Entering Turkey’s crypto market is no longer a matter of incorporating a technology company, opening bank accounts and publishing terms of use. A platform’s legal perimeter now reaches into its order flow, custody architecture, shareholder structure, capital, personnel, internal controls, record integrity, token-listing process and relationships with foreign group companies. The licence is not a document placed on top of an existing product. The product, company and technical operations must be designed as the regulated institution.

This guide explains the Turkish authorisation and compliance framework for crypto exchanges, custodians and adjacent businesses. It is intended for foreign platforms, founders, investors, banks, custody providers, wallet companies, liquidity firms and Web3 projects considering a Turkish market connection. It addresses practical search questions such as “crypto exchange licence Turkey”, “CMB licence for crypto platform”, “SPK crypto custody requirements”, “foreign exchange serving Turkish customers”, “TÜBİTAK crypto technical criteria”, “Travel Rule Turkey”, “crypto market maker licence” and “is the SPK operating list a licence?”

The decisive exercise is a functional map. Who receives the customer instruction? Who controls fiat? Who can transfer the crypto asset? Where are private-key shares? Who sets or sources the price? Which legal entity contracts with the customer? Which system produces the record shown to the regulator and the customer? A business can only classify its authorisation needs after those questions have concrete answers.

For legal advice on this matter, you may contact Av. Ahmet Karaca:

WhatsApp Email

Turkey’s crypto regulatory framework

Law No. 7518, published on 2 July 2024, amended Capital Markets Law No. 6362 and placed crypto-asset service providers under the regulatory and supervisory authority of the Capital Markets Board of Türkiye—the CMB, known in Turkish as SPK. The amendments introduced definitions of crypto asset, wallet, crypto-asset service provider, custody service and platform; required CMB permission for establishment and commencement of regulated activity; addressed customer assets and records; and introduced enforcement and criminal provisions.

On 13 March 2025, two central communiqués entered into force:

Communiqué III-35/B.1 governs establishment, authorisation, shareholders, managers, personnel, organisation, internal audit, internal control, risk management, information systems, records, independent audit and proof-of-reserves arrangements.
Communiqué III-35/B.2 governs services and activities, trading environments, customer orders, custody and transfers, token listing, reconciliation, capital and capital adequacy.

The CMB’s official announcement summarises their scope and links to the texts. These rules operate together with anti-money-laundering legislation, payment-services rules, commercial law, data protection, consumer law, tax, sanctions controls and other sector-specific duties.

Which activities fall inside the CMB perimeter?

The statutory definition of a platform covers organisations where one or more of the purchase and sale, initial sale or distribution, exchange, transfer, necessary custody and other determined transactions concerning crypto assets are carried out. Crypto-asset service providers also include custody providers and other entities designated under the legislation to provide services concerning crypto assets.

Commercial names do not control the analysis. An “on-ramp widget”, “broker”, “OTC desk”, “wallet infrastructure provider”, “liquidity partner” or “matching software company” can be inside or outside the perimeter depending on what it actually does. The functional assessment should cover:

Operational question	Why it matters
Who receives and accepts the customer’s order?	Order reception and execution can place the entity in platform activity.
Are customer orders matched with other orders or the firm’s own inventory?	The trading environment and counterparty model affect regulated obligations and conflicts.
Who controls the private keys or transfer authority?	Control can amount to custody even if the customer is described as beneficial owner.
Who receives customer fiat and in whose bank account?	Customer-money safeguarding and payment-services questions arise.
Can the operator freeze, reverse, whitelist or redirect?	Actual control may contradict a claimed non-custodial model.
Who selects tokens and determines access to trading?	Listing governance and issuer relationships become relevant.
How is revenue earned?	Fees, spreads, commissions and inventory gains help reveal the economic service.
Which Turkish-resident users are targeted?	Foreign status does not prevent Turkey-facing activity from entering the perimeter.

A software supplier that never contracts with customers, controls assets or receives orders may have a different position from the licensed platform using its code. But outsourcing technology does not outsource regulatory responsibility. Contracts, access controls, service levels, audit rights, data location, incident response and exit arrangements must correspond to the regulated entity’s duties.

