Can a Foreign Crypto Exchange Set Up a Platform in Turkey or Buy Into a Turkish Platform? 2026 — Capital Markets Law Arts. 35/B and 99/A: TRY 250 Million Capital, General Manager Resident in Turkey, 10-20-33-50% Share Permission, Ban on Serving Turkey from Abroad, Custody Rules and the Art. 109/A Penalty

Turkish version (Türkçe sürüm): Yabancı Kripto Borsası Türkiye’de Platform Kurabilir mi, Türk Platformuna Ortak Olabilir mi?

A foreign crypto exchange or an investor based abroad can establish a crypto asset trading platform or a custodian in Turkey, or buy shares in an existing platform. The provisions added to the Capital Markets Law (CML) by Law No. 7518 with effect from 2 July 2024 set no cap on foreign ownership and require no Turkish partner; however, every crypto asset service provider must obtain permission from the Capital Markets Board (CMB). The platform is incorporated in Turkey as a joint stock company, its shares are registered and issued against cash, its general manager is resident in Turkey, and its information systems and key shards are kept in Turkey. For 2026, the minimum founding capital is TRY 250 million for platforms and TRY 630 million for custodians. Share acquisitions at the 10%, 20%, 33% and 50% thresholds in an existing platform are subject to CMB permission. A platform based abroad that serves persons resident in Turkey through a Turkish-language website, a workplace in Turkey or promotion aimed at Turkey is deemed to be providing crypto asset services without permission; the penalty for this offence is three to five years’ imprisonment. This guide explains, with reference to the legislation, the foreign investor’s options, the establishment and permission process, the requirements for founders and managers, share acquisition permission, the ban on serving Turkey from abroad, the custody of customer assets, information systems, MASAK obligations and sanctions.

Who can provide crypto services in Turkey?

Crypto asset services in Turkey were brought under regulation by Law No. 7518 amending the Capital Markets Law, published in the Official Gazette of 2 July 2024 and in force on the same day. That Law added to the CML the definitions of crypto asset, crypto asset service provider, platform, custody service and wallet (Art. 3(1)(aa) to (ee)) and new articles on crypto asset service providers. Under the Law, crypto asset service providers are platforms, institutions providing crypto asset custody services and other institutions to be designated by the Board (Art. 3(1)(cc)). A platform is an institution where the buying and selling, initial sale or distribution, exchange and transfer of crypto assets, and the custody operations these require, are carried out (Art. 3(1)(dd)).

The only way to operate in this field is to be a crypto asset service provider authorised by the CMB. The Law makes Board permission mandatory for crypto asset service providers to be established and to commence operations (CML Art. 35/B(1)). The details are set out in two communiqués published together in Official Gazette No. 32840 of 13 March 2025: the Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers (III-35/B.1) and the Communiqué on the Working Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers (III-35/B.2). For information systems, the CMB’s Communiqué on Procedures and Principles for Information Systems Management (VII-128.10) and the criteria set by TÜBİTAK, the Scientific and Technological Research Council of Türkiye, also apply. The general framework of the new regime is explained in our article Türkiye’de Kripto Varlık Hukuku: 2024 Sonrası Yeni Rejim (in Turkish).

Paying with crypto assets is a separate matter: the Regulation on the Disuse of Crypto Assets in Payments of 16 April 2021, issued by the Central Bank of the Republic of Türkiye (CBRT), prohibits the direct or indirect use of crypto assets in payments (Art. 3(2)). CMB permission therefore does not turn a crypto platform into a means of payment. For details, see our article Kripto ile Ödeme Yapmak Yasak mı? (in Turkish).

Is there a limit on foreign ownership?

