Crypto asset service provider Turkey rules now include strict risk liability under Law No. 7518 and Article 71. TENHA LAW FIRM guides platforms on risk liability of crypto asset service providers. Contact us for strategic compliance advice.

Introduction

If you operate a crypto asset service provider in Turkey or you offer crypto services to clients resident in Turkey, your risk landscape has changed dramatically with Law No. 7518 – often referred to as the “Crypto Assets Law”. This reform amended the Capital Markets Law and linked crypto platforms directly to Article 71 of the Turkish Code of Obligations, a general clause on risk-based strict liability.

Until recently, many platforms approached liability primarily as a matter of contract – user terms, disclaimers, risk warnings. Under the new regime, however, crypto asset service providers (CASPs) may face strict risk liability (tehlike sorumluluğu) for losses arising from the operation of their IT systems, cyber-attacks, information security breaches and even staff behaviour, regardless of fault.

In this article, TENHA LAW FIRM breaks down:

• What “risk liability of crypto asset service providers” means in practice
• How Law No. 7518 and SPK (CMB) Article 99/B connect CASPs to Article 71
• Which risk scenarios are covered – and which service interruptions sit outside strict liability
• How boards and managers may face personal liability if platform assets are insufficient
• Concrete steps to design a robust compliance and risk-management framework

Our goal is to help both Turkish and international platforms understand this new regime, structure their operations accordingly and protect themselves – and their clients – before a major incident occurs.

1. Crypto Asset Service Provider Turkey – Why Risk Liability Matters

A crypto asset service provider Turkey is now treated as an enterprise that creates “important danger” (önemli ölçüde tehlike) for customers and the financial system. Under Capital Markets Law Article 3(cc) and (dd), CASPs include:

• Crypto trading platforms and exchanges
• Custody providers holding crypto assets for clients
• Entities involved in the initial sale, distribution or transfer of crypto assets
• Other service providers designated via secondary legislation of the Capital Markets Board (CMB / SPK)

Law No. 7518 aims to:

• Protect customer assets
• Prevent money laundering and terrorist financing
• Bring the crypto sector closer to a regulated financial market, similar to banking, while not copying the EU MiCA regime word-for-word

However, the most striking innovation is that crypto asset service providers are expressly subjected to general risk liability under Article 71 Turkish Code of Obligations, rather than a softer contractual liability standard. This means that, in many situations, the provider may be liable even if they have taken “all reasonably expected precautions”.

From a practical perspective, this changes:

• How you draft your platform terms
• How you design IT, security and internal control systems
• How you think about insurance, capital buffers and board oversight
• How you respond to incidents and handle customer claims

2. Risk Liability of Crypto Asset Service Providers under Law No. 7518

2.1. From Contractual Liability to Strict Risk Liability

Under classical contract law, a platform would typically be liable to its users under Article 112 Turkish Code of Obligations, which is based on fault but effectively reverses the burden: the creditor (customer) does not need to prove the debtor’s fault; it is the debtor who must prove that it is not at fault.

Law No. 7518 goes further. SPK Article 99/B(4) now provides that CASPs are liable, under Article 71 TBK, for losses arising from:

• The operation of their IT systems
• Any kind of cyber-attack
• Information security breaches
• Comparable technology-related incidents
• Losses caused by the conduct of their staff in relation to these risks

Under Article 71, this is risk liability (tehlike sorumluluğu) – the most severe form of strict liability in Turkish private law. The CASP’s only real defence is to prove that the causal link was cut by an external factor such as force majeure or the victim’s own heavy fault; demonstrating absence of fault is not enough.

In other words:

For a crypto asset service provider in Turkey, the law deliberately installs the strictest possible liability regime, not a soft, negligence-based one.

2.2. CASPs as “Dangerous Enterprises”

Article 71 TBK is a general clause on risk liability, created to deal with modern industrial and technological activities that generate serious danger for people and property (e.g. nuclear plants, hazardous transport, large-scale industrial facilities).

A “dangerous enterprise” is one which:

• By its nature, or by the materials, instruments or energies it uses,
• Can cause frequent or serious damage,
• Even when a specialist exercises all diligence that can reasonably be expected.

For crypto platforms, the typical risk is not physical explosion but systemic IT and cyber-security risk. Even with state-of-the-art security, distributed systems remain vulnerable to sophisticated attacks, human error and complex interactions. The legislator has chosen to treat this as a danger comparable, in legal terms, to certain industrial risks.

