Establishing a Crypto-Asset Service Provider in Türkiye and the SPK Operating Permit: 2026 Guide to Licensing, Capital, MASAK and Compliance

Forming a joint-stock company in the crypto-asset field does not by itself confer the right to act as a crypto-asset service provider. As of 2026 in Türkiye, regularly, commercially or professionally operating a crypto-asset trading platform, holding crypto-assets in custody on behalf of customers or managing private keys, and providing the other services listed in the legislation, is a capital-intensive financial service activity subject to continuous supervision that requires an establishment permit from the Capital Markets Board first, and then an operating permit and an authorization certificate. 123

This guide has been prepared for entrepreneurs, foreign investors, technology companies, financial institutions, board members, compliance officers and investment teams who plan to establish a new platform or custodian. The aim is not merely to list application documents; it is to set out, in a single legal roadmap, the license scope of the business model, the company and shareholding structure, the 2026 capital thresholds, MASAK obligations, information systems and custody architecture, customer agreements, and tax and sanction risks.

Critical Figures and Rules for 2026

Monetary thresholds may change through annual revaluation or a Board decision. When preparing the application file, one should look not only at the figures in this article but at the SPK bulletin in force on the date of application and the current application forms. 45

What Is a Crypto-Asset Service Provider?

Capital Markets Law No. 6362 defines the concept of crypto-asset service provider so as to cover platforms, institutions providing crypto-asset custody services, and other service providers determined by the Board. A "platform" refers to the institution in which one or several of the following are carried out: purchase and sale of crypto-assets, initial sale or distribution, swap, transfer, the custody that these require, and other transactions determined by the Board. 1

The consequence of this definition is as follows: a company’s calling itself a "technology company," "marketing partner," "agent," "liquidity intermediary," "wallet application" or "Web3 startup" does not remove the licensing obligation. If there are acts such as receiving customer orders, matching transactions, intermediating fiat currency deposits and withdrawals, exercising control over customer assets, carrying out transfers or managing private keys, the scope of the SPK may arise.

Platform Services

A platform permit relates to the receipt and execution of customer orders, operating a trading environment for crypto-assets, carrying out transfer and swap processes, listing, intermediation in an initial sale or distribution, and other permitted activities. An operating permit is not an authority to "do everything in the crypto field"; it is limited to the services shown in the authorization certificate.

Custody and Private Key Management

Controlling or safekeeping on behalf of customers the private keys that give access to a crypto-asset is not merely a technical hosting service. Key generation, signing, backup, recovery, hot-cold wallet architecture, multi-signature and authority management services may fall within the scope of the custody activity. The bank, independent custodian or platform wallet components of the custody model should be assessed separately.

Initial Sale, Distribution and Token Projects

The technological creation of a token on a blockchain does not by itself determine its legal nature. If a token is based on a capital market instrument, a payment instrument, electronic money-like value, a commodity or another right, the special legislation of the relevant institutions may also come into play. A platform is obliged to carry out checks on the legal nature, smart contract, listing conditions and custody infrastructure of an asset whose initial sale or distribution it intermediates. 3

The Distinction Between Investment Advisory and General Advice

Providing guiding comments and advice to a specific person or to a group with similar financial situation and risk preferences is investment advisory. In 2026, this service may be offered to customers whose crypto-assets at the platform have a current value of at least TRY 60,000,000; qualified personnel and a research unit are required. By contrast, financial analysis or advice of a general nature is subject to the general advice rules in the legislation. Managing a customer’s portfolio by proxy is prohibited. 34

For Which Business Models May an SPK Permit Be Required?

The business model map should be completed before the application

A material change to the business model after the establishment permit has been obtained may give rise to a need for additional permits and notifications in respect of a new service, product, token type, custody architecture or integration of a foreign group company. For this reason, the license file should rest not only on the company’s formation but on the product design.

Regulatory Authorities and Division of Duties

Crypto-asset service provision is not a single-authority permit area. Although the SPK is the principal regulatory and supervisory authority, the company’s activity intersects with the fields of duty of the following institutions:

• Capital Markets Board: establishment and operating permits, capital adequacy, customer relations, listing, market surveillance, custody, supervision and sanctions.
• Financial Crimes Investigation Board Presidency (MASAK): customer identification, beneficial owner, suspicious transaction reporting, compliance program, travel rule and enhanced measures.
• TÜBİTAK: support for information systems and technological infrastructure criteria and technical audit processes.
• Central Registry Agency (MKK): comparison of the reports of the platform and the custodian, central book-entry reporting and customer balance viewing infrastructure.
• Banking Regulation and Supervision Agency (BDDK): banks’ crypto custody activity and opinion processes.
• Central Bank of the Republic of Türkiye: prohibitions on the use of crypto-assets in payments and on the intermediation of payment/e-money institutions.
• Personal Data Protection Authority: remote customer onboarding, biometric data, transaction monitoring, international data transfers and data security.
• Revenue Administration (GİB) and the tax administration: obligations regarding corporate income, transaction revenue, payroll, withholding, expenses and documentation.

The SPK Process Has Two Stages: Establishment Permit and Operating Permit

First Stage: Establishment Permit

Before forming the company in the trade registry, the founders apply to the SPK with articles of association and founder/shareholder documents that comply with the establishment conditions. The Board may examine the source of capital, shareholding structure, beneficial owners, financial strength, reputation, group structure, planned activities and organizational design; it may request additional information, an independent audit or a rating. 2

An establishment permit is not an operating permit. A company that has been granted an establishment permit may not begin customer acceptance, advertising, order receipt, asset transfers or custody services that would give the impression that it will go operational.

