A Practical Legal Roadmap for Establishing and Licensing a Crypto Asset Service Provider Before the Capital Markets Board of Türkiye

Turkey has moved from a relatively unregulated crypto market to one of the most structured licensing regimes in the region.

Following the entry into force of Law No. 7518 on the Amendment of the Capital Markets Law on 2 July 2024, crypto asset service providers became subject to the regulatory and supervisory authority of the Capital Markets Board of Türkiye — Sermaye Piyasası Kurulu (“SPK” or “CMB”).

The regulatory framework became substantially more detailed on 13 March 2025 when the SPK published two major communiqués:

• Communiqué No. III-35/B.1 on the Establishment and Operating Principles of Crypto Asset Service Providers, and
• Communiqué No. III-35/B.2 on the Working Principles and Capital Adequacy of Crypto Asset Service Providers.

These regulations cover not merely the incorporation of a crypto company but its shareholders, management, personnel, cybersecurity architecture, custody structure, internal controls, financial strength and actual operating model.

Consequently, incorporating an ordinary Turkish technology company and launching a crypto exchange is no longer legally possible.

A company wishing to operate a crypto exchange or provide regulated crypto custody services in Turkey must first pass through a two-stage SPK authorization process:

1. establishment authorization, and
2. operating authorization.

Most importantly, receiving permission to incorporate the company does not mean that the company may immediately accept customers or operate a crypto exchange.

The business may commence regulated activities only after obtaining the relevant authorization certificate (yetki belgesi) from the SPK.

This article explains how that process works in practice.

1. What Is a Crypto Asset Service Provider Under Turkish Law?

The Capital Markets Law defines a crypto asset service provider broadly.

It includes:

• crypto asset trading platforms,
• crypto asset custody providers, and
• other entities designated by the SPK to provide services involving crypto assets, including their initial sale or distribution.

The legislation defines a crypto platform as an organization in which one or more activities involving the:

• purchase and sale,
• initial sale or distribution,
• exchange,
• transfer, and
• related custody

of crypto assets are carried out.

Accordingly, a business should first determine whether its proposed model constitutes a regulated crypto activity before preparing an SPK application.

A blockchain software company that merely develops technology may not necessarily require a crypto asset service provider authorization.

However, a company that regularly and commercially executes customer crypto transactions, maintains an exchange environment, intermediates crypto sales or provides custody will normally fall within the regulated framework.

2. Which Crypto Activities Require SPK Authorization?

Communiqué III-35/B.2 identifies the principal regulated crypto services.

Subject to SPK authorization, these include:

• receiving and executing orders relating to crypto assets,
• settlement of crypto transactions,
• transfer services,
• custody services required for such transactions,
• intermediation in initial sale or distribution of crypto assets,
• custody and management of crypto assets or private keys,
• crypto asset investment advisory services,
• and other services that may subsequently be designated by the SPK.

Each regulated activity carried out as a regular commercial or professional business requires authorization.

This means that the founders should not begin with the question:

“How do we establish a crypto company?”

The correct first question is:

“Which regulated activities will our business actually perform?”

The answer determines the license category, capital requirements, personnel structure, technological infrastructure and custody architecture.

3. Platform or Custody Provider? Choose the Regulatory Model First

The Turkish framework fundamentally distinguishes between two principal models.

Crypto Asset Trading Platform

This is the model normally used for a centralized crypto exchange through which customers:

• open accounts,
• buy and sell crypto,
• deposit and withdraw assets,
• place orders,
• and transfer crypto assets.

Crypto Asset Custody Provider

This model focuses on holding:

• customers’ crypto assets, or
• the private keys giving control over those assets.

The distinction is particularly important because the capital requirements are substantially different.

4. How Much Capital Is Required in 2026?

This is one of the first feasibility questions investors should examine.

When Communiqué III-35/B.2 was originally published in March 2025, the minimum capital amounts were:

• TRY 150 million for platforms, and
• TRY 500 million for custody providers.

However, these amounts are subject to periodic regulatory adjustment.

