Crypto Assets in Turkey after Law No. 7518: Crypto-Asset Service Providers, Custody, Market Abuse and Communiqués III-35/B.1 and III-35/B.2

Since 2 July 2024, crypto assets in Turkey have been regulated under the Capital Markets Law. Law No. 7518 added a licensing regime for crypto asset service providers (Art. 35/B), rules on client contracts, listing, market integrity and custody (Art. 35/C), SPK supervisory powers (Arts. 99/A–99/B) and new criminal offences (Arts. 109/A, 110/A and 115/A). SPK’s Communiqués III-35/B.1 and III-35/B.2, published on 13 March 2025, set the detailed rules. The regime differs from securities regulation in important ways. Crypto assets are not covered by the Investor Compensation Center (Art. 35/C(4)). Client cash and crypto assets held at banks are not covered by deposit insurance (Art. 35/C(6)). Market disruption on platforms is handled under the administrative rule in Art. 104, not the criminal manipulation and insider dealing offences, and crypto assets widely traded and priced abroad are excluded (Art. 35/C(3)). On the other hand, client assets are segregated and protected from the provider’s creditors (Art. 35/C(7)). At least 95% of client crypto assets not held in clients’ own wallets must be kept with an authorised custodian (Communiqué III-35/B.2 Art. 41). Embezzlement at a provider carries prison terms of up to 22 years (Art. 110/A). Capital market instruments may also be issued as crypto assets (Art. 13(1)). This guide explains the framework for foreign institutional investors. It reflects the legislation in force as at 26 October 2026.

Why the 2024 reform matters to institutional investors

Before 2024, crypto platforms in Turkey operated without a dedicated licensing regime. Law No. 7518 (26 June 2024, in force from 2 July 2024) brought them within the Capital Markets Law and under SPK supervision. For a foreign institution, the reform is relevant in three ways. First, it determines who may lawfully provide crypto services in Turkey and on what terms, including whether foreign platforms may serve Turkish residents. Second, it opens the possibility of issuing capital market instruments as crypto assets, which would change how holdings are recorded. Third, it creates a separate investor protection regime that is narrower in some respects than the regime for securities. That matters for any institution assessing exposure through Turkish counterparties, listed companies or funds.

This guide sets out the statutory rules and the main provisions of SPK’s communiqués. It does not assess any platform or crypto asset. The status of a particular provider should be checked against SPK’s published lists of licensed providers at the relevant date.

The legal framework

What the Capital Markets Law covers

Definitions. A crypto asset is an intangible asset that can be created and stored electronically using distributed ledger or similar technology, is distributed over digital networks and can represent value or rights (Art. 3(1)(bb)). A crypto asset service provider means a platform, a crypto asset custodian, or another institution designated by regulation to provide crypto-related services, including first sale or distribution (Art. 3(1)(cc)). A platform is an institution where one or more of the following are carried out: purchase and sale of crypto assets, first sale or distribution, exchange, transfer, and related custody (Art. 3(1)(dd)). A wallet is the software, hardware, system or application that allows crypto assets to be transferred and crypto assets or private and public keys to be stored online or offline (Art. 3(1)(aa)).

Which crypto assets are within the Law. SPK has regulatory, decision-making and enforcement powers over crypto assets that provide rights specific to capital market instruments (Art. 35/B(6)). For other crypto assets, it may set principles for their sale or distribution on platforms without applying the Law’s capital market instrument rules. The Law does not apply to crypto assets other than these two groups: those with capital-market-instrument rights, and those traded on platforms under the listing rules in Art. 35/C(2) (Art. 35/B(8)). Providers are subject to the other provisions of the Law only where these provisions are expressly referred to (Art. 35/B(5)).

Tokenised capital market instruments. SPK may set principles under which capital market instruments are issued as crypto assets and recorded in the electronic environment offered by the providers where they are created and stored, instead of being recorded at MKK. In that case, the records in that environment determine how rights are tracked, enforced against third parties and transferred. SPK may require integration between these records and the MKK system (Art. 13(1), sentences added by Law No. 7518). Our guide to MKK and book-entry securities explains the current system.

Other laws. The Law No. 1567 currency regime applies to all crypto transactions (Art. 35/B(9)). The Movable Pledge in Commercial Transactions Law No. 6750 does not apply to pledges over crypto assets (Art. 35/B(10)). The powers of other authorities under their own legislation are reserved (Art. 35/B(7)).