Core Elements of the Establishment Permit File

The establishment permit file should be consistent across the draft articles of association, the activity and revenue model, the direct and indirect shareholding chart, beneficial owner information, source of capital, three-year financial projection, organizational model and the planned technical architecture. Describing only a platform in one document and a custody or liquidity-provision activity in another may give the impression that the scope is unclear or contradictory.

Second Stage: Operating Permit and Authorization Certificate

Following the establishment permit, the company must be formed in accordance with the legislation, the capital paid, management and personnel appointed, internal control-risk-internal audit units set up, the MASAK compliance program prepared, information systems and wallet architecture put into operation, and custody agreements and technical integrations completed. If an application for the operating permit is not made within six months after the establishment permit, the right lapses; the Board may extend this period up to a total of one year. 2

Once the operating permit application results favorably, an authorization certificate showing the permitted services is issued. Activity may not begin without obtaining the authorization certificate. If the necessary fee is not paid and the receipt submitted to the Board within one month following notification, the operating permit is cancelled. 2

The Audit Threshold Before the Operating Permit

An operating permit file is not a folder consisting only of policy texts. Order, transfer, wallet, custody, identity verification, logging, complaint, reconciliation and disaster recovery processes must be tested on working systems; the authority matrix, personnel, supplier agreements and audit evidence must show actual operation. A divergence between written procedure and practice directly affects the permit process and subsequent liability.

What Consequence Does an Incomplete Application Have?

An application that does not meet the standards set by the SPK may be returned without being evaluated. If the additional information and documents requested by the Board are not completed within the period given, which may not be less than ten days, the application may be removed from processing. For this reason, the file must be prepared not as a "document submission" but as a legal, technical and financial audit file.

The Company’s Legal Structure and Articles of Association

The Joint-Stock Company Requirement

A crypto-asset service provider must be established as a joint-stock company. A limited liability company, ordinary partnership, branch or representative office structure is not by itself sufficient for a platform or custodian license. All of the shares must be registered shares issued for cash. The whole of the capital must be paid in cash, and equity must not fall below the minimum capital. 2

The Exclusivity of the Business Purpose

The business purpose in the articles of association must be drafted so as to be limited to the crypto-asset services to be authorized by the Board. Broadly writing unrelated commercial activities under the same legal entity makes it difficult to separate the financial and operational risks of the licensed activity. Support activities within the group, such as software, marketing, human resources or real estate, may be kept in separate companies; however, outsourcing does not remove responsibility from the licensed institution.

Trade Name, Trademark and Internet Domain Name

The trade name and trademark should accurately reflect the activities the institution is authorized to carry out; they should not create the impression of being licensed before a permit has been obtained. The internet domain name, mobile app store account, trademark rights and social media accounts must be under the company’s control; a registration, monitoring and response procedure should be established against fake domain names and phishing risks.

2026 Capital and Ongoing Financial Adequacy Requirements

Minimum Establishment Capital

For 2026, the minimum establishment capital of platforms is TRY 250,000,000 and that of custodians is TRY 630,000,000. The amount of TRY 50,000,000 that appeared on the old page is no longer current. 4

The whole of the capital must be paid in cash. The source of capital must be traceable through bank records, fund movements, the financial strength of the shareholders, income/wealth documents and, for foreign-sourced funds, international transfer documents. Borrowing the capital temporarily and depositing it, or being unable to explain its real source, damages the credibility of the application.

Traceability of the Source of Capital

That the nominal amount has been deposited in the account does not by itself provide sufficient assurance. From which shareholder, through which legal transaction and from which source of income the money arose, and whether there is temporary financing from a third party, disguised debt, a repayment undertaking or intra-group circulation, must be documented. For foreign currency and foreign-sourced funds, the bank chain, tax and sanction risk, and the link to the beneficial owner are examined together.

Equity, Capital Adequacy and the Borrowing Limit

During the activity, equity may not fall below the establishment capital. At least 25 percent of equity must be provided as paid-in or issued capital as of June each year. The capital adequacy base is calculated by deducting fixed assets, related-party receivables and the other items listed in the legislation. Total short- and long-term debts may not exceed three times the capital adequacy base; current assets must be at least equal to short-term debts. 3

Additional Equity for Custodians

In 2026, if total customer assets exceed TRY 1,250,000,000, additional equity of 1.5 percent of the excess is required. Once equity reaches TRY 1,900,000,000, this additional requirement does not apply. The obligation is monitored on the arithmetic average of three-month periods. 4

Liquid Reserve and Reserve Composition

A platform maintains a liquid reserve equal to 3 percent of the customer assets it holds in its own wallets. Excessive concentration of the reserve in a single asset is restricted; stricter composition limits apply to newly listed assets or assets with a low market value. Financial adequacy is a test not only of balance sheet size but of liquidity and asset quality.