For 2026, the SPK increased the applicable thresholds to:

The updated amounts were published through the SPK’s 2025/68 Bulletin.

Accordingly, an investor planning to establish a new Turkish crypto exchange in 2026 should not prepare the project on the historical TRY 150 million threshold.

The practical starting assumption should be:

At least TRY 250 million capital for a trading platform.

For a custody provider:

At least TRY 630 million.

Furthermore, minimum establishment capital is not necessarily the maximum amount of capital that the company may ultimately need.

The capital adequacy regulations impose continuing requirements depending on the provider’s balance sheet, risks and, particularly in the case of custody providers, the volume of customer assets under custody.

5. Capital Must Be Fully Paid in Cash

The capital requirement is not merely a nominal figure inserted into the articles of association.

For SPK authorization:

• the capital must be issued against cash,
• the required minimum capital must be fully paid,
• and the company’s equity must not fall below the applicable regulatory threshold.

Communiqué III-35/B.1 expressly requires crypto asset service providers to satisfy these financial requirements as part of the establishment and operating conditions.

Therefore, an entrepreneur cannot satisfy the regulatory capital requirement merely by contributing:

• software,
• intellectual property,
• trademarks,
• crypto assets,
• equipment,
• shareholder receivables, or
• other non-cash assets.

A licensing budget must therefore distinguish between:

capital required by regulation and additional operating expenditure required to build the business.

The latter can itself be considerable.

6. The Company Must Be Established as a Turkish Joint-Stock Company

A crypto asset service provider seeking SPK authorization must generally be incorporated as an:

Anonim Şirket (A.Ş.) — Turkish joint-stock company.

Communiqué III-35/B.1 requires, among other matters, that:

• the company be incorporated as a joint-stock company,
• all shares be registered shares,
• shares be issued against cash,
• the capital be fully paid,
• the articles of association comply with capital markets legislation,
• the corporate purpose be limited to activities authorized by the SPK,
• and the shareholding structure be transparent and identifiable.

A limited liability company therefore cannot normally obtain a standard crypto platform authorization in its existing form.

7. Even the Company Name Is Regulated

The trade name itself must comply with the SPK Communiqué.

A trading platform’s trade name must contain the expression:

“Kripto Varlık Alım Satım Platformu”

while a custody provider must use the expression:

“Kripto Varlık Saklama Kuruluşu.”

Use of a separate commercial name or brand for regulated activities also requires SPK authorization.

This is important from a startup perspective.

The founders should therefore conduct the following exercises before filing:

• corporate-name availability check,
• trademark clearance,
• domain-name analysis,
• SPK-compliant corporate name design,
• and brand-registration strategy.

Changing the brand after the license architecture has been established can create additional regulatory work.

8. Who Can Be a Shareholder of a Turkish Crypto Exchange?

The SPK does not examine only the company.

It also examines the people behind the company.

Founders and qualifying shareholders are subject to detailed fit-and-proper requirements.

Among other requirements, founders and relevant shareholders must generally:

• not be bankrupt,
• not have entered prohibited insolvency or restructuring circumstances,
• possess sufficient financial strength,
• possess the honesty and reputation required by the business,
• not have relevant connections with certain financial institutions whose licenses were revoked,
• and not have prohibited criminal convictions.

The Capital Markets Law expressly identifies serious offences that may prevent qualification, including certain convictions involving:

• fraud,
• embezzlement,
• bribery,
• theft,
• forgery,
• breach of trust,
• fraudulent bankruptcy,
• money laundering,
• terrorism financing,
• cybercrime,
• bank and credit-card offences,
• tax evasion,
• and specified offences against the State.

The SPK may also examine indirect ownership.

Therefore, attempting to place the investment through several holding companies does not necessarily remove the ultimate shareholder from regulatory scrutiny.

9. The Shareholding Structure Must Be Transparent

A crypto exchange cannot be designed around an opaque beneficial ownership structure.

The SPK requires the shareholding structure to be transparent and clear.

Where corporate shareholders are used, regulators may examine the shareholders behind those legal entities and ultimately identify natural persons with significant direct or indirect interests.

