Obligations of Crypto-Asset Service Providers: SPK and MASAK Guide

Summary

In Türkiye, the obligations of a crypto-asset service provider are not limited to collecting identity documents or filing suspicious transaction reports. Establishment and operating permits, adequate capital, segregation of customer assets, secure custody and transfers, an effective compliance program, record retention and liability toward customers are assessed together. Appearing on the SPK list is not an operating permit, and the listing of a crypto-asset is not a state guarantee. In light of the 2024–2026 regulations, this guide explains what businesses must do and the routes customers may take in the event of a violation. [1, 2, 3, 6]

Who is a crypto-asset service provider, and which activities are covered?

Capital Markets Law No. 6362 defines a crypto-asset as an intangible asset that can be created and stored electronically using distributed ledger technology or a similar technology, is distributed over digital networks, and can represent value or rights. The concept of a crypto-asset service provider covers platforms, entities providing custody services and other service providers determined on the basis of the Law. The everyday expression “crypto exchange” does not mean that all entities hold the same powers. [1]

A platform is the organization in which transactions such as trading and initial sale or distribution take place; custody service means the safekeeping and management of crypto-assets or of the private keys that give transfer authority over them. The fact that a platform, a bank, a software company and a custody company belong to the same economic group does not make them a single legal entity. Which company the contract is concluded with, into whose account cash is deposited and who controls the crypto-asset must each be determined separately. [1, 3]

A technology provider that merely develops software or does not control the customer’s private key is not in the same position as a business that carries out transfers to the customer’s account. However, calling an activity “software,” “decentralized finance” or “wallet” does not by itself place it outside the scope. The legal characterization is made on the basis of control of the assets, the service offered to the customer, fees, order routing and the actual role played in the transactions. For NFTs, in-game assets and similar products as well, what matters is not the name but the right and service provided. [1, 2, 3]

For this reason, an activity map should be prepared first when a new business model is set up. Which company will accept customers, receive orders, approve transfers, hold assets and enter into contracts with customers? Until these questions are answered, merely registering with the trade registry or establishing a company abroad does not resolve the question of permission in Türkiye.

How has the regulatory framework changed?

Crypto-asset service providers were included among MASAK obliged entities on May 1, 2021. Law No. 7518, published on July 2, 2024, clarified the SPK’s powers of establishment, operation, supervision and sanction; detailed rules were introduced by Communiqués III-35/B.1 and III-35/B.2 dated March 13, 2025. MASAK’s regulations of late 2024 and 2025 also created a new framework as regards financial institution status, the compliance program and transfer information. [1, 2, 3, 7]

For 2026, three developments in particular must be read together: the monetary amounts in SPK Bulletin No. 2025/68; Transition Decision No. 18/617 dated March 26, 2026; and MASAK General Communiqué Serial No: 34 dated September 23, 2026. To these have been added the practices of the Central Registry Agency’s (MKK) Crypto-Asset Central Registry System and the 2026 amendment on remote identification of foreign natural persons by passport. [4, 5, 12, 13, 14, 15]

The SPK regulates which services an entity may offer in the market and under what conditions; MASAK regulates the measures aimed at preventing the laundering of proceeds of crime, the financing of terrorism and related financial crime risks. The BDDK has a separate function regarding the custody activity of banks, TÜBİTAK regarding technical infrastructure criteria, MKK regarding the registry and reconciliation infrastructure, and the KVKK regarding personal data. Meeting the requirements of one authority does not remove the obligations owed to the others. [1, 2, 7, 14, 16]

Why are an SPK permit and appearing on the list not the same thing?

Establishment permit, operating permit and authorization certificate

The establishment and commencement of operations of crypto-asset service providers depend on SPK permission. Incorporation as a joint-stock company, the shareholding structure, the qualifications of the shareholders, capital, organization, information systems and the scope of activity are all parts of this permit review. An establishment permit does not mean that all the conditions required to serve customers have been met. The operating permit and authorization certificate stages in III-35/B.1 must be completed separately. [1, 2]

The general period for applying for an operating permit after the establishment permit must not be confused with the transition periods introduced for those that were already operating. The six-month application period under Article 17 of the Communiqué and the Board’s power to extend it do not apply in a uniform manner to every business on the transition list. In a new application, which permit decision was issued and which event started the period must be determined from the file. [2]

The SPK’s “List of Entities Operating in the Market” (Faaliyette Bulunanlar Listesi) is public information on the notifications and assessments in the transition process. The SPK has expressly stated that appearing on the list does not mean being authorized under the legislation. The current footnotes on the list, the operating restrictions and decisions concerning the entity’s own situation must also be read. A bank’s custody permit and the trading authority of a platform in the same group cannot be used in place of one another. [6, 25]

The limits of the March 26, 2026 decision

SPK Decision No. 18/617 provides that the period granted to platforms within the transition scope for signing a custody agreement and submitting it to the Board, and the period granted to entities on the List of Entities Operating in the Market for obtaining an authorization certificate, will be determined after the custodians to be authorized begin providing services widely. The text of the decision does not announce a new fixed final date. [5]

This decision is not a general exemption from the legislation. It cannot be concluded that all obligations such as identification, protection of customer assets, accurate advertising, suspicious transaction reporting and record keeping have been postponed. The business’s transition scope, any decisions later made about it and the entry-into-force status of the relevant provision must be examined separately. A statement to customers that the business is “SPK-licensed” must also be consistent with an actual authorization record. [1, 2, 5, 6]

What are the 2026 capital, equity and financial obligations?

