The Regulatory Framework for Crypto Platforms in Turkey

Crypto platforms in Turkey are regulated by the Capital Markets Board (CMB/SPKSPKThe Capital Markets Board — and the Capital Markets Law No. 6362In Turkish the same three letters are used for the regulator (Sermaye Piyasası Kurulu) and for the statute it administers (Sermaye Piyasası Kanunu No. 6362).Glossary →) under Capital Markets Law No. 6362 as amended by Law No. 7518 of 2 July 2024. Any platform that trades, holds in custody or transfers crypto assets for Turkish users now needs a CMB licence, must meet large minimum-capital thresholds, and must comply with anti-money-laundering rules enforced by MASAKMASAKThe Financial Crimes Investigation BoardTürkiye's financial intelligence unit — the body that receives suspicious-transaction reports and supervises anti-money-laundering duties.Glossary →. This guide explains the framework, the licensing path and what it means for foreign investors, operators and users.

From grey zone to licensed market

For years, crypto trading in Turkey operated without a dedicated legal framework. Platforms could be set up under ordinary company law, and the only binding rules came from anti-money-laundering legislation and a single payments restriction. That changed decisively with Law No. 7518, published in the Official Gazette on 2 July 2024, which amended the Capital Markets Law No. 6362 (Sermaye Piyasası Kanunu) to create a complete licensing regime for crypto asset service providers.

The reform did two things at once. It defined crypto assets and crypto asset service providers (CASPs) as regulated concepts, and it placed them under the supervisory authority of the Capital Markets Board (Sermaye Piyasası Kurulu, or CMB/SPK). Operating a crypto platform in Turkey is no longer a matter of ordinary commercial freedom; it requires a permit from a financial regulator. For the wider picture, see our overview of Turkey's crypto asset regulatory landscape.

Who regulates crypto platforms in Turkey

Three authorities matter for anyone running or using a crypto platform in Turkey, and their roles overlap rather than replace each other.

Capital Markets Board (CMB / SPK)

Since Law No. 7518, the CMB is the primary regulator. It licenses CASPs, sets their operating principles and capital requirements, supervises their conduct, and can suspend or revoke authorisation. A platform that issues, trades, holds in custody, transfers or otherwise provides services in crypto assets falls within its remit.

MASAK (Financial Crimes Investigation Board)

Crypto exchanges have been classified as obliged parties (yükümlü) under anti-money-laundering rules since 2021. Under Law No. 5549 on the Prevention of Laundering Proceeds of Crime, platforms must apply customer identification (KYC), monitor transactions, keep records and file suspicious transaction reports to MASAK (Mali Suçları Araştırma Kurulu). These duties continue alongside the new CMB licensing system.

Central Bank (TCMB)

The Central Bank issued the 2021 regulation that prohibits the use of crypto assets as a means of payment, directly or indirectly. The Regulation on the Disuse of Crypto Assets in Payments was published in the Official Gazette on 16 April 2021 (No. 31456) and took effect on 30 April 2021. Crypto can be bought, sold and held as an asset, but it cannot be used to settle payments for goods and services, and payment service providers may not build business models around crypto payments.

What counts as a crypto asset service provider

Law No. 7518 defines a crypto asset broadly as an intangible asset that can be created and stored in electronic form using distributed ledger or similar technology, distributed over networks, and that expresses value or rights. A crypto asset service provider is any entity that provides services connected to those assets.

In practice the regime captures several distinct business models, each with its own obligations:

• Crypto asset trading platforms (exchanges) that match buyers and sellers or trade against their own book.
• Custody institutions that hold crypto assets or the keys to them on behalf of customers.
• Wallet and transfer service providers that move assets between addresses for clients.

One structural point matters before anything else: a CASP must be incorporated in Turkey as a joint-stock company (anonim şirket) with fully paid-in capital. Foreign founders usually begin by helping a Turkish entity set up a Turkish joint-stock company to hold the licence.

The reach over foreign platforms and offshore activity

Foreign-incorporated platforms cannot escape the rules simply by serving Turkish residents from abroad. The framework is designed to reach services directed at the Turkish market, so a business actively targeting Turkish users should assume it needs Turkish authorisation.

In practice, the line is drawn around active solicitation. A platform that markets in Turkish, advertises to Turkish residents, offers Turkish-lira on-ramps or otherwise courts Turkish customers is treated as operating in Turkey and needs a CMB licence. Authorities can also restrict access to non-compliant foreign sites. A purely passive relationship, where a Turkish resident independently approaches an offshore platform without being solicited, sits closer to the edge of the rules, but the safe assumption for any operator with a Turkish customer base is that the regime applies.