Licensing of crypto asset service providers

Licence required. A crypto asset service provider may be established and start operating only with SPK’s permission, and may carry out only the activities SPK determines. SPK’s permission is also required for transfers of shares in a provider. Transfers made in breach of the rules are not entered in the share register, and entries made in breach are void (Art. 35/B(1)). SPK’s permission depends on the provider meeting criteria set by TÜBİTAK for information systems and technological infrastructure (Art. 35/B(2)).

Fit and proper rules. Shareholders of a provider must meet conditions similar to those for other financial institutions. They must not be bankrupt or in concordat. They must not have holdings in certain failed financial institutions. They must not have convictions for listed offences, including fraud, embezzlement, money laundering and offences under the Capital Markets Law. They must not be subject to a trading ban, must have the necessary financial strength and integrity, and must have a transparent shareholding structure (Art. 35/B(3)(a)). The same conditions, except financial strength, apply to board members and authorised signatories. Controlling individuals and holders of 10% or more of capital or voting rights in corporate shareholders must also meet them (Art. 35/B(3)(b)–(ç)). A holder of 10% or more who loses these qualifications must transfer the shares within six months (Art. 35/B(3)(d)).

Corporate form and activities. Providers must be joint stock companies with registered shares issued for cash, with capital fully paid in cash and not less than the amount set by SPK. Their business must be limited to the licensed activities (Communiqué III-35/B.1 Art. 5(1)). These conditions do not apply to banks providing custody (Art. 5(2)). The activities that require a licence are order reception and execution, exchange and transfer with related custody, intermediation in first sale or distribution, custody of crypto assets or private keys, and investment advice on crypto assets (Communiqué III-35/B.2 Art. 5). Providers must apply for membership of the Turkish Capital Markets Association (Capital Markets Law Art. 74(1)).

Foreign platforms. Activities of a platform established abroad that are directed at persons resident in Turkey count as unauthorised provision of crypto services. Activities are deemed directed at Turkish residents if the foreign platform opens a place of business in Turkey, has a Turkish-language website, or promotes or markets its services directly or through Turkish persons or institutions (Art. 99/A(1)). Services that Turkish residents obtain abroad entirely on their own initiative, without any promotion or marketing directed at Turkey, are outside the Communiqué (Communiqué III-35/B.2 Art. 9(1)).

Custody and protection of client assets

Self-custody first. The Law starts from the principle that clients keep their crypto assets in their own wallets (Art. 35/C(6)). Where clients choose not to do so, custody must be provided by banks authorised by SPK and approved by the BDDK Board, or by other institutions SPK has authorised as crypto custodians. Clients’ cash must be held in banks (Art. 35/C(6)).

Custody limits. At least 95% of client crypto assets that clients do not keep in their own wallets must be held with a custodian. Up to 5% may be held in the platform’s own wallets (Communiqué III-35/B.2 Art. 41(1)). The ratios are calculated on the total current value, monitored continuously and restored at the daily reconciliation time. The share held in platform wallets may not exceed 10% at any point during the day, and any excess must be moved to the custodian immediately (Art. 41(2)). Platforms must also hold a liquid reserve equal to 3% of client assets held with them (Art. 41(3)). Custodians hold client crypto assets separately from their own, in the platform’s name and on an omnibus basis (Art. 26(1)). Their hot wallets should not exceed 5% of total client assets, or 10% where they execute transfer orders for all of a platform’s clients (Art. 26(6)–(7)).

Segregation and immunity. Client cash and crypto assets are separate from the provider’s assets, and records must be kept accordingly. Client assets held with a provider cannot be attached, pledged, included in a bankruptcy estate or made subject to an interim injunction because of the provider’s debts, even for public receivables. In the same way, the provider’s assets cannot be attached for the clients’ debts (Art. 35/C(7)).

Trading, listing and market integrity

Listing. Platforms must have a written listing procedure for the crypto assets they trade or distribute and for delisting them. SPK may set principles that include technical criteria (Art. 35/C(2)). A listing committee of at least three members, most of them experienced in finance, law, information technology, information security or distributed ledger technology and at least one of them a board member, decides on listings and delistings based on written assessment reports (Communiqué III-35/B.2 Art. 20). In principle, listed crypto assets must be capable of custody with an authorised custodian. They must also not be subject to restrictions by the relevant authorities, not give the project owner extraordinary unilateral rights, not conceal wallet addresses in transfers, and be capable of being held in cold wallets (Art. 21(1)). Subject to exceptions, platforms may not list crypto assets whose first sale or distribution they themselves, or persons connected with them, carried out (Art. 21(2)).