No. CML Arts. 35/B and 35/C, and the articles of Communiqué III-35/B.1 governing establishment requirements, founder qualifications and share acquisitions (Arts. 5, 6 and 26), use only the concepts of “natural and legal persons”; they impose no nationality, place-of-residence, foreign-capital ratio, reciprocity or Turkish-partner requirement. Foreign Direct Investment Law No. 4875 also provides that, unless international agreements or special laws provide otherwise, foreign investors are treated equally with domestic investors (Art. 3(a)). A crypto exchange based abroad can therefore own all the shares of the platform company.

There is, however, a series of requirements that tie the foreign investor to Turkey. These requirements are not specific to foreigners, but they directly affect the centralised structure of a group based abroad: activity is carried out through a joint stock company incorporated in Turkey, the general manager is resident in Turkey, systems and keys are kept in Turkey, and outsourced services may not obstruct CMB supervision. The requirements for founders and shareholders also apply up to the upper links of the ownership chain abroad.

The foreign investor’s four options

A foreign crypto exchange or investor wishing to enter the Turkish market has four legal options. The first is to establish a new platform or custodian in Turkey and complete the establishment permission, operating permission and certificate of authorisation stages. The second is to buy shares in an existing platform; on this route, share acquisition permission and the target company’s position in the transition process are decisive. The third is to work with a platform in Turkey as a customer, liquidity provider or technology supplier. The fourth is to provide services only from abroad, without targeting Turkey; this option remains narrow because of the rules prohibiting the targeting of users in Turkey.

The fact that the target company is a crypto exchange does not mean that CMB permission is the only approval the acquisition needs. If turnover-based thresholds are exceeded, the transaction may also require Competition Board approval; the approvals a foreign investor needs when buying a Turkish company are set out together in our guide Buying a Turkish Company as a Foreign Investor: Which Approvals Do You Need?

Establishment requirements: joint stock company, trade name, capital and equity

A company to be established as a crypto asset service provider must be a joint stock company, all its shares must be registered, the shares must be issued against cash and its capital must be fully paid in cash (Communiqué III-35/B.1, Art. 5(1)). These requirements do not apply to banks that will provide custody services (Art. 5(2)); custody services by banks are subject to a favourable opinion of the Banking Regulation and Supervision Agency (BRSA) (CML Art. 35/C(10); Communiqué III-35/B.1, Art. 9(5)-(6)).

There is also a specific rule on the trade name: the trade name of platforms must include the phrase “kripto varlık alım satım platformu” (crypto asset trading platform) and that of custodians the phrase “kripto varlık saklama kuruluşu” (crypto asset custodian) (Communiqué III-35/B.1, Art. 7); the use of a business name or brand is subject to Board permission (Art. 7(3)). A group based abroad can use its global brand in Turkey only with this permission.

As to capital, Communiqué III-35/B.2, Art. 34 set the minimum founding capital at TRY 150 million for platforms and TRY 500 million for custodians, and provides that these amounts may be redetermined by the Board each year, taking into account the revaluation rate (Art. 53). The 2026 amounts announced in CMB Bulletin 2025/68 are TRY 250,000,000 for platforms and TRY 630,000,000 for custodians. The equity rules apply on an ongoing basis: equity may not fall below the founding capital, at least 25% of equity must consist of paid-in or issued capital, and a platform’s equity may not be lower than its liquid reserve obligation (Communiqué III-35/B.2, Art. 35). Custodians also hold additional equity for the portion of customer assets above a certain amount.

Because the amounts may be redetermined each year, the foreign investor’s business plan should budget not only for the capital at establishment but also for the amounts that may be redetermined in later years and for the equity rules. Where one company will carry on both platform and custody activities, the applicable amount should be clarified with the CMB before applying. All the details of the establishment requirements are set out article by article in our guide Kripto Borsası Kurma Şartları 2026 (in Turkish).

