Turkey Crypto License: CMB/SPK Authorisation Under Law No. 7518

A Turkey crypto license is CMB/SPK authorisation for a crypto-asset service provider (CASP) under Law No. 7518. Any exchange, custody provider, or platform operating in or into Türkiye must obtain Capital Markets Board permission before it is established and before it begins operating, with minimum capital and MASAK anti-money-laundering duties applying in parallel.

For founders, exchange operators, and compliance officers weighing Türkiye as a base, the question is no longer whether crypto is regulated, but how to obtain the licence and what it requires. This guide sets out the regulator, the governing statute, the CASP categories, the minimum capital floors, the two-stage permit process, the MASAK AML layer, custody rules, and the penalties for operating without authorisation. As a Zug-based advisory, we treat Türkiye as one node in a wider map you can compare crypto licence jurisdictions against before committing.

Turkey's Crypto Licensing Regime at a Glance

Türkiye now runs a full statutory licensing regime for crypto-asset service providers. The foundation is Law No. 7518, which amends Capital Markets Law No. 6362 and places all CASPs under the authority of the Capital Markets Board of Türkiye (CMB / Sermaye Piyasası Kurulu, SPK). Law 7518 was published in the Official Gazette No. 32590 on 2 July 2024 and took effect on publication. Three CMB communiqués issued in 2025 then filled in the operating detail, including the minimum capital figures.

Who needs a crypto license in Türkiye

Any crypto-asset service provider, whether an exchange (trading platform), a custody provider, or another platform offering crypto services, operating in or into Türkiye must be authorised by the CMB before it is established and before it begins operating. The board determines which activities a CASP may perform, and only those approved activities are permitted, according to analysis of the statute. There is no informal or registration-only route: the permission requirement is structural, built into the amended Capital Markets Law.

The framing: 2024 statute, 2025 rules, in force today

Although the page slug carries "2026", the Turkish regime is not a future or speculative reform. The primary statute, Law No. 7518, was enacted by the Grand National Assembly on 26 June 2024 and published on 2 July 2024. The three implementing communiqués followed in the Official Gazette No. 32840 on 13 March 2025. The framework is therefore fully in force today, with transition milestones running through mid-2026. Read it as the current Turkish crypto licensing regime rather than as something new in 2026.

Who Regulates Crypto in Turkey: CMB/SPK, MASAK and the Supporting Bodies

Turkish crypto oversight is shared across several institutions, but two carry the weight. The Capital Markets Board licenses and supervises CASPs, and MASAK supervises anti-money-laundering compliance. A cluster of supporting bodies, TÜBİTAK, the BRSA, and the MKK, handle the technical, banking, and custody backbone. The Central Bank (CBRT) sits behind the regime through its earlier 2021 payments rule.

Capital Markets Board (CMB / SPK): the licensing authority

The Capital Markets Board of Türkiye (Sermaye Piyasası Kurulu, SPK) is the licensing authority. A CASP must obtain CMB permission both to be established and to begin operating, and only CMB-determined activities are permitted. The board also sets the establishment and operating principles, capital adequacy rules, and information-systems standards through its communiqués. Authorisation can be conditioned on compliance with TÜBİTAK criteria for information systems and technological infrastructure.

MASAK: the AML supervisor

MASAK (the Financial Crimes Investigation Board, Mali Suçları Araştırma Kurulu) is the anti-money-laundering supervisor. Crypto-asset service providers are classified as "obliged parties" under AML Law No. 5549, which means they must run customer due diligence, monitor transactions, file suspicious-transaction reports, and observe the Travel Rule. MASAK authorisation and compliance run in parallel to the CMB licence, not instead of it, so a CASP must satisfy both supervisors.

TÜBİTAK, BRSA and MKK: the technical and custody backbone

Three further bodies underpin the regime. TÜBİTAK sets the information-systems and technology-infrastructure criteria that CMB authorisation can be conditioned upon. The BRSA (banking regulator) licenses the banks that are eligible to hold customer crypto in custody. The MKK (Central Securities Depository of Türkiye) provides the system integration for customer assets. Together they shape the safeguarding architecture a licensed CASP must plug into.

Law No. 7518 and the 2025 Secondary Regulations

The legal spine of the Turkish regime is precise and citable. Law No. 7518 created the primary authority; three 2025 communiqués gave it operating substance; and a 2021 Central Bank regulation supplies the background.