For this reason, before filing an application, counsel should prepare a complete:

ultimate beneficial ownership chart.

This should normally identify:

• direct shareholders,
• indirect shareholders,
• holding companies,
• voting rights,
• privileged shares,
• board nomination rights,
• control relationships,
• ultimate beneficial owners.

Complex offshore structures should be carefully evaluated before filing.

Regulatory transparency is more important than corporate complexity.

10. Significant Share Transfers Will Continue to Require SPK Control

Obtaining the license does not mean shareholders can later freely sell the company.

Among other cases, SPK authorization is required where a transaction causes a person to:

• acquire at least 10% of the capital or voting rights,
• cross the 20% threshold,
• cross the 33% threshold,
• cross the 50% threshold,
• or fall below these thresholds.

Transfers of privileged shares giving board representation rights may also require authorization regardless of percentage.

This has major consequences for:

• venture capital investments,
• private equity rounds,
• founder exits,
• strategic acquisitions,
• mergers and acquisitions.

A shareholders’ agreement for a licensed crypto company must therefore be drafted with SPK approval mechanics in mind.

11. Stage One: The SPK Establishment Application

The first formal regulatory stage is the establishment authorization application.

The founders prepare the proposed articles of association in accordance with:

• Capital Markets Law No. 6362,
• Communiqué III-35/B.1,
• Communiqué III-35/B.2,
• Turkish Commercial Code,
• and related regulations.

They then submit the required application package to the SPK.

The SPK currently provides specific application materials for new crypto asset service providers, including:

• establishment authorization petition,
• notarized declaration,
• declarations concerning natural-person shareholders,
• declarations concerning corporate shareholders,
• notarized undertaking,
• and the prescribed supporting-document package.

The SPK expressly warns that applications containing missing documents or documents that do not comply with the required format may not be processed.

This is therefore not an application in which it is advisable to “apply first and complete the company later.”

The ownership and business model should be structured before filing.

12. What Should the SPK Establishment File Demonstrate?

Although the exact documentary requirements must always be checked against the current SPK forms at the date of application, the establishment file will generally need to enable the regulator to understand:

The Company

• proposed corporate name,
• business model,
• articles of association,
• proposed regulated activities,
• capital structure.

The Shareholders

• identity,
• ownership percentages,
• source and financial capacity,
• beneficial ownership,
• corporate shareholder structures,
• fit-and-proper qualifications.

Governance

• proposed management structure,
• board structure,
• control rights,
• corporate governance arrangements.

Financial Capacity

The applicants should be able to demonstrate that they possess the financial capacity necessary to satisfy the relevant capital requirement.

The SPK may request additional information and may also require independent audit or rating work in relation to the provider or its corporate shareholders.

13. Establishment Authorization Is Not an Operating License

This distinction is one of the most important parts of the Turkish system.

Suppose the SPK approves the establishment of:

ABC Kripto Varlık Alım Satım Platformu A.Ş.

This does not mean ABC may immediately:

• accept customer deposits,
• open trading accounts,
• execute crypto orders,
• hold customer crypto assets,
• or publicly operate an exchange.

The establishment approval essentially allows the institution to be set up in the regulatory form required for the next phase.

A separate operating authorization is required.

14. The Six-Month Rule

Once SPK establishment authorization has been obtained, the provider must generally apply for its operating authorization within:

six months.

If it does not apply within that period, its right to obtain the operating authorization expires.

The SPK may, where it considers appropriate, extend the period, but the total period may not exceed one year.

This creates an important planning consequence.

A founder should not obtain establishment permission and only afterward begin thinking about:

• software architecture,
• cybersecurity,
• custody,
• compliance,
• personnel,
• internal audit,
• risk management,
• MKK integration.

Much of that work should already be underway before the establishment application is finalized.

15. Stage Two: Building the Regulated Institution

The operating-license stage is considerably more demanding than merely incorporating the company.

Before an operating authorization can be obtained, the company must demonstrate that it has become an actual regulated financial institution.