On the basis of the amounts set for 2026 in SPK Bulletin No. 2025/68 dated December 31, 2025, the minimum establishment capital is TL 250,000,000 for platforms and TL 630,000,000 for crypto-asset custodians. The amounts of TL 150 million and TL 500 million from the period when the Communiqué was first published cannot be used as the current establishment amounts. The special regime to which banks are subject for custody activity is also assessed separately. [3, 4]

Establishment capital, the equity to be maintained during operations, the capital adequacy base and the liquid reserve are not the same quantity. The capital adequacy base is monitored on the basis of risk provisions and operating expenses; the borrowing limit and current asset adequacy are monitored under their own calculations. The annual compliance time under Art. 34/3 of III-35/B.2 is also part of the calendar of monetary updates. Looking only at the capital figure in the trade registry does not prove financial adequacy. [3, 4]

One percent of the previous year’s revenue of platforms, excluding interest income, is paid to the SPK and one percent to the TÜBİTAK budget by the end of May of the relevant year, pursuant to Law Art. 130/5. This amount is not a crypto transaction tax levied on the investor’s profit; it is a corporate obligation of the platform. MKK service fees, tax and accounting obligations, and audit and custody costs are separate from it. [1, 24]

What responsibilities do the board of directors and the compliance officer assume?

The board of directors is obliged to establish internal control, risk management, internal audit and the necessary organization. Assigning the relevant duties to appointed persons does not remove management’s supervisory responsibility. A MASAK compliance program must include corporate policies, risk management, monitoring and control, a compliance officer and deputy, training and internal audit together. The board of directors is ultimately responsible for running the program effectively and in a manner appropriate to the scope of the business. [2, 7, 9]

The duty of the compliance officer is not merely to fill out a reporting form. The officer must be able to intervene in doubtful situations at customer acceptance, make assessments independent of the sales unit, access records and escalate necessary matters to the management level. An organization that neutralizes suspicious transaction review because of sales targets, pressure from important customers or fear of loss of revenue creates a serious compliance risk despite the job description on paper. [7]

It is possible to obtain legal, audit or technical services from outside; however, an outsourcing agreement does not automatically transfer to another company a function that the law requires to be held within the entity, nor the responsibility for it. The scope of the service, data access, subcontractors, auditability, outage management and the return of data upon termination must be clearly regulated. Purchasing a ready-made “MASAK procedure” does not mean that actual transactions have been audited. [2]

Know your customer: At what stage is identification mandatory?

Continuing business relationships and the transaction amount distinction

When a continuing business relationship such as opening an account is established, identification is carried out regardless of the amount. MASAK’s current guide explains identification also outside a continuing business relationship when a transaction, or the total of linked transactions, is TL 15,000 or more, and for crypto-asset transfers exceeding the same amount. In the case of a suspicious transaction or doubt about the adequacy of previously obtained identification information, no monetary threshold applies. The TL 75,000 threshold in older texts cannot be used as current practice. [7, 8]

These thresholds do not mean that an account without identification can be used up to a certain amount. Establishing a continuing business relationship is already an independent ground for identification. Having obtained a document in one transaction also does not mean that all later transactions must be approved without limit. The purpose of the business relationship, the customer’s economic situation, source of funds, expected transaction volume and risk profile must be kept up to date. [7, 8]

For a natural person, identity and address must be verified; for a legal entity, the company registration, the power of representation and the authority of the person carrying out the transaction. The person acting on behalf of the company and the natural person who ultimately controls it may differ. The beneficial owner review is not completed merely by entering the name of the signatory into the system. Where the ownership and control structure is layered, the necessary inquiry is deepened. [7, 8]

Remote identification and foreign customers

Remote customer acquisition does not consist of sending a photo through a messaging application. For an applicable method, verification of the document, assessment of the person’s authenticity, security checks and recording of the process are required together. In 2026, the possibility of remote identification by passport for natural persons who are not Turkish nationals was expanded; this change does not mean that foreign customers are exempt from identity and risk checks. [2, 7, 13]

Where identification cannot be carried out or sufficient information about the purpose of the business relationship cannot be obtained, the provisions on not opening an account, not carrying out the transaction or terminating the existing relationship come into play. On the other hand, the information and documents requested from the customer must be connected to the obligation. Treating every foreigner, every high-value transaction or every personal wallet as an automatic indicator of crime is not a risk-based review. The reason for the specific risk and the proportionality of the measure applied must be recorded. [7, 8]

How is the travel rule applied to crypto transfers?

The travel rule is the obligation concerning sender and recipient information that must accompany a crypto-asset transfer. Within the framework of Art. 24/A of the Regulation on Measures, for transfers of TL 15,000 or more, fields are regulated such as the sender’s name or title, wallet address or transaction reference and additional identifying information, and the recipient’s name or title and wallet address or transaction reference. For transactions below the amount, certain basic information is also required; they are not an area of transfers entirely without information. [7, 8]

The verification obligation of the institution that first receives the information, the measures to be taken by the intermediary and recipient institutions against missing information, and the secure transmission of the transfer message are distinct from one another. Missing messages must be completed, a risk assessment must be made and, where necessary, the transfer must be rejected or the service relationship assessed. The fact that a technology provider has transmitted the message does not make institutional oversight unnecessary. [7, 8]

Transacting with wallets under a person’s own control or with foreign service providers is also not prohibited in itself. However, statements about the recipient or sender, the nature of the wallet, counterparty information and risks are assessed under the relevant rules. An address visible on the blockchain does not by itself prove the identity of the natural person behind it. The customer’s statement, account records and technical findings must be examined together. [7]

Under the travel rule, the secure sharing of personal information is not the same thing as writing that information onto a publicly accessible blockchain. The technical design should convey the necessary information to the right recipient and should not cause unnecessary identity data to spread in open or uncontrolled environments. If a messaging or compliance service abroad is used, the data transfer is assessed separately. [7, 16, 18]

48- and 72-hour waiting periods and stable crypto-asset limits

MASAK General Communiqué Serial No: 29 regulates a waiting period for in-scope withdrawals made to wallets not registered with any service provider, or to foreign service providers or financial institutions authorized to transfer that are not obliged under their own legislation to share sender–recipient information. As a rule, such crypto-asset withdrawals are to be made at least 48 hours after the purchase, swap or deposit transaction, and the first withdrawal at least 72 hours after. This provision cannot be described as a 72-hour suspension of all cash withdrawals or of all transactions within the platform. The type of transaction and the exceptions in the Communiqué are examined separately. [7, 10]