Foreign crypto exchanges targeting Turkey

The 2024 amendments and CMB guidance address foreign platforms offering services to persons resident in Turkey. The legislation identifies facts under which activity is considered directed at Turkish residents, including opening a place of business in Turkey, creating a Turkish-language website and conducting direct or indirect marketing through persons or institutions located in Turkey.

These are not the only facts that a market-entry review should document. A realistic assessment also examines:

Turkish language in applications, support, campaigns or educational material;
local affiliates, representatives, employees or contractors;
TRY rails and relationships with Turkish banks or payment firms;
local domain names and search advertising;
influencer, affiliate and referral programmes;
events and sponsorships in Turkey;
customer onboarding and residence controls;
terms allocating the customer to a foreign or Turkish group entity; and
whether geoblocking and offboarding are real, consistent and auditable.

The relevant CMB transition announcement required foreign service providers targeting Turkish residents to end those activities within the stated transition period unless brought into the lawful framework. A foreign group should not assume that a non-Turkish contracting entity neutralises Turkish-facing product design.

The CMB Operating Entities List is not a licence

One of the most persistent due-diligence errors is to treat appearance on the CMB’s “Faaliyette Bulunanlar Listesi” as final authorisation. The official list itself states that inclusion does not mean an organisation has been authorised under the legislation.

A status memorandum should distinguish:

historical operation before the new framework;
transition notification or application;
appearance on a public list;
establishment permission;
activity authorisation and the precise services covered;
ongoing conditions, restrictions or transition decisions; and
current public disclosures and certificates.

This matters in acquisitions, banking, token-listing negotiations and vendor contracts. “We are on the list” does not answer whether the intended activity is permitted today.

Establishment and corporate form

The communiqués impose detailed establishment conditions. The company must be a joint-stock company and meet requirements concerning its shares, capital, articles, founders and business purpose. Founders, significant shareholders, managers and certain personnel are subject to eligibility standards. Share transfers and changes in control can require regulatory treatment.

A foreign sponsor should plan ownership before filing. Late insertion of a holding company, option, nominee, voting arrangement or financing right can create regulatory questions not visible in the share ledger. Beneficial ownership, financial strength, criminal and regulatory history, insolvency status and transparent source of capital should be documented across the chain.

The articles of association cannot be treated as a generic incorporation form. They should align with the authorised activities, governance, registered shares, transfer restrictions, representation and regulatory requirements. Corporate documents, shareholder submissions and the technical operating model must tell the same story.

Capital and capital adequacy

Capital requirements are not static numbers. They can be adjusted by CMB decisions and interact with continuing own-funds requirements, customer assets and activity scale. In the CMB’s decision setting amounts applicable for 2026, the minimum establishment capital was set at TRY 250 million for platforms and TRY 630 million for custody providers. The same decision adjusts other monetary thresholds relevant to the regime.

Those figures are an entry point, not the complete capital analysis. A model should include:

paid-in establishment capital and source;
continuing minimum own funds;
activity- and asset-linked additions;
deductions and assets that do not qualify;
loss absorption and forecast burn;
capital impact of custody volume and operating risks;
contingent liabilities, guarantees and group exposures; and
early-warning and board escalation thresholds.

A startup budget that spends regulatory capital on product development without modelling continuing adequacy may satisfy incorporation and fail operation. Finance, risk and wallet growth should be projected together.

Governance, managers and the three-lines structure

The board cannot delegate away accountability merely because crypto operations are technically specialised. Governance should allocate ownership of customer assets, market operations, listings, AML, information security, incident response, outsourcing, complaints, reconciliation, capital and regulatory reporting.

Internal control, risk management and internal audit must have defined independence, access and reporting. Combining titles in an organisational chart does not demonstrate functional independence. The institution should be able to show who designed a control, who performed it, who tested it, what evidence was retained and how exceptions reached the board.

Management suitability should be evidenced, not asserted. Experience matrices can map each required competence to directors and senior personnel: capital markets, banking, distributed-ledger systems, cybersecurity, custody, AML, finance, legal and operations. Key-person and succession risk deserve special attention in founder-led organisations.

Custody: legal ownership is not the same as key control

Turkish law protects customer crypto assets and cash within the statutory framework, including separation from the service provider’s own property and limits on their use for the provider’s debts. Operational compliance depends on the architecture actually preserving that separation.