Among the principal requirements are:

• preservation of establishment conditions,
• fully paid capital,
• compliance with capital adequacy rules,
• completed organizational structure,
• qualified personnel,
• qualified general manager and deputies,
• compliant technological infrastructure,
• cybersecurity systems,
• internal audit,
• internal control,
• risk management,
• technical integrations,
• and appropriate operational procedures.

This is where many startup-style projects become substantially more expensive than expected.

16. A Three-Person Founding Team Is Not Enough

SPK regulation requires genuine organizational capacity.

The provider must establish the business units contemplated under the regulatory framework and employ sufficient personnel.

These may include functions relating to:

• operations,
• internal control,
• internal audit,
• risk management,
• information technology,
• information security,
• compliance,
• customer operations,
• transaction monitoring,
• price surveillance,
• custody coordination.

Platforms must also create an appropriate price surveillance system, including a dedicated function under the applicable rules.

A business model consisting of one founder, one developer and an outsourced customer-service team will therefore generally not satisfy the institutional framework expected from a regulated platform.

17. Management Requirements Are Strict

The management team must also satisfy specific qualifications.

General Manager and Deputy General Managers

They must have at least seven years of professional experience in areas such as:

• financial markets,
• information processing,
• information technology, or
• financial technology.

The general manager must also be:

• resident in Türkiye,
• employed specifically for this function,
• and appointed on a full-time basis.

Appointments of the general manager and deputy general managers require the SPK’s favorable opinion.

Board of Directors

The board must consist of at least:

three members.

A majority of the board members must be graduates of four-year university programs. Board members are also subject to suitability conditions.

These requirements should be taken into consideration at the cap-table stage rather than shortly before the operating-license application.

18. Personnel Qualifications Also Matter

As a rule, managers and regulated personnel must possess at least a four-year university degree unless a specific exception applies.

Certain operational and information-technology employees may satisfy the educational requirement with an associate degree where the conditions in the Communiqué are met.

The SPK also retains authority to impose:

• specific educational criteria,
• professional experience requirements,
• licensing requirements,
• or professional certifications

depending on the function performed.

Therefore, HR recruitment for a licensed crypto company is itself a regulatory exercise.

19. Technology Is Part of the License, Not Merely an IT Question

One of the largest differences between an ordinary software startup and a regulated crypto platform is the treatment of technology.

Under Article 35/B of the Capital Markets Law, the provider must establish systems capable of operating securely and create necessary internal control mechanisms.

Compliance with technological criteria determined through the TÜBİTAK infrastructure framework is expressly relevant to establishment and operating authorization.

Communiqué III-35/B.1 further requires compliance with:

• information-systems rules,
• technological-infrastructure requirements,
• applicable cybersecurity standards,
• and TÜBİTAK infrastructure criteria.

A crypto exchange license therefore cannot realistically be obtained with a technical architecture designed first and presented to the regulator later.

Legal and technical design must be developed simultaneously.

20. What Will Regulators Examine Technically?

Depending on the business model, the regulatory review may involve issues such as:

• wallet architecture,
• hot wallets,
• cold wallets,
• private-key management,
• access-control systems,
• multi-factor authentication,
• cybersecurity,
• privileged-user access,
• business continuity,
• backup systems,
• disaster recovery,
• transaction logs,
• blockchain transaction monitoring,
• separation of duties,
• customer-asset reconciliation,
• intrusion detection,
• incident management.

During the operating-license process, the SPK may request an information-systems examination involving TÜBİTAK or other public institutions.

The examination can extend beyond traditional IT systems and include the wallets and distributed-ledger processes actually used by the service provider.

21. Custody Must Be Designed Before the License Application

Custody is not something that should be left until launch.

A trading platform must determine:

• which crypto assets will remain within its permitted wallet structure,
• which assets will be held by an authorized custody provider,
• how transfers will occur,
• how daily reconciliation will operate,
• how customer balances will correspond with blockchain assets,
• and how custody risks will be controlled.

Communiqué III-35/B.2 establishes detailed rules concerning settlement, custody, reconciliation and transfers between platform and custody-provider wallets.