For withdrawals of stable crypto-assets, whose value is sought to be kept fixed by reference to an official currency, a precious metal or other assets, the general limit is the equivalent of USD 3,000 per day and USD 50,000 per month. Where the Communiqué’s conditions are met, such as sharing the required travel rule information with the counterparty service provider, the limits may be applied at double. Splitting a transaction into small parts does not remove the obligations; linked transactions and risk are assessed as a whole. [7, 10]

Exceptions relating to purposes such as providing liquidity, market making and arbitrage between markets cannot be applied solely on the basis of the customer’s statement. The nature of the activity concerned, the transfer amount and frequency, counterparty and wallet information, and the documents with which the necessary checks are carried out must be demonstrated. Separate board approval for each customer, periodic collection of source and account documents, and continuous monitoring and control are required; if it becomes clear that the transaction does not fall within the exception, the limits apply immediately. The exception is not an unlimited transfer route open to everyone. [7, 10]

Transfers between a platform and a custodian arising from capital markets legislation are also different from transfers the custodian makes on behalf of the customer; the relevant restrictions apply to the second group. The Communiqué also provides that an explanation of at least twenty characters describing the nature of the transaction be obtained for transfers. Random characters, repeated generic phrases or an explanation inconsistent with the transaction do not achieve the purpose of the obligation. The explanation and the account movement should be consistent; if suspicion has arisen, obtaining an explanation must not make a suspicious transaction report unnecessary. [7, 10]

How and when is a suspicious transaction reported?

A suspicious transaction arises where there is information, suspicion or a matter requiring suspicion that assets have been acquired through illegal means or are being used for illegal purposes, or are being used in connection with terrorist acts or terrorist organizations. No conviction, completed offense or specific minimum amount is required for reporting. A transaction at the attempt stage can also be assessed. [7, 9]

Volume inconsistent with the customer’s economic profile, a large number of unexplained links to third parties, inability to document the source of funds, a sanctions list match or a marked deviation from ordinary usage may be grounds for review. However, a single indicator does not make the customer a criminal. Actual information, the risk indicator, the customer’s explanation and the result of the review must be recorded separately from one another. Example typologies are not a closed list. [7]

The report is made within ten business days at the latest from the date the suspicion arises, and immediately in cases where delay would be harmful. This period does not always begin on the same day as the date of the transaction; when the suspicion arose must be explained through the records. The statutory reporting period must not be exceeded on the ground of completing an internal investigation or obtaining all documents; important information obtained later must be communicated by a supplementary report. [7]

The report is made through the authorized compliance officer using MASAK’s current electronic reporting system and guides. A suspicious transaction report, a user application made through MASAK Online and electronic notification procedures are different functions. Uploading a file to the wrong portal or merely e-mailing a support unit should not be assumed to be a duly made report. [7, 11]

Confidentiality of the report

The fact that a suspicious transaction has been reported cannot be disclosed to unauthorized persons, including the persons party to the transaction. Suspicious transaction reports within the institution and system access credentials must also be protected. Being in the same financial group does not allow unlimited sharing of the information that a report has been made. Statutory supervision and judicial exceptions remain within their own scope. [7, 9]

This confidentiality obligation is observed when giving information to customers; however, answering every question merely with “MASAK” must not render all corporate disclosure and complaint processes ineffective. The matters that can be disclosed, the documents requested, the status of the transaction and the application channel should be communicated in an understandable way within the scope that is legally possible. The fact that a suspicious transaction report has been made is not, by itself, a final confiscation or an indefinite account freeze decision. [1, 7, 9]

Transaction holds, postponement, asset freezing and judicial seizure

When these concepts are used interchangeably, there is a risk of applying to the wrong authority and losing time. An account may become unusable because of the ordinary transfer waiting period, missing identification information, the platform’s security check, a postponement under MASAK’s regime or a decision of a judicial authority. The first review should identify the specific legal basis of the restriction. [7, 9, 10, 12, 19]

The postponement framework of at most seven business days under Art. 19/A of Law No. 5549 is not a general “seven-day application period” for all of the customer’s objections. Art. 128/A of the CMK, introduced at the end of 2025, allows the relevant financial institution to suspend, for up to forty-eight hours, the account holding the benefit derived from the offenses listed in the article; it requires that the suspension and the account movements be reported immediately to the Chief Public Prosecutor’s Office. The fact that both this provision and the MASAK transfer waiting rule contain “48 hours” does not show that they are the same procedure. Notice is also given to the account holder; the account holder may submit a request for lifting to the Chief Public Prosecutor’s Office, and the prosecutor decides on the request within twenty-four hours. [9, 19]

MASAK General Communiqué Serial No: 34 dated September 23, 2026 regulates the measures for the prompt reporting and postponement of transactions concerning persons and entities subject to the relevant United Nations Security Council listing decisions. Institutions should establish controls that process list updates in a timely manner, and should also investigate the incorrect matching of different persons with the same or similar names. The Communiqué regulates the urgent measures within its own scope; it cannot be read as an authority to close all customer accounts on the same ground. [12]

The obligation to send, in physical or electronic form within ten days, the information and documents requested under Art. 128/A of the CMK must also be tracked separately. This period must not be confused with the ten business days in the MASAK suspicious transaction report. In judicial seizure, the provisions on judge’s approval, time limits and return to the owner apply under their own conditions. The non-liability provision foreseen for a lawful suspension cannot be extended to every arbitrary or indefinite account restriction. [19]

How are the risks of proceeds of crime and terrorist financing assessed?

In money laundering risk, the origin of the funds in a crime and the giving of them a legitimate appearance matter; in terrorist financing, the purpose for which the funds will be used may matter. A source obtained by lawful means may also be allocated for a prohibited purpose. For this reason, the compliance review cannot be reduced to the initial source of the money or the size of the transaction alone. [7, 9, 12]

A donation, aid, commercial sale, member payment or any other explanation does not by itself make a transaction legitimate or suspicious. The real purpose, the parties, the beneficiary, the transaction pattern and the information available must be assessed together. Legitimate civil society activity and prohibited financing cannot be placed in the same category. The review should follow a method that explains concrete risks, not one that presumptively accuses people of legally protected activities. [7]

For a high-risk customer or transaction, measures such as additional information on the source of funds and wealth, senior-level approval and enhanced monitoring may be applied. A risk score generated by technology is not a final legal assessment. What facts the algorithm relies on, how false-positive alerts are handled and the reasoning for the authorized person’s decision should be auditable when necessary. [7]

How should customer cash and crypto-assets be protected?

