Crypto Regulation in Turkey: The CMB’s New Structure and What It Means for CASPs

Crypto regulation in Turkey has moved from a grey area to a licensing regime supervised by the Capital Markets Board of Türkiye (CMB, known locally as SPK) in less than two years. For international exchanges, custody providers and Web3 companies looking at one of the largest retail crypto markets in the region, the key questions are no longer whether rules exist, but who enforces them, how supervision is organised and what a foreign platform may and may not do without a licence.

This article summarises the legal framework for crypto regulation in Turkey, explains the CMB’s new organisational structure introduced in November 2025 and sets out what these developments mean for crypto asset service providers. A Turkish-language analysis of the CMB’s restructuring, SPK’nın Yeni Teşkilat Yapısı ve Yeni SPK Kripto Varlık Düzenlemeleri, is also available.

The Legal Framework for Crypto Regulation in Turkey

The cornerstone is Law No. 7518, which amended Capital Markets Law No. 6362. The law was adopted by the Turkish Grand National Assembly on 26 June 2024 and created the first statutory framework for crypto assets in Turkey. It introduced the concept of a crypto asset service provider (CASP), a term that covers trading platforms and custody institutions, and placed them under CMB authorisation and supervision through Articles 35/B and 35/C of the Capital Markets Law.

Crypto regulation in Turkey then developed through secondary legislation in stages. The CMB issued communiqués on the establishment and operating principles of CASPs, their capital adequacy and their working procedures, covering requirements for founders, shareholders and managers, internal audit, internal control and risk management, the custody and transfer of crypto assets, and listing procedures. Listed crypto assets may not be traded on platforms with leverage, used for derivative contracts or subjected to short selling or lending transactions.

The transition period is still running. In March 2026, the CMB extended both the deadline for platforms to sign agreements with custody institutions and complete their technical integration, and the deadline for CASPs to obtain their operating licences. According to the CMB bulletin, the final timeline will be set once licensed custody institutions start providing services to platforms on a wide scale.

When Is a Foreign Platform Operating Without a Licence?

Under crypto regulation in Turkey, this is the question that matters most for international businesses. Under the amended Capital Markets Law, a foreign platform that has not obtained a licence is treated as providing unauthorised crypto asset services in Turkey if it opens a place of business in Turkey, creates a Turkish-language website, or engages in promotion and marketing of its crypto asset services directly or through persons or entities resident in Turkey. Any one of these activities is sufficient.

The consequence is serious. Unauthorised CASP activity is subject to criminal sanctions under the Capital Markets Law and to access blocking measures. Foreign platforms with Turkish users should review their website localisation, marketing partnerships, influencer campaigns and local affiliates against this test before taking any step in the market.

The CMB’s New Organisational Structure

On 19 November 2025, the CMB’s new Organisation Regulation was published in the Official Gazette No. 33082. It repealed the 1982 organisation regulation, updated the Board’s service units and created a more technical, specialised structure for supervising the crypto asset ecosystem. The Regulation does not impose new obligations on CASPs directly, but it shows clearly how crypto regulation in Turkey will be enforced from now on.

A Single Home for Crypto: The Financial Technologies Department

The newly established Financial Technologies Department has become the centre of the CMB’s regulatory and supervisory work on crypto assets. It handles applications for the issuance and sale of crypto assets based on distributed ledger technology, runs all processes relating to the tokenisation of capital market instruments, carries out licensing, authorisation and supervision of CASPs under Articles 35/B and 35/C, and monitors transactions that could affect market security and stability. For CASPs, this department is now the main counterpart at the CMB.

Tighter Enforcement Against Unlicensed Activity

The Supervision Department has retained its role, but its powers in the crypto sector are now clearly defined. It detects and investigates unauthorised crypto asset service provision, examines embezzlement and irregularities at CASPs, and continues to audit financial records and reports. Unlicensed platforms targeting Turkish users should expect crypto regulation in Turkey to be enforced more intensively.

Information Systems and Cybersecurity as a Priority

The new Information Systems Department is responsible for regulating and auditing the technical infrastructure of CASPs. It prepares rules on information systems management and technical compliance, conducts remote and on-site IT audits, reviews independent information systems audit reports and tracks remediation of findings, and coordinates with national authorities on cybersecurity threats. CASPs should expect more systematic audits of logging, access management, backups and penetration testing.

Financial Reporting and Independent Audit

The new Independent Audit and Valuation Activities Department oversees the financial reporting of CASPs, checks compliance of financial statements with Turkish Accounting and Financial Reporting Standards, handles the authorisation and quality control of audit firms and monitors CASPs’ financial disclosure obligations.

Remote Onboarding for Crypto Platforms

Two further changes in 2026 affect how licensed platforms acquire customers. In February 2026, the CMB extended its communiqué on remote identification to crypto asset service providers. In September 2026, a further amendment allowed foreign nationals to be onboarded remotely using NFC-enabled passports, subject to a closed SWIFT loop for funds and quarterly reporting to MASAK. We explain these rules in detail in our article on remote onboarding in Turkey.

What Crypto Regulation in Turkey Means for CASPs

The direction of crypto regulation in Turkey is clear. The CMB will supervise the crypto sector through specialised departments, with more detailed standards expected on licensing, cybersecurity, information systems, reporting and audit. Application formats, periodic reporting and compliance processes are likely to be refined further as the transition period ends.

For a foreign group, the practical sequence is to decide first whether it wants to serve Turkish users at all, since even a Turkish-language website triggers the licensing requirement. If it does, it should plan its licence application, local corporate structure, custody arrangements and IT infrastructure together, and treat cybersecurity and financial reporting as areas of direct CMB scrutiny from day one. Groups already active in other jurisdictions may find it useful to compare the Turkish approach with the UK crypto regulation 2026 framework.

Frequently Asked Questions

Who regulates crypto in Turkey?

The Capital Markets Board of Türkiye licenses and supervises crypto asset service providers under the Capital Markets Law as amended by Law No. 7518. Anti-money laundering obligations are overseen by MASAK.

Can a foreign exchange serve Turkish users without a licence?

Opening a place of business in Turkey, operating a Turkish-language website or marketing crypto services in Turkey directly or through local persons is treated as unauthorised activity. A licence is required for any of these.

How KYO Legal Can Help

KYO Legal advises crypto asset service providers, Web3 companies and fintech groups on CMB licensing, compliance with crypto regulation in Turkey and market entry. Learn more about our fintech law practice and our work in the crypto and electronic money sector, or contact us. The CMB’s regulations and bulletins are published on the CMB website.

This article is for general information only and does not constitute legal advice. Please seek specific advice for your situation.