Popular Tags
Crypto Asset Service Provider Turkey: 7 Essential Rules (2026) | TENHA LAW FIRM
Crypto asset service provider Turkey rules explained. Turkish crypto regulation 2025, licensing, custody and AML obligations. TENHA LAW FIRM. Contact us for tailored advice.
Introduction
If you are planning to operate as a crypto asset service provider in Turkey, understanding the new regulatory framework is no longer optional – it is a legal necessity. With Communiqué III-35/B.1, the Capital Markets Board of Turkey (Sermaye Piyasası Kurulu – SPK) has introduced a detailed rulebook covering the establishment, licensing and ongoing supervision of crypto platforms and custody providers.
This new regime is particularly important for crypto exchanges, wallet providers, custodians and banks that wish to offer crypto asset custody services in Turkey. It defines who can obtain a licence, what minimum capital and organisational requirements must be met, how information systems and cold wallets must be structured, and which activities are prohibited.
In this article, TENHA LAW FIRM explains the key elements of Turkish crypto regulation 2025, focusing on practical implications for local and international stakeholders. You will learn:
- Which entities are considered “crypto asset service providers”
- Licensing and governance rules for platforms and custodians
- Obligations on client protection, risk disclosures and contracts
- AML / MASAK expectations and KYC requirements
- Restrictions on marketing, promotions and outsourcing
Our firm regularly advises foreign investors, fintech founders and established financial institutions on Turkish capital markets and crypto regulations. If you need tailored advice, you can also review our FinTech & Crypto Law practice page and contact us directly through our website.
1. What the New Turkish Crypto Asset Service Provider Regime Covers
The Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers (III-35/B.1) sits under the 6362 Capital Markets Law and defines the general framework for this new regulated sector.
1.1 Scope and Definitions
Under the Communiqué, “crypto asset” is broadly defined as an intangible asset created and stored electronically using distributed ledger or similar technology, which can be transferred on digital networks and represents value or rights. Crypto assets themselves are not automatically classified as securities, but where capital markets characteristics arise, SPK jurisdiction becomes stronger.
The term crypto asset service provider covers:
- Trading platforms (exchanges)
- Crypto asset custody providers
- Other entities designated by SPK to provide services such as initial sale, distribution, transfer and related activities
Key sub-definitions include:
- Platform – entities where crypto asset trading, initial sale, distribution, clearing, transfer and related operations are performed
- Crypto custody service – safekeeping and management of clients’ crypto assets or private keys granting transfer rights
- Custodian – entities specifically authorised by SPK to provide crypto custody services
- Cold wallet / hot wallet – technologies governing how private keys are stored, including strict security expectations for cold wallets
The Communiqué also cross-refers to the separate Communiqué III-35/B.2 on working principles and capital adequacy, and to TÜBİTAK infrastructure criteria for information systems and cyber security.
1.2 Entities Covered and Exemptions
In principle, only joint stock companies (anonim ortaklık) can obtain crypto asset service provider status. Banks may provide crypto custody services, but are subject to a combined regime: SPK rules plus the oversight of the Banking Regulation and Supervision Agency (BDDK). Certain provisions (such as some shareholder tests) are relaxed for banks, but their internal systems must still satisfy SPK’s expectations.
2. Turkish Crypto Regulation 2025: Why Communiqué III-35/B.1 Matters
The new Turkish crypto regulation 2025 is designed to move the sector from an unregulated “grey area” towards a formal, capital-markets style regulatory framework.
2.1 Objectives of the Communiqué
The Communiqué has three main objectives:
- Licensing and supervision – bringing exchanges and custodians under SPK authorisation and ongoing supervision.
- Client and market protection – ensuring clear risk disclosures, proper custody standards and robust organisational structures.
- Systemic and technological resilience – imposing high standards on information systems, cyber security and infrastructure.
In addition, SPK aims to align crypto markets with broader capital markets norms, including transparency, fair treatment of clients, conflict of interest management, and robust record-keeping.
2.2 Integration with Other Regulatory Bodies
The regime also relies on coordination with other Turkish authorities:
- MASAK – AML / CFT obligations, including “know your customer” (KYC) and reporting of suspicious transactions
- MKK (Central Registry Agency) – registration of clients and oversight of records on platforms
- TÜBİTAK – minimum infrastructure and security criteria for information systems and wallet structures
- BDDK – preliminary opinions and expansion approvals for banks wishing to act as crypto custodians
For international players, this means that compliance is not only about obtaining a licence from SPK. It requires building a fully integrated compliance framework across capital markets, banking, AML and data protection laws.
