements

The Turkish model creates a regulated custody structure.

Platforms need to consider whether customer assets are held:

• within permitted platform wallet arrangements;
• through authorised custody institutions;
• through another legally permissible structure.

Custody rules remain one of the key transitional areas in 2026.

On 26 March 2026, the CMB decided that the deadlines for platforms to sign and submit custody agreements and for entities on the transitional Operating Entities List to obtain authorisation certificates would be determined after CMB-authorised custodians begin providing crypto custody services to platforms on a sufficiently widespread basis.

Therefore, the current custody framework must be checked at the actual date of a licence application.

22. Do Not Confuse the CMB Operating List With a Licence

The CMB publishes a List of Operating Entities.

However, this is currently expressly described as a temporary list.

The CMB states clearly that inclusion in the list does not mean that the entity has been authorised under the relevant legislation.

This is especially important when:

• acquiring an existing exchange;
• partnering with another platform;
• conducting due diligence.

A company appearing on the SPK website may still be operating within a transitional framework rather than under final authorisation.

The precise regulatory status should be verified independently.

23. Token Listing Procedures

A new exchange must establish a formal listing and delisting policy.

Token listing cannot be based only on popularity, trading volume or commercial fees.

The CMB framework regulates the listing of crypto assets and requires platforms to operate within formal listing standards.

A legal and technical listing review should consider issues such as:

• project structure;
• blockchain technology;
• token functionality;
• decentralisation;
• market liquidity;
• cybersecurity;
• conflicts of interest;
• regulatory classification.

Particular caution is required where the token may legally qualify as a capital market instrument or represent financial rights.

24. Market Surveillance Must Be Built Into the Exchange

Traditional crypto markets are vulnerable to practices such as:

• wash trading;
• spoofing;
• pump-and-dump schemes;
• artificial volume;
• coordinated trading.

The Turkish regime requires regulated platforms to establish price-surveillance systems and mechanisms for detecting market-disruptive activity.

Therefore, a crypto exchange needs surveillance infrastructure in addition to ordinary transaction matching.

The compliance team should have escalation procedures when suspicious market conduct is detected.

25. Leveraged Crypto Trading Is Restricted

A foreign exchange entering the Turkish market cannot automatically replicate every product offered internationally.

The CMB regulatory framework prohibits leveraged, credit-based and derivative crypto transactions within the relevant regulated platform framework.

Accordingly, services involving:

• leveraged crypto trading;
• margin lending;
• derivatives;
• similar high-risk structures

must be analysed carefully before being offered in Türkiye.

The Turkish product catalogue may therefore need to differ materially from the exchange’s global product catalogue.

26. Crypto Investment Advisory Services

Platforms should also distinguish general market commentary from regulated investment advice.

For 2026, the CMB increased the minimum crypto-asset value that a customer must hold with the platform in order to receive the regulated investment-advisory service contemplated by the crypto regulation to:

TRY 60 million.

This is particularly important for automated advisory tools.

A feature described as:

• AI investment assistant;
• portfolio recommendation engine;
• personalised token recommendation

may potentially create regulatory issues depending upon how personalised and directive the service becomes.

27. Independent Audits

Regulated exchanges are subject to independent audit requirements.

The audit framework may include:

• financial audit;
• information systems audit;
• regulatory compliance review;
• proof-of-reserves examination.

A new applicant should therefore design its record-keeping and systems from the beginning so that they can be independently tested.

Attempting to make an unauditable platform compliant immediately before the operating application can create substantial delays.

28. Proof-of-Reserves Requirements

Proof-of-reserves has become a formal part of the Turkish regulatory architecture.

It is intended to provide evidence that assets represented in customer records are actually supported by crypto assets held under the relevant custody structure.

A proof-of-reserves framework may require reconciliation between:

• blockchain wallet balances;
• custody records;
• customer liabilities;
• internal ledgers.

It should therefore be built into the accounting and wallet architecture rather than treated as an occasional marketing exercise.

29. MASAK Registration and AML Compliance

Obtaining CMB permission does not complete the compliance process.

