Legal Requirements for Token Issuance and CMB Risk in Turkey

Launching a token in Turkey is no longer a legally undefined activity.

A project founder may technically create an ERC-20, BEP-20 or similar token within minutes. From a legal perspective, however, deploying a smart contract is only the beginning of the analysis.

The critical questions are:

What does the token represent?

How will it be sold?

Will money be collected from the public?

Will investors expect a financial return?

Will the token be listed on a crypto exchange?

Does it represent shares, debt, profit participation, commodities, real estate or another regulated asset?

Since the amendments introduced by Law No. 7518 in July 2024 and the detailed secondary regulations introduced by the Capital Markets Board of Türkiye (“CMB” or “SPK”) on 13 March 2025, these questions may determine whether the project is merely issuing a crypto asset or conducting a regulated capital markets or crypto asset service activity without authorization.

For founders, the most dangerous assumption is:

“It is a utility token, so SPK rules do not apply.”

The name placed on the whitepaper does not determine the legal character of the token.

Its economic substance, contractual rights, marketing, distribution structure and actual use do.

1. Is It Legal to Create a Token in Turkey?

As a general principle, Turkish law does not prohibit a company or entrepreneur from developing blockchain technology or technically creating a token.

The Capital Markets Law now defines a crypto asset broadly as an intangible asset that can be created and stored electronically using distributed ledger technology or similar technology, distributed through digital networks, and capable of representing value or rights.

More importantly, the CMB’s Communiqué III-35/B.2 expressly defines a token as a crypto asset created through smart contracts on an existing distributed ledger technology, without having its own distributed ledger network, which represents value, a service or a right within a particular ecosystem.

Therefore, Turkish legislation now expressly recognises the concept of a token.

But this does not mean that every method of issuing, selling or marketing a token is automatically lawful.

The legal risk generally begins not with writing the smart contract, but with:

• selling the token;
• distributing it to investors;
• raising funds;
• promising economic returns;
• listing the token;
• providing secondary-market trading;
• providing custody;
• transferring customer tokens; or
• designing the token to represent another legally regulated asset.

2. The Most Important Classification: What Does the Token Actually Give to Its Holder?

Before launching any token in Turkey, a legal classification memorandum should be prepared.

The token should broadly be tested against the following categories.

Utility Token

A genuine utility token may provide access to:

• software;
• a digital platform;
• membership functions;
• additional application features;
• digital content; or
• a particular blockchain ecosystem.

For example, a SaaS company might create a token that allows users to access premium functions within its ecosystem.

This structure may present a comparatively lower securities-law risk.

However, calling a token a “utility token” does not solve the issue if the project simultaneously tells purchasers:

“Buy today for $0.10 because we expect the token to reach $5 after listing.”

At that point, the commercial reality begins to look considerably more like an investment product.

3. Security Tokens Carry the Highest SPK Risk

The Capital Markets Law expressly gives the CMB authority over crypto assets granting rights specific to capital markets instruments.

This is an extremely important provision.

A token should therefore receive heightened legal scrutiny if it grants its holder:

• company ownership;
• dividend rights;
• voting rights comparable to shareholder rights;
• repayment of principal;
• predetermined interest;
• profit participation;
• revenue sharing;
• rights over liquidation proceeds;
• rights linked to securities;
• returns linked to a portfolio or index; or
• another investment-type entitlement.

Consider a Turkish technology company issuing 10 million tokens and announcing:

“Token holders will receive 15% of our company’s annual profits.”

Calling the instrument a “utility token” would not necessarily remove the capital-markets character of the rights attached to it.

The substance of the arrangement may bring it directly into the CMB’s regulatory sphere.

4. Tokenizing Company Shares Is Particularly Sensitive

Suppose a Turkish startup has TRY 50 million share capital.

The founders decide to create one million blockchain tokens and announce:

“Each token represents 0.0001% ownership of the company.”

This should not be treated as an ordinary crypto project.