3. Licensing, Governance and Operational Requirements for Platforms
3.1 Licensing Conditions: Capital, Structure and Shareholders
To obtain a crypto asset service provider license in Turkey, entities must satisfy strict conditions:
- Incorporation as a joint stock company with all shares registered and paid in cash
- Minimum paid-in capital and ongoing equity (özsermaye) levels as prescribed in SPK’s capital adequacy rules
- Exclusive business purpose limited to authorised crypto asset services
- Transparent and clear shareholding structure
- Founders and shareholders must:
- Not be bankrupt or subject to concordat
- Not have significant criminal records for financial, market or terrorism-related offences
- Not be subject to trading bans under the Capital Markets Law
- Possess the required financial strength, reputation and integrity
Significant share acquisitions (starting from 10%) and changes in voting rights or board representation are subject to prior SPK approval. Unauthorised transfers are not valid and cannot be recorded in the share ledger.
3.2 Governance: Board, Management and Key Personnel
The Communiqué sets detailed rules on governance:
- A board of at least three members, with the majority holding a four-year university degree
- General Manager (CEO) must be resident in Turkey, full-time and have at least seven years of relevant experience in financial markets, IT or financial technologies
- General Manager and deputies require SPK’s prior approval
- Board members, senior managers and authorised signatories must satisfy “fit and proper” criteria similar to major shareholders
The Communiqué also requires a clear organisational chart, written job descriptions, and segregation of duties between operations, risk, compliance, IT and internal audit.
3.3 Mandatory Internal Systems and Information Technology
Before SPK grants an operating licence, platforms must demonstrate that:
- Internal audit, internal control and risk management units are established and functional
- Information systems and security infrastructure comply with the separate SPK Information Systems Regulation (VII-128.10) and TÜBİTAK infrastructure criteria
- Technical integration with MKK is complete
- Wallet structures – especially cold wallets – meet security expectations and protect clients against loss or misuse of keys
SPK can request joint inspections with other authorities and may require information systems audits focusing on blockchain integration, wallet management and transaction records.
4. Client Protection, AML, Advertising and Outsourcing Rules
4.1 Client Risk Disclosures and Framework Agreements
Platforms must sign a framework agreement with each client before executing any transaction. This contract may be concluded physically or remotely (using methods compatible with SPK rules on remote identification and electronic contracting). It must at least cover:
- Order transmission, execution, clearing and settlement principles
- Deposit and withdrawal of fiat and crypto, including any limits
- Identity verification, user credentials and security responsibilities
- Applicable fees, commissions and taxes
- Name of the custodian(s) entrusted with clients’ crypto assets
- List of rights and obligations of both parties
In addition, clients must receive:
- A standardised risk disclosure form explaining the general risks of crypto assets
- Clear information about where client crypto assets and fiat funds are held
- Explanations on spreads, maker-taker fees, and any market-maker / liquidity provider relationships
These documents must be provided in writing or electronically, and platforms must obtain explicit acknowledgements from clients.
4.2 AML / KYC Obligations and Customer Identification
Crypto asset service providers are explicitly subject to MASAK rules on the prevention of money laundering and terrorism financing. This means:
- Client identification (including foreign clients)
- Collection of tax identification or equivalent numbers issued by the client’s home state
- Ongoing monitoring of transactions and reporting of suspicious activities
- Application of enhanced due diligence where necessary
Remote onboarding is allowed, provided that the identification process follows SPK’s rules on remote customer identification and cross-checks of personal data with the Ministry of Interior’s civil registry systems.
4.3 Advertising, Promotions and Public Communications
The Communiqué contains strict rules on advertising and promotions by crypto platforms:
- Communications must be objective and not misleading or manipulative
- No promises of guaranteed profit or loss-free investment
- No exploitation of vulnerable groups or emotional triggers (such as religious or cultural sensitivities)
- No use of extreme prizes or promotions that push users to trade purely for bonuses
- No claims that services are under government guarantee, or that SPK/banks insure investment outcomes
Where platforms advertise numerical data such as customer numbers or asset volumes, they must rely on verifiable sources and clearly reference them.
Insurance policies covering client crypto assets or cyber risks may be taken out, but they cannot be used as a marketing tool in a way that misleads clients into believing that all risks are covered.
4.4 Outsourcing and External Service Providers
Crypto asset service providers may outsource only support functions that help them fulfil regulatory obligations (such as IT maintenance, call centres, data archiving, security and facility management). However, they cannot outsource:
- Activities that must be performed exclusively by the board
- Core licensed services or their marketing
- Accounting of transactions and preparation of financial reports
- Internal audit, internal control or risk management functions
Where outsourcing is permitted, a written contract is required and the provider remains fully responsible towards SPK and its clients.
Frequently Asked Questions About Crypto Asset Service Providers in Turkey
How to get a crypto asset service provider license in Turkey?