Crypto asset service providers are also subject to Turkish anti-money laundering rules administered by MASAK.

MASAK’s September 2025 Crypto Asset Service Providers Guide specifically addresses:

• customer identification;
• remote identification;
• enhanced measures;
• Travel Rule compliance;
• crypto transfer restrictions;
• PEPs;
• suspicious transaction reporting;
• compliance programmes.

A crypto exchange therefore requires a formal AML compliance architecture from launch.

30. Know Your Customer Requirements

A Turkish crypto exchange should establish procedures capable of verifying its customers.

KYC may include:

• name and identity;
• date of birth;
• Turkish identification number where applicable;
• address;
• beneficial ownership for corporate customers;
• source of funds;
• customer risk profile.

Higher-risk customers may require enhanced controls.

MASAK expressly emphasises a risk-based approach for crypto asset service providers.

31. Remote Customer Onboarding

Crypto exchanges may onboard customers remotely, subject to Turkish remote identity rules.

MASAK amended its regulations on 12 June 2025 specifically to regulate remote identity verification by crypto asset service providers.

Under the current framework, CASPs use specified remote identification methods, and specified identity data is verified through the Ministry of Interior’s identity-sharing database.

Accordingly, a simple upload of an identification-card photograph will generally not constitute a complete regulated onboarding solution.

The platform should integrate proper identity verification into the user flow.

32. Privacy-Focused Crypto Assets Create Additional Risk

MASAK rules contain specific restrictions concerning privacy-based crypto assets.

The current remote identification framework states that crypto asset service providers intermediating the trading or custody of privacy-based crypto assets cannot conduct remote identification in the same manner contemplated for ordinary CASP onboarding.

A platform planning to list privacy coins should therefore perform a separate AML and product-risk assessment.

33. Crypto Travel Rule

The Travel Rule is now a central part of Turkish crypto compliance.

The exchange must be able to obtain and transmit required information concerning persons involved in crypto transfers in accordance with the applicable MASAK framework.

MASAK’s current guidance specifically addresses:

• Travel Rule requirements;
• crypto transfer limits;
• waiting periods;
• customer identification;
• originator and beneficiary information.

This means the exchange’s withdrawal and deposit system must be compliance-aware.

A purely blockchain-address-based system may not be sufficient.

34. Suspicious Transaction Reporting

The platform must also establish procedures for reporting suspicious transactions to MASAK.

A crypto exchange should identify activity potentially involving:

• fraud;
• stolen crypto;
• ransomware;
• layering;
• darknet markets;
• terrorist financing;
• sanctions evasion;
• mule accounts.

Automated blockchain analytics may assist compliance, but responsibility remains with the regulated company.

35. Politically Exposed Persons

Customer screening should include politically exposed persons (“PEPs”) where required.

MASAK’s current crypto guidance includes specific measures concerning business relationships involving politically exposed persons.

The platform’s AML architecture should therefore provide mechanisms for:

• PEP identification;
• management approval;
• enhanced review;
• source-of-funds analysis;
• increased transaction monitoring.

36. Personal Data Protection

Crypto exchanges also fall under Turkish personal data legislation.

Law No. 6698 on the Protection of Personal Data (“KVKK”) applies to customer data such as:

• identity documents;
• contact data;
• financial information;
• IP information;
• device data;
• wallet addresses;
• transaction history;
• fraud data.

The exchange should therefore establish:

• privacy notices;
• legal grounds for processing;
• retention policies;
• processor agreements;
• information-security controls;
• data subject request procedures.

AML retention obligations and privacy law should be coordinated rather than considered separately.

37. Foreign Cloud and Technology Providers

Many crypto exchanges rely on global service providers for:

• cloud infrastructure;
• cybersecurity;
• blockchain analytics;
• customer support;
• CRM;
• identity verification.

Each outsourcing relationship should be reviewed for:

• CMB information-systems requirements;
• security;
• access rights;
• data transfer;
• subcontracting;
• business continuity.

A technology provider acceptable for a general Web3 startup may not automatically be suitable for a CMB-regulated crypto institution.