Turkish company law and capital markets law contain formal rules governing the creation, ownership, registration and transfer of corporate shares.

Putting the concept of a share into a smart contract does not eliminate these rules.

Law No. 7518 gives the CMB authority to establish rules allowing capital markets instruments to be issued as crypto assets and tracked through electronic systems instead of the conventional registration structure.

Accordingly, founders should not attempt to create their own parallel blockchain share registry simply because the technological infrastructure makes it possible.

A tokenized share project requires a substantially different legal analysis from an ordinary utility-token project.

5. SPK Regulation Now Covers Initial Token Sales

One of the most important changes introduced by the new regime concerns initial sale and distribution.

Under Communiqué III-35/B.2, regulated crypto asset activities include, among other things:

• execution of crypto asset orders;
• exchange;
• transfer;
• custody;
• intermediation in the initial sale or distribution of crypto assets; and
• certain investment advisory activities.

Where these activities are conducted regularly as a commercial or professional activity, authorization from the CMB is required.

This makes the structure of an ICO, IEO, token launch or pre-sale extremely important.

6. Does the Project Owner Need an SPK License Merely to Create the Token?

Not necessarily.

Turkish legislation distinguishes between the project owner and the regulated platform.

The Communiqué defines the project owner as the natural or legal person developing a project for the creation of a crypto asset.

Therefore, merely being the developer of a crypto project should not automatically turn a startup into a licensed crypto exchange.

But problems arise when the same company begins to operate functions resembling a regulated platform.

For example, suppose the project itself:

1. sells tokens continuously to Turkish customers;
2. maintains customer accounts;
3. accepts TRY deposits;
4. converts TRY into its token;
5. provides a marketplace;
6. matches buyers and sellers;
7. transfers customer tokens; and
8. stores customers’ private keys.

At that point, saying:

“We are only the token issuer.”

may no longer reflect the reality of the business.

The activity may fall within the regulated crypto asset service provider framework.

7. The Safer Model: Issuer + Authorized Platform

For many Turkish projects planning a public token distribution, the legally safer architecture may involve separating:

the project owner

from

the regulated platform carrying out the sale, listing and trading infrastructure.

Communiqué III-35/B.2 specifically regulates a platform’s role when intermediating an initial sale or distribution.

The platform must review the smart contract according to the legal nature and characteristics of the token and cannot intermediate the initial sale of crypto assets that fail the minimum listing criteria.

This means that serious token projects intending to enter the Turkish market should increasingly expect a due-diligence process before listing.

8. What Will a Turkish Crypto Platform Examine Before Listing the Token?

Platforms are required to establish listing committees.

The committee must evaluate whether a crypto asset satisfies the applicable listing criteria and prepare an assessment report.

Listing analysis may include issues such as:

• technological infrastructure;
• blockchain security;
• ability to trace transactions;
• circulating supply;
• market structure;
• liquidity;
• vulnerability to manipulation;
• history of the project team;
• fraud concerns;
• regulatory restrictions;
• legal rights represented by the asset; and
• whether those rights are legally enforceable.

A token is therefore no longer merely a smart contract submitted to an exchange with a listing fee.

Regulated Turkish platforms must conduct their own legal and technical assessment.

9. The Founder Should Not Have Extraordinary Unilateral Powers

Another highly practical issue concerns tokenomics and smart-contract administration.

The CMB listing rules specifically address whether a token has been created in a way that grants extraordinary unilateral powers to the project owner.

For example, regulators and exchanges may scrutinise whether the founder can unilaterally:

• mint unlimited new tokens;
• freeze all wallets;
• confiscate investors’ tokens;
• alter token balances;
• change the total supply;
• manipulate the price mechanism;
• withdraw liquidity;
• terminate investors’ rights; or
• change the economic structure of the project.

Founder-controlled admin keys are therefore not merely a cybersecurity issue.

They may become a regulatory and listing issue.