Segregation of assets, custody and reconciliation

Customer cash and crypto-assets are separate from the entity’s own assets. Records must be kept on a customer basis; the entity’s debts and the customer’s assets must not be mixed. The protection in the Law against attachment, pledge and inclusion in the bankruptcy estate relates to this segregation. It does not create absolute immunity with respect to the customer’s own debts or a lawful judicial decision directed at the customer’s own assets. [1, 3]

Customer cash must be separately identified in bank accounts, not combined with the platform’s own account and not used for purposes other than its intended one. A platform cannot accept or deliver cash by hand; money transfers are carried out through the customer’s own bank account. Directing a payment to an employee’s personal IBAN or transferring money to another, undisclosed company cannot be regarded as an ordinary operational choice. [3]

The custody model of Art. 41 of III-35/B.2 rests on holding at least 95 percent of the crypto-assets that the customer has not chosen to hold in their own wallet with the custodian, and on a 5 percent limit for the portion remaining in platform wallets. The intraday 10 percent limit, reconciliation, the 3 percent liquid reserve and the special provisions on the calculation of small balances apply together. Without examining the total of assets against which these ratios are calculated and the effect of the transition decisions on the specific entity, one should not summarize the rule simply as “95 percent cold wallet.” [3, 5]

The custody agreement should clearly set out the allocation of duties, transfer approval, wallet definitions, reconciliation, extraordinary transfers, service interruption, return of assets and termination. The use of more than one custodian must not cause records to become disconnected from one another. That the balance shown to the customer appears in the system does not by itself prove that the asset is actually and correctly held in the right amount. [3]

The insurance and state guarantee misconception

An SPK permit is not a commitment to protect the value of the investment. The listing of a crypto-asset does not mean a public guarantee; Art. 35/C/6 of the Law excludes the assets and cash within the relevant custody from the deposit and participation fund insurance regime. An MKK record is also not an unlimited payment guarantee for loss. If private insurance exists, the insured risk, the beneficiary, limits, deductibles and exclusions must be read separately. [1, 14]

Information systems, cybersecurity and independent audit

The entity’s information systems, key management, access authorizations, backup, business continuity and incident response must be established in accordance with the relevant SPK regulations and the TÜBİTAK infrastructure criteria. Multi-factor authentication is important, but it alone does not eliminate all risks. A new device, an unusual IP address, a change to security settings, the addition of a withdrawal address and high-risk transfers must be monitored as a whole. [2, 3]

Safeguarding the private key and protecting access to the customer account are different security layers. While the account password is protected, unlimited administrator access or permissions left open after an employee leaves can create serious risk. Access by external service providers should be restricted with the same discipline; their records and the right to audit should be secured by contract. [2]

Under Art. 48 of III-35/B.1, the annual information systems audit, the audit of internal processes and infrastructure compliance, and the reserve proof audit as of the end of the third, sixth, ninth and twelfth months are separate obligations. The differentiated provisions for banks and the Board’s power to request additional audits are reserved. Carrying out one audit does not replace the other audits or daily reconciliation. [2]

In a cyber incident, the priority is to prevent the loss from growing, to preserve the records and to assess the necessary notifications separately. Altering system logs, overwriting old records or failing to keep a timeline that explains the incident later weakens both the audit and the defense. As important as the existence of a business continuity plan is whether it has been tested and whether it was actually implemented during the incident. [2]

Record retention, disclosure and MKK obligations

For documents, books and records under Law No. 5549, an eight-year retention period applies, calculated from the different starting points specified in the Law, such as the date of issue, the last entry and the last transaction. For identification documents, the date of the last transaction is important. The ten-year retention obligations for transaction and customer records provided in SPK regulations are also taken into account separately. The lapse of eight years does not mean that all crypto service records may be deleted. [2, 7, 9]

What must be retained is not just screenshots and accounting totals. The customer acquisition record, the contract version, the approvals given, the order and transfer times, wallet addresses, transaction IDs, security checks, complaints and reconciliation records must be capable of being produced together when necessary. If the contract text was later changed, determining the version in force on the date of the dispute is particularly important. [2, 3]

Lawful requests for information and documents from MASAK and audit staff are fulfilled on time after verifying authority and scope. Confidentiality or personal data grounds do not categorically prevent the provision of information to an authority authorized by law; however, they also do not justify the indiscriminate transfer of all customer data beyond what is requested. Receipt of the request, its referral to the responsible person and verification of the transmission should be recorded. [7, 9, 16]

MKK’s KVMKS system serves to record the transactions and balances held in service providers’ book-entry systems and to compare platform and custodian balances. In 2026, practices and announcements concerning the system continued; MKK’s announcement on the relevant TCMB decision was published on August 3, 2026. Membership, registry, reporting and reconciliation must be carried out in accordance with the relevant directives and circulars. Reporting to MKK does not mean that the crypto-asset is itself held at MKK, and it does not replace a MASAK report. [14, 15, 24]

Personal data and service providers abroad

Identity information, wallet addresses and transaction records may constitute personal data when they can be linked to an identified or identifiable natural person. The fact that a platform has a legal obligation to carry out identification does not mean it may use this data without limit for advertising, profiling or other purposes. The purpose of processing, legal basis, notice, access authorization and retention period must be determined separately. [16]

In systems using biometric verification, the conditions for special categories of data are examined separately. Not every video or photograph automatically falls into the same legal category; the purpose and operation of the technique used to uniquely identify a person are what matter. Obtaining a general consent checkbox from the customer does not replace the necessary technical and legal assessments. [16]