Trading restrictions. Listed crypto assets may not be traded with leverage. They may not be the subject of derivative contracts, or of margin purchases, short sales or lending under SPK’s credit transaction rules (Communiqué III-35/B.2 Art. 14). A platform may execute client orders as counterparty from its own wallet. It must then inform clients that their losses may result in its profit and, apart from liquidity provision and market making, may sell only up to the crypto assets in its wallets (Art. 12).

Market disruption. Prices on platforms form freely. Art. 104 of the Law, on market-disrupting acts, applies to transactions on platforms that cannot be explained by a reasonable economic reason and that would disrupt the confidence, transparency and stability of trading. Transactions in crypto assets that SPK considers widely traded abroad, with prices also formed abroad, are excluded. Platforms must set order and trading rules, operate a surveillance system and take preventive measures. They must identify market-disrupting transactions, restrict, suspend or close the accounts involved, and report their findings to SPK (Art. 35/C(3)). Our guide to market-disrupting acts under Art. 104 explains that rule. The criminal offences of market manipulation and insider dealing in Arts. 106 and 107 are not among the provisions applied to platform-traded crypto assets by Art. 35/C(3).

Client contracts and disputes

Framework agreements and disclosure. Contracts between providers and clients may be concluded in writing or by distance means accepted by SPK. SPK may regulate their content, fees, amendment and termination. Any contractual term that removes or limits a provider’s liability to its clients is void (Art. 35/C(1)). Platforms must have internal mechanisms to resolve client objections and complaints effectively, and must identify clients under the anti-money laundering legislation (Art. 35/C(1)). Before trading, platforms must sign a framework agreement and give clients a risk disclosure form. They must also disclose fees, any market maker or liquidity provider, where client assets and cash are held, and whether client orders are executed against the platform itself (Communiqué III-35/B.1 Arts. 21–22).

Disputes. Relations between platforms and their clients, and disputes arising from transactions on platforms, are governed by general law (Art. 35/C(4)). Claims are therefore brought in the ordinary courts or, if the contract so provides and the dispute is arbitrable, in arbitration. Our guide to arbitration of investor disputes explains that route.

Prohibited practices. Providers may not accept deposits. They may not promise a return on crypto assets, except as permitted under Communiqué III-35/B.2 Art. 10(4). They may not dispose of client assets without authority, or take broad powers of attorney from clients to trade on their behalf. They may not act against clients’ interests, encourage excessive trading or keep transactions off the books (Communiqué III-35/B.1 Art. 49).

Civil liability of providers and their managers

Unlawful activities and failure to deliver. Providers are liable for losses caused by their unlawful activities and by their failure to meet cash payment or crypto delivery obligations. If the loss cannot be recovered from the provider, or clearly will not be, the provider’s members are liable to the extent the loss can be attributed to them, according to their fault and the circumstances (Art. 99/B(3)).

Operational and cyber losses. Providers are liable under Code of Obligations Art. 71, the provision on liability for dangerous activities, for crypto losses caused by the operation of their information systems, by cyber attacks and information security breaches, or by any conduct of their staff. Members are liable in the same way if the loss cannot be recovered from the provider. Losses from interruptions in service that occur without the provider’s fault, such as a temporary inability to transmit orders or make transfers, are excluded (Art. 99/B(4)).

Personal bankruptcy of those responsible. Where board members, staff or controlling shareholders are found to have made decisions or carried out transactions that amount to embezzlement under Art. 110/A, the court may, at SPK’s request, declare them personally bankrupt. Their assets are then used first to pay client losses, rateably if insufficient, with any surplus returned. The same applies to persons who obtained benefits from those transactions, in respect of the benefit obtained (Art. 110/B).

Information documents. Persons who sign information documents prepared under SPK rules for the sale or distribution of crypto assets are jointly and severally liable for losses caused by false, misleading or incomplete information in them. Relations between those who raise money from the public in this way and those who provide funds are governed by general law (Art. 35/B(6)).

SPK supervision and measures

Inspections. SPK’s inspection powers under Arts. 88–90 apply to providers, and personnel from other public bodies may be assigned to assist (Art. 99/B(1)). Financial and information systems audits of providers are carried out by independent audit firms on SPK’s list (Art. 99/B(2)).