38. Can a Foreign Crypto Exchange Operate in Turkey Without Establishing a Local Platform?

Active targeting of Turkish customers creates significant regulatory risk.

The Capital Markets Law framework treats services by foreign platforms directed toward persons resident in Türkiye as unauthorised crypto asset service activity where the applicable Turkish requirements are not satisfied.

The CMB has expressly identified the following as indicators that an overseas platform is targeting Turkish residents:

• opening a workplace in Türkiye;
• establishing a Turkish-language website;
• directly marketing crypto services toward Turkish residents;
• marketing through persons or institutions resident in Türkiye.

Therefore, a foreign exchange cannot simply claim that Turkish law is irrelevant because the parent company is incorporated abroad.

39. Foreign Marketing Strategy Must Be Reviewed

The regulatory risk is particularly relevant to:

• Turkish-language social media;
• Turkish influencers;
• Turkish affiliate programmes;
• local sponsorships;
• Turkey-specific advertisements;
• Turkish customer-support teams.

Indeed, the CMB has continued during 2026 to take measures concerning websites identified as providing unauthorised overseas crypto or leveraged services to Turkish residents.

Foreign exchanges should therefore conduct legal review before launching Turkey-specific marketing.

40. A Foreign Crypto Licence Is Not a Turkish Licence

A licence obtained in another jurisdiction does not automatically authorise crypto services in Türkiye.

For example, regulatory permission obtained in:

• the European Union;
• United Kingdom;
• United Arab Emirates;
• United States;
• Switzerland;
• Singapore

does not function as a passport into the Turkish regulated crypto market.

Turkish market access must be analysed separately under Capital Markets Law No. 6362 and the CMB regulations.

41. Can You Buy an Existing Exchange Instead?

An investor may consider acquiring an existing Turkish exchange rather than establishing a new platform.

This can sometimes provide faster access to infrastructure and customers.

However, acquisition requires extensive due diligence.

The investor should determine whether the target:

• has final operating permission;
• merely appears on the transitional list;
• has outstanding regulatory deficiencies;
• satisfies capital requirements;
• has appropriate custody arrangements;
• has passed information-system audits;
• complies with MASAK obligations.

The CMB expressly states that its current Operating Entities List is transitional and does not itself constitute authorisation.

Buying a listed company without checking its precise regulatory status can therefore create substantial risk.

42. Regulatory Due Diligence Checklist for Acquiring a Crypto Exchange

An acquisition review should cover:

CMB Status

Exactly which permissions have been granted?

Shareholders

Will the acquisition require regulatory approval?

Capital

Does the company satisfy 2026 capital requirements?

Custody

Where and how are customer crypto assets held?

Customer Assets

Do blockchain balances reconcile with customer liabilities?

Token Listings

Has the exchange followed compliant listing procedures?

Technology

Have information systems been audited?

Cybersecurity

Has the exchange experienced hacks or material incidents?

MASAK

Is the AML compliance programme functioning?

Travel Rule

Are crypto transfers compliant?

Regulatory Correspondence

Has the company received warnings or deficiency letters?

A regulatory licence should never be valued separately from the liabilities attached to the entity holding it.

43. Step-by-Step Guide to Establishing a Crypto Exchange in Turkey

A practical market-entry process can be summarised as follows.

Step 1: Define the Business Model

Identify precisely which crypto services the platform will provide.

Step 2: Conduct Regulatory Classification

Determine the required CMB authorisations and whether custody will be performed internally or through an authorised institution.

Step 3: Identify Investors and Shareholders

Ensure prospective shareholders satisfy regulatory eligibility requirements.

Step 4: Prepare the Capital

A new platform should plan around the current TRY 250 million minimum establishment capital for 2026.

Step 5: Prepare the Corporate Structure

Design the Turkish joint-stock company, registered shares, trade name and articles of association.

Step 6: Submit the CMB Establishment Application

Use the CMB’s current forms and submit complete supporting documents.

Step 7: Complete Company Incorporation

Once the required regulatory establishment process permits it, complete trade registry incorporation.

