A crypto exchange may be incorporated in Singapore, Dubai, the European Union, the United Kingdom or another jurisdiction and have no company incorporated in Turkey. Yet Turkish residents may still be able to open accounts, trade Bitcoin or USDT, use the mobile application and transfer crypto assets to and from the platform.
This creates an increasingly important legal question:
Can a foreign crypto exchange legally provide services to users residing in Turkey without obtaining authorization from the Capital Markets Board of Türkiye?
Following the amendments introduced by Law No. 7518, which entered into force on 2 July 2024, the answer has become substantially clearer.
Turkey does not simply regulate crypto exchanges according to the country in which the exchange is incorporated. The Turkish regulatory framework also examines whether a foreign platform is directing its activities toward persons resident in Turkey.
This distinction is critical.
A website being technically accessible from Turkey is not necessarily the same thing as the platform actively targeting the Turkish market. However, once a foreign exchange begins creating a Turkish-language market presence, advertising to Turkish residents, using Turkish intermediaries or otherwise systematically soliciting Turkish customers, the activity may fall within the Turkish licensing regime.
For foreign exchanges, investors, founders and crypto businesses, understanding where this regulatory line is drawn has become essential.
1. Turkey Introduced a Licensing Regime for Crypto-Asset Service Providers
Law No. 7518 significantly amended Capital Markets Law No. 6362 and brought crypto-asset service providers within the regulatory and supervisory authority of the Capital Markets Board of Türkiye (“CMB” or “SPK”).
The law introduced statutory definitions for concepts including:
- crypto assets,
- wallets,
- crypto-asset service providers,
- crypto-asset custody services, and
- crypto-asset trading platforms.
Under Article 35/B of the Capital Markets Law, crypto-asset service providers must obtain authorization from the CMB in order to be established and commence regulated activities in Turkey.
The CMB subsequently issued two major communiqués on 13 March 2025:
Communiqué III-35/B.1, governing the establishment and operating principles of crypto-asset service providers, and
Communiqué III-35/B.2, governing their operating procedures, permitted services and capital adequacy requirements.
The CMB confirms that these regulations cover matters including licensing, shareholders, management, information systems, risk management, record keeping, custody, trading and capital adequacy.
The result is straightforward:
Operating a crypto exchange in the Turkish market is now a regulated capital-markets activity.
But the more difficult question concerns exchanges incorporated outside Turkey.
2. A Foreign Incorporation Does Not Automatically Place the Exchange Outside Turkish Law
One of the most important provisions introduced by Law No. 7518 is Article 99/A of the Capital Markets Law.
The provision expressly addresses foreign crypto exchanges.
Under Article 99/A, activities conducted by platforms established abroad toward persons resident in Turkey are considered unauthorized crypto-asset service provider activities unless they fall within the Turkish regulatory framework.
The legislation therefore focuses on the target market, rather than merely on the exchange’s registered office.
A company cannot necessarily avoid Turkish regulation simply by stating:
“Our company is incorporated abroad, our servers are abroad and our user agreement is governed by foreign law.”
If the economic reality demonstrates that the platform is actively addressing the Turkish market, Turkish regulatory jurisdiction may nevertheless arise.
The rule is expressly contained in Article 99/A of Capital Markets Law No. 6362.
3. When Is a Foreign Exchange Considered to Be Targeting Turkey?
The legislation provides particularly useful criteria.
A foreign platform will be deemed to be conducting activities directed toward persons resident in Turkey if any of the following circumstances exists:
- it opens a workplace in Turkey;
- it establishes a Turkish-language website;
- it directly conducts promotion or marketing activities concerning its crypto services toward the Turkish market; or
- it carries out such marketing or promotion through persons or institutions resident in Turkey.
The CMB may also establish additional criteria for determining whether activities are directed toward Turkish residents.
This provision has major practical consequences.
Consider the following examples.
Example 1 – Turkish-Language Website
A crypto exchange incorporated in the Cayman Islands operates:
exchange.com/tr
and provides its website completely in Turkish.
Turkish investors can register through the Turkish interface and receive Turkish-language promotional material.
The existence of a Turkish-language website is expressly identified by the law as an indicator that the platform is targeting persons resident in Turkey.
Example 2 – Turkish Influencer Campaign
A foreign exchange pays Turkish cryptocurrency influencers to publish:
“Register today and receive a 100 USDT bonus.”
Even though the exchange itself has no office in Istanbul, marketing through persons resident in Turkey falls directly within Article 99/A.
Example 3 – Turkish Affiliate Marketing Network
A foreign platform appoints Turkish individuals or companies as referral partners and pays commissions for bringing Turkish customers onto the platform.
Such a structure presents a significant regulatory risk because the law expressly covers marketing conducted either directly or through Turkish persons or institutions.
