Fintech, Crypto and Financial Licensing Law in Türkiye

Between 2024 and 2026 Türkiye moved financial technology out of the grey zone and into a permission-based regime. Crypto-asset services now sit inside capital markets legislation; payment and e-money activity requires authorisation from the Central Bank of the Republic of Türkiye (TCMB); leveraged transactions may be carried out only by intermediary institutions holding a licence from the Capital Markets Board (SPK) — the body referred to in English-language materials as the CMB. This page sets out the framework in force and the obligations an applicant will actually meet, with the instrument cited in each case.

For a foreign platform, one point governs everything else on this page: a licence issued anywhere other than Türkiye gives you no right to serve people resident in Türkiye. There is no recognition, no equivalence, no passport.

RoNa Legal's work in this field is preparing the application file, managing the process and representing the client before the competent authorities. A licence or permission is granted only by the administration. No law firm grants a licence and none can promise an outcome.

The Framework: Law No. 7518 and the SPK Regime

Law No. 7518, published in the Official Gazette of 2 July 2024, no. 32590, inserted definitions of crypto-asset, wallet, crypto-asset service provider and custody service into Capital Markets Law No. 6362 (CML), and created new Articles 35/A, 35/B, 35/C, 99/A and 109/A. Crypto-asset service providers (in Turkish, kripto varlık hizmet sağlayıcı, KVHS — the CASP of Turkish law) thereby fell within capital markets regulation and SPK supervision.

The secondary legislation consists of the SPK's Communiqués III-35/B.1 (establishment and operating principles) and III-35/B.2 (working procedures and capital adequacy), both published in the Official Gazette of 13 March 2025, no. 32840. They replaced the transitional i-SPK.35.B Principle Decision.

Supervision is not concentrated in one hand. The SPK is the primary regulator. On the anti-money-laundering side the competent body is MASAK, the Turkish financial intelligence unit. Where a bank is to act as custodian, the favourable opinion of the Banking Regulation and Supervision Agency (BDDK) is required. Information-systems and key-management criteria are set by TÜBİTAK, the national scientific and technological research council.

Crypto-Asset Service Providers (CASPs)

Types of authorisation

Capital and incorporation requirements (2026)

Minimum establishment capital was updated by SPK Bulletin 2025/68 of 31 December 2025, applying the 25.49% revaluation rate set for 2026 by General Communiqué No. 585 on the Tax Procedure Law (Official Gazette 27.11.2025, no. 33090):

• Trading platform: TRY 250,000,000 (base figure in the Communiqué: TRY 150,000,000)
• Custody institution: TRY 630,000,000 (base figure in the Communiqué: TRY 500,000,000)

The capital must be paid in full and in cash, and equity may not fall below that amount (Communiqué III-35/B.1, conditions of establishment). Revalued capital figures must be met by the end of the sixth month of the year in question at the latest (III-35/B.2, art. 34(3)).

Custody institutions carry a further, separate obligation (III-35/B.2, art. 35(4), as revalued for 2026): where total customer assets held in custody exceed TRY 1,250,000,000, additional equity of 1.5% of the excess is required; once equity reaches TRY 1,900,000,000, no additional equity is required.

Structural conditions: a joint-stock company; all shares registered in name and issued against cash; the articles of association must limit the corporate object exclusively to crypto-asset services; head office in Türkiye; a transparent shareholding structure in which the ultimate controlling shareholder can be identified; a board of at least three members, a majority of whom hold a four-year university degree; the favourable opinion of the SPK for the appointment of the general manager and deputy general manager.

Foreign ownership is permitted. What is not negotiable is the form: the company must be incorporated in Türkiye as a joint-stock company, its head office must be in Türkiye, and it must obtain SPK permission. A foreign shareholder is subject to the same integrity, financial standing and reputation conditions as a Turkish founder.

Technology, custody and TÜBİTAK criteria

The generation, management and backup of private keys must comply with the TÜBİTAK Infrastructure Criteria. Key shares and backups must be kept in Türkiye, and control must remain with the CASP — a point that defeats most off-the-shelf offshore custody architectures. Cold/hot wallet separation, use of a secure hardware module and multi-factor authentication are mandatory.

Customer assets are segregated from the CASP's own assets. They cannot be attached, pledged, or included in the bankruptcy estate. Customer crypto-assets may not be held by the platform itself; they must be kept with an authorised custody institution. That rule is also the source of the bottleneck described below.