Step 8: Appoint Management

Establish qualified management and compliance responsibility.

Step 9: Establish Internal Systems

Create internal control, internal audit and risk management functions.

Step 10: Build Technology

Develop secure trading, wallet, settlement, surveillance and cybersecurity infrastructure.

Step 11: Build Custody Architecture

Establish compliant hot/cold wallet structures and authorised custody arrangements.

Step 12: Establish MASAK Compliance

Implement KYC, AML, PEP, sanctions, transaction monitoring and Travel Rule systems.

Step 13: Prepare Customer Documentation

Draft customer agreements, risk disclosures, privacy notices and platform rules.

Step 14: Establish Token Listing Procedures

Create formal listing and delisting criteria.

Step 15: Complete Audit Requirements

Complete relevant independent, information-system and proof-of-reserves reviews.

Step 16: Apply for Operating Permission

Submit the final CMB operating application and evidence of operational readiness.

Step 17: Launch Only After Authorisation

Do not begin regulated commercial operations before the required permission has become effective.

44. Common Mistakes When Establishing a Crypto Exchange in Turkey

Incorporating Before Regulatory Planning

An ordinary company structure may require costly restructuring.

Underestimating the Capital Requirement

The current platform minimum is TRY 250 million for 2026, not the original TRY 150 million introduced in 2025.

Confusing Establishment Permission With a Licence to Trade

Operating permission is separate.

Confusing the Transitional CMB List With Licensing

The CMB expressly warns that inclusion is not authorisation.

Leaving Custody Until the End

Custody architecture is central to the regulated business.

Ignoring MASAK

CMB approval does not eliminate AML obligations.

Copying an International Product Catalogue

Some services available internationally, including leveraged or credit-based crypto products, are restricted under the Turkish framework.

Launching Turkish Marketing From Abroad

A Turkish-language website or targeted Turkish marketing may bring a foreign platform within Turkish regulatory jurisdiction.

Frequently Asked Questions About Establishing a Crypto Exchange in Turkey

Can I legally establish a crypto exchange in Turkey?

Yes. New crypto trading platforms can apply to the CMB for establishment and operating permission under the current regulatory framework. The CMB approved at least one new platform establishment application in March 2026, confirming that the permanent new-entry framework is operational.

What is the minimum capital for a crypto exchange in Turkey in 2026?

The current minimum establishment capital is TRY 250 million.

Does a crypto exchange need to be an A.Ş.?

The regulatory platform structure requires a Turkish joint-stock company with a regulator-compliant share and corporate structure.

Who issues the crypto exchange licence?

The Capital Markets Board of Türkiye regulates and authorises crypto asset service providers.

Is company incorporation enough?

No.

The CMB regulatory structure distinguishes between establishment and operating processes. Regulated exchange activity should not begin merely because the company has been incorporated.

Can foreigners own a Turkish crypto exchange?

Foreign investors may potentially participate subject to CMB shareholder and ownership requirements. The ownership chain and ultimate beneficial owners must be transparent and regulatory eligibility should be confirmed.

Can a foreign crypto exchange use its existing licence in Turkey?

A foreign licence does not automatically create Turkish authorisation. Active targeting of Turkish residents may constitute unauthorised crypto service provision under Turkish law.

Can a Turkish crypto exchange offer leverage?

The CMB framework restricts leveraged, credit-based and derivative crypto transactions within the regulated platform framework.

Does a crypto exchange need AML/KYC systems?

Yes. MASAK’s crypto guidance requires extensive customer identification, enhanced due diligence, Travel Rule, suspicious transaction reporting and compliance procedures.

Can customers be onboarded remotely?

Yes, subject to the specific remote identification rules applicable to crypto asset service providers.

Does Turkey apply the Travel Rule?

Yes. MASAK’s current CASP guidance specifically addresses the Travel Rule and crypto-transfer controls.

Is every exchange on the CMB website fully licensed?

No. The current “Operating Entities List” is expressly described as temporary, and inclusion does not itself mean that an entity has been authorised.

Conclusion: How to Establish a Crypto Exchange in Turkey in 2026

Establishing a crypto exchange in Turkey is now a substantial regulated financial-services project.