Custody analysis should draw a control map:

which entity holds each private key or key share;
where each key share, backup and signing component is located;
how hot, warm and cold arrangements are defined;
who can initiate, approve and broadcast a transfer;
how thresholds, roles and emergency overrides work;
how customer entitlements reconcile to on-chain balances;
how forks, airdrops, staking rewards and contract migrations are treated;
how keys are generated, backed up, recovered, rotated and destroyed; and
what happens when a vendor or group service becomes unavailable.

Multi-party computation and threshold cryptography can reduce single-key risk, but they do not answer the legal custody question automatically. If the provider or its coordinated system can cause a transfer, the allocation of shares, control and decision rights remains central. The communiqués also impose Turkey-location and control requirements for private keys or key shares and relevant mechanisms in specified arrangements.

Platforms must establish relationships and technical processes with authorised custody providers as required by the framework. A CMB decision of 26 March 2026 addressed transition timing for custody agreements and authorisation certificates by linking deadlines to the widespread commencement of services by authorised custody institutions. That decision should be read as a current transition measure, not as a permanent exemption from custody architecture.

TÜBİTAK technical criteria

Law No. 6362 assigns TÜBİTAK a defined role in technical criteria and assessments. TÜBİTAK BİLGEM published criteria for crypto-asset service providers’ information systems and technological infrastructure. The criteria address areas such as wallet security, information-systems governance, information security and business continuity.

A credible readiness programme converts each requirement into an evidence-bearing control. Examples include:

Domain	Design question	Evidence
Key management	Can one person or compromised environment move customer assets?	Ceremony records, threshold configuration, role matrix and tests
Access	Are privileged actions strongly authenticated, time-bound and reviewed?	Identity logs, access reviews, approvals and revocation tests
Secure development	Are changes reviewed, tested, signed and segregated?	Change tickets, code review, build provenance and release logs
Monitoring	Can anomalous withdrawals and control failures be detected?	Alert rules, cases, response times and tuning decisions
Continuity	Can critical services and keys recover within approved objectives?	Impact analysis, recovery tests and board-reviewed results
Outsourcing	Can the institution audit, replace and exit the supplier?	Contract rights, inventory, concentration analysis and exit exercise

A policy saying “industry-standard encryption is used” is not evidence that the signing environment meets a defined control. Technical and legal teams should maintain a single requirements matrix so that representations in the application match the deployed system.

Records, time, integrity and the internal ledger

A regulated platform must preserve far more than blockchain transactions. Customer identity, orders, executions, prices, communications, internal transfers, balances, withdrawals, approvals, complaints and system events may all matter. Some activity occurs entirely off-chain, and public-ledger data cannot reconstruct it.

Record design should address:

authoritative source for each field;
consistent timestamps and time synchronisation;
immutable or tamper-evident storage;
linkage among order, trade, transfer and customer identifiers;
versioning of terms, fees and product rules;
voice and electronic communication retention where applicable;
data lineage into regulatory and customer reports;
controlled correction of errors; and
search, export and legal-hold capability.

The best test is operational: can the institution reconstruct one disputed customer journey from bank deposit through trade, internal ledger, custody balance and on-chain withdrawal without manual assumptions? That same reconstruction is often decisive in the investigations and exchange disputes we handle.

Proof of reserves is an audit process, not a marketing widget

A public wallet balance or Merkle-tree page can contribute to transparency, but regulatory proof of reserves must address controlled assets, customer liabilities, scope, ownership, completeness, cut-off, encumbrances and reconciliation. A platform can display sufficient on-chain assets while omitting liabilities; a custodian can control an address without establishing that the assets are unencumbered customer property.

The CMB’s principle decision on proof-of-reserves audits addresses audit periods, wallet information and procedures. Readiness requires an inventory of networks, addresses, wallet types, control arrangements and customer obligations, together with evidence that the selected population is complete.

Reconciliation breaks should have owners, age limits, escalation and resolution records. “Blockchain finality” does not resolve differences caused by pending deposits, reorg policy, token decimals, fees, internal transfers or incorrect customer crediting.

Trading rules, best execution and conflicts

The trading model determines the controls. An order book, request-for-quote system, broker model and principal dealing desk create different execution and conflict questions. The platform should document order types, matching priority, partial fills, cancellation, downtime, erroneous trades, price sources, fees, spreads and customer disclosures.