Accordingly, negotiations with potential custody partners should begin early in the licensing project.

22. MKK Integration Is Also Part of the Regulatory Architecture

The Turkish regime does not treat customer records as entirely internal exchange data.

The provider must establish the integrations required by the regulatory framework with the Central Securities Depository of Türkiye — Merkezi Kayıt Kuruluşu (“MKK”).

The operating-license conditions specifically include completion of relevant technical and system integration tests with MKK, subject to the applicable implementation framework.

Accordingly, a practical licensing workstream should include an independent:

MKK integration project.

23. MASAK Compliance Must Be Built Into the Platform

Receiving an SPK license does not remove anti-money-laundering obligations.

Crypto asset service providers are also subject to the Turkish AML/CFT framework administered by MASAK.

In June 2025, MASAK introduced additional enhanced customer-due-diligence measures specifically concerning crypto asset service providers through General Communiqué No. 29.

A new platform should therefore build, before commercial launch:

• customer identification procedures,
• beneficial-owner checks,
• sanctions screening,
• transaction monitoring,
• suspicious-transaction reporting mechanisms,
• risk classification,
• enhanced due diligence,
• crypto-transfer controls,
• and internal AML compliance procedures.

KYC is therefore not merely a “customer onboarding feature.”

It is a statutory compliance system.

24. Internal Audit, Internal Control and Risk Management Are Mandatory

A licensed platform must establish formal control structures.

These should not merely exist on an organizational chart.

They must actually operate.

For example, the internal audit function must be capable of independently examining the provider’s operations and control environment.

The regulatory structure includes dedicated requirements relating to:

• internal audit,
• internal control,
• risk management,
• operational risks,
• cyber risks,
• regulatory compliance.

The SPK framework also requires providers to maintain these structures throughout their activities, not merely on the date the license is obtained.

25. Proof-of-Reserves Audits Are Important

Crypto platforms are also subject to proof-of-reserves auditing requirements.

The SPK has published specific principles governing these audits.

Among other matters, the audit framework involves verification of customer crypto balances, wallets and liquid reserves. The audit methodology requires specified portions of customer crypto assets to be tested, and the relevant assets included in the audit must be verified.

This has an important consequence for founders:

The accounting ledger, wallet system and blockchain balances should be capable of being reconciled from the first day of operations.

A platform that cannot prove where customer assets are located will face serious regulatory problems.

26. The Operating-License Application

Once the company has established:

• its corporate structure,
• capital,
• board,
• management,
• personnel,
• internal controls,
• technology,
• custody arrangement,
• compliance program,
• and necessary integrations,

it files the second-stage application for operating authorization.

The provider must submit documentation demonstrating that it satisfies both the general and activity-specific requirements.

The SPK may request additional information.

If additional documents requested by the SPK are not completed within the prescribed period—which cannot be less than ten days—the application may be removed from processing.

The application should therefore be managed as a structured regulatory due-diligence project rather than a conventional administrative filing.

27. SPK Can Inspect the Infrastructure Before Granting the License

The SPK is not required simply to rely on declarations provided by the applicant.

During the licensing process, regulators may examine whether the company actually has the required:

• personnel,
• systems,
• infrastructure,
• wallet arrangements,
• technological capacity,
• security measures,
• internal controls.

The SPK may also require technical review involving TÜBİTAK and other competent public authorities.

Accordingly, “paper compliance” is insufficient.

The platform must be technically capable of operating before the operating license is granted.

28. When Can the Crypto Exchange Actually Start Operating?

Only after the SPK considers the application compliant can the company receive an authorization certificate identifying the activities it may perform.

Before the certificate is issued, the required fee under the Fees Law must also be paid and proof of payment submitted to the SPK.

Importantly:

The company may not commence the regulated activity before obtaining the authorization certificate.

Communiqué III-35/B.1 expressly provides that regulated activities cannot begin before issuance of the authorization certificate.

This prohibition should be taken seriously.