2.3. What Damage Is Covered?

Turkish law generally allows compensation for pure economic loss if a specific protective rule has been breached. Because SPK Article 99/B(4) explicitly refers to “loss of crypto assets” arising from the characteristic risks of CASP operations, pure financial loss – for example, the complete loss of a client’s BTC or USDT balance – can in principle be compensated under Article 71.

However, valuation raises difficulties: crypto markets are highly volatile, and determining the relevant value date (pre-incident, post-incident, or judgment date) may be contentious. The scholarship rightly highlights that volatility complicates damage assessment and may require careful judicial and evidentiary approaches.

3. Article 71 Turkish Code of Obligations: The Strict Liability Backbone

3.1. Conditions of Risk Liability

To trigger Article 71 TBK, three key conditions must be satisfied:

1. Existence of a dangerous enterprise or activity
   • The CASP’s operations must constitute an activity that creates important danger.
   • Under SPK 99/B, this is presumed for crypto asset service providers.
2. Damage arising from the typical risk of that activity
   • Not every incident at a platform is covered; there must be a connection with its characteristic risk, such as system operation, cyber-attacks or security breaches.
   • A customer who trips in the lobby of a CASP office may have a claim, but not under Article 71’s crypto-specific risk liability.
3. Adequate causal link (uygun illiyet bağı)
   • The typical risk must be a condition that, in the ordinary course of events, can objectively lead to the damage in question.

If these conditions are met, the CASP is liable, regardless of its fault or level of diligence.

3.2. Who Is Liable?

Under Article 71, the owner and the operator of the enterprise are jointly and severally liable (müteselsil sorumluluk).

Applied to a crypto asset service provider Turkey:

• The licensed platform entity (company) is liable as enterprise owner / operator;
• If damage cannot be compensated from the platform’s assets, members of the board may be liable according to their fault and the circumstances. This follows from SPK Article 99/B(4), which extends responsibility to management in certain cases.

In addition, SPK Article 110/B introduces potential criminal liability (embezzlement-like offences) for board members who misappropriate customer assets, adding another layer of personal exposure.

3.3. When Can a CASP Escape Liability?

For risk liability, there is no general “due care” defence. The CASP cannot simply argue, “We did everything right.” To avoid liability, it must prove that the causal link was cut by:

• A genuine force majeure (extraordinary, unforeseeable and unavoidable external event),
• The victim’s heavy fault, or
• In certain views, a third party’s heavy fault that completely supersedes the platform’s risk.

The statute itself also recognises that some situations fall outside the risk-liability regime: for example, temporary service interruptions during which orders cannot be transmitted or trades/transfers cannot be executed, without any fault of the CASP, are carved out of Article 71 coverage.

This is important for platforms: not every downtime equals strict liability. But where downtime interacts with cyber-attacks, data breaches or system mis-design, the protection may evaporate.

4. Common Risk Scenarios for Crypto Platforms and Their Customers

In practice, a crypto asset service provider Turkey faces a series of recurring risk scenarios. Under the new regime, many of these will be assessed through the lens of risk liability of crypto asset service providers:

• ❌ Major hacking incident
  • Attackers exploit a vulnerability in hot-wallet infrastructure and drain customer funds.
  • Legal effect: Classic case of system-related risk; Article 71 TBK and SPK 99/B(4) strongly point to strict liability vis-à-vis customers.
• ❌ Information security breach / insider abuse
  • Employee leaks API keys or bypasses controls, causing unauthorised withdrawals.
  • Legal effect: The statute expressly includes staff conduct within the characteristic risk. Disclaimers in employment contracts or platform T&Cs will not remove Article 71 exposure.
• ❌ Serious system malfunction
  • A software update fails, corrupting balances or order books. Clients lose access to their crypto assets or suffer mis-executed trades.
  • Legal effect: Operation of IT systems is central to the CASP’s risky activity; risk liability likely applies if damage is not purely theoretical but results in actual loss.
• ❌ Downtime during market crash
  • Platform is unreachable during extreme volatility; customers miss sales and suffer losses.
  • Legal effect: Here, the statutory carve-out for temporary service interruptions without CASP fault becomes crucial. Careful factual analysis is needed: was this an unavoidable overload or a preventable capacity failure?
• ❌ Regulatory breach triggering asset freeze
  • CASP fails to comply with AML/CTF obligations; regulators intervene and freeze operations, indirectly causing customer loss.
  • Legal effect: Liability may arise under both standard fault-based rules and risk liability, particularly if the regulatory breach is linked to the platform’s characteristic risks and internal control failures.