Where the platform, affiliate or liquidity provider trades against customers, governance should identify the conflict and prevent misuse of customer order information. Market surveillance should look for manipulation patterns suited to crypto markets: wash trading, spoofing, layering, coordinated pumps, self-trading, misuse of listing information and abusive activity across linked accounts.

Best-execution duties cannot be met by copying securities language into terms. The execution policy must correspond to actual routing, price formation, speed, likelihood, custody, costs and venue selection. Monitoring should test outcomes and explain exceptions.

Token listing and delisting

Platforms need a listing committee and documented criteria under Communiqué III-35/B.2. Listing is not a one-time legal opinion. Technical, legal, market-integrity and financial risks evolve after admission.

A listing file should examine:

issuer, foundation, core team and beneficial control;
token purpose, rights and economic dependence;
supply, mint, burn, vesting and treasury concentration;
administrator, upgrade, pause, blacklist and oracle powers;
network security, bridge dependence and audit history;
liquidity, price formation, related market makers and manipulation risk;
sanctions, AML and illicit-finance exposure;
disclosures, marketing and issuer commitments;
conflicts, fees or holdings of decision-makers; and
monitoring triggers and orderly delisting.

For the current treatment of unique non-fungible digital assets and assets used only within virtual games, Communiqué III-35/B.2, Article 49 provides the separate-market and disclosure framework. Article 21 addresses listing conditions, including restrictions linked to underlying assets. The 2025/15 CMB bulletin records the repeal of specified points of the 2024 principle decision. A token’s actual function and rights must be tested against the current framework; calling an investment token an “NFT” does not settle its treatment.

AML, KYC and the Travel Rule

Crypto-asset service providers are obliged entities. MASAK’s framework includes customer identification, beneficial-owner identification, ongoing monitoring, suspicious-transaction reporting, information production, retention, compliance programmes, enhanced measures and risk management. The MASAK sector guide is essential operational reading.

The Travel Rule requires defined originator and beneficiary information in qualifying crypto transfers. Implementation is not achieved by adding a free-text field. The provider needs counterparty classification, data exchange, validation, sanctions and risk screening, missing-information workflow, self-hosted-wallet treatment, rejection and hold logic, privacy controls and auditable decisioning.

MASAK General Communiqué No. 29 introduced enhanced measures including transaction descriptions, limits and waiting periods for specified crypto withdrawals. The rule includes a general minimum waiting period after relevant purchase, exchange or deposit events and a longer period for the first withdrawal, together with limits and conditions for stablecoin transfers and defined exceptions. The official text should be translated into product rules precisely; simplified website summaries are risky.

Monitoring should join fiat, platform and blockchain data. A customer’s bank payer, P2P counterparty, device, order, internal transfer and withdrawal destination may each be legitimate in isolation while the joined sequence requires review. At the same time, a blockchain exposure alert is not proof of wrongdoing. FATF guidance treats red flags as contextual indicators.

Customer cash, payment services and the crypto-payments restriction

Customer cash arrangements must follow the capital-markets framework and banking relationships. If a group company, payment institution or merchant collects and transmits funds, separate payment-services questions arise. Law No. 6493 requires authorisation for regulated payment services, with criminal consequences for unauthorised provision.

Turkey also distinguishes crypto trading from use of crypto assets in payment. The CBRT Regulation on the Disuse of Crypto Assets in Payments prohibits direct and indirect use of crypto assets in payments and restricts payment-service business models. An exchange on-ramp, merchant checkout, remittance product and corporate treasury purchase may use similar APIs but have different legal outcomes.

P2P, OTC, market making and liquidity provision

Proprietary purchase and sale of a firm’s own assets is not identical to executing transactions for customers. Risk increases where the business systematically receives third-party funds, sources or matches counterparties, acts for another’s account, controls settlement or holds itself out as a continuous service.

A market maker providing quotes to a licensed platform may be a counterparty rather than the platform operator, but the agreement and operational reality must be reviewed. Examine:

whether quotes are principal or customer orders;
access to non-public order information;
inventory and settlement control;
performance incentives and manipulation safeguards;
affiliate and conflict relationships;
customer-facing representations;
AML allocation and record availability; and
whether the arrangement crosses into another regulated activity.