29. “We Have Applied to the SPK” Is Not the Same as “We Are Licensed”

This distinction has historically caused confusion in the Turkish crypto market.

A company may:

• have submitted documents,
• have been under review,
• have appeared during a transitional regulatory process,
• or have completed an establishment stage.

None of these facts alone necessarily means that the institution possesses a final authorization to conduct every regulated activity.

For a new entrant, the decisive question is:

Has the SPK issued the relevant operating authorization and authorization certificate?

Until that point, customer-facing regulated crypto operations should not commence.

30. What Happens If the SPK Rejects the Operating-License Application?

If the company:

• fails to apply within the prescribed period, or
• its operating-license application is rejected,

it cannot simply remain incorporated indefinitely as a nominal crypto exchange.

Under Communiqué III-35/B.1, it must generally, within three months of notification:

• resolve to terminate the company, or
• amend its articles and trade name so that they no longer cover regulated crypto asset services.

The relevant registration and publication requirements must then be completed.

The six-month preparation period should therefore be treated as a real licensing deadline.

31. Unauthorized Operation Is a Criminal Risk

Operating without authorization is not merely an administrative violation.

Article 109/A of the Capital Markets Law provides criminal sanctions for unauthorized crypto asset service provision.

Natural persons and officers of legal entities found to be providing crypto asset services without the required authorization may face:

• three to five years’ imprisonment, and
• a judicial fine of between 5,000 and 10,000 days.

Therefore, a startup should not launch a “beta” exchange with real customer funds on the assumption that an SPK application can be filed afterward.

32. Can a Foreign Investor Establish a Turkish Crypto Platform?

Foreign investment is not inherently inconsistent with the Turkish licensing structure.

However, foreign ownership does not remove SPK scrutiny.

The regulator will still examine:

• direct shareholders,
• indirect shareholders,
• ultimate beneficial owners,
• control rights,
• financial strength,
• fit-and-proper qualifications,
• shareholder transparency.

Where foreign corporate shareholders are involved, the documentation exercise can become more complex because corporate-registry documents, ownership structures and supporting materials may need to be obtained from foreign jurisdictions and properly legalized or apostilled.

The investment structure should therefore be finalized before the SPK filing.

33. Can a Foreign Crypto Exchange Simply Offer Services From Abroad?

This strategy also carries significant regulatory risk.

The Capital Markets Law treats certain services offered by foreign platforms to persons resident in Türkiye as unauthorized crypto asset service provision.

Accordingly, a foreign exchange cannot safely assume that absence of a Turkish subsidiary automatically places it outside Turkish regulation.

A market-entry analysis should therefore be performed before:

• opening a Turkish-language website,
• targeting Turkish customers,
• conducting Turkish marketing,
• establishing local operations,
• or actively soliciting customers resident in Türkiye.

34. A Practical SPK Licensing Roadmap

For a new crypto exchange project, the licensing exercise can be organized into the following sequence:

Phase 1 — Regulatory Classification

Determine precisely:

• what the product does,
• whether it constitutes a platform,
• whether custody is involved,
• whether initial sale/distribution services will be offered,
• whether investment advisory services are contemplated.

Phase 2 — Shareholder Structuring

Complete:

• beneficial ownership analysis,
• fit-and-proper review,
• financing analysis,
• shareholder documentation.

Phase 3 — Capital Planning

For a 2026 platform, plan for at least:

TRY 250 million regulatory capital, subject to any additional applicable requirements.

Phase 4 — Corporate Documentation

Prepare:

• articles of association,
• corporate purpose,
• regulated trade name,
• governance provisions,
• share rights.

Phase 5 — SPK Establishment Application

File the current SPK forms and supporting documentation.

Phase 6 — Incorporation and Institutional Build-Out

Establish:

• management,
• personnel,
• internal audit,
• internal control,
• risk management,
• AML compliance.

Phase 7 — Technology and Cybersecurity

Complete:

• platform architecture,
• wallet systems,
• authentication,
• access controls,
• cybersecurity,
• TÜBİTAK infrastructure compliance.