Review of Founders, Shareholders and Beneficial Owners

The founders’ and shareholders’ bankruptcy/composition status, their past relationship with financial institutions whose operating permits were cancelled, convictions for certain offenses, trading bans, financial strength, and integrity and reputation requirements are examined. Indirect shareholdings, voting rights, privileges, management control and beneficial owners must be shown transparently. 2

Share Transfers and Change of Control

After formation, direct or indirect share transfers, changes of control and shares conferring a privilege of representation on the board of directors are subject to a permit or notification regime. Share options, convertible debt, veto rights, shareholders’ agreements and intra-group control arrangements should not be assessed solely by looking at the trade registry shareholding ratio.

Can There Be Foreign Shareholders and Foreign Managers?

The legislation imposes no categorical prohibition on the shareholding of a foreign natural or legal person. However, the incorporation documents, activity documents, shareholding and management chain, ultimate beneficial owners, criminal record and financial strength documents of foreign shareholders must be submitted with an apostille or duly executed certification and a Turkish translation. Sanction lists, tax residence, source-country risk and intra-group fund flows are examined separately.

Board of Directors, Senior Management and Personnel

The Board of Directors Consists of at Least Three Members

The statement "at least three shareholders" in the old text is not correct. The legislation requires that the board of directors consist of at least three members and that the majority of the members be graduates of schools offering four-year bachelor’s degrees. The number of shareholders is a separate matter under the Turkish Commercial Code and the company structure. 2

General Manager and Senior Management

The general manager must be employed exclusively for this duty, be resident in Türkiye and work full time. Education, experience in financial markets/technology, and integrity and reputation requirements are documented for each manager. The board of directors’ delegation of duties, conflicts of interest and powers over critical decisions should be clearly regulated.

Mandatory Functions

• Internal audit: independent assurance of compliance of activities with the legislation and internal procedures.
• Internal control: continuous monitoring of processes, controls and compliance with the legislation.
• Risk management: measurement of market, liquidity, operational, cyber, custody, counterparty and compliance risks.
• Price surveillance unit: detection of inexplicable transactions or transactions that impair market integrity, and reporting to the Board.
• Operations and technical personnel: order, balance, wallet, database, integration and reporting processes.
• MASAK compliance unit: compliance officer, deputy, monitoring-control, training, internal audit and suspicious transaction reporting.

Information Systems, Cybersecurity and Operational Resilience

The principal risk of a crypto-asset service provider is not solely market risk. Loss of a private key, unauthorized transfer, SIM swap, account takeover, a fake application, abuse of authority, supplier outage, a data integrity breach and misuse of a recovery key may directly create customer loss and manager liability. The Law provides a heavy liability regime for crypto-asset losses arising from the operation of information systems, cyberattacks, information security breaches and personnel conduct. 1

TÜBİTAK Infrastructure Criteria and Independent Audit

Compliance of information systems and technological infrastructure with TÜBİTAK criteria may be examined in the establishment and operating permit process. Crypto-asset service providers have an authorized independent audit carried out at least once a year with respect to information systems and internal control processes; proof-of-reserves audits are conducted separately. An audit report should be part of a regular improvement cycle, not the later disclosure of weak controls.

Wallet Security

• The purpose, limits and access authorities of hot and cold wallets should be defined separately.
• Private key generation, splitting, storage, backup and signing processes should be based on segregation of duties.
• In methods such as multi-signature or multi-party computation, a single person must be prevented from completing a transfer.
• Key recovery and emergency procedures should be tested; test records should be kept.
• Address whitelisting, behavioral analysis, device/IP control and approvals of high-value transfers should be applied together.
• Fake applications, domain names and social media accounts should be monitored continuously; an incident response plan should exist.

Private Key Lifecycle and Incident Response

Each of the stages of key generation, use, rotation, backup, recovery and destruction should be tied to a separate authority and record regime. The steps for stopping transfers, moving wallets, notifying customers and authorities, preserving records of evidentiary value and a controlled return to operation should be determined in advance for the moment a key is seized or lost or the possibility of an unauthorized signature arises.

Outsourcing and Cloud Use

Cloud, cybersecurity, call center, software development, identity verification or blockchain analytics services may be outsourced; however, regulatory responsibility cannot be delegated. The written agreement should cover service level, audit right, data location, subcontractors, confidentiality, incident notification, continuity, exit plan and access by regulatory authorities.

Custody Model and Segregation of Customer Assets

The Principle of Holding in One’s Own Wallet and Authorized Custody

The Law adopts as its principle that customers hold their crypto-assets in their own wallets. Assets that a customer does not hold in his or her own wallet are held by an authorized bank or an institution authorized by the Board to provide custody services. Customer cash is held in banks; it is not covered by deposit insurance. 1

95% Custody and the 10% Intraday Limit

At least 95 percent, on a current value basis, of the assets that customers do not hold in their own wallets must be held at the custodian. At most 5 percent may be held in platform wallets at reconciliation; if 10 percent is exceeded intraday, the excess must be transferred to the custodian immediately, without waiting for the reconciliation time. 3

Automated Management of Limit Breaches

The percentage limits should not be monitored only in an end-of-day control table. Balances in platform wallets, price changes and customer movements should be tracked close to real time; alert levels, automatic transfer, manual approval, transaction halt and exception records should be defined. Correcting a breach afterwards does not eliminate the custody and operational risk that arose during the breach.