Our Turkish analyses of crypto liquidity provision and crypto market making examine these boundaries in more detail.

Investment advice, research and social-media content

General market commentary, issuer marketing, personalised recommendations and regulated investment advice are not interchangeable. Communiqué III-35/B.2 includes crypto-asset investment advice among activities subject to the applicable permission and organisational framework. The relationship, personalisation, compensation, product, audience and call to action matter.

Writing “not financial advice” does not change a paid, personalised recommendation into neutral education. Platforms should govern research, influencer arrangements, referral compensation, employee dealing, issuer-sponsored content and conflicts. Our Turkish guide to crypto investment advice under CMB rules addresses the distinction.

Outsourcing and group-company architecture

Global groups often centralise wallets, liquidity, cloud infrastructure, security operations, customer support and development. Turkish authorisation does not make those dependencies disappear. The regulated entity should maintain an inventory showing service owner, data and key access, locations, subcontractors, concentration, audit rights, incident duties, continuity and exit plan.

Intercompany agreements need substance: service levels, regulatory access, records, confidentiality, intellectual property, liability, allocation of security decisions and termination assistance. If the Turkish entity cannot continue or exit without a foreign affiliate’s discretion, operational independence should be examined before application.

Application architecture: from gap analysis to operating evidence

A serious authorisation project can be organised into seven workstreams:

Perimeter and target licence. Freeze the product map, legal entities, customer journeys and regulated services.
Corporate and capital. Establish ownership, eligibility, funding, articles and continuing adequacy.
Governance and people. Appoint qualified board and control functions with real independence.
Custody and asset protection. Design keys, wallets, segregation, reconciliation and third-party custody.
Trading and products. Establish order, execution, listing, conflicts, surveillance and complaints controls.
AML and sanctions. Build onboarding, monitoring, Travel Rule, investigations and reporting.
Technology and evidence. Implement TÜBİTAK-aligned controls, records, resilience, testing and audit readiness.

Each requirement should have an owner, design document, implementation evidence, test result, deficiency, remediation date and approval. Regulators authorise an institution capable of controlled operation, not a folder of aspirational policies.

Pre-filing tests that expose hidden weaknesses

Before filing, run end-to-end scenarios:

reconstruct a customer’s order and withdrawal from original records;
restore a critical signing component under dual control;
reconcile customer entitlements to controlled on-chain assets;
process a transfer with incomplete Travel Rule information;
detect and stop an anomalous destination change;
execute a token-listing conflict and recusal workflow;
respond to a prosecutor’s targeted preservation and account request;
simulate outage of a cloud or custody dependency;
show capital impact after a severe loss; and
produce the evidence pack for every step.

Across platform, bank, project and investigation work, these operational walk-throughs reveal discrepancies that document review misses: the policy names the Turkish entity, while the actual approval sits with a foreign team; the ledger reports customer ownership, while keys and reconciliation cannot demonstrate it; or the Travel Rule process exists only after the transfer has been released.

Enforcement and personal responsibility

The CMB has supervisory, corrective and enforcement powers under the amended law. Unauthorised activity can lead to access restrictions and criminal exposure under Article 109/A. The framework also includes provisions addressing misconduct by service-provider managers and protection of customer assets.

Directors and responsible officers should ensure that minutes show the information received, risks debated and action taken. A technical presentation that no director can challenge does not evidence oversight. Escalations concerning liquidity, custody, cyber incidents, reserve gaps, sanctions and unauthorised products must reach the appropriate level in time.

Customer communications, complaints and crisis decisions

Many compliance failures become visible first through customer communication. An exchange advertises “instant withdrawals” while its AML and custody systems impose conditional delays. A token page repeats an issuer’s promise without explaining administrator powers. A support agent describes an account restriction as a final authority decision when the review is still internal. These are not merely tone problems: they can affect informed consent, complaints, evidence and regulatory trust.

Product, legal and operations teams should control the complete communication lifecycle. Fees, spreads, execution methods, custody arrangements, withdrawal rules, token risks and complaint channels should be accurate in the language in which Turkish residents are served. Version history matters, because the applicable disclosure is the one presented when the customer acted. Translating a global policy literally can be misleading where the Turkish entity, legal remedy or service scope differs.