Phase 8 — Custody Architecture

Negotiate and implement the legally compliant custody model.

Phase 9 — MKK and Other Integrations

Complete required technical and operational integrations.

Phase 10 — Operating-License Application

Submit evidence showing that the company is operationally capable of complying with SPK rules.

Phase 11 — Regulatory Inspection and Remediation

Respond to:

• SPK questions,
• additional-document requests,
• technical findings,
• infrastructure deficiencies.

Phase 12 — Authorization Certificate

Pay the applicable regulatory fee and obtain the SPK authorization certificate.

Only then should the regulated platform launch.

35. How Long Does an SPK Crypto License Take?

There is no responsible way to guarantee that an SPK crypto license will be issued within a fixed number of weeks.

The statutory structure itself shows why.

The application involves review of:

• shareholders,
• corporate documentation,
• capital,
• management,
• personnel,
• systems,
• cybersecurity,
• custody,
• internal control,
• risk management,
• regulatory integrations.

The SPK may also request additional documents or technical examinations.

For project planning purposes, founders should therefore treat licensing as a multi-stage regulatory project, not an ordinary company-registration process.

The six-month deadline following establishment authorization makes preparation before filing particularly important.

36. How Much Does Establishing a Licensed Crypto Exchange Really Cost?

The statutory capital requirement is only the beginning.

A realistic budget may also need to include:

• technology development,
• cybersecurity infrastructure,
• wallet infrastructure,
• custody costs,
• qualified personnel,
• compliance personnel,
• internal audit,
• internal control,
• risk management,
• independent audit,
• proof-of-reserves audit,
• legal advisory services,
• MASAK compliance,
• MKK integration,
• SPK fees,
• insurance if required,
• office and operational infrastructure.

Therefore:

TRY 250 million should not be interpreted as the total budget required to launch a licensed crypto exchange in Türkiye.

It is principally the current 2026 minimum capital threshold for the platform itself.

37. The Most Common Strategic Mistake: Building the Exchange Before Designing the License

Many fintech entrepreneurs follow the traditional software startup model:

build product → acquire users → obtain legal advice → seek license.

For a Turkish crypto asset service provider, this order should largely be reversed.

A safer sequence is:

regulatory classification → license architecture → ownership structure → technology design → compliance design → product build → SPK authorization → launch.

Why?

Because the regulatory requirements affect the product itself.

They influence:

• wallet design,
• customer onboarding,
• transaction approval,
• custody,
• account structure,
• staffing,
• reporting,
• cybersecurity,
• transfers,
• internal accounting,
• audit trails.

Rebuilding these systems after development can be substantially more expensive than designing them correctly from the beginning.

38. Final Assessment: Obtaining an SPK Crypto License Is a Financial-Institution Project, Not a Simple Company Formation

The Turkish crypto licensing regime has fundamentally changed the nature of establishing a crypto exchange.

A founder is no longer merely establishing a technology company.

The founder is establishing a regulated financial-market institution.

As of 2026, a new crypto asset trading platform should be prepared for, among other requirements:

• Turkish joint-stock company structure,
• registered shares,
• transparent ultimate ownership,
• fit-and-proper shareholders,
• minimum TRY 250 million capital for a platform,
• qualified board of directors,
• experienced general manager and deputy managers,
• internal audit,
• internal control,
• risk management,
• price surveillance,
• MASAK compliance,
• cybersecurity infrastructure,
• TÜBİTAK infrastructure compliance,
• MKK integration,
• custody arrangements,
• independent audit,
• proof-of-reserves controls,
• and a separate SPK operating authorization.

For a crypto custody institution, the current 2026 minimum capital threshold is even higher at TRY 630 million.

The central practical point is therefore simple:

Do not start by incorporating the company. Start by designing the license.

Once the ownership structure, capital, product architecture, custody model, management team and technological infrastructure have been designed around SPK requirements, the establishment and operating-authorization applications can be built around a coherent regulatory strategy.

In Turkey’s post-2024 crypto market, the competitive barrier is no longer merely technology or customer acquisition.

The license itself has become part of the product.