Three-stage permission: establishment permission, operating permission and certificate of authorisation

A new crypto asset service provider goes through three stages. In the first stage, an application is made to the Board for establishment permission (Communiqué III-35/B.1, Art. 8). After obtaining establishment permission, the company applies for operating permission; at this stage, compliance of the information systems and technological infrastructure with the criteria set by TÜBİTAK is also required (CML Art. 35/B(2); Communiqué III-35/B.1, Art. 9(1)). The application for operating permission must be made within six months of the establishment permission; if no application is made within this period, the right to obtain operating permission lapses. The Board may extend this period, but the total period may not exceed one year (Communiqué III-35/B.1, Art. 17(1)). In the final stage, the certificate of authorisation is issued, and the company may commence operations only after the certificate of authorisation has been issued (CML Art. 35/C(10); Communiqué III-35/B.1, Art. 17(5)). Before the certificate of authorisation is issued, a fee is paid under the Law on Fees (Harçlar Kanunu); if the fee receipt is not submitted to the Board within one month at the latest from the Board’s notification of the operating permission, the operating permission is cancelled (Communiqué III-35/B.1, Art. 17(6)).

There are also transitional provisions for companies that were operating when Law No. 7518 entered into force. Within one month, these companies had to declare either that they would apply for permission or that they would resolve to liquidate within three months (Provisional Art. 11(1)). The CMB therefore published two lists: the “List of Those in Operation” (Faaliyette Bulunanlar Listesi) and the “List of Those in Liquidation” (Tasfiye Sürecinde Olanlar Listesi). The CMB expressly states on its page that being on the list of those in operation does not mean authorisation by the Board. At the time of writing, that list contained 52 entries, 43 platforms and 9 custody applications, and the liquidation list contained 56 entries. Details on the lists are in our article SPK Listesindeki Kripto Borsası ‘Lisanslı’ mı Demek? (in Turkish).

The deadlines for platforms in the transition process to obtain a certificate of authorisation and to sign agreements with custodians have also changed. In Bulletin 2025/61, the CMB extended the deadline for custody agreements to 31 March 2026. By its decision No. 18/617 of 26 March 2026, it then announced that both deadlines would be set after the custodians to be authorised have begun providing crypto asset custody services to platforms on a widespread basis (CMB Bulletin 2026/18). As a result, at the time of writing there is no fixed certificate-of-authorisation date for platforms in the transition process.

The practical conclusion for a foreign investor planning a new establishment is this: the operating permission application should be ready within the six-month period that runs after establishment permission, and the plan for working with an authorised custodian and the TÜBİTAK assessment should be prepared in advance. Application forms and a template “Notarial Declaration for Prospective Shareholders (Legal Person)” (Pay Sahibi Olacaklara İlişkin Noter Beyannamesi (Tüzel Kişi)) have been published on the CMB’s website. As a general rule, official documents issued abroad require an apostille or consular legalisation and a Turkish translation to be used in Turkey.

Requirements for founders, shareholders and managers

The requirements for founders and shareholders are listed in the Law. The shareholders of a crypto asset service provider must not have been declared bankrupt, must not have declared a concordat (konkordato) or be in a similar situation; must not have held 10% or more of the shares in, or control of, bankers subject to liquidation or financial institutions whose operating permission was revoked other than by voluntary liquidation; must not have been convicted of the offences listed in the Law or of an intentional offence carrying five years’ imprisonment or more; must not be subject to a trading ban under Art. 101; must have the necessary financial strength, honesty and reputation; and the ownership structure must be transparent and clear (CML Art. 35/B(3)(a)). The Communiqué also requires them not to bear responsibility at institutions whose operating permission was revoked by the Board and not to have received an administrative fine under Art. 104 in the last five years (Communiqué III-35/B.1, Art. 6(1)). Natural persons entitled to receive more than half of the distributable profit, or to elect or nominate more than half of the board members, must also meet these requirements (CML Art. 35/B(3)(c); Communiqué III-35/B.1, Art. 6(2)). The Law does not refer to Banking Law No. 5411 in this respect; it sets its own requirements for crypto asset service providers.