Customer Assets Are Separate from the Company’s Assets

Cash and crypto-assets belonging to customers are separate from the service provider’s assets. Customer assets cannot be attached, pledged, included in the bankruptcy estate or made the subject of an interim injunction on account of the service provider’s debts, nor can the company’s assets on account of customers’ debts, even for a public receivable. This protection does not excuse poor accounting or incomplete reconciliation; the segregation must be provable both systemically and in accounting terms. 1

MKK Reconciliation

The reports that the platform and the custodian submit to the MKK must produce the same result. The MKK compares the reports, notifies the Board of differences, and prepares the central book-entry reports in a form that allows the customer to query balances in the E-Yatırımcı system. A difference between the wallet balance, the customer sub-account and the accounting record is not a daily operational problem but a regulatory breach risk.

Listing, Market Integrity and Prohibited Transactions

Listing Committee and Review

For each crypto-asset it will list, the platform must review its legal nature, technology, project team, circulation, custody feasibility, cyber risk, market integrity, conflicts of interest and information disclosures. A listing decision is not a sales decision to be made by the commercial department alone; written criteria, a committee and records are required.

Price Surveillance and Market-Disrupting Transactions

The platform establishes a price surveillance system to detect transactions that cannot be explained on economic grounds and that undermine confidence and stability. It has an obligation to restrict, suspend or close suspicious accounts and to report its findings to the Board. Wash trading, self-dealing, fake volume, coordinated price movements and transactions by employees/related parties should be included in the monitoring scenarios.

Prohibition of Leverage, Credit, Derivatives, Short Selling and Lending

Crypto-assets listed on the platform cannot be made the subject of leveraged trading, derivative contracts, credit purchases, short selling or lending transactions. Even if the product is named "futures," "earn," "margin," "lending" or another marketing name, the prohibition cannot be circumvented through its economic function. 3

Return Commitments and Disposal of Customer Assets

Except in permitted special cases, a KVHS cannot promise, in writing or orally, that a crypto-asset will yield a particular return; nor can it dispose, without authorization, of cash and crypto-assets belonging to customers, whether for itself or in favor of a third party. Liquidity and staking-like products should be examined separately, legally and technically.

Customer Acceptance, Agreement and Disclosure

Framework Agreement

The relationship with the customer must be based on a framework agreement in writing or electronic form that complies with the legislation. The agreement should clearly regulate the scope of services, fees, order transmission, custody, transfer, reconciliation, default, transaction cancellation, disputes, personal data, electronic notices, account security and the conditions for restricting the account. The agreement cannot remove the company’s obligations by means of an exclusion of liability contrary to mandatory regulation.

Risk Disclosure Form

The customer must be informed of the price, liquidity, technology, cyberattack, private key, regulatory, token project and foreign platform risks of crypto-assets. An operating permit does not mean that the transaction is under public guarantee or that a crypto-asset carries a State guarantee; crypto-assets are not subject to the investor compensation system. 1

Fees, Spread and Conflicts of Interest

Commission, spread, custody, transfer, withdrawal, listing and other fees must be clearly notified to the customer. The platform’s acting as a counterparty to customer transactions with its own portfolio, liquidity provider relationships, related token projects and services received from group companies should be addressed in the conflict of interest policy.

MASAK Compliance Program

Crypto-asset service providers are obliged entities under the legislation on laundering of proceeds of crime and prevention of terrorist financing. Compliance is not merely taking a photograph of the customer’s ID; it is a management system covering risk management, monitoring and control, a compliance officer, training, internal audit, suspicious transaction reporting and record keeping. 6

Identifying the Customer and the Beneficial Owner

When establishing a continuing business relationship, identification is carried out irrespective of the amount. For a legal entity, in addition to the representative, the shareholding structure and beneficial owner are determined; a declaration is obtained as to whether the customer is acting on behalf of another. The customer profile is updated with information on income and source of funds, expected transaction volume, high-risk country, product and channel.

The Chain of Control for Legal Entity Customers

One should not be content with identifying the direct shareholders in the trade registry. Indirect shareholding, voting agreements, privileges, veto rights, rights to appoint management, trusts or similar structures, and the authority of the person acting on the company’s behalf must be examined. The inability to identify the beneficial owner, or an inconsistency between the source of funds and the company’s activity, affects the decision on customer acceptance and enhanced measures.

Remote Identification

Remote customer onboarding requires controls such as real-time and uninterrupted video communication, the security features of the identity document, NFC or equivalent verification, a liveness test, biometric comparison, a one-time password and record integrity. With the amendment of 28 February 2026, KVHSs were expressly added to the scope of the remote identification communiqué. 7

Politically Exposed Persons

Whether the customer or beneficial owner is a politically exposed person (PEP) must be determined; for foreign PEPs and for domestic/international PEP relationships regarded as risky, senior management approval, source-of-funds review and close monitoring must be applied. Leaving office does not mean that the risk ends automatically.

Suspicious Transaction Reporting

If there is information, suspicion or reasonable grounds that a transaction is connected with illegal betting, fraud, rented accounts, ransomware, sanctions violation, a mixer/tumbler, a privacy asset, a cross-chain bridge, a mule account or an unusual transfer pattern, a confidential suspicious transaction report is made to MASAK. It cannot be disclosed to the customer that a report has been made.