10. Tokenizing Real Estate Does Not Avoid Real Estate Law

A common project structure is:

“We will tokenize an apartment worth TRY 100 million and sell 100,000 tokens. Each investor will economically own 1/100,000 of the property.”

This structure creates substantial legal risk.

The CMB has expressly stated that tokenization does not eliminate regulatory obligations applicable to the underlying asset.

Activities relating to assets such as commodities and real estate must still comply with the legislation administered by the competent authorities.

A smart contract cannot itself replace:

• the land registry;
• legally required transfer formalities;
• condominium ownership rules;
• company-share requirements; or
• securities legislation.

If the token merely gives investors a contractual right to income produced by the property, another problem emerges:

Has the project effectively created an investment instrument backed by real estate?

That requires a separate capital-markets analysis.

11. A Gold-Backed or Asset-Backed Token Is Also High Risk

The same principle applies to tokens representing:

• gold;
• silver;
• commodities;
• securities;
• baskets of assets;
• financial indexes; or
• other regulated underlying assets.

The CMB previously made clear that simply putting these assets onto blockchain infrastructure does not permit issuers to circumvent legislation applicable to the underlying product.

A project should therefore avoid assuming that:

“This is not gold; it is a gold token.”

will remove commodity, custody or capital-markets requirements.

Legally, the underlying economic entitlement remains highly relevant.

12. What About Stablecoins?

Stablecoin projects require particularly careful analysis.

A token might be designed to track:

• TRY;
• USD;
• EUR;
• gold; or
• another reference asset.

Depending on its structure, this could trigger several regulatory regimes simultaneously.

There is also a separate restriction under the Central Bank of the Republic of Türkiye’s Regulation on the Disuse of Crypto Assets in Payments.

Crypto assets within the scope of that Regulation cannot be used directly or indirectly for payments, and services enabling such use cannot be provided.

Therefore, a startup that markets its token as:

“Turkey’s new digital payment currency—you can pay every merchant with our token”

creates a materially different regulatory problem from a token merely functioning as a technological access mechanism.

The analysis may involve not only the CMB but also the CBRT and payment-services legislation.

13. Whitepapers Are Legally Important Documents

In the crypto industry, founders sometimes treat the whitepaper as marketing material.

That approach can be dangerous.

Under Article 35/B of the Capital Markets Law, where disclosure documents required by the CMB are prepared for the relevant sale or distribution, natural and legal persons signing those documents may be jointly liable for losses resulting from false, misleading or incomplete information.

Accordingly, statements such as:

• “guaranteed return”;
• “zero risk”;
• “100x potential”;
• “fully backed”;
• “audited reserves”;
• “guaranteed exchange listing”;
• “SPK approved”; or
• “investors cannot lose money”

should never be included without a legally and factually sustainable basis.

Tokenomics documentation, website statements and social-media marketing should all be reviewed together.

14. “SPK Approved Token” Is a Dangerous Marketing Statement

A token being listed on a Turkish platform does not mean that the Turkish government guarantees it.

The Capital Markets Law expressly provides that listing or permitting the sale/distribution of a crypto asset does not constitute a public guarantee.

A project should therefore avoid language implying that:

• SPK guarantees the token;
• SPK guarantees its price;
• the government guarantees repayment; or
• exchange listing constitutes investment approval.

Such wording may create both regulatory and civil liability.

15. Public Fundraising Is One of the Biggest Warning Signs

Consider two projects.

Project A

A software company gives customers free blockchain tokens that allow access to additional storage capacity.

There is no token sale and no investment promise.

Project B

A startup sells 100 million tokens to the public, raises USD 20 million and advertises:

“The token will appreciate when our company grows.”

Project B presents dramatically greater regulatory risk.

The more the structure resembles:

• fundraising;
• an investment round;
• public offering;
• profit participation; or
• expectation of appreciation driven by the founders’ efforts,

the more important it becomes to determine whether capital markets legislation applies.