For a foreign investor, the most important rule is that the requirements apply up to the upper links of the ownership chain. Shareholders holding, directly or indirectly, 10% or more of the capital or voting rights of legal-person founders, and of legal-person shareholders holding 10% or more of the capital or privileged shares granting the right to be represented on the board, must also meet the same requirements (CML Art. 35/B(3)(ç); Communiqué III-35/B.1, Art. 6(3)). Documenting the holding structure abroad up to the ultimate natural persons is therefore the most time-consuming part of the application. If shareholders holding 10% or more or privileged shares granting the right to be represented on the board, or such persons in the chain, later lose any of the requirements other than financial strength, they must transfer their shares within six months to persons who meet the requirements; the Board decides who exercises the voting rights during this period (CML Art. 35/B(3)(d)).

Board members, persons authorised to represent the company, managers and staff must also meet the shareholder requirements other than financial strength (CML Art. 35/B(3)(b); Communiqué III-35/B.1, Arts. 13(1) and 15(2)). The management team is also subject to a requirement that ties it to Turkey. The board of directors consists of at least three members, the majority of whom hold a four-year university degree (Communiqué III-35/B.1, Art. 15). The general manager and deputy general managers must have at least seven years’ experience in financial markets, data processing, information technology or financial technology; the general manager works exclusively in this role and full time, is resident in Turkey, and the appointment requires the Board’s favourable opinion (Communiqué III-35/B.1, Art. 14). The Turkish Commercial Code imposes no nationality requirement for board membership; however, a foreign general manager or manager who will actually work in Turkey needs a work permit. This is also explained in our guide Can a Foreigner Be a Board Member or Manager of a Turkish Company?

Buying into an existing platform: share acquisition permission

The Law makes Board permission mandatory for transfers of shares in crypto asset service providers and provides that transfers made in breach of the permission requirement cannot be entered in the share ledger (CML Art. 35/B(1)). The Communiqué ties this permission to thresholds: share acquisitions by which a person, directly or indirectly, reaches 10% of the capital or exceeds 10%, 20%, 33% or 50%, and share transfers that bring a holding below these levels, are subject to Board permission. Transfers of privileged shares granting the right to be represented on the board, or of shares carrying usufruct rights, are subject to Board permission regardless of any ratio. Transfers of shares in the platform’s legal-person shareholders also require permission if they result in these thresholds being crossed. Transfers below the thresholds are notified to the Board within ten business days (Communiqué III-35/B.1, Art. 26).

In calculating the ratios, the shares of the person’s spouse, of children under their custody, of companies in which these persons are partners with unlimited liability or serve as chair or member of the board, general manager or deputy general manager, of companies in which a direct or indirect holding of 25% or more is held, and of persons determined by the Board to be acting together, are taken into account together (Communiqué III-35/B.1, Art. 26(7)). This rule treats purchases made by a group abroad through different companies as a single acquisition. The acquirer must also meet the requirements for founders.

When buying an existing platform, legal due diligence should not be limited to the company’s financial position. Whether the target company is on the list of those in operation or on the liquidation list, the stage reached by its operating permission application, whether the Board has taken any measure against the company, and whether customer assets are held in line with the custody rules should each be examined separately. The Board may also take measures against platforms on the list; for example, a decision dated 23 September 2026 prohibited a listed platform from accepting new customers and from listing new crypto assets. CMB permission should therefore be written into the share purchase agreement as a condition to closing, and the consequences for the agreement if permission is not obtained should be regulated clearly.

Can a crypto exchange based abroad serve Turkey?

No, not by targeting Turkey. Under CML Art. 99/A(1), activity by platforms based abroad that targets persons resident in Turkey is deemed to be providing crypto asset services without permission. The Law lists opening a workplace in Turkey, creating a Turkish-language website and carrying out promotion and marketing activities directly or through persons or institutions resident in Turkey as indications of activity targeting Turkey, and considers the presence of any one of these sufficient; the Board may also set other criteria. Foreign platforms targeting Turkey when the Law entered into force had to end those activities within three months (Provisional Art. 11(4)); the CMB announced this date as 2 October 2024.