Compliance Officer and Compliance Unit

A compliance officer and at least one deputy compliance officer must be appointed within thirty days after the operating permit. The appointment documents are submitted to MASAK within the specified periods. The compliance officer must have access to the board of directors, independence, and sufficient budget and personnel. 6

Travel Rule, Transfer Periods and Stable Crypto-Asset Limits

Travel Rule

Sender and recipient information must be carried securely in the crypto transfer message; there must be a procedure for completion, return, rejection and risk escalation in respect of missing or unverifiable information. Transfer software cannot be content with merely broadcasting the blockchain transaction; a simultaneous data message and counterparty risk control are required.

Missing or Unverifiable Transfer Data

If the required information does not arrive from the counterparty service provider, the transaction should not be completed automatically. Depending on the nature of the deficiency, requests for information, holding the transfer, return or rejection, raising customer and counterparty risk, and a suspicious transaction assessment should be carried out. Taking into account the irreversibility of a blockchain transaction, the technical system should place data validation before broadcast.

48 Hours and 72 Hours for the First Withdrawal

For certain withdrawals to an unregistered wallet or to a foreign institution with no data-sharing obligation similar to the travel rule, the transfer is carried out at least 48 hours after the purchase, swap or deposit of the crypto-asset; for the customer’s first withdrawal, this period is at least 72 hours. 6

Stable Crypto-Asset Withdrawal Limits

For stable crypto-asset withdrawals, a limit equivalent to USD 3,000 per day and USD 50,000 per month applies. In transfers to which the travel rule applies, the limits may be doubled. The liquidity provider, market maker or arbitrage exception depends on a board of directors resolution for each customer, source-of-funds documents and continuous monitoring. 6

A Transaction Description of at Least 20 Characters

The platform must obtain from the customer, for all crypto transfers, a description at least 20 characters long explaining the nature of the transaction. Automatic acceptance of generic or meaningless statements does not fulfill the purpose of the rule; the description must be used in risk analysis. 6

Personal Data Protection and Data Governance

Remote identification, facial images, liveness data, identity documents, device fingerprints, IP, on-chain addresses, transaction history and risk scores bring the personal data regime into play. Biometric data may be special category data. The purpose of processing, legal basis, retention period, access authority, international transfer, supplier relationships and data breach response should be established separately under the KVKK.

Disclosure and Explicit Consent Are Not the Same Thing

Explicit consent is not always required for identity and record-keeping obligations arising from legislation; on the other hand, marketing, profiling or non-mandatory biometric use may require a different legal basis. The privacy notice, the agreement, cookie preferences and commercial electronic message consent serve separate functions.

International Data Transfer

Cloud, email, customer support, blockchain analytics or group company integration may take data abroad. The transfer mechanisms under the KVKK, standard contracts and data residency should be mapped before the application. The SPK’s and MASAK’s requirements on access to data and record-keeping in Türkiye should be secured in supplier agreements.

Foreign Platforms and Cross-Border Services

That a platform established abroad has no company in Türkiye does not remove the prohibition on activity directed at Türkiye. Opening a workplace in Türkiye, creating a Turkish-language website, or carrying out direct or indirect promotion and marketing through persons/institutions resident in Türkiye causes the activity to be regarded as directed at Türkiye. In that case unauthorized activity, content removal/access blocking and criminal liability may arise. 1

The Reverse Solicitation Defense

A Turkish user’s accessing a foreign platform on his or her own initiative is not the same as the platform’s targeting Türkiye. However, if there is a Turkish-language campaign, a local influencer, TRY pairs, Turkish customer service, a local payment channel, a Türkiye-specific bonus or a sales team, the defense that "the customer came on his or her own" is weakened.

Indicators of Targeting Türkiye

Language alone is not decisive in every case; the domain name, app store targeting, advertising budget, a user acquisition program in Türkiye, a local representative or call center, Turkish lira trading pairs, local bank relationships and a Türkiye-specific contract/fee structure are assessed together. The marketing or customer support role of a Turkish company in the group may also change the nature of the cross-border activity.

Technology or Liquidity Relationship with a Foreign Group Company

Obtaining software, brand, liquidity, order routing or custody services from a foreign group company may mean that the service is in fact transferred abroad. The license scope and the outsourcing rules are examined according to which company holds data access, customer orders, wallet control and price formation.

Use of Crypto-Assets in Payments

Under the Central Bank (TCMB) regulation, crypto-assets cannot be used in payments directly or indirectly; payment service providers cannot develop business models in this way, and payment/e-money institutions cannot intermediate fund transfers to or from crypto platforms. The platform’s bank integration and a payment institution integration are not subject to the same legal regime. 8

The plan to use a token as a pricing or payment instrument in purchases cannot be resolved by an SPK permit alone. The product design must be examined separately under the TCMB regulations, Law No. 6493 and, if necessary, the electronic money legislation.

Accounting, Tax and Annual Institutional Contributions

The Tax Model Should Be Built According to the Activity Model

Platform commission, spread income, listing fees, custody income, technology services, own-portfolio transactions, token distribution and payments to foreign groups are not of the same tax nature. Corporate tax, VAT or BSMV (banking and insurance transactions tax), transfer pricing, thin capitalization, withholding, exchange rate differences and documentation should be assessed according to the business model. Generalizations such as "crypto transactions are tax-free" or "the same tax applies to every transaction" are not safe.