A complaints framework should classify issues by more than response deadline. The institution needs to recognise patterns that reveal a control failure: repeated account takeover after a security-setting change; deposits credited on the wrong network; P2P disputes involving third-party payers; an unusual concentration of token-listing complaints; unexplained reconciliation breaks; or customers receiving inconsistent reasons for restrictions. Root-cause analysis should feed security, AML, listing, vendor and board processes.

Crisis playbooks deserve the same discipline. A hot-wallet incident, stablecoin depeg, chain halt, bridge exploit, sanctions designation or custody-provider outage creates legal and technical decisions in minutes. Who can suspend deposits, trading and withdrawals? Which entity communicates? How are customer assets distinguished from the firm’s inventory? What evidence is preserved before systems are changed? Which authorities, counterparties and customers must be notified? How will reopening criteria be approved?

A blanket shutdown can sometimes preserve assets; in another incident it may trap customers in a rapidly failing product or create unequal treatment. The playbook should therefore define decision factors rather than prescribe one answer. Records should show data available at the time, alternatives considered, conflicts, approvals and later review. In investigations involving exchanges, these contemporaneous records often explain conduct better than a policy reconstructed after the event.

Data protection and regulatory access

Crypto compliance processes use identity documents, device identifiers, IP logs, transaction histories, wallet addresses, biometric or remote-identification data and risk assessments. These datasets engage Turkey’s personal-data framework while also supporting mandatory retention, monitoring and authority requests. “Blockchain data is public” does not make every joined customer profile unrestricted personal data.

The institution should map purposes, legal bases, access roles, retention, cross-border transfers, vendors and deletion limits. Data minimisation must coexist with the obligation to keep complete regulated records. Legal holds should prevent routine deletion after a complaint, incident or authority request. When a foreign group operates shared monitoring, the Turkish entity should know where data is processed, which affiliate can access it and how a regulator can obtain the required record without delay.

Authority requests require verification and controlled execution. The response log should record the requesting body, legal basis, scope, searches performed, data disclosed, restriction implemented and approver. Over-disclosure can prejudice customer rights; under-disclosure can breach a statutory duty. A mature platform can produce targeted records without giving unrestricted access to unrelated customer or key material.

Due diligence for investors, acquirers and banking partners

Transaction diligence should go beyond the CMB list. Verify the exact application and authorisation status, capital, shareholder eligibility, activity scope, custody contracts, key-control architecture, proof-of-reserves findings, AML remediation, regulator correspondence, incidents, complaints, outsourcing, litigation and tax position.

Technical diligence should sample the claims. Select wallets and reconcile them. Inspect privileged access and key ceremonies. Trace a small set of customer journeys. Test whether the platform can produce internal-ledger and blockchain records consistently. Review smart-contract or bridge dependencies. Identify liabilities that cannot be seen on-chain.

For a bank, the same exercise informs risk appetite and account controls. For an acquirer, it informs conditions precedent, warranties, indemnities and post-closing capital. For a seller, early remediation is more credible than a data room full of policies created immediately before diligence.

A practical answer to “How do we launch a crypto exchange in Turkey?”

Begin with service and control, not branding. Decide whether the Turkish entity will operate a platform, provide custody or combine authorised activities; whether it trades as principal; how fiat enters; where customer assets and key shares sit; which tokens will be listed; and which group functions are essential. Confirm current CMB amounts, transition decisions and permitted scope immediately before action.

Then design the company, capital, governance, AML, custody and systems around that target. Build evidence while implementing. Test the complete customer and asset lifecycle. Submit a coherent application in which corporate documents, policies, contracts, diagrams and deployed technology describe the same institution.

That is the practical difference between a licence project and a legal memo. The former must survive a failed withdrawal, a disputed order, a cyber incident, a reserve audit and an authority request—not merely answer what the rules say.

Related Pega Hukuk analysis

Official sources

İlgili çalışma alanı: Kripto Varlık Hizmet Sağlayıcı (KVHS) Lisansı ve MASAK Uyumu — Kripto varlık hizmet sağlayıcıları, kripto borsaları, saklama kuruluşları ve fintech girişimleri.

Related English guides on Turkish P2P law

Use these guides for the transaction-specific questions:

Crypto Exchange Licensing in Turkey: CMB, Custody and AML Guide