Services that do not target Turkey are assessed separately. Communiqué III-35/B.2, Art. 9(1) excludes from the scope of the Communiqué services that persons resident in Turkey obtain from crypto asset service providers abroad entirely on their own initiative, provided that no promotion, advertising or marketing activities aimed at persons resident in Turkey are carried out. This exception should, however, be interpreted narrowly: even one of the elements listed in the Law, such as a Turkish-language website, or promotion and marketing carried out directly or through persons or institutions resident in Turkey (for example business partners or social media influencers), makes the activity one that targets Turkey.

The consequences of activity targeting Turkey are severe. The CMB orders the removal of content or the blocking of access to sites carrying on unauthorised activity, and the decision is sent to the Association of Access Providers (Erişim Sağlayıcıları Birliği) (CML Art. 99/A(3)(c)). For example, in Bulletin 2025/61 the CMB ordered access bans on 16 websites offering unauthorised crypto asset services and leveraged trading from abroad. In addition, criminal proceedings are initiated under Art. 109/A against natural persons and the authorised officers of legal persons carrying on unauthorised activity. The position and risks for users are explained in our article İzinsiz Kripto Hizmeti ve Yurt Dışı Platform Riski (in Turkish).

The legal route for an international exchange to remain in the Turkish market is to incorporate a separate joint stock company in Turkey and obtain CMB permission for that company. The CMB’s list of those in operation includes Turkish companies bearing the names of some international brands; however, these companies are subject to the permission process like all others, and being on the list does not in itself mean permission. The parent company abroad serving the Turkish company’s customers through its own platform, on the other hand, is incompatible with the rules requiring customer assets to be held in custody in Turkey and systems to be kept in Turkey.

Customer assets and custody

The protection of customer assets at a crypto asset service provider is one of the strictest rules of the Law. Under the Law, the principle is that customers keep their crypto assets in their own wallets; crypto assets that a customer does not keep in their own wallet are held in custody at banks authorised by the Board and approved by the BRSA, or at other institutions authorised by the Board. Customer cash must be held at banks, and this cash is not covered by insurance under Art. 63 of Law No. 5411 (CML Art. 35/C(6)). Customer cash is tracked in separate accounts at banks (CML Art. 46(7)-(8), applicable through Art. 35/C(7)). Customer assets are separate from the assets of the crypto asset service provider; they cannot be attached, pledged or included in the bankruptcy estate (CML Art. 35/C(7)). Customers of crypto asset service providers are not covered by the protection of the Investor Compensation Centre (CML Art. 35/C(4)).

The Communiqué also sets the custody ratios numerically. A platform keeps at least 95% of the crypto assets that customers do not hold in their own wallets at a custodian; at most 5% may be held in platform wallets, and this ratio may not exceed 10% during the day (Communiqué III-35/B.2, Art. 41). Assets held in a custodian’s hot wallet may not exceed 5% of customer assets, or 10% if it holds all the customer assets of a platform (Communiqué III-35/B.2, Art. 26(6)-(7)). Private keys are kept in hardware security modules (HSMs) (Communiqué III-35/B.2, Art. 26(4)), and key shards are kept in Turkey together with their backups (Art. 27(2)).

Civil liability is also heavy. Crypto asset service providers are liable for damage arising from unlawful transactions and from failure to deliver customer assets (CML Art. 99/B(3)). Liability for losses resulting from cyber attacks on information systems, information security breaches or the acts of staff is determined under the provisions on strict liability for hazardous activities in Art. 71 of Turkish Code of Obligations No. 6098 (CML Art. 99/B(4)). A security flaw in technology supplied by a group company abroad does not remove the Turkish company’s liability to its customers. What happens to customer assets if a platform closes or goes bankrupt is explained in our article Kripto Borsası Batarsa veya Kapanırsa Paralar Ne Olur? (in Turkish).