The old concept that “ICOs are outside SPK regulation” is no longer a safe basis for structuring a Turkish project.

The CMB’s powers over crypto assets expanded significantly following Law No. 7518.

16. Can a Foreign Company Issue the Token Instead?

Creating a company in Dubai, Estonia, Switzerland or another jurisdiction does not automatically eliminate Turkish regulatory risk.

Article 99/A of the Capital Markets Law specifically addresses foreign crypto platforms targeting persons resident in Türkiye.

Factors indicating Turkish targeting include:

• opening a workplace in Türkiye;
• establishing a Turkish-language website;
• directly marketing crypto services to Turkish residents; or
• marketing through persons or institutions located in Türkiye.

Therefore, the structure:

Dubai company + Turkish founders + Turkish website + Turkish influencers + Turkish investors

should not be assumed to fall outside Turkish regulation merely because the token issuer was incorporated abroad.

17. SPK Risk of Using Influencers to Sell Tokens

Marketing strategy is another important compliance issue.

If the project uses influencers to publish messages such as:

“Buy before Binance listing.”

“Guaranteed 20x return.”

“Only three days left before the price explodes.”

the regulator may look beyond the wording of the smart contract and examine how the product was actually marketed.

For regulated platforms, the rules specifically restrict misleading advertising and promotions involving guaranteed returns or incentives designed to direct customers toward particular crypto investments.

Founders should therefore develop a token marketing compliance policy before beginning public promotion.

18. What Happens If the Business Accidentally Becomes an Unlicensed Crypto Platform?

This is where the regulatory risk becomes serious.

Article 109/A of the Capital Markets Law provides criminal sanctions for unauthorized crypto asset service provider activity.

Persons found to be operating as crypto asset service providers without the required authorization may face:

three to five years’ imprisonment

and

a judicial fine of 5,000 to 10,000 days.

This is not merely theoretical.

The CMB has already made criminal complaints in relation to businesses and websites alleged to have conducted unauthorized crypto asset service provider activities.

The CMB also has powers relating to:

• access blocking;
• removal of online content;
• suspension of unauthorized activities;
• advertisements and promotions; and
• other regulatory measures.

Therefore, token structuring should be completed before the token sale begins, not after receiving an inquiry from the regulator.

19. NFTs and In-Game Tokens May Receive Different Treatment

Not every blockchain asset carries the same CMB risk.

The CMB has previously distinguished:

• unique, non-fungible digital assets; and
• crypto assets used solely to create or obtain items within virtual games

from the ordinary crypto-asset listing framework.

However, simply calling something an “NFT” is not sufficient.

For example, issuing 100,000 identical “NFT investment certificates” representing fractional rights in a hotel and promising rental income is economically very different from selling unique digital artwork.

Again:

substance prevails over terminology.

20. Practical SPK Risk Matrix for Token Projects

The classification must always be performed on the actual project documentation rather than the token name alone.

21. What Documents Should Be Prepared Before Launching a Token in Turkey?

A professionally structured project should normally prepare at least:

1. Token Legal Classification Memorandum
2. Tokenomics Memorandum
3. Whitepaper Legal Review
4. Smart Contract Legal Rights Matrix
5. Project Owner Corporate Documentation
6. Token Sale Agreement
7. Risk Disclosure
8. Privacy Notice and KVKK Documentation
9. AML/KYC Structure where applicable
10. Marketing and Influencer Guidelines
11. Platform Listing Legal Opinion
12. Terms of Use
13. Conflict-of-Interest Policy
14. Founder Token Lock-Up and Vesting Rules
15. Regulatory Analysis of the Underlying Asset

The legal memorandum should answer one question before any public launch:

Why is this token legally allowed to be issued and distributed in the proposed manner?

22. A Practical Pre-Launch Test

Before launching a token in Türkiye, founders should answer the following questions.

Question 1

Does the token give investors company ownership?

If yes, stop and conduct a capital-markets/company-law analysis.