Measures. For unlawful activities, SPK may apply the measures in Art. 96. For unauthorised providers, it may apply the measures in Art. 99, and for their advertising, Art. 100(1) (Art. 99/A(1)). If a provider cannot meet, or soon will not be able to meet, its cash or crypto delivery obligations, or its financial position is seriously weakening, SPK may act. It may require the provider to strengthen its finances within up to three months, or without notice suspend its activities, revoke its authorisation or restrict or remove the signing powers of responsible managers and staff (Art. 99/A(2)). SPK may order the removal of online content or blocking of access for unlawful advertising, unauthorised crypto advice or portfolio management, and unauthorised online provision of crypto services (Art. 99/A(3)). Breaches of Arts. 35/B and 35/C and SPK regulations attract administrative fines under Arts. 103 and 105 (Art. 99/B(5)).

Attachment and seizure. Interim measures, attachments and similar administrative or judicial requests concerning client cash and crypto assets are carried out exclusively by the providers. Electronic queries and attachment follow the Enforcement and Bankruptcy Law, Art. 78. Crypto assets seized by judicial authorities are kept in wallets created at SPK-authorised custodians (Art. 99/B(7)). Our guide to freezing assets in Turkey explains these measures for other assets.

Criminal offences

Reductions for repayment. If the embezzled assets are returned in kind or the loss is fully compensated before an investigation begins, the penalty is reduced by two thirds. Voluntary return or full compensation before prosecution begins halves the penalty, and before judgment reduces it by one third (Art. 110/A(4)–(5)).

Procedure. Investigations into the offence in Art. 110/A(3) are conducted by prosecutors on SPK’s written notification or, where delay would be harmful, of their own motion. If an indictment is accepted, SPK becomes a participating party. Cases are heard by designated heavy criminal courts (Art. 115/A). Where a provider that has chosen liquidation, or did not apply to SPK in time, fails to execute its clients’ transfer requests, that failure constitutes the offence of unauthorised activity under Art. 109/A. Disputes about those transfer requests are governed by general law (Provisional Art. 11(2)). Our guide to joining a criminal case explains how victims take part in proceedings.

The transitional regime

Providers operating when Law No. 7518 entered into force had to declare to SPK within one month either that they would apply for a licence or that they would decide to liquidate within three months, without accepting new clients (Provisional Art. 11(1)). Foreign providers had to end activities directed at Turkish residents within three months (Provisional Art. 11(4)). Under Communiqué III-35/B.1, providers on SPK’s list of operating entities had to apply for an operating licence by 30 June 2025 and obtain their licence by 30 June 2026, failing which liquidation rules apply. SPK may extend these periods (Provisional Art. 1 of the Communiqué; Capital Markets Law Provisional Art. 11(3)). Whether a particular provider completed the process, or is subject to an extension or liquidation, should be checked against SPK’s announcements.

Points for foreign institutional investors

1. 1. Distinguish the regimes. Securities, including any tokenised capital market instruments, carry the full protection of the Capital Markets Law. Platform-traded crypto assets are subject only to the provisions the Law expressly applies to them (Art. 35/B(5) and (8)).
2. 2. Do not assume compensation. There is no Investor Compensation Center cover and no deposit insurance for crypto assets and related client cash (Art. 35/C(4) and (6)).
3. 3. Rely on segregation and custody. The main structural protections are segregation and immunity of client assets (Art. 35/C(7)) and the 95% custody rule (Communiqué III-35/B.2 Art. 41).
4. 4. Check exposure through issuers and funds. Listed companies’ disclosures and fund documents should be reviewed for crypto holdings and for the counterparties used.
5. 5. Monitor tokenisation. If SPK sets principles under Art. 13(1), rights in tokenised instruments will follow the provider’s electronic records rather than MKK, which affects custody, voting and title arrangements.
6. 6. Use the liability provisions. Claims may lie against the provider, its members where the provider cannot pay (Art. 99/B(3)–(4)), signatories of information documents (Art. 35/B(6)) and, through personal bankruptcy, those responsible for embezzlement (Art. 110/B).

Frequently asked questions

When did Turkey’s crypto asset law take effect?

Law No. 7518 amended the Capital Markets Law with effect from 2 July 2024. SPK’s Communiqués III-35/B.1 and III-35/B.2 were published on 13 March 2025.

Who supervises crypto asset service providers in Turkey?

The Capital Markets Board (SPK). Banks providing crypto custody also need the favourable opinion of the Banking Regulation and Supervision Agency (Art. 35/C(6) and (10)).