Information systems, TÜBİTAK and audit

The information systems and technological infrastructure of crypto asset service providers must comply with the criteria set by TÜBİTAK (CML Art. 35/B(2)), and compliance with the TÜBİTAK infrastructure criteria is one of the conditions for operating permission (Communiqué III-35/B.1, Art. 9(1)). The CMB’s Communiqué on Procedures and Principles for Information Systems Management (VII-128.10) requires primary and secondary systems to be kept in Turkey (Art. 27(1)). This rule is a direct obstacle to a global exchange running its Turkish company by connecting it to a central matching engine or to servers abroad. Technology services may be obtained from abroad; however, outsourcing may not be structured in a way that obstructs the Board’s access to information and documents or its supervision (Communiqué III-35/B.1, Art. 32(10)).

On the audit side, crypto asset service providers have independent audits carried out by firms on the Board’s list (CML Art. 99/B(2)), and their information systems undergo an independent audit every year (Communiqué on Independent Audit of Information Systems (III-62.2), Art. 30(1), as amended by III-62.2.b). Communiqué VII-128.10 requires penetration testing at least once a year and audit trails to be kept for at least five years (Communiqué VII-128.10, Arts. 8 and 22(4)).

Ongoing obligations: MASAK, CBRT, levies and tax

Crypto asset service providers are obliged parties under the Regulation on Measures for the Prevention of Laundering Proceeds of Crime and the Financing of Terrorism (the “Regulation on Measures”) (Art. 4(1)(ü)). Customer due diligence, suspicious transaction reporting, record-keeping and compliance programme obligations therefore apply in full. The rule on transmitting sender and recipient information in crypto asset transfers (the travel rule) is set out in Art. 24/A of the Regulation on Measures; the threshold applicable under this rule was raised from TRY 15,000 to TRY 30,000 by an amendment published in the Official Gazette on 7 October 2026. The details of the amendment are explained in our article MASAK Kimlik Tespiti Sınırı 370.000 TL Oldu (7 Ekim 2026) (in Turkish), and cross-border transfers in our article Sınır Ötesi Kripto Transferi ve Travel Rule (in Turkish).

MASAK General Communiqué No. 29, published in Official Gazette No. 32940 of 28 June 2025, also introduced transaction rules in Art. 4: withdrawals within its scope are executed at least 48 hours after the purchase, swap or deposit, and 72 hours for the first withdrawal; stablecoin withdrawals are subject to limits of USD 3,000 per day and USD 50,000 per month, and these limits may be applied at up to twice that amount for transfers to which the travel rule applies; each transfer includes a description of at least 20 characters. An exemption may be granted with the approval of the platform’s board of directors for customers working for liquidity provision, market making or arbitrage, and transfers between a platform and a custodian fall outside these rules. If a foreign market maker plans to work with a Turkish platform, the conditions of this exemption should be assessed from the outset. The effect of these rules on users is explained in our article Kripto Hesabım Bloke Edildi (in Turkish).

Under the CBRT’s Regulation, payment and e-money institutions may not act as intermediaries for fund transfers to or from crypto asset platforms (Regulation on the Disuse of Crypto Assets in Payments, Art. 4(2)). A platform’s Turkish lira flows therefore run through banks. What to do if a platform’s bank accounts are interfered with by a MASAK, prosecutor’s or bank decision is explained in our article Kripto Varlık Platformunun Banka Hesabı veya Transferi Durdu (in Turkish).

Each year, platforms also pay 1% of their previous year’s revenues, excluding interest income, to the CMB and 1% to the TÜBİTAK budget by the end of May (CML Art. 130(5)). On the tax side, no transaction tax specific to crypto assets is in force. A bill submitted to the Grand National Assembly of Türkiye in March 2026 provided for a crypto asset transaction tax and withholding tax on gains, but these articles were removed from the bill during the debates in the General Assembly. The general principles of taxing crypto gains are explained in our article Kripto Varlıkların Vergilendirilmesi (in Turkish).

