“P2P merchant”, “OTC desk” and “liquidity provider” are business descriptions, not Turkish regulatory permissions. The legal analysis starts with what the business actually does: whose assets it trades, whose instructions it follows, whether it holds or transfers customer value, and how it offers the service.
An individual selling accumulated crypto, a company investing its treasury, a desk executing customer orders and a marketplace matching users can all use similar screens. They may nevertheless occupy different regulatory positions. This guide explains the classification process before a business launches, changes its model or responds to an investigation.
The authorisation question is about the service
Law No. 7518 introduced the crypto service-provider framework into Capital Markets Law No. 6362. Communiqué III-35/B.2, Article 5 identifies regulated activities including receiving and executing crypto orders, exchange, transfer and related custody, intermediation in initial sales or distributions, custody or management of assets or keys, and investment advice.
Article 6 requires authorisation when the regulated activities are carried on as a regular occupation or commercial or professional activity. The inquiry therefore has two parts: identify a covered service, then determine how it is conducted. Trading frequency is relevant evidence but is not a substitute for the first part. The absence of a separate commission does not necessarily mean that no service is being supplied; remuneration may be embedded in a spread.
Conversely, a spread or repeated proprietary trading should not be treated as conclusive proof of customer intermediation. Actual ownership, obligations, control and risk must be established. There is no universal trade-count or turnover threshold in these provisions that readers can use as a personal-trading safe harbour.
Do not rely on the repealed 2024 P2P point
The September 2024 CMB principle decision included a P2P-specific statement about transactions in one’s own name for another person’s account. Point 6 is often quoted as if it were still the operative rule. The CMB’s 2025/15 bulletin records its repeal alongside other points following the new communiqués.
Two opposite errors follow from overlooking that change. One is to present the repealed wording as a current standalone prohibition. The other is to interpret repeal as a blanket exemption for P2P businesses. The correct starting point is the current statute and the services, authorisation and operational provisions of the communiqués.
What does the own-wallet provision actually say?
Article 6(3) of III-35/B.2 addresses crypto service providers’ purchases, sales and transfers for their own wallets with parties other than their customers, without an intention to supply a crypto service. Its wording is narrower than the claim “anything sent through my wallet is exempt”. The provision must be read with the statute’s definitions and the rest of Article 6.
A wallet registered to a company can contain value economically belonging to clients. A company may take legal title briefly while remaining contractually obliged to execute someone else’s instructions. An operator may describe incoming funds as a purchase price although the real obligation is to send equivalent value to a nominated foreign beneficiary. The entire relationship needs examination.
A defensible analysis documents the asset owner before and after each leg, the party carrying market risk, the customer’s rights on cancellation, the treatment of fees, and the operator’s power over settlement. The own-wallet wording cannot be used to avoid explaining those facts.
Four business models that need different analysis
| Hypothetical model | Facts supporting the description | Facts that change the question |
|---|---|---|
| Personal disposal | Previously acquired holdings sold for the holder’s own benefit | Customer instructions, borrowed identities or funds accepted for onward delivery |
| Corporate treasury trading | Company-owned capital, genuine inventory and exposure, corporate books | A “treasury” account routinely settles transactions for unrelated people |
| OTC dealing or order execution | Customer quotes and a defined settlement obligation | Whether the desk acts as principal, intermediary, custodian or payment transmitter |
| P2P marketplace | Advertisements, matching, order controls and potentially escrow | Who operates the venue, controls assets and undertakes customer obligations |
The table is a fact-gathering tool, not a list of pre-approved models. A business may perform more than one role. An exchange’s contract might permit an institutional liquidity relationship, while the same firm’s direct retail activity raises a different authorisation issue.
Liquidity provision and market making require their own evidence
III-35/B.2 contains provisions concerning transaction environments, counterparties, proprietary platform activity and liquidity. These should be read against the actual agreement. Who quotes? On which venue? To whom is the service offered? Does the firm deal only with an institutional counterparty, or solicit retail customers under the same arrangement?
MASAK’s documented exception for qualifying liquidity provision, market making and intermarket arbitrage is a separate issue. Under the enhanced-measures guide, a platform may refrain from applying specified waiting periods and amount limits only with the required customer-specific board approval, evidence and monitoring. It is not obtained by putting “arbitrage” in a transfer description.