When a foreign cloud, support, analytics or travel rule service is used, the mechanism for transfer abroad is assessed. If the standard contract method is used, there is an obligation to notify the Authority within five business days of the completion of the signatures. The existence of this mechanism does not remove the SPK’s special requirements regarding information systems and the location of data. KVKK compliance and sectoral infrastructure compliance must be ensured together. [2, 16, 18]

Notification to the KVKK Board without delay and within seventy-two hours at the latest from learning of a personal data breach, and notification to the affected persons within the framework of the relevant principles, come into play. This 72 hours is entirely different from the 72-hour waiting rule for the first crypto withdrawal. The same cyber incident may have separate reporting consequences with respect to the SPK, MASAK, the KVKK and the judicial authorities. [2, 7, 17]

Listing, customer agreements, advertising and conflicts of interest

Listing and documentation of the customer relationship

A platform must have a written procedure for listing and delisting. The project owner’s statements, technological risks, legal nature, trading volume, conflicts of interest and the decision process are assessed. A committee decision or the commencement of trading on the platform is not a guarantee that the asset is safe or profitable. Significant risks that emerge later are also a subject of post-listing oversight. [1, 3]

The customer framework agreement must explain, in an understandable way, the scope of services, the order and transfer procedure, fees, custody, risks, communication, complaints and termination conditions. It must be possible to prove which text was approved on which date. Under Art. 35/C/1 of the Law, contract terms that remove or limit the service provider’s liability toward the customer are invalid. Statutory liability cannot be eliminated by a clause saying “all loss belongs to the customer.” [1, 2]

Advertising, steering and prohibited transactions

A guarantee of returns, an untrue statement of licensing, the impression of risk-free trading and steering that exploits the customer’s lack of knowledge create legal risk. Prohibitions such as taking deposits or participation funds, unauthorized handling of customer savings and unrecorded transactions apply separately. General market information, general steering recommendations and personalized investment advice must be kept distinct from one another. [2, 3]

Campaigns and social media content must be reviewed not only for their words but for their overall effect. Sponsored content, referral fees, employee transactions and relationships in return for listing are included in the conflict of interest assessment. The sentence “this is not investment advice” does not by itself provide protection where the content is in fact personalized advice or misleading promotion. [2, 3]

A platform permit cannot be accepted as authority to offer every kind of leveraged transaction, credit, lending or portfolio management. The actual economic structure of the product and the relevant prohibition/permission provisions must be examined. That a user can access the same product on a foreign application does not in itself make the provision of that service to a customer resident in Türkiye lawful. [1, 2, 3]

Platforms abroad and the ban on payments with crypto

A license or registry record abroad does not replace the requirement for a permit in Türkiye. Art. 99/A of the Law treats situations such as opening a place of business in Türkiye, creating a Turkish-language website or promoting and marketing directly or through intermediaries to persons resident in Türkiye as activity directed at Türkiye. The connection to Türkiye is not limited to the group’s headquarters address. [1]

In contracts with parties abroad, the applicable law, jurisdiction, notification, access to records, return of assets and the enforceability of a decision are important. Writing a foreign law into the contract does not automatically exclude the mandatory permit and customer protection provisions that must be applied in Türkiye. For direct transfers to a foreign platform or for foreign custody services, both sectoral rules and data transfer rules must be examined. [1, 2, 3, 18]

The TCMB’s Regulation on the Non-Use of Crypto Assets in Payments governs the direct or indirect use of crypto-assets in payments and the provision of services for it. There is also a separate restriction on payment and electronic money institutions acting as intermediaries for fund transfers to or from crypto platforms. Trading crypto-assets and making a crypto-asset a means of payment are not the same activity. The assumption that a platform can integrate with any payment institution for its TL transactions is mistaken. [20]

What are the administrative and criminal consequences of violations?

For violations of the rules on permits, capital, organization, customer assets and operations, SPK inspection, an administrative fine, restriction of operations or suspension and, where conditions exist, revocation of authority may come into play. For unauthorized activity or prohibited promotion over the internet, removal of content and blocking of access are also considered. An inspection letter does not mean that the operating permit will necessarily be revoked; the legal nature of the finding and the applicable sanction are determined separately. [1, 2]

Art. 109/A of the Law provides for imprisonment from three to five years and a judicial fine of five thousand to ten thousand days for unauthorized crypto-asset service provision. For unlawful dispositions over customer assets, the embezzlement and other offense provisions in Art. 110/A may separately come into play. Not every breach of contract is embezzlement, and not every loss is fraud. The act, authority, intent and the movement of assets are examined concretely. [1]

Violation of MASAK obligations may give rise to the administrative or judicial sanctions in Law No. 5549. Customer identification, suspicious transaction reporting, the compliance program, disclosure, and retention and submission are different obligations. The revalued amounts for 2026 administrative fines, the increased application for the group of obliged entities and the lower limits linked to the transaction amount must be taken into account. It is not correct to present the first base amount in the Law as the definitive fine that applies today. [7, 9, 23]

In assessing a violation, the date of the transaction, the rule in force on that date, the number of mutually independent acts, notification, the competent authority, the reasoning, the calculation and proportionality are examined. An administrative fine, a criminal investigation and customer compensation serve different purposes; the outcome of one process does not automatically end all the others.

Who is liable when the customer suffers loss?

