Crypto Service Provider Licensing in Turkey: CMB Guide

Turkey brought crypto-asset service providers under formal financial regulation in 2024, amending the Capital Markets Law (Sermaye Piyasası Kanunu) to require that any entity offering crypto-related services to Turkish customers hold a licence from the Capital Markets Board (Sermaye Piyasası Kurulu, or SPK). This shift matters for fintech founders, foreign investors, and anyone running or considering a crypto business with a Turkish user base.

What Counts as a Crypto-Asset Service Provider?

The regulation introduces the concept of a kripto varlık hizmet sağlayıcısı (KVHS) — a business that, as part of its regular activities, enables customers to buy, sell, exchange, transfer, or hold crypto-assets, or operates a trading platform for such assets. The term "crypto-asset" is defined broadly in the law, covering not only established cryptocurrencies but also other digital tokens that meet the statutory criteria. Exchanges, custody wallets, brokerage apps, and similar platforms operating in Turkey all fall within the scope.

The single most important procedural point: only an SPK-licensed entity may provide these services. There is no exempt category for "small" operators or for platforms that claim to be based abroad while actively serving Turkish users.

The Licensing Requirement and Who Must Apply

Every KVHS must be licensed by SPK before operating. To obtain a licence, applicants must demonstrate a minimum paid-in capital set by SPK regulation, a Turkish registered legal entity, proven technical infrastructure that meets SPK's security and auditability standards, an internal compliance programme, and founders and senior managers who pass fit-and-proper assessments.

Foreign platforms that do not have a Turkish subsidiary but that actively target Turkish residents — through Turkish-language interfaces, local payment methods, or marketing directed at Turkey — are expected to seek SPK authorisation. Operating across borders without meeting this obligation has the same legal consequences as domestic unlicensed operation.

Platforms that were already active when the 2024 rules entered into force were granted a transition period to regularise their status. That window is substantially closed, meaning any unlicensed platform still accepting Turkish customers is now directly exposed to enforcement action.

Obligations That Come With a Licence

A VASP licence does not only permit operation — it creates a continuing set of compliance duties. Three stand out in practice.

Customer asset segregation. A licensed KVHS must hold customer crypto-assets entirely separately from its own corporate holdings. This rule is designed to prevent a scenario where an insolvent platform uses client crypto to cover its own liabilities. Failure to maintain segregation is a serious breach that can lead to immediate licence revocation.

AML and MASAK registration. Every licensed KVHS must register with MASAK (the Financial Crimes Investigation Board) and implement a full anti-money laundering and counter-terrorism-financing programme. This means robust customer due diligence, ongoing transaction monitoring, and prompt suspicious transaction reporting. Our guide on MASAK compliance obligations for foreign clients covers the AML framework in detail.

The FATF Travel Rule. When a KVHS transfers crypto-assets on behalf of a customer, it must transmit originator and beneficiary information alongside the transfer — mirroring what banks do for wire transfers. This has significant IT and operational implications, particularly for platforms that previously had no reason to collect beneficiary data.

On the data protection side, KVKK (the Personal Data Protection Law) applies in full to any data about Turkish customers. Read our KVKK compliance guide for background on data processor obligations. The broader picture of how crypto regulation fits Turkey's digital-economy framework is explored in our article on the Turkish AI and technology law framework.

Consequences of Operating Without a Licence

SPK has authority to order unlicensed platforms to immediately cease operations in Turkey, and to request that telecommunications and hosting providers block access to their websites from within Turkey. Administrative fines under the Capital Markets Law are proportionate to the nature and scale of the violation.

Beyond administrative action, the Capital Markets Law includes criminal provisions that apply when a person or entity knowingly provides regulated capital-markets services without a licence. These provisions can reach individuals — not just legal entities — so founders and executives of unlicensed VASPs face personal criminal exposure. This is not a theoretical risk for Antalya-based businesses or foreign entrepreneurs with Turkish user bases.

Frequently Asked Questions

Q: Can a foreign company serve Turkish crypto customers without a local entity?

No. Foreign platforms that actively market to Turkish users are considered to be providing services in Turkey. SPK expects such entities to establish a Turkish legal entity and obtain a licence before operating.

Q: Are stablecoins regulated the same way as Bitcoin or Ethereum?

The law defines crypto-assets broadly. Whether a specific token is covered depends on its characteristics. Stablecoins generally fall within the definition, but each product should be reviewed individually before launch.

Q: What happens to customer funds if a KVHS loses its licence?

The mandatory segregation requirement means customer assets should be traceable and separable from company assets. Enforcement proceedings and recovery in practice can be complex — another reason why choosing a licensed, compliant platform matters.

Q: How long does the SPK licensing process take?

There is no fixed statutory deadline for SPK to decide on an application. In practice, the process is documentation-intensive and typically takes several months. Starting the process before commencing operations is essential.

How Mona Hukuk Can Help

Our Antalya office advises fintech founders, crypto businesses, and foreign investors on Turkish capital-markets and technology law. We guide clients through SPK licensing applications, design MASAK-compliant AML programmes, and represent businesses facing regulatory scrutiny. Whether you are entering the Turkish market for the first time or reviewing the compliance posture of an existing platform, we can help you assess your obligations accurately.

Contact us at contact@monahukuk.com or call +90 (242) 606 14 32 to schedule a consultation in Antalya.