Example 4 – Turkish Office
A Dubai crypto exchange establishes a “representative office” in Istanbul from which employees assist Turkish customers.
The fact that customer assets are technically held outside Turkey does not necessarily prevent Turkish regulation from applying.
Opening a workplace in Turkey is expressly listed as one of the statutory indicators of targeting the Turkish market.
4. Is Mere Accessibility from Turkey Enough?
This is one of the most important practical distinctions.
The legislation does not expressly state that the mere technical accessibility of a foreign website from a Turkish IP address automatically constitutes targeting Turkey.
Article 99/A instead identifies positive indicators of market targeting, such as Turkish-language websites, local offices and marketing activities.
This means there is an important difference between:
a Turkish resident independently finding and accessing a foreign international platform, and
the foreign platform actively soliciting Turkish residents as customers.
However, foreign exchanges should be extremely cautious about treating this distinction as a broad “reverse solicitation” exemption.
Unlike certain international financial-services regimes, Turkish crypto legislation does not establish a detailed statutory safe harbour under which all customer-initiated activity is automatically excluded from regulation.
Moreover, Article 99/A expressly authorizes the CMB to establish additional criteria for determining whether activities are directed toward Turkish residents.
Therefore, the factual circumstances must be evaluated as a whole.
The platform’s language settings, advertising campaigns, referral arrangements, local customer support, payment infrastructure, social-media presence and commercial strategy may all become relevant.
5. Having a Foreign Crypto Licence Is Not a Substitute for SPK Authorization
Another common misconception is:
“Our exchange is regulated in Europe/Dubai/Singapore, so we can also serve Turkey.”
This is not necessarily correct.
Authorization granted by a foreign regulator may demonstrate that the platform is regulated in its home jurisdiction, but it does not automatically provide passporting rights into Turkey.
For example, authorization under an EU regulatory regime does not, by itself, constitute authorization under Turkish Capital Markets Law.
Likewise, a licence issued by a Dubai, UK, Swiss or Singaporean authority does not automatically permit the exchange to establish a Turkish-language platform and market services to Turkish investors.
Where Turkish regulatory thresholds are triggered, compliance with Turkish SPK requirements must be assessed separately.
6. The October 2024 Deadline Was a Major Turning Point
Following the entry into force of Law No. 7518, the CMB expressly announced that foreign crypto-asset service providers falling within Article 99/A were required to terminate activities directed toward persons resident in Turkey by 2 October 2024.
The CMB warned that foreign platforms continuing such activities after that date could become subject to Articles 99/A and 109/A of the Capital Markets Law.
Therefore, this should no longer be viewed as a temporary transition issue.
As of 2026, the transition period has long expired.
Foreign exchanges should now structure their Turkish exposure on the assumption that active solicitation of Turkish residents without appropriate authorization may generate regulatory and potentially criminal consequences.
7. SPK Can Block Access to Foreign Crypto Platforms
One of the strongest regulatory tools available to the CMB is internet access blocking.
Under Article 99/A(3), where the CMB determines that unauthorized crypto-asset service provider activities are being conducted through the internet, it may decide that the relevant online content should be removed and/or access should be blocked.
The decision is transmitted to the Access Providers Association for implementation.
This is not merely a theoretical authority.
The CMB has repeatedly issued enforcement decisions against websites that it determined were providing unauthorized crypto-asset services to persons resident in Turkey.
For example, CMB bulletins published during 2025 ordered legal action for access blocking against multiple websites identified as conducting unauthorized crypto-asset service activities directed toward Turkish residents.
The practice continued into 2026. A 2026 CMB bulletin again identified websites providing unauthorized crypto and leveraged-trading services toward Turkish residents and initiated the legal procedures required to block access.
For users, this creates an important operational risk.
A foreign exchange may function normally today but later become difficult or impossible to access through ordinary internet connections in Turkey if regulatory action is taken.
8. Unauthorized Crypto Services Can Also Create Criminal Liability
The consequences are not limited to website blocking.
Article 109/A of Capital Markets Law No. 6362 establishes the criminal offence of unauthorized crypto-asset service provision.
Persons found to be conducting crypto-asset service provider activities without authorization, and responsible officials of legal entities carrying out such activities, may face:
three to five years’ imprisonment, and
a judicial fine of between 5,000 and 10,000 days.
The CMB has already issued criminal complaint decisions concerning persons or website operators alleged to have conducted unauthorized crypto-asset services.
This demonstrates that Article 109/A is not simply a compliance provision sitting unused in the legislation.
Enforcement has begun.
Foreign crypto companies considering a Turkish marketing strategy should therefore treat the issue as both a regulatory and criminal-law risk.
9. Is the Turkish User Committing a Crime by Using a Foreign Exchange?
This distinction is particularly important.
Article 109/A criminalizes conducting unauthorized crypto-asset service provider activities.