The regulatory transformation that began with Law No. 7518 in July 2024 and continued with the comprehensive CMB communiqués published in March 2025 means that a cryptocurrency exchange can no longer be treated as an ordinary software or Web3 company.

A new platform must first determine exactly which crypto activities it intends to provide and then structure its corporate, financial and technological architecture around those regulated services.

One of the most important requirements is capital.

The minimum establishment capital originally introduced at TRY 150 million has been increased to TRY 250 million for 2026. A separate crypto custody institution is subject to a substantially higher minimum establishment capital of TRY 630 million.

Capital alone, however, is far from sufficient.

A successful CMB application requires a transparent Turkish corporate structure, suitable shareholders, qualified management, internal control, risk management, internal audit and sophisticated information systems.

The platform must also establish a secure infrastructure for custody and customer asset protection.

Customer and company assets must be appropriately segregated and tracked, while wallet architecture must address hot-wallet and cold-wallet security. The CMB framework also requires price-surveillance systems and mechanisms capable of detecting market-disruptive conduct.

The regulatory application itself should be divided into two conceptual stages:

establishment, and

operational authorisation.

The CMB publishes current application documentation for both new crypto asset service providers and operating permissions and warns that incomplete or improperly formatted applications will not be processed.

For this reason, the technology, staffing, custody and compliance systems should be developed in parallel with the legal application.

MASAK compliance must also be treated as a core part of the project.

A Turkish crypto exchange must establish KYC procedures, enhanced customer due diligence, remote customer identification, transaction monitoring, suspicious transaction reporting, PEP controls and Travel Rule infrastructure. MASAK’s September 2025 guidance expressly brings these requirements together within the crypto sector’s compliance framework.

For international investors, two further points are particularly important.

First, a foreign crypto licence does not passport into Türkiye.

A foreign company actively directing crypto services at Turkish residents may fall within the rules concerning unauthorised crypto asset service provision. The use of a Turkish-language website, establishment of a workplace in Türkiye or direct or indirect marketing toward Turkish residents are specifically recognised indicators of Turkish-market targeting.

Second, investors acquiring an existing Turkish exchange should not assume that appearance on the CMB’s website means the platform already has full authorisation.

The CMB’s existing Operating Entities List remains a transitional list, and the regulator expressly states that inclusion does not constitute authorisation.

This is particularly relevant in 2026 because the transition into the permanent custody framework is still being completed. In March 2026, the CMB postponed the determination of certain custody agreement and authorisation-certificate deadlines until authorised custody institutions begin providing services to platforms on a sufficiently widespread basis.

Therefore, investors should verify the exact regulatory status of each target company rather than relying on public-list inclusion alone.

From a practical perspective, the most efficient approach for anyone planning to establish a crypto exchange in Turkey is to develop the following workstreams together:

corporate structure, CMB licensing, shareholder compliance, capital planning, technology architecture, custody, cybersecurity, token listing, market surveillance and MASAK compliance.

Attempting to build the entire product first and consider licensing later creates a substantial risk that core features will need to be redesigned.

By contrast, integrating regulatory requirements into the platform from the beginning can reduce licensing delays, capital inefficiencies and operational risk.

For investors seeking to establish a cryptocurrency exchange, digital asset platform, crypto brokerage or institutional crypto trading business in Türkiye, the central principle is therefore clear:

Regulatory approval should be treated as part of the product architecture, not as an administrative step after the product has been built.

As of July 2026, Türkiye has one of the more structured crypto regulatory regimes in the region. Market entry remains possible, including for new platforms, but it requires significant capital, institutional governance and a long-term commitment to regulatory compliance.

Legal Disclaimer: This article provides general information regarding the establishment and licensing of cryptocurrency exchanges in Türkiye as of July 2026. It does not constitute legal advice. CMB capital thresholds, custody arrangements, transitional periods, MASAK requirements and other regulatory standards may change. Each proposed crypto exchange should be analysed separately based on its ownership structure, services, technology, custody model and intended customer base.