SPK and TÜBİTAK Contributions

Under the Law, platforms pay 1 percent of all their income for the previous year, excluding interest income, to the SPK’s budget and 1 percent to the TÜBİTAK budget, to be used in the development of blockchain and related information technologies, by the end of May of the relevant year. This burden is a regulatory cost separate from the classic tax calculation. 1

Expenses Overlooked in Budget Planning

• Establishment and operating permit fees and annual regulatory contributions.
• Equity and liquid reserve needs beyond the minimum capital.
• Custodian, bank, MKK, independent audit and proof-of-reserves costs.
• Cybersecurity, HSM/MPC, blockchain analytics, logging and business continuity infrastructure.
• Qualified personnel, compliance officer, internal control, risk and audit functions.
• Legal, tax, data protection, trademark and contract advisory.

Advertising, Promotion, Influencers and Commercial Communication

A KVHS’s advertising and commercial communication must accurately reflect the scope of its permit, the risks and the nature of the product. Creating the impression of a guaranteed return, risk-free profit, State guarantee, an "SPK-approved coin," deposit-like protection or investor compensation may constitute unlawfulness. Bonus, referral, gift token, giveaway and influencer campaigns should be reviewed in advance for content encouraging investor behavior and for the advertising prohibition/proportionality.

Influencer Content Is Not Considered Outside the Company

Content published by an agency or influencer may be considered the company’s commercial communication because of contractual control and the relationship of interest. A content approval flow, mandatory risk warnings, archiving, campaign targeting and a deletion/correction mechanism should be established.

Customer Protection, Liability and Disputes

An Operating Permit Is Not a Public Guarantee

SPK authorization does not mean that transactions are under public guarantee. Crypto-assets are not subject to the investor compensation system; crypto and related cash held at a bank is not covered by deposit insurance. The customer continues to bear counterparty, technology and market risk. 1

Liability of the Company and Its Managers

A KVHS is liable for loss arising from its unlawful activities and from its failure to perform its cash payment or crypto delivery obligations. If the loss cannot be compensated by the company, the personal liability of its members may come into question according to their fault and the requirements of the situation. For losses caused by cyberattack, information security breach and personnel conduct, the Law regulates a special liability based on Article 71 of the Turkish Code of Obligations (TBK). 1

SIM Swap and Account Takeover

In account takeover disputes, fault and causation among the mobile operator, the platform, the user and the criminal perpetrators are examined separately. Decision No. E.2025/5307, K.2026/2209 of 15.04.2026 of the 3rd Civil Chamber of the Court of Cassation emphasized that the new SPK information system rules, which were not in force on the date of the event, cannot be applied to a past event. This decision matters in that the current regime is not automatically applied to pre-2024 cases; it does not narrow the scope of the KVHS obligations in 2026. 9

Evidence

• Customer agreement, risk form, explicit consent and privacy notice records.
• IP, device, session, SIM swap, identity verification and transaction approval logs.
• Wallet addresses, transaction hashes, blockchain analytics reports and counterparty information.
• Call center, email, support records, alarms and incident response records.
• Authority matrix, personnel access logs, change and version records.
• Custodian, bank, MKK and platform reconciliation records.

Unauthorized Activity, Administrative Measures and Criminal Liability

Unauthorized Crypto-Asset Service Provision

Carrying on KVHS activity without a permit may lead, in addition to the halting of the activity, removal of advertisements, removal of content or blocking of access, to a criminal investigation. Article 109/A of the Law provides imprisonment of three to five years and a judicial fine of five thousand to ten thousand days for unauthorized activity. In its 2026 bulletins, the SPK has published criminal complaint decisions concerning unauthorized platforms and the domain name/infrastructure relationships that aid this activity. 110

The Risk of Intermediation and Providing Infrastructure

The role of persons and companies that provide an unauthorized platform with a brand, domain name, local payment, customer referral, call center, promotion or technical infrastructure may be examined separately. Mere provision of a general-purpose service is not the same as a special cooperation that knowingly facilitates the continuation of the unauthorized activity; the contract, revenue sharing, control and level of actual contribution affect the risk of criminal and administrative measures.

Embezzlement

For board members and personnel who appropriate for themselves or for another money, other property or crypto-assets entrusted to them by reason of their duty or which they are obliged to protect/safeguard, imprisonment of eight to fourteen years and a judicial fine are provided; a heavier penalty is provided where deceit is involved. The use of the resources of a company whose operating permit has been revoked by controlling shareholders in a manner that endangers the company is also subject to a special embezzlement provision. 1

Temporary Suspension of Activity or Revocation of the Permit

A weakening of the financial structure, the inability to fulfill customer payment/delivery obligations, the loss of establishment or operating conditions, false statements, and information system and internal system deficiencies may lead to the temporary suspension of activity or the revocation of permits. The loss of a condition must be notified to the Board within three business days.

Legal Remedies Against SPK Decisions

The rejection of an establishment or operating permit application, removal from processing, suspension of activity, revocation of a permit, an administrative fine or an access measure may, depending on the nature of the act, be subject to review by the administrative courts. Filing a lawsuit does not automatically stop the act. The principles of competence, form, reasoning, material facts, proportionality and equality should be assessed together with the technical reports and the application file.

A request for a stay of execution must rest not merely on a claim of economic loss but on the conditions of manifest unlawfulness and damage that is difficult to remedy. Where the activity poses a risk to customer assets or financial stability, the public interest assessment is also important.