Can a foreign crypto platform serve Turkish residents?

Activities directed at Turkish residents without SPK authorisation are unauthorised. A Turkish-language website, a local place of business or marketing through Turkish persons is treated as directing activities at Turkey (Art. 99/A(1)). Services obtained entirely on the client’s own initiative are outside the Communiqué (Communiqué III-35/B.2 Art. 9).

Are crypto assets covered by the Investor Compensation Center?

No. Art. 35/C(4) expressly excludes crypto assets from the compensation rules in Art. 82.

Is client cash at a crypto platform protected by deposit insurance?

No. Crypto assets kept at banks, and client cash in this context, are not covered by deposit insurance under Banking Law Art. 63 (Art. 35/C(6)).

Can a platform’s creditors seize client crypto assets?

No. Client cash and crypto assets are separate from the provider’s assets and cannot be attached, pledged, included in its bankruptcy estate or made subject to injunctions for its debts (Art. 35/C(7)).

How much of client crypto must be held with a custodian?

At least 95% of client crypto assets not kept in clients’ own wallets, with no more than 10% held in the platform’s wallets at any time during the day (Communiqué III-35/B.2 Art. 41).

Do market manipulation offences apply to crypto assets?

Art. 35/C(3) applies the market disruption rule in Art. 104 to platform transactions, except for crypto assets widely traded and priced abroad. It does not extend the criminal offences in Arts. 106 and 107.

Can crypto assets be traded with leverage on Turkish platforms?

No. Listed crypto assets cannot be traded with leverage, used in derivatives, or be the subject of margin purchases, short sales or lending (Communiqué III-35/B.2 Art. 14).

Can a platform exclude its liability in its terms?

No. Any term removing or limiting a provider’s liability to its clients is void (Art. 35/C(1)).

Who is liable for losses from a hack?

The provider, under the dangerous activity liability rule in Code of Obligations Art. 71. If the loss cannot be recovered from it, its members are liable according to their fault (Art. 99/B(4)).

What is the penalty for embezzlement at a crypto provider?

Eight to fourteen years’ imprisonment, rising to fourteen to twenty years where fraudulent concealment is involved, and twelve to twenty-two years for misuse by controlling shareholders of a provider whose licence has been revoked (Art. 110/A).

Can managers of a failed provider be made personally bankrupt?

Yes. At SPK’s request, the court may declare those found to have committed embezzlement-type acts personally bankrupt, with their assets used first to pay client losses (Art. 110/B).

Can shares or bonds be issued as crypto assets in Turkey?

SPK may set principles for issuing capital market instruments as crypto assets recorded by providers instead of MKK, in which case those records govern title and transfer (Art. 13(1)).

Are disputes with platforms heard by special courts?

No. Relations and disputes between platforms and clients are governed by general law (Art. 35/C(4)).

Related guides

• Turkey’s 2026 Fund and Market Manipulation Crisis: Legal Guide for Foreign Institutional Investors — the entry point to this series
• MSCI’s Turkey Index Freeze and the Legal Response
• Lease Certificates (Sukuk) in Turkey
• Inflation Accounting in Turkey: TMS 29 and the Tax Books
• Individual Application to Turkey’s Constitutional Court and the ECHR
• Privileged Shares in Turkish Listed Companies
• Enforcing a Money Judgment in Turkey
• Turkey’s Emissions Trading System and Climate Law No. 7552
• Anti-Money Laundering Rules for Foreign Investors in Turkey
• Recovering Investor Losses from Insurers in Turkey
• Service of Documents in Turkish Proceedings
• Voting at Turkish General Meetings from Abroad
• Derivatives in Turkey: VİOP, OTC and Leveraged Trading
• SPK Investigations in Turkey: Powers, Secrecy and Reports
• Short Selling, Margin Trading and Securities Lending in Turkey
• Market-Disrupting Acts in Turkey: Capital Markets Law Art. 104
• Claims Against Brokers, Custodians and Portfolio Managers in Turkey
• Insolvency in Turkey: Concordat, Bankruptcy and Client Assets
• MKK and Book-Entry Securities in Turkey
• Social Media Manipulation and Unlicensed Advice in Turkey
• Criminal Code Offences in Turkish Capital Markets Cases
• Freezing Assets in Turkey
• Arbitration of Investor Disputes in Turkey
• Currency and Capital Movements Law for Foreign Investors in Turkey