What Law 7518 changed in the Capital Markets Law

Law No. 7518 on Amending the Capital Markets Law was enacted on 26 June 2024 and published in the Official Gazette No. 32590 on 2 July 2024, effective on publication. It amends Capital Markets Law No. 6362 (the CML) and adds new statutory definitions: crypto asset, wallet, crypto asset service provider, crypto asset custody service, platform, and TÜBİTAK. A crypto asset is defined as an intangible asset created and stored electronically using distributed-ledger or similar technology. Most importantly, the law brings CASPs under the rulemaking, authorisation, and supervisory authority of the CMB.

The three CMB communiqués (III-35/B.1, III-35/B.2, VII-128.10)

The operating detail arrived in three CMB communiqués published in the Official Gazette No. 32840 on 13 March 2025:

• Communiqué No. III-35/B.1 sets the establishment and operating principles of CASPs.
• Communiqué No. III-35/B.2 sets operating procedures and capital adequacy, including the minimum capital floors.
• Communiqué No. VII-128.10 governs the management of information systems.

Communiqué III-35/B.2 is the one that carries the headline capital figures discussed in the next section.

Background: the 2021 CBRT payments ban

The regime did not start from a blank page. In 2021 the Central Bank of Türkiye (CBRT) issued the Regulation on the Prohibition of the Use of Crypto Assets in Payments, dated 16 April 2021, No. 31456. That rule barred crypto from being used for payments and provided the first official Turkish definition of crypto assets, predating the 2024 licensing framework. It remains the context against which the later CASP licensing regime was built.

CASP Categories and Minimum Capital Requirements

The capital floors are the single most decision-critical figures for anyone planning a Turkish entity. Communiqué III-35/B.2 sets two licensed CASP categories, trading platforms and custody providers, each with its own minimum initial share capital.

Crypto-asset trading platforms (exchanges)

A crypto-asset trading platform, the exchange category, needs minimum initial share capital of TRY 150,000,000 (approximately USD 4.1 million) under Communiqué III-35/B.2. This is the category that most founders mean when they ask about a Turkey crypto exchange license, and it is the route to consider alongside the wider mechanics of launching a licensed crypto exchange in any jurisdiction.

Crypto-asset custody providers

A crypto-asset custody provider needs minimum initial share capital of TRY 500,000,000 (approximately USD 13.7 million), also under Communiqué III-35/B.2. The custody floor sits well above the exchange floor, reflecting the safeguarding role a custodian plays for customer assets and the segregation and integration duties that come with it.

The superseded TRY 50 million figure (historical note)

You may still find older commentary citing a TRY 50 million platform floor, with some references to 100 million. That figure came from an earlier CMB principle decision and is superseded. The final secondary regulation, Communiqué III-35/B.2, sets the platform floor at TRY 150 million and the custody floor at TRY 500 million. Treat the TRY 50 million figure as historical context only, not as the current requirement.

The Two-Stage CMB Licensing Process

Licensing in Türkiye is a two-stage process under the CMB, with a strict window between the stages and separate transition deadlines for operators that were already active when the rules came in.

Stage 1: establishment permit (kuruluş izni)

The first stage is the establishment permit (kuruluş izni), the initial CMB approval a CASP must secure before it can operate. At this stage the board reviews the proposed entity, its governance, and its readiness to meet the operating principles in Communiqué III-35/B.1.

Stage 2: operating license (faaliyet izni) within 6 months

The second stage is the operating license (faaliyet izni). A firm must apply for it within six months of the establishment permit; failing to apply within that period forfeits the right to apply. The six-month window is a hard procedural gate, so an applicant should plan the operating-license submission from the moment the establishment permit is granted.

Application documentation

CMB authorisation rests on a substantial document set. Applicants should expect to provide corporate governance structures, information security protocols, business continuity plans, and financial statements, alongside evidence of meeting the capital floors and the TÜBİTAK information-systems criteria. The depth of this documentation is where most of the preparation effort goes.

Transition deadlines for existing operators

Operators already active when the rules arrived face their own transition milestones:

• 30 June 2025 was the operating-license application deadline for existing platforms and the custody-infrastructure alignment deadline.
• 31 December 2025 was the deadline for renewing pre-existing customer framework agreements in compliance with Communiqué III-35/B.1.
• 30 June 2026 is the operating-license completion deadline.