The application process

The process has two stages: first the establishment permit, then the operating permit. The application for the operating permit must be made within six months of the establishment permit; the SPK may extend that period to a maximum of one year where it considers it necessary. The principal components of the file: business plan and financial projections, documents on founders and shareholders, information-systems infrastructure report, cyber-security audit certificate, MASAK compliance programme, the executed contract with a custody institution, draft customer framework agreements, and a proof-of-reserves audit report.

Establishment permit, operating permit and licence are distinct legal steps. Obtaining one does not produce the next automatically — a distinction that matters when reading press coverage of "the first crypto approvals in Türkiye".

Where the regime actually stands (July 2026)

The position on the ground differs from what the legislation alone suggests, and application planning has to account for that difference:

• By Bulletin 2026/34 (4 June 2026) the SPK granted the first crypto operating permits — but only to three banks, as crypto-asset custody institutions: Akbank T.A.Ş., Türkiye Garanti Bankası A.Ş. and Yapı ve Kredi Bankası A.Ş.
• No trading platform has received an operating permit. In the same bulletin the SPK looked favourably on applications by Fiba Yatırım Menkul Değerler A.Ş. and Fintag Yazılım Danışmanlık A.Ş. to found platforms — but that is an establishment permit only. No further crypto operating permit appears in the subsequent bulletins, up to and including 2026/44 of 8 July 2026.
• The 30 June 2026 deadline for CASPs on the List of Operating Entities to obtain their licence was postponed by SPK Decision no. 18/617 of 26 March 2026 (Bulletin 2026/18). No new fixed date has been set: the SPK decided that the period would be determined after authorised custody institutions begin providing custody services to platforms on a widespread basis.
• The SPK's "List of Operating Entities" (Faaliyette Bulunanlar Listesi, provisional list dated 30 June 2026) contains 56 entities, of which 9 are marked "(Saklama Başvurusu)" — custody applicants — and 47 are trading platforms. In the SPK's own words, appearing on the list "does not mean that the entities on this list are authorised under the relevant legislation." The list exists under provisional article 11 of the CML for the sole purpose of informing the public.

The risk of unauthorised activity — read this before you enter the market. For a platform established abroad, opening a place of business in Türkiye, running a Turkish-language website, or carrying out promotion and marketing directed at persons resident in Türkiye — whether directly or through an intermediary — constitutes unauthorised CASP activity within the meaning of CML art. 99/A. Article 109/A provides for imprisonment of three to five years and a judicial fine of five thousand to ten thousand days. This is a criminal provision, not an administrative one, and it attaches to the natural persons behind the platform. A Turkish-language landing page and an affiliate campaign are, on their own, enough to raise it.

MASAK / AML Compliance

The basis is Law No. 5549 on the Prevention of Laundering of Proceeds of Crime and its secondary legislation (the Measures Regulation, the Compliance Programme Regulation; MASAK General Communiqué No. 29, 28 June 2025). CASPs became obliged parties in 2021 and were moved by the amendment package of 25 December 2024 into the status of "financial institution" — the same weight of obligation as a bank.

The principal obligations:

• Appointment of a compliance officer and a deputy — registered with MASAK, full-time and independent.
• Compliance programme — institutional policy, risk management, monitoring and control, training, internal audit.
• Customer identification (KYC) — on the establishment of a permanent business relationship, regardless of amount. Remote identification is not available for privacy-focused crypto-assets.
• Travel Rule (Measures Regulation, art. 24/A) — for transfers of TRY 15,000 and above, information on the originator and the beneficiary must be obtained and its accuracy verified.
• Suspicious transaction reporting — through the EBAS system, within 10 business days at the latest of the suspicion arising (immediately where delay is prejudicial), regardless of amount.

The compliance programme has to be a functioning control system rather than a paper exercise; it is a core component of the operating-permit file submitted to the SPK. Processing customer data separately triggers obligations under Turkish data protection law and, for European customer books, the GDPR — see data protection.

Payment Institutions and Electronic Money Institutions

The basis is Law No. 6493 and the Regulation on Payment Services and Electronic Money Issuance and on Payment Service Providers of 1 December 2021. Since 1 January 2020 the competent authority has been the TCMB, the Central Bank.

Minimum capital under art. 14 of the Law:

These are the founding-capital figures set by Art. 14 of Law 6493. They are distinct from the minimum own-funds amounts, which the TCMB revalues each January and which must be checked against the current year's communiqué. The joint-stock form is mandatory; shareholders holding 10% or more must meet the qualifications required of a bank founder; shares are registered in name.

For the Turkish-lira leg of a crypto platform, either integration with a licensed payment or e-money institution, or a separate licence, is required. The TCMB Regulation of 16 April 2021 prohibits the use of crypto-assets in payments; the prohibition targets their use as a means of payment, not the buying and selling of crypto-assets.