Even where that exception is properly applied, it does not itself decide whether the customer’s business requires CMB authorisation. AML treatment, licensing and contractual acceptance are three separate determinations. The transfer-rules guide explains the exception’s conditions and the controls that remain.
Company registration, tax registration and merchant verification
Incorporation establishes a legal entity. Tax registration addresses tax administration. A municipal workplace licence concerns the premises and activity within its own framework. A platform badge reflects that platform’s onboarding criteria. None should be presented as equivalent to the CMB’s permission for a regulated service.
A useful adverse example is Danıştay 4th Chamber, E.2024/4049, K.2025/3497, 29 May 2025. The dispute arose from a workplace-licence application described as software and programming, while the actual activity involved crypto dealing. The majority treated the real activity as material and reversed the lower court’s approach. The underlying events predated the present crypto framework; the decision is not a ruling that every current crypto business is forbidden or that a municipal licence substitutes for CMB authorisation.
The practical lesson is to make corporate purposes, contracts, bank explanations, tax records and actual operations consistent. A software description should not be used to conceal an OTC desk. A tax opinion about income classification does not authorise the underlying financial service.
When the model also resembles money transmission
Suppose a desk receives lira from customer A and promises to arrange value for beneficiary B abroad, using stablecoins in the middle. The legal question is not resolved by calling the intermediate trade “P2P”. The arrangement may require examination under payment-services law as well as the crypto framework, including who receives funds, who owes the beneficiary and where the service is offered.
The CBRT’s crypto-payment regulation adds restrictions on direct and indirect crypto use in payments and on specified payment-service models. Selling an asset for one’s own investment purposes and facilitating merchants’ crypto payments are materially different operations. Avoid promising customers that conversion into lira automatically removes the payment-law issue.
A business assessment should map the entire value route, not stop at the operator’s wallet. Include foreign counterparties, subcontractors, collection accounts and who bears non-delivery risk. Where the arrangement resembles remittance, that question should be resolved before launch.
A foreign company does not settle the Turkish perimeter
Law No. 6362, Article 99/A, addresses foreign platforms targeting persons resident in Turkey. The statutory indicators include a Turkish workplace, a Turkish-language website and relevant marketing directed to Turkish residents. III-35/B.2, Article 9 also addresses services obtained abroad on a resident’s own initiative within its conditions.
These rules concern actual targeting and service provision. An overseas incorporation certificate or foreign licence is not a passport into every Turkish regulated activity. Equally, nationality is not the same as residence. A model serving a Turkish resident must be analysed on its facts rather than assuming that a foreign passport removes the territorial issue.
A written cross-border assessment should identify the contracting entity, customer residence, marketing channels, location of staff, bank accounts, custody, dispute forum and the foreign rules separately. See P2P trading by foreigners and cross-border users.
For a Dubai-based desk or a model connecting AED, USDT and Turkish-lira payments, the Dubai–Turkey P2P guide applies these questions alongside VARA licensing, payment-service boundaries and the company’s tax position.
Prepare a business-model dossier before seeking a conclusion
- Value-flow diagram: each fiat and crypto leg, including custody and internal platform transfers.
- Ownership schedule: whose money or assets are held at each stage and what happens on cancellation.
- Service description: exactly what is promised to customers, including advice, execution, transfer or safekeeping.
- Contracts and public material: actual terms, advertisements, website and merchant profile.
- Economics: spread, fee, inventory risk, funding source and settlement exposure.
- Operations: staff, devices, account authority, signing control and customer access.
- Jurisdictions: establishments, customer residence and targeting.
- Controls and records: identity, source of funds, third-party payments, complaints, reconciliation and retention.
The legal opinion should tie each conclusion to those facts, identify unresolved regulatory questions and state what operational change would require reassessment. A conclusion based on a proprietary model becomes unreliable if the business later starts receiving client funds or holding their keys.
What if the business has already started?
Preserve records and obtain a model-specific review. Do not backdate contracts, relabel historical transfers or delete advertisements to make the old activity fit the preferred category. If a material authorisation issue emerges, the response should address whether the affected activity must stop or change and how existing customer obligations will be handled lawfully.
Article 109/A of Law No. 6362 provides criminal consequences for unauthorised crypto service-provider activity; other measures and claims may also arise. The presence or absence of a fraud complaint is therefore not the only question. The existing crypto exchange licensing and compliance guide develops the institutional framework, while the main P2P law guide places it alongside civil, criminal and tax issues.