We do not quote an end-to-end approval timeline here, because no official primary-source figure exists. Older advisory claims of a "1 to 4 month" process are unsourced marketing, not a regulatory commitment, so treat any timeline estimate as indicative only.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

AML, KYC and the MASAK Travel Rule

The CMB licence is only half the picture. In parallel, a Turkish CASP is an obliged party under the AML regime and must satisfy MASAK. These duties mirror the global standard and connect Türkiye to the wider framework of crypto Travel Rule compliance.

MASAK obliged-party duties under Law 5549

As obliged parties under AML Law No. 5549, Turkish CASPs must run customer due diligence (CDD), monitor transactions on an ongoing basis, identify beneficial owners, file suspicious-transaction reports within 72 hours, and operate internal control mechanisms. These are the same building blocks that appear in any robust set of AML and KYC requirements, adapted to the Turkish supervisor.

Travel Rule threshold and withdrawal delays

MASAK's Travel Rule became operational on 25 February 2025. Under it, transfers of TRY 15,000 or more require verified sender details. MASAK General Circular No. 29, published in the Official Gazette No. 32940 on 28 June 2025, added withdrawal-delay rules: a first withdrawal is delayed by at least 72 hours, and subsequent transactions by at least 48 hours. These delays are designed to give compliance teams time to screen unusual activity.

Custody, Asset Segregation and Customer Protection

Türkiye places strong emphasis on safeguarding customer assets, and the rules here are among the most distinctive features of the regime.

Where customer crypto assets must be held

Customer crypto assets must be segregated from the provider's own balance sheet. Custody is restricted to Turkish banks authorised by the BRSA or to specialised institutions licensed by the CMB. A CASP therefore cannot simply self-custody customer holdings on its own infrastructure; it must route them through an approved custody channel, which materially shapes its operating model.

MKK system integration

Beyond segregation, customer-asset systems must integrate with the Central Securities Depository of Türkiye (MKK). This integration brings crypto customer-asset record-keeping into the same infrastructure that supports Turkish securities markets, reinforcing transparency and customer protection. Planning for MKK integration early avoids costly architecture changes later in the application.

Penalties for Operating Without a CMB License

The penalties are the clearest reason to license before launching. Operating as a crypto-asset service provider without CMB authorisation is a criminal offence in Türkiye, carrying imprisonment of three to five years plus a judicial fine. Additional embezzlement offences can apply to managers where customer assets are misused, according to analysis of the statute. The exact Capital Markets Law article should be pinned with counsel, since sources reference the penalty provisions slightly differently, but the headline exposure is unambiguous: this is a regime where unlicensed operation carries personal criminal liability, not just an administrative fine.

Can Foreign Crypto Companies License in Turkey

Foreign-owned businesses can serve the Turkish market, but only through the same gate as everyone else: CMB authorisation. A foreign group cannot bypass the licence by operating from offshore into Türkiye, because the permission requirement attaches to serving the Turkish market. The detail of whether a Turkish-incorporated entity is mandatory, and the precise local-establishment and entity-structure rules, is not fully settled in the public sources we reviewed, so it should be confirmed with Turkish counsel before applying. Many groups find it useful to weigh Türkiye against lighter-touch regimes, such as India's FIU registration, Dubai VARA licensing, or El Salvador's Bitcoin regime, before deciding where to base.

How Crypto Valley Partners Helps You License in Turkey

Türkiye is a high-bar regime: substantial capital, a strict two-stage permit, a deep document set, parallel MASAK AML obligations, and criminal exposure for getting it wrong. From our practice advising founders and operators across jurisdictions, the projects that go smoothly are the ones that map the establishment-permit and operating-license requirements before incorporating, build the AML and custody architecture into the design from day one, and plan the six-month operating-license window as a single continuous process rather than two separate filings.

Crypto Valley Partners AG, based in Zug, helps you assess whether Türkiye is the right fit against other markets, structure the entity, assemble the CMB application, and align the MASAK compliance program in parallel. We do not publish fixed prices, because scope depends on your activity category and starting point; we scope each engagement to the actual requirements. You can also start by mapping Türkiye against alternatives on Crypto-License.io and our wider jurisdiction comparison resources.

Have questions about your specific situation? Book a free 15-minute discovery call with our licensed advisers, no commitment. Book a Call

By Magnus Müller · Reviewed by Magnus Müller · Last updated: 2026-06-14