Licensing, capital and the secondary regulations

Law No. 7518 set the framework; the detail arrived through two CMB communiqués published in the Official Gazette on 13 March 2025 (No. 32840):

• Communiqué III-35/B.1 on the establishment and operating principles of CASPs; and
• Communiqué III-35/B.2 on operating procedures, capital adequacy and custody.

The single most important practical change is capital. CASPs must be joint-stock companies with fully paid-in capital, and the minimum thresholds are high:

Other core features of the licensing regime include:

• Mandatory CMB authorisation before a platform may operate or continue operating in Turkey.
• Fit-and-proper standards for founders, shareholders and managers.
• Governance, internal control and information-security obligations, reflecting the technical risk of holding digital assets.
• Customer asset segregation, so that client crypto holdings are kept separate from the platform's own assets and protected if the operator fails.

If you are structuring or acquiring a licensed platform, the capital threshold, fit-and-proper review and market consolidation all shape the deal, so the structuring work should start before any application.

The transition deadlines you cannot miss

A transition regime applies to platforms that were already operating when the rules took effect. It runs on two hard dates:

• Apply for an operating licence by 30 June 2025. Existing operators (and custody institutions on the CMB's list of operating entities as at 13 March 2025) had to file their application by this date.
• Obtain the licence by 30 June 2026. Applicants must satisfy the CMB's operating conditions and hold an authorisation certificate by this final date.

An operator that fails to apply by 30 June 2025, or fails to obtain its licence by 30 June 2026, becomes subject to the liquidation provisions in Communiqué III-35/B.1. Out of the many platforms that previously operated informally, only a limited number entered the transition process, signalling a sharp consolidation of the market toward licensed operators.

Compliance obligations for operators

A licensed platform carries continuing obligations that go well beyond the initial permit. The most important fall into four groups.

Anti-money-laundering and KYC

Under Law No. 5549 and MASAK secondary legislation, platforms must verify customer identity, apply enhanced due diligence to higher-risk clients, monitor and record transactions, and report suspicious activity. Travel-rule information sharing on transfers and sanctions screening are expected. Newer AML measures also include withdrawal holds (commonly 48 hours, and longer for a first withdrawal from an account) and limits on stablecoin transfers, with stricter limits for platforms that do not apply the travel rule.

Custody and client asset protection

Client crypto must be held under the custody rules in Communiqué III-35/B.2, with segregation designed so that customer holdings are not part of the platform's own estate. For anxious users, this bankruptcy-remoteness of client assets is the single most reassuring feature of dealing with a licensed operator rather than an informal one.

Consumer and market-conduct rules

As CMB-supervised entities, platforms must treat customers fairly, disclose risks, handle complaints and avoid market abuse. Misleading promotion of crypto products can expose operators to regulatory and civil liability under the Capital Markets Law and, where deception is involved, to criminal exposure under the Turkish Penal Code (Law No. 5237). Clear, compliant customer terms and platform agreements are part of meeting these duties.

Data protection and information security

Handling Turkish users' personal data triggers obligations under the Personal Data Protection Law (KVKKKVKKPersonal Data Protection Law No. 6698Türkiye's data protection statute — the rules on collecting, storing and transferring personal data, and the authority that enforces them.Glossary →, Law No. 6698), including registration where required and breach notification. The CMB's information-systems rules add specific cybersecurity and resilience requirements.

How crypto gains are taxed in Turkey

As of mid-2026, Turkey has no crypto-specific gains or transaction tax in force. Crypto gains are dealt with under the general income and corporate tax framework, and the treatment of an individual's gains can depend on the facts. This is an area to confirm with a Turkish tax adviser rather than assume.

There was a notable development worth knowing about. On 2 March 2026 the ruling party submitted an omnibus bill proposing a 10% withholding tax on crypto gains (withheld quarterly through platforms) and a 0.03% transaction levy on service providers. Those crypto tax articles were withdrawn from the bill on 26 March 2026 after parliamentary negotiations, so they did not become law. The government has signalled it may bring back a refined version in a later proposal, so the position should be re-checked before you rely on it.

What this means for foreign investors and users

For foreign investors and founders, the message is that Turkey now has a real, EU-influenced regulatory framework. That brings legitimacy and bank access for compliant operators, but it also means substantial upfront capital, licensing time and ongoing compliance cost. Entering the market without authorisation is no longer viable, and the high capital thresholds favour well-funded entrants and consolidation.

For foreign users and expats, trading and holding crypto remains lawful, but using it to pay for goods and services in Turkey is prohibited. Choosing a CMB-licensed platform is the safest route, because licensed operators are subject to customer-protection and asset-segregation rules. If a platform fails or withholds your assets, a Turkish lawyer can advise on enforcing claims against an insolvent platform.

Frequently asked questions