To obtain a licence, you must incorporate a joint stock company in Turkey, meet minimum capital and equity requirements, have a transparent shareholding structure, appoint fit-and-proper board members and management, establish internal systems, and build a compliant IT / wallet infrastructure that satisfies SPK and TÜBİTAK criteria. A detailed application, with supporting documents, is then submitted to SPK for review.
What are the main requirements for crypto exchanges in Turkey?
Exchanges must:
-Conclude framework agreements with clients and provide risk disclosures
-Keep client fiat funds in bank accounts and crypto assets with authorised custodians
-Implement AML / KYC procedures in line with MASAK rules
-Establish internal audit, risk management and compliance units
-Ensure accurate record-keeping, integration with MKK and robust IT security
-Failure to meet these requirements can lead to licence refusal, suspension or revocation.
Are crypto assets regulated by the Capital Markets Board in Turkey?
SPK does not treat every crypto asset automatically as a security, but crypto asset service providers (platforms and custodians) are now clearly regulated under the Capital Markets Law and the III-35/B.1 Communiqué. Where a crypto asset has capital markets features (for example, investment tokens), SPK’s powers are even stronger and additional rules may apply.
What are AML obligations for crypto platforms in Turkey?
Crypto platforms are “obliged entities” under MASAK rules. They must identify clients, collect and verify key information (including foreign tax identification numbers where applicable), monitor transactions, report suspicious activities, keep records, and implement internal policies and training on AML / CFT. Remote onboarding is possible but must follow strict identification procedures.
Can banks provide crypto custody services in Turkey?
Yes. Banks may be authorised as crypto custody providers. However, they require both SPK’s approval and an expansion of activities authorised by BDDK. For their crypto custody units, certain SPK organisational, IT and risk-management rules apply alongside standard banking regulations.
How are client assets protected by crypto exchanges in Turkey?
Client fiat must be held in bank accounts. Crypto assets are generally held with authorised custodians, with strong emphasis on cold wallet storage, strict internal controls, and segregation of client assets from the provider’s own funds. SPK may also require professional liability and cyber-security insurance in certain cases.
What are the advertising restrictions for crypto platforms in Turkey?
Platforms cannot:
-Guarantee profit or promise no losses
-Use extreme promotions or prizes that distort client decision-making
-Imply government guarantee or full insurance coverage
-Use misleading statistics or comparisons without clear references
All marketing must be fair, clear and not misleading.
What happens if a provider loses its licence or fails to obtain one?
Entities that operate without SPK authorisation, or whose licences are revoked, cannot present themselves as crypto asset service providers in their trade names, articles of association, announcements or advertisements. They must either change their corporate purpose and name or proceed to liquidation within a set period.
Conclusion: Next Steps for Exchanges and Fintechs
The new regime on crypto asset service providers in Turkey is a decisive step towards a more transparent, secure and institutionalised market. For international exchanges, wallet providers and banks, Turkey now offers a clear – but demanding – regulatory route into a large and dynamic market.
At TENHA LAW FIRM, we assist clients at every stage of this process: from choosing the right corporate structure and preparing licence applications, to designing compliant AML frameworks, customer contracts, wallet architectures and cross-border operating models.
If you are considering entry into the Turkish market, restructuring an existing platform, or assessing the impact of Turkish crypto regulation 2025 on your business, early legal planning will save both time and cost.
📞 Contact TENHA LAW FIRM today for a focused consultation on your crypto asset service provider project in Turkey.
Key Takeaways
- ✅ Turkey now has a detailed SPK regime for crypto asset service providers, covering exchanges and custodians.
- ✅ Only joint stock companies (and certain banks) that meet strict capital, governance and IT criteria can be licensed.
- ✅ Platforms must protect clients through risk disclosures, framework agreements, segregated custody and robust IT security.
- ✅ AML / MASAK compliance, including remote identification standards, is a central pillar of the regime.
- ✅ Advertising, promotions and outsourcing are tightly controlled – legal review of your business model and campaigns is essential.
About the Author
Arslan Tenha, Attorney at Law
Founder & Senior Partner, TENHA LAW FIRM
With over 20 years of experience in Turkish and cross-border business law, Arslan Tenha regularly advises international investors, fintech entrepreneurs and financial institutions on Turkish Citizenship by Investment, capital markets regulation and emerging crypto asset service provider frameworks.
Legal Disclaimer
This article is provided by TENHA LAW FIRM for informational purposes only and does not constitute legal or investment advice. Turkish legislation and regulatory practice may change over time, and the application of the law depends on the specific facts of each case. For tailored legal advice on your situation, please contact our firm to schedule a consultation. Content current as of 25 November 2025.
Related Articles from TENHA LAW FIRM
- Regulatory Overview of Crypto Asset Trading Platforms in Turkey
- AML and KYC Compliance for FinTech and Digital Asset Businesses
- Turkish Banking and Custody Rules for Digital and Traditional Assets