The offence is directed primarily toward persons carrying out the unauthorized business and the responsible officials of legal entities providing those services.
The legislation does not state that an ordinary investor commits the offence under Article 109/A merely because he or she opens an account with a foreign platform.
Therefore, the regulatory risk faced by the platform should not automatically be confused with criminal liability of the customer.
That said, users can of course face separate legal exposure if their particular transactions involve money laundering, fraud, tax offences, sanctions violations, unlawful gambling proceeds or other criminal conduct.
Likewise, a person who goes beyond being a customer and actively operates, markets or assists an unauthorized platform may require a separate legal assessment.
10. What About Turkish Influencers and Referral Partners?
This is an increasingly important risk area.
Foreign exchanges commonly acquire customers through:
- cryptocurrency influencers;
- YouTube channels;
- Telegram groups;
- X accounts;
- affiliate marketing programs;
- referral codes; and
- commission-based introducing arrangements.
However, Article 99/A expressly recognizes marketing carried out through Turkish persons or institutions as evidence that the foreign exchange is targeting Turkish residents.
Therefore, an exchange cannot necessarily avoid the Turkish licensing framework by outsourcing its Turkish marketing operations to influencers.
For the influencer or marketing intermediary, the analysis is more complex.
A simple advertisement, an introduction arrangement, operating customer accounts and effectively acting as part of the service-provider structure are legally different activities.
Depending on the person’s actual role, questions concerning participation in unauthorized activities, advertising regulations and other liabilities may arise.
Accordingly, Turkish influencers should not assume that a foreign exchange being licensed somewhere else automatically makes a Turkish referral campaign legally risk-free.
11. Can a Global Exchange Establish a Turkish Subsidiary Instead?
Yes, and this is effectively the regulatory path followed by some international crypto groups.
A multinational crypto brand may operate globally through one entity while establishing a separate Turkish company to provide regulated services in Turkey.
However, the distinction between the entities must be taken seriously.
The Turkish entity must comply with the requirements applicable under:
- Capital Markets Law No. 6362;
- Communiqué III-35/B.1;
- Communiqué III-35/B.2;
- information systems regulations;
- custody requirements;
- MASAK legislation;
- customer identification rules; and
- other applicable Turkish legislation.
The fact that a global group has a well-known international exchange does not eliminate the regulatory obligations of the Turkish entity.
Likewise, the existence of a Turkish subsidiary does not necessarily authorize the foreign parent company itself to solicit Turkish residents outside the scope of the Turkish company’s authorization.
12. Being on the SPK List Does Not Necessarily Mean Full Authorization
Investors should also understand the meaning of the CMB’s published crypto-service-provider lists.
The CMB currently warns that its “Faaliyette Bulunanlar Listesi” is a transitional list and that inclusion on the list does not itself mean that the relevant company has been fully authorized under the applicable legislation.
This distinction is particularly important when performing due diligence on a crypto platform.
A user should not simply ask:
“Is the company’s name visible on the SPK website?”
The better question is:
“What is the company’s exact regulatory and authorization status?”
For institutional investors, fintech companies and businesses integrating crypto services, this distinction should form part of formal counterparty due diligence.
13. What Are the Risks for Turkish Users of Foreign Exchanges?
Even where a Turkish resident can technically access a foreign platform, several legal and practical risks remain.
Access-Blocking Risk
The CMB may restrict access if it determines that the platform is conducting unauthorized services directed toward Turkey.
Withdrawal Risk
If the foreign exchange freezes the user’s account, recovering crypto assets may require proceedings against a company located outside Turkey.
Jurisdiction Risk
The customer agreement may provide for foreign courts or international arbitration.
Enforcement Risk
Even if a Turkish court ultimately issues a favourable judgment, enforcement may require proceedings in the country where the exchange or its assets are located.
Regulatory Protection Risk
A user dealing directly with a foreign entity should not automatically assume that the protections applicable to a Turkish SPK-regulated provider will apply in exactly the same manner.
Insolvency Risk
If the foreign exchange collapses, the user may have to pursue a creditor claim under a foreign insolvency regime.
This is why the question:
“Can I open the account?”
is not necessarily the same question as:
“Will I be legally protected if something goes wrong?”
14. What Happens If the Foreign Exchange Freezes the Turkish User’s Account?
This is where the jurisdictional distinction becomes particularly important.
Suppose a Turkish investor has USD 500,000 worth of crypto assets on a platform incorporated abroad and the account is suddenly frozen.
The investor’s lawyer should immediately determine:
- the identity of the contracting entity;
- the jurisdiction in which that entity is incorporated;
- the governing-law provision in the user agreement;
- the court or arbitration clause;
- the location of customer assets;
- whether the exchange has a Turkish subsidiary;
- whether the Turkish subsidiary participated in the transaction;
- whether the foreign platform actively targeted the Turkish market; and
- whether the freeze resulted from internal compliance, sanctions, AML requirements or a judicial order.