The delivery obligation and cyber losses

Art. 99/B/3 of the Law regulates the liability of the service provider for losses arising from unlawful activities and from failure to perform the obligation to pay cash or deliver crypto-assets. Which asset, in what amount and under which contract the customer is entitled to; when the claim was submitted; and why it was not fulfilled must be determined. The TL equivalent shown on an application screen and the number of crypto-asset units that must be delivered are not the same claim. [1]

Art. 99/B/4, in turn, refers to Art. 71 of the TBK for crypto-asset losses arising from the operation of information systems, a cyberattack, an information security breach or staff conduct. A general defense such as “a third party carried out the cyberattack; the entity has no liability at all” is not sufficient. Which system and activity the loss is related to, the statutory liability regime and the causal link are examined. [1, 21]

At the same time, the same paragraph excludes from this special liability regime losses such as the inability to place orders, carry out transactions or make transfers due to temporary service interruptions occurring without the service provider’s fault. This exception does not automatically cover continuing loss of access, the disappearance of assets or faulty security management. Nor can it be said that all claims for lost profit will be accepted on the basis of a hypothetical high-priced sale that never took place. [1]

Liability of staff members and the customer’s conduct

Where the loss cannot be compensated by the service provider, or it is clear that it cannot be compensated, the liability of staff members comes into play under the conditions in Arts. 99/B and 110/B. Every employee, shareholder or manager cannot be held liable on the same ground and without limit. The person’s duty, authority, fault, effect on the loss and the conditions of the relevant special provision must be established separately. [1]

The customer’s sharing of a password, entering information on a fake website or ignoring a security warning may affect the discussion of causation and reduction. However, the use of an OTP in the transaction does not in every case conclusively prove that the true account holder gave a valid instruction. Who changed the security setting, how the new device was recognized and with what check the risky transfer was approved must also be investigated. [21, 26, 27]

What do court decisions show on security and proof?

Istanbul Regional Court of Appeal 14th Civil Chamber: The platform’s evidence and security review

The decision of the 14th Civil Chamber of the Istanbul Regional Court of Appeal, E.2022/244, K.2025/1603, dated October 9, 2025, concerns a compensation claim brought against a platform on the allegation that crypto-assets were withdrawn from the customer’s account without the customer’s knowledge. In the decision, password and verification records, account security preferences, the time of notification and the technical course of the incident were discussed; it was found that the conditions requiring fault to be attributed to the platform had not been established in the specific case, and the dismissal judgment was upheld. [26]

The principle the decision points to is that a bare statement that “a transfer was made from my account” is not enough. Access to the user account, security changes and the times of the withdrawal must be shown separately. Conversely, the entity too must explain the controls it applied with concrete records. Merely presenting the standard contract does not show how the system worked at the time of the incident.

The limit of the decision: The events of the dispute predate the new liability provisions of Law No. 7518. It is not correct to generalize the decision to mean that, in all cyber losses after 2024, a platform will be liable only if fault is proven. For present-day events, Art. 99/B/4 in particular must be examined separately. In the Regional Court of Appeal decision, the route of appeal on points of law was left open; the outcome of any appeal after the decision has not been established here. The decision is also not a nationwide binding judgment unifying case law. [1, 26]

Court of Cassation 3rd Civil Chamber: SIM card fraud, the law at the date of the event and compensation

The decision of the 3rd Civil Chamber of the Court of Cassation (Yargıtay), E.2025/5307, K.2026/2209, dated April 15, 2026, concerns a claim for pecuniary and non-pecuniary damages brought against a mobile operator over a SIM card change on June 23–24, 2023 and the transactions carried out from a crypto-asset account. The court of first instance accepted the operator’s liability with respect to the SIM card transaction at the dealer and the resulting security deficiency. The Court of Cassation did not change the main outcome on compensation; it corrected the attorney fee items and affirmed the judgment as corrected. [27]

The decision’s significant finding concerns the later SPK provisions invoked in the operator’s defense, namely that “the relevant articles were not in force on the date of the event.” This concretely shows that new regulations cannot automatically be applied to a past event. It also states that the expert report relied on for the judgment was suitable for review and for rendering a judgment. [27]

While the decision preserves the main outcome on USD 7,990.71 in pecuniary damages and TL 25,000 in non-pecuniary damages, the dismissal of the separately claimed increase in the value of the crypto-asset was not changed. These amounts are not a tariff for other cases. The decision cannot be presented as a compensation judgment against a crypto platform; the defendant is a mobile operator. [27]

For file preparation, the change of the telephone line, e-mail access, platform logins, security settings and withdrawal transactions must each be shown separately. A defense by the entity that “another service provider had a security obligation” does not take the effect of its own conduct outside the review. For each defendant, the obligation breached, the rule on the date of the event, the causal link and the loss must be determined. [26, 27]

What documents should the customer collect and how should they apply?

In the first stage, account and transaction security must be ensured; suspected unauthorized access must be reported to the platform without delay. The notification channel, the time of sending and the reply received should be preserved. Even for legal assistance, the private key, recovery words, account password or one-time verification code must not be shared. For the review, transaction IDs, addresses and account records in most cases provide sufficient starting data.

The file should include the version of the contract on the date of the event, identification and account opening information, balance and transaction statements, bank receipts, wallet addresses, transaction ID, the network used, e-mail and SMS notifications, support records and earlier applications. Whether the times are Türkiye time or another time zone should be stated; alongside screenshots, the original digital record should be preserved where possible. [2, 3, 22]

The platform may be asked to preserve the account, security settings and related records. If there is a risk of record loss, preservation of evidence under Art. 400 et seq. of the HMK is considered; if there is an appropriate request and the conditions exist, an interim injunction or precautionary attachment is considered. Knowing a wallet address does not mean that a court decision can be directly enforced technically on the blockchain. It is important to identify the person or service provider that actually controls the asset. [1, 22]

A complaint to the SPK concerns the supervisory dimension, information sent to MASAK the financial crime risk, a criminal complaint the criminal investigation, and a private-law claim restitution and compensation. These are not all concluded by the same petition or by the same authority. The customer should separately pursue the litigation route needed to obtain redress for their own loss. A complaint to the institution or discussions with the other side do not by themselves stop any of the limitation or litigation time limits. [1, 9, 21, 22]

The competent court is determined by assessing the capacity of the parties, the nature of the contract, the purpose of the transaction and the legal protection sought. The regime of jurisdiction may differ for the different claims brought against a platform, a custodian, a bank or a mobile operator. It cannot be said that every case is heard in the consumer court merely because one party is a natural person, or in the commercial court merely because it involves crypto-assets. Mediation as a condition precedent to litigation is also examined according to the type of dispute identified. [22, 26, 27, 28]

Where there is no special period for contractual claims, the ten-year period in Art. 146 of the TBK; and for torts, the two-year period from learning and the ten-year period from the act under Art. 72, together with the exception of the longer criminal limitation period, may come into play. The starting point, learning, interruption and the true nature of the claim are calculated separately. In the judicial courts, an expert report is, as a rule, objected to specifically within two weeks of notification under Art. 281 of the HMK. In administrative and criminal decisions, the route of application and the time limit specific to the type of decision are followed. [21, 22]

A practical obligation and document matrix for entities

The table below is a working tool showing the records with which statutory obligations can be tracked within the business. It does not state that an audit has been carried out or that the same organization will be sufficient for all entities.