The last two rules are particularly important for exchanges whose business model abroad is built on derivative products or their own token. The Turkish company may not offer customers in Turkey the leveraged products the group offers abroad; the details are in our article Türkiye’de Kripto Kaldıraç Yasak mı? (in Turkish).

Sanctions: access bans, administrative fines and offences

Natural persons, and the authorised officers of legal persons, found to be operating as a crypto asset service provider without permission are punished by three to five years’ imprisonment and a judicial fine of five thousand to ten thousand days (CML Art. 109/A). Activity by foreign platforms targeting Turkey also falls within this scope (Art. 99/A(1)). If the Board finds that cash payment or crypto asset delivery obligations cannot be met, or that the financial structure has seriously weakened, it may require the financial structure to be strengthened within a period not exceeding three months, or, without granting any period, temporarily suspend operations or withdraw the operating authority (Art. 99/A(2)). It may also order access bans on sites carrying on unauthorised activity (Art. 99/A(3)(c)). Administrative fines are imposed for breaches of the Law and the Board’s regulations (Arts. 99/B(5) and 103); for 2026, the lower limit of the administrative fine under Art. 103(1) is TRY 445,243.49 and the upper limit TRY 5,565,516.37 (CMB Bulletin 2025/68).

Heavier penalties are provided for acts directed at customer assets. The offence of embezzlement at crypto asset service providers is punishable by eight to fourteen years’ imprisonment and a judicial fine of up to five thousand days; where it is committed through fraudulent conduct aimed at preventing the embezzlement from being discovered, the penalty is fourteen to twenty years’ imprisonment and a judicial fine of up to twenty thousand days, and the judicial fine may not be less than three times the loss (CML Art. 110/A). In addition, against the chair and members of the board, other personnel and natural-person shareholders holding management or control in law or in fact who are found to have carried out decisions and transactions deemed embezzlement under Art. 110/A, the court may, at the Board’s request, directly order personal bankruptcy, limited to customer losses (CML Art. 110/B). The scope of the offence and the transition period are explained in our article İzinsiz Kripto Platformu İşletmenin Cezası (in Turkish).

Users of crypto assets, by contrast, are not the target of the Law’s sanctions system: Art. 109/A punishes those operating as crypto asset service providers. Nevertheless, access bans and the MASAK rules at Turkish platforms affect users in Turkey of exchanges based abroad in practice.

Checklist

Common mistakes

• Targeting users in Turkey under a foreign licence. A Turkish-language website, a workplace in Turkey or promotion aimed at Turkey on its own counts as providing crypto asset services without permission (CML Arts. 99/A(1) and 109/A).
• Mistaking a place on the CMB list for permission. The CMB expressly states that being on the list of those in operation does not mean authorisation; a certificate of authorisation is required to commence operations.
• Planning on the 2025 capital amounts. TRY 150 and 500 million are the original amounts in the Communiqué; the 2026 amounts are TRY 250 and 630 million and may be redetermined by the Board each year.
• Leaving the parent company’s shareholders out of the review. The founder requirements apply up to the qualifying shareholders of legal-person shareholders (CML Art. 35/B(3)(ç)).
• Running the Turkish business on the group’s central system abroad. Primary and secondary systems are kept in Turkey, and key shards are stored in Turkey.
• Appointing the general manager from abroad. The general manager must be resident in Turkey and work full time (Communiqué III-35/B.1, Art. 14).
• Not making the share purchase agreement conditional on CMB permission. An unauthorised share transfer cannot be entered in the share ledger (CML Art. 35/B(1)).
• Bringing the group’s leveraged products to Turkey. Leveraged trading, derivatives, lending and short selling are not permitted in listed crypto assets (Communiqué III-35/B.2, Art. 14).