Transition-Period Lists and Old Time Limits

The one-month declaration period in 2024 and the 2025-2026 transition calendar were for institutions that were already operating when the law entered into force. For newly established companies, the transition regime does not apply; the establishment permit and operating permit process under Communiqué III-35/B.1 applies. The statements in the earlier article about "notification by 02.08.2024" and "continuing activity during the application process" are not current for a new entrepreneur.

The "List of Those Operating" on the SPK’s website is still published as a temporary list, and the Board expressly states that being on the list does not mean authorization. When assessing a company’s license status, not only the temporary list but the authorization certificate and the scope of the permit should be examined. 11

Step-by-Step Formation and Licensing Roadmap

1. Define the business model: distinguish platform, custody, transfer, initial sale, investment advisory, technology or intra-group service.
2. Prepare a legal scope opinion: determine which services are subject to a permit and which are prohibited or fall under the authority of another institution.
3. Build the shareholding and financing structure: make the beneficial owner, source of capital, foreign shareholder documents and control rights transparent.
4. Design the articles of association and management model: regulate the business purpose, trade name, shares, board of directors, delegated authority and conflicts of interest.
5. Complete the establishment permit file in accordance with the current SPK forms and submit it to the Board.
6. After the establishment permit, register the company, pay the capital and open corporate accounts.
7. Put the technical architecture into operation: complete order, wallet, custody, security, logging, reporting, disaster recovery and MKK integration.
8. Establish custodian and bank relationships; test the agreement, reconciliation and asset transfer flows.
9. Complete internal systems and personnel: management, general manager, risk, internal control, audit, operations, information security and compliance.
10. Prepare customer documents: agreement, risk form, fee schedule, KVKK notices, complaint and account security processes.
11. Close the gaps found in the independent audit, proof of reserves, penetration test and business continuity tests.
12. Submit the operating permit application without missing the six-month period from the establishment permit; do not begin activity without obtaining the authorization certificate.

Document Checklist for the Establishment and Operating Permits

Founder and Shareholder Documents

• Identity/passport, residence and contact information.
• Criminal record and the required financial/reputation declarations.
• Résumé, education and experience documents.
• Financial strength, wealth, income and source of capital documents.
• For legal-entity shareholders, incorporation documents, financial statements and a group chart.
• For foreign documents, apostille/certification and sworn translation.
• Chart of direct/indirect shareholding and ultimate beneficial owners.

Corporate Documents

• Draft articles of association in SPK format.
• Business plan, budget, revenue model and three-year financial projection.
• Organizational chart, job descriptions and authority matrix.
• Operating principles of the board of directors and committees.
• Internal control, risk management, internal audit and conflict of interest policies.
• MASAK compliance program, risk policy and suspicious transaction processes.
• Outsourcing and supplier inventory.

Technical Documents

• System architecture, data flows, network and security diagrams.
• Wallet and key lifecycle, hot-cold wallet limits.
• Order, transaction, price surveillance and market integrity systems.
• Customer due diligence, travel rule and blockchain analytics integration.
• Logging, incident response, backup and disaster recovery plan.
• Custody, bank and MKK integrations and test results.
• Independent audit, proof of reserves, penetration test and vulnerability remediation records.

Common Mistakes

• Believing that merely forming a joint-stock company in the trade registry is sufficient for a crypto company.
• Continuing to use the old TRY 50,000,000 capital figure.
• Unnecessarily changing the shareholding structure as if there were an "at least three shareholders" requirement; overlooking that the correct rule is a minimum of three board members.
• Treating presence on the temporary list as an operating permit.
• Confusing the establishment permit with the operating permit, and accepting customers before the authorization certificate.
• Thinking that the technical infrastructure can be set up after the license file.
• Trying to resolve custody, MKK and bank integrations after the product launch.
• Believing that MASAK compliance is merely taking a photograph of the ID.
• Regarding a foreign group company’s serving Turkish users as outside the license.
• Using expressions such as "SPK-approved," "guaranteed," "risk-free" or deposit-like in advertising.
• Thinking that responsibility passes to the supplier when cloud, software or call center services are outsourced.
• Failing to segregate customer assets, company assets and the liquidity provider account systemically.
• Not including tax and regulatory contribution costs in the business plan.

Conclusion

Crypto-asset service provision in Türkiye is no longer a simple joint-stock company formation under general company law. The 2024 amendment of the Law, the two basic SPK Communiqués of 13 March 2025, MASAK’s enhanced measures and the capital thresholds updated in 2026 have tied entry into the sector to a regime of two-stage permits, high capital, strong governance, independent audit, secure custody and continuous compliance.

A successful license project is possible not by the legal team’s filling in the application form, but by the product, technology, finance, custody, cybersecurity, MASAK, tax and corporate governance teams working on the same business model. The most critical decision is made before the company is formed: which service will be offered, who will have access to customer assets, where will revenue be earned, and in which legal entity will the regulatory responsibility be carried?

Because the legislation and monetary thresholds change quickly, the application file should not be submitted without a final check against the current SPK forms, bulletins and MASAK guides. This article provides general legal information; the license scope and application strategy for a specific business model should be determined after seeing the technical architecture and shareholding documents.

Frequently Asked Questions

Is it enough merely to form a joint-stock company to set up a crypto company?

No. Although forming a joint-stock company is required, it does not by itself confer the right to operate. An establishment permit, then an operating permit and an authorization certificate, must be obtained from the SPK.