Question 2

Does it promise dividends, interest, profit or revenue sharing?

If yes, very high SPK risk.

Question 3

Is the token backed by real estate, gold, securities or another regulated asset?

If yes, analyse the legislation applicable to the underlying asset.

Question 4

Will the public pay money or crypto to obtain the token?

If yes, analyse initial sale/distribution rules.

Question 5

Will it be listed on a Turkish crypto platform?

If yes, the platform’s listing and first-distribution rules become relevant.

Question 6

Will the project itself operate a trading environment?

If yes, crypto asset service provider authorization may be required.

Question 7

Will customer crypto or private keys be held by the project?

If yes, custody regulation must be examined immediately.

Question 8

Is the token marketed as an investment?

If yes, the SPK risk increases significantly.

Question 9

Can founders mint, confiscate or manipulate tokens unilaterally?

If yes, restructure the smart contract and token governance.

Question 10

Is the token intended to operate as a payment instrument?

If yes, CBRT payment regulations must also be analysed.

23. The Most Dangerous Token Structure

From a Turkish-law perspective, one of the riskiest structures would look like this:

A newly established company creates an ERC-20 token.

It sells the token directly through its website.

Investors pay in USDT.

The company promises investors that the token price will increase.

Influencers advertise the token in Türkiye.

The founders guarantee an exchange listing.

Part of company profits will be distributed to token holders.

The company also maintains wallets for investors and allows them to buy and sell tokens through its website.

This project potentially combines:

• public fundraising;
• capital-markets-type rights;
• initial crypto asset distribution;
• investment marketing;
• exchange activity;
• custody activity; and
• unauthorized crypto asset service provider risk.

Changing the heading of the whitepaper to “Utility Token” would not solve these problems.

The entire project architecture would need to be redesigned.

24. A Safer Token Architecture

A comparatively safer Turkish token project could instead be structured as follows:

The token provides a genuine technological function inside an operating ecosystem.

It does not represent:

• company shares;
• debt;
• interest;
• dividends;
• guaranteed returns; or
• rights over regulated underlying assets.

Token documentation clearly explains:

• functionality;
• supply;
• founder allocation;
• vesting;
• risks;
• governance;
• smart-contract powers; and
• circumstances affecting token use.

No guaranteed price appreciation is marketed.

Where public distribution and Turkish exchange listing are contemplated, the project works through an appropriately authorized platform and goes through the relevant listing process.

The smart contract and whitepaper are reviewed together before launch.

This does not eliminate regulatory risk, but it significantly reduces the possibility that the business model accidentally becomes an unauthorized securities or crypto-platform operation.

Conclusion: In Turkey, You Should Classify the Token Before You Code the Token Sale

The regulatory environment for token projects in Türkiye has changed fundamentally.

Since Law No. 7518 and the CMB’s 2025 secondary legislation, the correct question is no longer:

“Is cryptocurrency legal in Turkey?”

The correct question is:

“What legal right does this token represent, how will it be distributed, and which regulated activity does the business model actually perform?”

Creating a token is not necessarily prohibited.

But the risk increases dramatically when the project:

• raises money from the public;
• creates investment expectations;
• promises financial returns;
• tokenizes securities or regulated assets;
• provides trading or custody;
• targets Turkish investors from abroad; or
• carries out activities reserved for CMB-authorized crypto asset service providers.

The most important practical rule is therefore:

Do not launch first and classify later.

Before the smart contract is publicly deployed, the project should complete a Token Legal Classification, review the whitepaper, analyse tokenomics, determine the appropriate sale and listing structure and identify whether CMB, CBRT or another regulatory authority has jurisdiction.

In token projects, a relatively small change in the economic rights attached to the token can turn a normal blockchain product into a regulated financial instrument.

And in Türkiye, that distinction may determine the difference between a compliant Web3 project and an unauthorized capital markets or crypto asset activity carrying administrative, civil and even criminal consequences.