Turkey Crypto Regulation in 2026: Licensing, Compliance and Tax for Foreign Investors and Platforms

Crypto trading is legal in Turkey, but every platform that serves Turkish users now needs a licence from the Capital Markets Board. Law No. 7518 brought crypto-asset service providers under the Board in July 2024, and the detailed rules followed in 2025. As of mid-2026, the regime is fully live: there are capital thresholds, custody and anti-money-laundering duties, a payment ban, and a licensing deadline of 30 June 2026 that decides which platforms survive. This guide sets out what the rules require of foreign investors, exchanges and custodians operating in or with Turkey.

From gray zone to licensing regime: what changed

For years, crypto trading in Turkey sat in a legal gray zone. Buying, holding and trading crypto assets was never banned, but no dedicated framework supervised the platforms that facilitated it. That changed with Law No. 7518, which amended the Capital Markets Law (Sermaye Piyasası Kanunu No. 6362). The Turkish Grand National Assembly adopted the law on 26 June 2024, and it entered into force when published in the Official Gazette on 2 July 2024.

The reform did two things at once. First, it gave crypto assets a statutory definition for the first time. Second, it placed crypto-asset service providers (CASPs) — trading platforms, custodians and related intermediaries — under the authorization and supervision of the Capital Markets Board (Sermaye Piyasası Kurulu, SPK / CMB). Operating without a licence is no longer a regulatory gap; it is unlawful.

For foreign investors and platforms, the headline is simple: Turkey now treats crypto-asset services like a regulated financial activity, with licensing, capital, custody and anti-money-laundering obligations enforced by the SPK and MASAK. The rest of this guide explains each layer and the deadlines that matter most in 2026.

How Turkish law defines a crypto asset

Under the amended Law No. 6362, a crypto asset is broadly defined as an intangible value created and stored virtually using distributed-ledger technology (or similar technology) and distributed over digital networks, which does not qualify as fiat currency, deposit money, electronic money, a payment instrument, a security, or another capital-market instrument already regulated elsewhere.

This functional definition matters because it is deliberately wide. It is the SPK — not the issuer or the platform — that ultimately decides how a particular token is treated. A token marketed as a "utility" coin can still be assessed on its economic substance, and tokens that behave like securities or capital-market instruments may fall under the existing capital-markets regime rather than the new crypto rules.

Three categories you will encounter

• Crypto assets — the general class covered by Law No. 7518.
• Capital-market instruments in tokenized form — security tokens, which may trigger prospectus and offering rules under Law No. 6362. Our team handling capital-markets and SPK licensing can tell you which side of the line your token sits on.
• Excluded instruments — fiat, e-money and payment instruments, which remain under the Central Bank and the Banking Regulation and Supervision Agency (BDDK).

The SPK licensing regime: capital, custody and conduct rules

The core of the framework is Article 35/B of Law No. 6362, which requires every crypto-asset service provider to obtain an SPK permit both to be established and to operate. The Board filled in the detail through secondary legislation — principally Communiqués No. III-35/B.1 and III-35/B.2, published in the Official Gazette on 13 March 2025 — which set the operating principles, capital thresholds and conduct rules for platforms and custodians.

Licensed activities

• Operating crypto-asset trading platforms (exchanges).
• Crypto-asset custody (safekeeping of customers' assets).
• Transfer, initial sale and distribution of crypto assets.

Minimum capital

The vague "set by the SPK" wording is gone. The communiqués fix concrete figures:

Custody and segregation of client assets

Customer crypto and cash must be kept separate from the platform's own assets. The custody rules are specific and worth knowing as a depositor:

Other core obligations of a licensed CASP

• Risk management and cybersecurity — documented controls, secure key management and incident response.
• Governance and fit-and-proper management — vetted shareholders and senior managers.
• Investor protection — clear risk disclosures, complaint handling and advertising restrictions.
• Data protection — see the KVKK obligations below.

If you are launching or restructuring a platform, our crypto and blockchain regulatory lawyers can map your activities against the SPK framework before you commit capital.

How to get a crypto licence in Turkey: the steps and the 30 June 2026 deadline

Foreign founders ask this most often, so here is the practical path. A CASP that serves Turkish residents is expected to operate through a Turkish entity that holds the SPK permit; you cannot license an offshore shell to do this from abroad.

The licensing flow

• Form a Turkish entity — typically a joint-stock company (anonim şirket), which we can help with through our team establishing a Turkish entity.
• Meet the capital threshold — TRY 150,000,000 (trading) or TRY 500,000,000 (custody), paid in cash into a Turkish bank account.
• Build the compliance stack — risk management, cybersecurity, custody arrangements (the 95%/5% split), governance and disclosure documents.
• Appoint a MASAK compliance officer and register as an obliged entity (see the AML section).
• Apply to the SPK for establishment and operating permits under Article 35/B.

The transition timeline for existing platforms

Platforms that were already active when the law came in were given a transition path, but the dates are now critical:

Reverse solicitation: offshore exchanges and Turkish users

A point competitors often miss: the III-35/B.1 communiqué applies a reverse-solicitation principle. Foreign CASPs that are not SPK-licensed are restricted from actively soliciting or marketing to Turkish residents. A purely passive service approached by a Turkish user on their own initiative is treated differently from one that advertises, onboards or targets the Turkish market — but the line is narrow, and active outreach to Turkish customers without a Turkish licence carries real exposure. If your platform has Turkish users, take advice before assuming reverse solicitation covers you.

Anti-money-laundering: MASAK, KYC and the 2025 controls

Crypto businesses in Turkey are classified as obliged entities under Law No. 5549 on the Prevention of Laundering Proceeds of Crime, enforced by the Financial Crimes Investigation Board (MASAK). This obligation pre-dates the 2024 licensing reform and applies alongside it.