What is the minimum capital for a crypto platform in 2026?

TRY 250,000,000 for platforms. The whole of the capital must be paid in cash; equity must not fall below this amount. The amount needs to be rechecked on the date of application.

What is the minimum capital for a crypto custodian?

TRY 630,000,000 for 2026. As the custodied customer assets increase, an additional equity requirement may also arise.

Must a company have at least three shareholders?

No. The number in the legislation relates to the board of directors: the board of directors consists of at least three members. The number of shareholders is a separate company law matter.

Can activity begin immediately after an establishment permit is obtained?

No. The establishment permit allows the company to be formed. For customer acceptance and service, an operating permit and an authorization certificate must be obtained.

Within what period must an application for the operating permit be made?

It must be made within six months following the establishment permit. If the SPK deems it necessary, it may extend the period, provided that the total does not exceed one year.

Does being on the SPK’s temporary list mean having a license?

No. The SPK expressly states that being on the List of Those Operating does not mean authorization.

Can a foreign person be a shareholder in a crypto platform?

There is no categorical nationality prohibition. However, the shareholding chain, ultimate beneficial owner, financial strength, criminal record and foreign documents are examined in detail.

Can a board member be a foreigner?

Yes, provided that he or she has the qualifications in the legislation and submits the required documents. The general manager, however, must be resident in Türkiye and work full time.

How much of customers’ crypto-assets must be held at the custodian?

At least 95 percent of customer assets not held in their own wallets are held at an authorized custodian. The platform wallet ratios are separately restricted.

Can a crypto platform offer leveraged transactions?

No. Listed crypto-assets cannot be made the subject of leveraged, credit, derivative, short selling or lending transactions.

Can a crypto platform provide investment advisory?

If the conditions are met, yes. In 2026, the current value of the customer’s crypto-assets at the relevant platform must be at least TRY 60,000,000; qualified personnel and a research unit must exist.

Can a platform manage a customer’s portfolio?

No. Managing a customer’s portfolio by proxy or on verbal authority is prohibited.

Can remote identification be carried out?

Yes; but the liveness, identity verification, video communication, risk assessment and record conditions in the SPK and MASAK regulations must be complied with.

Is there a waiting period on the first crypto withdrawal?

For transfers to certain external wallets or non-compliant foreign institutions, a waiting period of at least 72 hours applies to the first withdrawal and at least 48 hours to subsequent transactions.

What is the stable crypto-asset withdrawal limit?

As a rule, the equivalent of USD 3,000 per day and USD 50,000 per month. In transfers to which the travel rule applies, it may be applied at double.

Is a description mandatory on a crypto transfer?

Yes. The platform must obtain a description of at least 20 characters on the nature of the transaction for all transfers.

Can payments be made with crypto-assets?

The TCMB regulation prohibits direct or indirect crypto payment and the payment services directed at it.

Does an operating permit place customer assets under State guarantee?

No. An SPK permit is not a public guarantee; crypto-assets are not covered by the investor compensation system or deposit insurance.

If a foreign platform opens a Turkish-language site, is a Turkish license required?

A Turkish-language site, an office in Türkiye or direct/indirect marketing directed at Türkiye may cause the activity to be regarded as directed at Türkiye and creates a risk of unauthorized activity.

Does offering wallet software as a technology company require a license?

Providing only software without controlling the customer’s private key may be assessed differently. However, where there is key management, transfer or control over customer assets, a custody/platform permit comes into play.

What is the penalty for unauthorized crypto service provision?

The Law provides imprisonment of three to five years and a judicial fine of five thousand to ten thousand days; access and activity measures may also be applied.

Does the platform have an annual payment obligation to the SPK and TÜBİTAK?

Yes. 1 percent of all income for the previous year, excluding interest income, is paid to the SPK and 1 percent to TÜBİTAK by the end of May.

Can a lawsuit be filed if the application is rejected?

Depending on the nature of the act, an annulment action may be filed before the administrative courts and, under the necessary conditions, a stay of execution requested. A lawsuit does not automatically stop the act.

What is the most important work before the application?

An analysis of the business model and license scope. Setting up the company and technical infrastructure before the product, custody, customer fund flow, foreign group relationship and revenue model are clear can lead to costly mistakes.

Sources

1. Capital Markets Law No. 6362 - current text Source

2. Communiqué on the Establishment and Operating Principles of Crypto-Asset Service Providers (III-35/B.1) Source

3. Communiqué on the Working Procedures and Principles of Crypto-Asset Service Providers and on Capital Adequacy (III-35/B.2) Source

4. SPK Bulletin No. 2025/68 - revalued amounts for 2026 Source

5. SPK - Application Processes for Crypto-Asset Service Providers Source

6. MASAK - Compliance Guide to Obligations for Crypto-Asset Service Providers Source

7. SPK - Communiqué on Remote Identification and Electronic Contracts (III-42.1) Source

8. TCMB - Regulation on the Non-Use of Crypto-Assets in Payments Source

9. Court of Cassation 3rd Civil Chamber, E. 2025/5307, K. 2026/2209, dated 15.04.2026 Source

10. SPK Bulletin No. 2026/51 - criminal complaints concerning unauthorized KVHS activities Source

11. SPK - List of Those Operating (Temporary List) Source

12. Güneş & Güneş Law Office - updated earlier article Source