For each scenario, a CASP must think not only in terms of “Can we defend ourselves?”, but also “How do we pre-allocate and manage this risk?” through:

• Contractual architecture (terms, risk warnings, allocation clauses)
• Governance and internal control
• Insurance and capital planning
• Incident response and communication plans

5. Why Choose TENHA LAW FIRM for Crypto Asset Service Provider Turkey Compliance?

At TENHA LAW FIRM, we combine capital markets expertise, tort law analysis and a deep understanding of blockchain and crypto business models. The new regime under Law No. 7518 and Article 71 TBK is not only a compliance challenge; it is a strategic risk issue that goes to the core of your platform’s viability.

Our expertise includes:

• ✅ Structuring and licensing of crypto asset service providers in Turkey
• ✅ Drafting and revising platform terms, custody arrangements and internal policies in line with SPK 99/B and Article 71
• ✅ Designing governance structures that mitigate board and management personal liability
• ✅ Advising on cyber-security, IT procurement and outsourcing contracts from a risk-allocation perspective
• ✅ Supporting incident response, negotiations with regulators and handling customer claims and litigation

We regularly advise international platforms entering the Turkish market and Turkish CASPs that wish to align their operations with global best practices while meeting domestic legal requirements.

6. Frequently Asked Questions About Crypto Asset Service Provider Turkey Risk Liability

7. Conclusion: Taking Action on Crypto Asset Service Provider Turkey Risk Rules

The new regime for crypto asset service provider Turkey marks a decisive step: crypto platforms are now treated as dangerous enterprises under Article 71 TBK, subject to the strictest form of civil liability for their characteristic risks. For operators, this is not merely a legal technicality; it directly affects business continuity, reputation and solvency.

At TENHA LAW FIRM, we help platforms translate the abstract concept of risk liability of crypto asset service providers into concrete governance, contractual and technical measures. From licensing and policy drafting to incident response and litigation, our team guides both Turkish and international CASPs through this evolving landscape.

If you operate – or plan to operate – a crypto asset service provider in Turkey, now is the time to:

• Map your risk exposure under Law No. 7518 and Article 71 TBK
• Align your IT, security and governance structures with the new standards
• Clarify the personal exposure of board members and senior management

📞 Contact TENHA LAW FIRM today to schedule a confidential consultation on your crypto platform’s risk liability and compliance strategy.

🔑 Key Takeaways

• ✅ Law No. 7518 subjects crypto asset service provider Turkey operations to Article 71 TBK risk liability, not only to contract-based rules.
• ✅ CASPs are treated as dangerous enterprises, liable for losses from IT system operation, cyber-attacks, security breaches and staff conduct.
• ✅ Customers can, in principle, claim pure economic loss for loss of crypto assets where characteristic risks materialise.
• ✅ Board members face potential personal and even criminal liability if platform assets are insufficient or mismanaged.
• ✅ Proactive compliance, governance and cyber-security planning with TENHA LAW FIRM can significantly reduce exposure and protect both the platform and its clients.

About the Author

Arslan Tenha, Attorney at Law
Senior Lawyer, TENHA LAW FIRM

With over 20 years of experience in Turkish commercial and financial law, Arslan Tenha advises international investors, FinTech companies and regulated institutions on cross-border transactions, financial regulation and dispute resolution. His practice increasingly focuses on crypto asset regulation, risk liability and digital-asset structures in Turkey.

Legal Disclaimer

This article is provided by TENHA LAW FIRM for informational purposes only and does not constitute legal advice. Turkish legislation and regulatory practice on crypto assets are evolving and may change. For tailored advice regarding your specific situation as a crypto asset service provider or investor, please contact our firm directly. Content current as of 28 November 2025.

Related Articles from TENHA LAW FIRM (Suggested)

• Crypto Asset Service Provider Turkey: 7 Essential Rules (2025)
• Crypto Licensing in Turkey: Essential 2025 Guide to Secure Exchanges
• Turkish Crypto Asset Law No. 7518: Overview for International Investors
• Article 71 Turkish Code of Obligations: Understanding Risk Liability in Modern Industries