What MASAK requires

• Customer identification (KYC) — verifying every customer's identity before onboarding.
• Ongoing due diligence — risk-based transaction monitoring.
• Suspicious transaction reporting — filing reports with MASAK where laundering or terrorist financing is suspected.
• Threshold reporting and record retention — keeping customer and transaction records for the statutory period.
• Compliance officer — a designated, responsible compliance function.

The 2025 tightening: concrete limits

In 2025, MASAK moved from general guidance to hard rules. The instrument to know is MASAK General Communiqué No. 29, published in the Official Gazette on 28 June 2025, which introduced specific operational limits:

Foreign customers should expect Turkish platforms to ask detailed onboarding questions and to query or freeze transfers that lack documented source of funds. Money-laundering itself is criminalized under the Turkish Penal Code (TCK No. 5237), and MASAK non-compliance carries administrative fines plus, in serious cases, imprisonment. For how those sanctions actually bite, see our note on administrative and criminal liability for fintech breaches.

Stablecoins in Turkey: what the rules say

Stablecoins attract their own search interest, and the rules treat them with particular caution. There is no Turkish stablecoin licensing regime that makes a USDT or USDC a domestic payment instrument — they remain crypto assets, not money. Two limits govern day-to-day use:

• Transfer caps — roughly USD 3,000 per day and USD 50,000 per month for stablecoin transfers under MASAK Communiqué No. 29, with higher allowances where a platform applies full Travel Rule data collection.
• No payment use — because of the Central Bank payment ban (below), you cannot lawfully use a stablecoin to settle for goods or services in Turkey, only to trade or hold it through a compliant platform.

The payment ban: crypto is not legal tender

Separately from the SPK regime, the Central Bank of the Republic of Türkiye (TCMB / CBRT) issued its Regulation on the Non-Use of Crypto Assets in Payments, published on 16 April 2021 and effective from 30 April 2021. It remains in force and draws a clear line:

• Prohibited — using crypto assets, directly or indirectly, to pay for goods and services, and providing payment or electronic-money services built on crypto.
• Permitted — buying, holding, selling and transferring crypto as an investment asset through compliant platforms.

In short, crypto in Turkey is an investable asset class, not money. A foreign business cannot lawfully accept Bitcoin as payment for Turkish-delivered goods or services, but an investor can lawfully trade and custody crypto through a licensed CASP. How banks handle the resulting accounts is shaped by the BDDK; our team can advise on how Turkish banks treat crypto accounts and the AML risk attached to them.

Crypto tax in Turkey in 2026: no statute yet, but a near-miss to watch

This is the part most older guides get wrong, so read it carefully. As of mid-2026 there is still no dedicated crypto-tax statute in force in Turkey. Crypto income is characterized under general tax principles based on the frequency and organization of the activity: occasional disposals are treated differently from structured trading or mining, which is more likely to be commercial income. Mining is typically commercial; staking rewards may be passive or commercial depending on involvement.

This matters for structuring. Foreign individuals and entities with Turkish-source crypto income can fall within Turkish tax obligations even today, and a returning withholding regime would shift the compliance burden onto platforms. Cross-border positions should be reviewed before activity begins; our team can assess your Turkish tax exposure on crypto income against both the current rules and the pending bill.

Data protection, disputes and other touchpoints

Platforms process large volumes of personal data and must comply with the Personal Data Protection Law (KVKK No. 6698) — covering lawful processing grounds, data-subject rights and cross-border transfer rules. Getting this right is a licensing-relevant control, not an afterthought; we advise CASPs on KVKK data-protection compliance as part of the build.

Disputes between platforms and customers are litigated under ordinary civil and commercial procedure (TBK No. 6098, TTK No. 6102 and HMK No. 6100), and cross-border elements bring in the International Private and Procedural Law (MÖHUK No. 5718). For the platform-side rulebook in more depth, see our note on the SPK framework for crypto platforms.

If a dispute, a frozen account or a MASAK query affects you, you can speak with our crypto and fintech team for a confidential review of your position.

Turkey vs the EU's MiCA: a quick comparison

Foreign platforms often weigh Turkey against the EU's Markets in Crypto-Assets framework (MiCA). The two regimes share direction but differ in structure and scale.

The practical takeaway: a MiCA authorization does not let you serve Turkish residents, and a Turkish licence does not give you EU access. If your roadmap covers both markets, plan two licensing tracks rather than one.

What this means for foreign investors and platforms

If you are an investor

• Use platforms that are licensed, or confirmed within the SPK transition and on track for the 30 June 2026 deadline — not unregulated offshore sites with no Turkish footprint.
• Keep clean source-of-funds records; Turkish AML controls actively query large or unusual transfers.
• Plan around the 48-hour withdrawal hold and the stablecoin caps.
• Remember you cannot pay for Turkish goods or services in crypto, only invest in it.
• Check your Turkish tax exposure now, and watch for the crypto tax expected to return after its March 2026 withdrawal.

If you are a platform or custodian

• You need an SPK permit under Article 35/B before establishing or operating, with capital of TRY 150m (trading) or TRY 500m (custody).
• You must meet custody (95%/5%), cybersecurity, governance and disclosure requirements under the March 2025 communiqués.
• You are an obliged entity under Law No. 5549 with full MASAK KYC, reporting and the 2025 transfer-control duties.
• If you are offshore, assess the reverse-solicitation limits before marketing to Turkish residents.

The regime is maturing, with further alignment to FATF standards and MiCA expected, a pending tax question, and ongoing discussion of a central bank digital currency. Because the SPK retains wide discretion and the secondary rules keep developing, a Turkish lawyer should review your specific facts before you act.

Frequently asked questions