The initial assessment at the management level should not be limited to the question “which document is missing?” Can all the records of a sample transaction be traced from customer acceptance to the return of assets; to whom does a high-risk alert go; who can stop a transaction in an emergency; and who concludes the customer’s complaint, and on the basis of what record? The answers to these questions show whether the procedure is actually implemented. [2, 3, 7]

Conclusion

The legal compliance of a crypto-asset service provider requires that the permit, financial adequacy, customer identification, transfer security, custody, records, data protection and liability for loss be established together. Using old monetary thresholds, treating the transition list as a license, or grouping all account restrictions under the label “MASAK block” can lead to a loss of rights for both the entity and the customer.

What is decisive for the entity is that the obligation can be demonstrated not only as a written policy but through transaction and audit records. For the customer, the right counterparty, the law at the date of the event, the technical course of the security incident and the application time limits must be determined together. A sound legal assessment rests not on a label or a single screenshot but on the correct legal characterization and verifiable records.

Related articles: The article Do Crypto-Assets Pass by Inheritance? Succession to an Exchange Account, Bitcoin and a Cold Wallet separately addresses the passing of crypto-assets to heirs on death, the distinction between an exchange account and a cold wallet, and the legal consequences of access credentials.

Frequently Asked Questions

Is every platform on the SPK list licensed?

No. The List of Entities Operating in the Market is not the same as an operating permit or an authorization certificate. The current permit decision of the entity concerned, its scope and any restrictions are examined separately. [6, 25]

What is the minimum capital for a crypto platform in 2026?

For 2026, the amount is set at TL 250 million for platforms and TL 630 million for crypto-asset custodians. The special regime for banks and the equity and reserve obligations to be maintained during operations are assessed separately. [3, 4]

I will deposit only a small amount when opening an account; is identification mandatory?

Yes. The amount is not taken into account when a continuing business relationship is established. The monetary thresholds for transfers and other transactions do not remove this independent obligation. [7, 8]

Is the TL 75,000 identification threshold still valid?

This threshold in the older text is not consistent with the current guide. The guide specific to crypto-asset service providers takes TL 15,000 and above as the basis for transactions outside a continuing business relationship and for crypto transfers. At account opening and in suspicious situations, no amount threshold applies. [7]

Why is there a 72-hour wait on the first crypto withdrawal?

Because of the security and compliance measure in MASAK Communiqué No: 29, the rule of at least 72 hours applies to the first in-scope crypto withdrawal, and at least 48 hours to other relevant withdrawals. The type of transaction and the exceptions are assessed separately. [7, 10]

Does the USD 3,000 daily limit apply to all crypto transactions?

No. The regulation is directed at the relevant stable crypto-asset withdrawals. The monthly limit, application at double through information sharing, and documented exceptions must be examined together. [7, 10]

Is it prohibited for me to transfer to my own wallet?

A transfer to a personal wallet is not prohibited merely for that reason. Identity, counterparty information, risk checks, the waiting period and the applicable limit conditions continue to apply. [3, 7]

Is the customer told about a suspicious transaction report?

No. The fact that a report has been made cannot be disclosed to unauthorized persons, including those party to the transaction, except for statutory exceptions. Transaction information that can be disclosed and the confidentiality of the report are managed separately. [7, 9]

Must a crime be proven for a suspicious transaction report?

No. Information, suspicion or a matter requiring suspicion may be sufficient. A report is not a court decision that the customer is guilty. [7, 9]

Is every account restriction challenged in the same court?

No. A platform check, a MASAK postponement, an asset freeze, a suspension under the CMK and a judicial seizure are different measures. The correct route is determined on the basis of the specific legal basis and the decision. [9, 12, 19]

Can customer assets be attached for the platform’s debt?

Under the segregation protection in the Law, the customer’s assets cannot be pursued for the platform’s debt. However, a lawful judicial procedure directed at the customer’s own debt or the customer’s own assets is a separate matter. [1]

Does an MKK record mean the investment is under a state guarantee?

No. The KVMKS is a registry and reconciliation infrastructure. An MKK record does not create a guarantee of the price of the crypto-asset or of payment for every loss. [1, 14]

If a platform is attacked, is it necessarily relieved of liability?

No. The reference in Art. 99/B/4 of the Law to Art. 71 of the TBK and the features of the specific case are examined. The exception for temporary interruptions without fault is not a general exclusion of liability that can be applied to all cyber losses. [1, 21]

Is every transaction approved with an OTP deemed a genuine customer instruction?

No conclusive result can be drawn from that alone. Who controlled the telephone, e-mail, device and security settings, and the technical flow of the transaction, are investigated. [26, 27]

Is the retention period for records eight years or ten years?

The eight-year retention under MASAK and the ten-year record obligations under the SPK apply according to the type of document and the starting event. All records cannot be deleted by taking the shorter period as the basis. [2, 7, 9]

Is a foreign license sufficient for operating in Türkiye?

No. For services and marketing directed at Türkiye, the permit and operating conditions under Turkish law apply separately. [1]

If I complain to the SPK, will my money be refunded automatically?

No. A supervisory complaint is different from a claim for refund or compensation. The claim must be directed to the right counterparty and, where necessary, to the competent court; time limits must be tracked separately. [1, 21, 22]

Should I share my private key for a legal review?

No. The private key, recovery words, account password and verification code must not be shared. A review can safely begin with the incident chronology, transaction IDs, addresses and account records.