These questions determine whether proceedings should be commenced in Turkey, abroad, through arbitration or simultaneously through several mechanisms.
The fact that the investor lives in Istanbul does not automatically mean that assets held through a foreign contractual entity can easily be recovered through a Turkish enforcement proceeding.
15. What Should a Foreign Exchange Do Before Accepting Turkish Customers?
For a foreign crypto platform, the safest compliance approach is to conduct a Turkey market-targeting assessment before onboarding or marketing to Turkish residents.
The assessment should examine at least:
- whether Turkish-language web pages exist;
- whether the mobile application is specifically localized for Turkey;
- whether Turkish residents are actively targeted through advertising;
- whether Turkish influencers or affiliates are used;
- whether Turkish customer-support operations exist;
- whether Turkish offices or personnel are maintained;
- whether Turkish payment infrastructure is integrated;
- whether bonuses or campaigns specifically address Turkish users;
- whether the platform has a Turkish corporate affiliate; and
- whether the planned services require SPK authorization.
The company should also carefully separate the global entity from any locally regulated entity.
A disclaimer stating:
“This service is not intended for residents of Turkey”
may be relevant evidence, but a disclaimer alone will have limited value if the commercial reality shows that the same company is running Turkish advertisements, Turkish social-media campaigns and Turkish customer acquisition programs.
Regulators generally examine conduct, not merely contractual labels.
16. A Useful Practical Test: Accessibility or Targeting?
A practical legal analysis can be summarized through the following distinction.
Lower Regulatory Risk
A foreign global website is available internationally, has no Turkish office, conducts no Turkish advertising, employs no Turkish introducers and does not specifically solicit Turkish residents.
The Turkish customer independently reaches the platform.
This does not automatically fall within the express statutory presumptions identified in Article 99/A.
However, the circumstances should still be monitored because the CMB has authority to adopt further criteria.
High Regulatory Risk
The platform:
- has a Turkish-language website;
- purchases Turkish Google advertisements;
- pays Turkish influencers;
- publishes Turkish promotional campaigns;
- offers referral bonuses specifically to Turkish customers;
- operates a Turkish customer-acquisition team; or
- maintains a local workplace.
Here, the risk that the platform will be considered to be conducting unauthorized crypto-asset service provider activity in Turkey is substantially greater.
17. The Regulatory Direction Is Clear
The broader direction of Turkish crypto regulation is now relatively clear.
Turkey has moved away from an environment in which foreign and domestic crypto platforms could largely operate without a specific capital-markets licensing framework.
The regulatory structure created by Law No. 7518 and the CMB’s 2025 communiqués increasingly resembles a conventional financial-services model:
if a company wants to commercially address the Turkish market, Turkish authorization and compliance requirements must be taken seriously.
The CMB’s continuing access-blocking decisions in 2025 and 2026 demonstrate that enforcement is active rather than theoretical.
Conclusion: A Foreign Exchange Cannot Treat Turkey as an Unregulated Market
A foreign crypto exchange does not become subject to Turkish law merely because one Turkish investor happens to discover its global website.
But the legal position changes significantly when the platform actively targets persons resident in Turkey.
Under Article 99/A of Capital Markets Law No. 6362, a Turkish workplace, Turkish-language website or direct or indirect marketing activity toward Turkish residents may establish the necessary connection with the Turkish market.
Once that threshold is crossed, providing crypto-asset services without the required regulatory status may be treated as unauthorized crypto-asset service provider activity.
The possible consequences are substantial:
- SPK investigation;
- removal of online content;
- blocking of access to websites;
- restrictions on advertising and marketing;
- regulatory measures; and
- criminal exposure under Article 109/A, including imprisonment and judicial fines.
For Turkish investors, the legal question is different. Ordinary use of a foreign platform is not itself defined as the criminal offence established under Article 109/A. Nevertheless, users of offshore exchanges may face significantly greater problems in recovering assets, enforcing contractual rights and dealing with insolvency or account freezes.
For foreign crypto companies, the practical rule is therefore simple:
Do not ask only whether your servers and company are located outside Turkey. Ask whether your business model is commercially directed toward Turkey.
That is the question on which the Turkish regulatory analysis increasingly turns.
For investors, the equally important question is:
Before transferring substantial assets to an overseas crypto exchange, do you know which legal entity holds your assets, which regulator supervises it and where you would have to sue if the platform refused to return your money?
In crypto markets, those questions often become important only after an account is frozen. By then, the legal and practical options may already be considerably more limited.
This article provides general legal information as of August 2026 and does not constitute legal advice. The regulatory status of a specific crypto exchange should be assessed according to its corporate structure, Turkish-facing activities, marketing practices, contractual arrangements and current CMB regulations and decisions.
No Responses