Leveraged Transactions (Forex)

Leveraged transactions fall under Law No. 6362 and Communiqué III-37.1; the competent authority is the SPK. Article 27 of the Communiqué, as amended by Communiqué III-37.1.b published in the Official Gazette of 10 February 2017, no. 29975:

• Maximum leverage of 10:1 — not to be exceeded at the moment the position is first opened (art. 27(1)).
• Minimum initial margin of TRY 50,000, or the equivalent in foreign currency (art. 27(3)).

Both limits stand unchanged in the text in force as at 14 July 2026 and have not been subject to revaluation. In addition: a real-time demo account must be offered; losses exceeding the margin cannot be claimed from a retail customer; customer-level custody is held at Takasbank; and advertising that is misleading or promises high returns is prohibited.

Foreign licences have no validity in Türkiye. A Vanuatu, Saint Vincent, FCA or CySEC licence confers no right to provide leveraged-transaction services to persons resident in Türkiye. Having such persons trade over the internet or by telephone without SPK permission is unauthorised capital markets activity, and access to the site is blocked under Law No. 5651. Where orders are not in fact transmitted to the market, the conduct may amount to aggravated fraud. For investors who have suffered loss on platforms of this kind, criminal complaints, objections to MASAK freezing orders and restitution claims are handled within our criminal law and investigations practice.

Illegal Betting: Criminal Defence and Compliance

In Türkiye the power to organise betting and games of chance belongs exclusively to the State. Under Law No. 7258 it is vested in the Spor Toto Organisation (sports events) and the National Lottery Administration. It is legally impossible to grant a betting or gambling licence to a private person or company — and there is therefore no such thing as a "betting licence application" service in Türkiye. Any adviser offering one is describing something that does not exist. This subject can be addressed only in its criminal-law and compliance dimension.

The sanctions provided for under art. 5 of Law No. 7258:

Access blocking applies under Law No. 5651; security measures and confiscation of assets may be imposed on legal persons.

The services that may lawfully be offered here are limited and defensive in nature: representation of suspects and defendants (including allegations of acting as a money conduit); objection to MASAK freezing and account-blocking decisions; objection to access-blocking orders; and timely objection before the Criminal Judgeship of Peace to an administrative fine imposed for placing a bet.

Cross-Border Structuring: The Türkiye–Montenegro Axis

The Turkish capital thresholds — TRY 250,000,000 for a platform, TRY 630,000,000 for a custody institution — are decisive for many ventures. The jurisdiction in which the group is established is therefore a structural decision as much as a legal one.

In Montenegro, crypto-asset service providers are regulated not under a standalone digital assets law but by registration with the Capital Market Authority (Komisija za tržište kapitala) under Articles 40a and 40b of the Law on the Prevention of Money Laundering and Terrorist Financing (ZSPNFT). A state fee of EUR 5,000 is payable on submission of the application for entry in the register (Commission fee schedule, art. 14). The crypto rulebook sets no decision period for the Commission; absent a lex specialis term, the general rules of administrative procedure apply. As at July 2026, no standalone digital assets law has been adopted in Montenegro.

Two things must be clearly understood here. First, Montenegro is not a member of the European Union; a Montenegrin registration confers no right to serve clients within the EU — no passport — under MiCA (Regulation (EU) 2023/1114). Second, the MiCA transitional regime ended on 1 July 2026. Since that date, providing crypto-asset services to clients established in the EU without a MiCA authorisation is a breach of EU law, and MiCA provides for substantial administrative penalties. Any structure targeting the EU market must be designed from that starting point, not around it.

For the Montenegrin regime in detail, see Montenegro fintech, crypto and licensing; for incorporation, shareholding structure and the tax dimension, see Montenegro company formation.

How We Work

RoNa Legal practises in Türkiye through lawyers admitted to the Kocaeli Bar, and in Montenegro through RoNa Legal DOO (Budva). In fintech matters we undertake: regulatory analysis and a structuring opinion; preparation of the SPK establishment- and operating-permit application file; establishment of the MASAK compliance programme; preparation of the TCMB payment / e-money licence application; contractual and corporate governance documentation; annulment proceedings against administrative sanctions and refusal decisions; and defence in criminal investigations, including objections to MASAK freezing orders.

Permission or a licence is granted only at the discretion of the competent administration. What we do is prepare the application file, manage the process and represent the client before the authorities.

To have the legal position of your file assessed, use the form on our contact page or write to us.

This page is for general information and does not constitute legal advice; a lawyer–client relationship arises only under a written power of attorney or engagement letter.