Sources

1. Capital Markets Law No. 6362 (Sermaye Piyasası Kanunu). In particular Arts. 3, 35/B, 35/C, 99/A, 99/B, 109/A, 110/A–B and 130/5. SPK legislation text.
2. SPK, Communiqué No. III-35/B.1. Communiqué on the Establishment and Operating Principles of Crypto-Asset Service Providers (Kripto Varlık Hizmet Sağlayıcıların Kuruluş ve Faaliyet Esasları Hakkında Tebliğ); Official Gazette March 13, 2025/32840.
3. SPK, Communiqué No. III-35/B.2. Communiqué on the Working Procedures and Principles and Capital Adequacy of Crypto-Asset Service Providers (Kripto Varlık Hizmet Sağlayıcıların Çalışma Usul ve Esasları ile Sermaye Yeterliliği Hakkında Tebliğ); Official Gazette March 13, 2025/32840.
4. SPK, Bulletin No. 2025/68. December 31, 2025; monetary amounts for 2026, table for III-35/B.2.
5. SPK, announcement of Decision No. 18/617 dated March 26, 2026. Bulletin No. 2026/18, p. 6, E/1. The copy of the SPK bulletin accessible on PRM Finans.
6. SPK, List of Entities Operating in the Market (Faaliyette Bulunanlar Listesi). Statement that the transition list does not amount to authorization, and current entity records.
7. MASAK, Compliance Guide on Obligations for Crypto-Asset Service Providers (Kripto Varlık Hizmet Sağlayıcılar İçin Yükümlülüklere Uyum Rehberi). September 2025; identification, travel rule, transfer controls, reporting and retention. Subsequent amendments have been assessed separately.
8. Regulation on Measures Regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism (Suç Gelirlerinin Aklanmasının ve Terörün Finansmanının Önlenmesine Dair Tedbirler Hakkında Yönetmelik). In particular Arts. 4–26/A; identification, beneficial owner, transfer information and enhanced measures.
9. Law No. 5549 on the Prevention of Laundering Proceeds of Crime (Suç Gelirlerinin Aklanmasının Önlenmesi Hakkında Kanun). In particular Arts. 3–8, 13–14 and 19/A.
10. MASAK General Communiqué Serial No: 29. Official Gazette June 28, 2025; transfer waiting periods, stable crypto-asset limits and the explanation obligation. To be read together with pp. 17–18 of the MASAK Guide.
11. MASAK Online Application Guide (MASAK Online Başvuru Kılavuzu). March 2025; distinction between the user application and the suspicious transaction reporting system.
12. MASAK General Communiqué Serial No: 34. Official Gazette September 23, 2026/33379. United Nations sanctions lists, reporting and postponement; legislation text reproduced on Legalbank.
13. MASAK, Announcement on Remote Identification by Passport (Pasaportla Uzaktan Kimlik Tespitine İlişkin Duyuru). June 29, 2026. Amending Communiqué Serial No. 32, Official Gazette June 27, 2026/33293.
14. MKK, Crypto-Asset Central Registry System (Kripto Varlık Merkezi Kayıt Sistemi). The system’s registry, comparison and reconciliation function.
15. MKK, Announcement on the Approval of the KVMKS by the TCMB (KVMKS’nin TCMB Tarafından Onaylanmasına İlişkin Açıklama). Corporate announcement dated August 3, 2026.
16. Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu). In particular Arts. 4–6, 9–12; purpose limitation, legal basis, transfer and security.
17. KVKK, Personal Data Breach Notification Procedures and Principles (Kişisel Veri İhlali Bildirim Usul ve Esasları). Announcement concerning Decision No. 2019/10 dated January 24, 2019.
18. KVKK, Public Announcement on Standard Contracts for Transfers Abroad (Yurt Dışına Aktarımda Standart Sözleşmeler Hakkında Kamuoyu Duyurusu). Signing of the standard contract and the five-business-day notification period.
19. Law No. 7571, CMK Art. 128/A added by Art. 22. TBMM adopted text; suspension of an account, judicial seizure, notification and provision of information.
20. TCMB, Regulation on the Non-Use of Crypto Assets in Payments (Ödemelerde Kripto Varlıkların Kullanılmamasına Dair Yönetmelik). Official Gazette April 16, 2021/31456; Arts. 3–4.
21. Turkish Code of Obligations No. 6098 (Türk Borçlar Kanunu). In particular Arts. 49–52, 71–72, 112 and 146–149.
22. Code of Civil Procedure No. 6100 (Hukuk Muhakemeleri Kanunu). In particular Arts. 190, 219–220, 266, 281–282, 389 and 400 et seq.
23. MASAK, Obligations and Sanctions (Yükümlülükler ve Yaptırımlar). Groups of obligations under Law No. 5549 and the administrative/judicial sanctions framework; the sanctions section of the Guide.
24. MKK, KVMKS 2026 Fee Schedule (KVMKS 2026 Yılı Ücret Tarifesi). Circular dated January 20, 2026; financial planning of obligations.
25. SPK, Crypto-Asset Service Providers (Kripto Varlık Hizmet Sağlayıcılar). Official page on authorization, transition records and applications.
26. Istanbul Regional Court of Appeal 14th Civil Chamber (İstanbul BAM 14. Hukuk Dairesi). E.2022/244, K.2025/1603, October 9, 2025. Platform security, user account and compensation. Dismissal of the appeal on the merits; route of appeal on points of law open. De Jure full decision record.
27. Court of Cassation 3rd Civil Chamber (Yargıtay 3. Hukuk Dairesi), E.2025/5307, K.2026/2209, April 15, 2026. SIM card transaction and crypto-asset loss; mobile operator. Affirmed as corrected with respect to the attorney fee items. De Jure full decision record.
28. Consumer Protection Law No. 6502 (Tüketicinin Korunması Hakkında Kanun). In particular Arts. 3, 73 and 73/A; assessment of jurisdiction and condition precedent to litigation according to the contract and the capacity of the parties.