Frequently asked questions

Can foreigners establish a crypto exchange in Turkey?

Yes. Capital Markets Law Art. 35/B and the CMB’s Communiqués III-35/B.1 and III-35/B.2 contain no nationality, foreign-capital ratio or Turkish-partner requirement. However, activity is carried out through a joint stock company incorporated in Turkey, and establishment, commencement of operations and share transfers are subject to CMB permission (CML Art. 35/B(1)).

Is there a limit on the foreign ownership ratio?

No. The Law and the communiqués use only the concepts of natural and legal persons; a foreign company can own all the shares of a platform. Law No. 4875 also provides that, unless international agreements or special laws provide otherwise, foreign investors are treated equally with domestic investors (Art. 3(a)).

How much capital is needed to set up a crypto platform?

The amounts in Communiqué III-35/B.2, Art. 34 may be redetermined by the Board each year, taking into account the revaluation rate. The 2026 amounts announced in CMB Bulletin 2025/68 are TRY 250,000,000 for platforms and TRY 630,000,000 for custodians. The capital is fully paid in cash, and equity may not fall below the founding capital.

How does the permission process work?

The process has three stages: establishment permission, operating permission and a certificate of authorisation. The operating permission application is made within six months of the establishment permission; the Board may extend this period up to one year in total. The company may commence operations only after the certificate of authorisation has been issued (Communiqué III-35/B.1, Art. 17).

Can the general manager be a foreigner?

The Communiqué imposes no nationality requirement; however, the general manager works exclusively in this role and full time, is resident in Turkey, must have at least seven years’ experience, and the appointment requires the Board’s favourable opinion (Communiqué III-35/B.1, Art. 14). A foreign general manager working in Turkey also needs a work permit.

Are the shareholders of the parent company abroad also reviewed?

Yes. Shareholders holding, directly or indirectly, 10% or more of the capital or voting rights of legal-person founders, and of legal-person shareholders holding 10% or more or privileged shares granting board representation, must also meet the founder requirements (CML Art. 35/B(3)(ç); Communiqué III-35/B.1, Art. 6(3)). The ownership chain should therefore be documented up to the ultimate natural persons.

Is permission needed to buy shares in an existing crypto platform?

Yes. Share acquisitions that reach 10% of the capital or exceed 10%, 20%, 33% or 50%, share transfers that bring a holding below these levels, and transfers of privileged shares granting board representation or of shares carrying usufruct rights, are subject to Board permission; transfers below the thresholds are notified within ten business days (Communiqué III-35/B.1, Art. 26). Transfers in breach of the permission requirement cannot be entered in the share ledger (CML Art. 35/B(1)).

Is buying a platform on the CMB list safe enough?

Not on its own. The CMB expressly states that being on the list of those in operation does not mean authorisation. The stage reached by the target company’s operating permission application, any Board measures against the company and the way customer assets are held should also be examined, and CMB permission should be made a condition to closing.

Can a crypto exchange based abroad serve users in Turkey?

Not by targeting Turkey. Activity by platforms based abroad that targets persons resident in Turkey is deemed to be providing crypto asset services without permission; opening a workplace in Turkey, creating a Turkish-language website or promotion and marketing aimed at Turkey are among these cases (CML Art. 99/A(1)).

What if a user opens an account at a foreign exchange on their own initiative?

Communiqué III-35/B.2, Art. 9(1) excludes from its scope services that persons resident in Turkey obtain from service providers abroad entirely on their own initiative, provided that no promotion, advertising or marketing is aimed at persons resident in Turkey. CML Art. 109/A punishes those operating as service providers; access bans, however, affect users in practice.

Can an institution based abroad trade on a Turkish platform?

Yes. Institutions resident abroad may place orders on a Turkish platform under an agreement and with documents complying with anti-money laundering legislation (Communiqué III-35/B.2, Art. 11(2)-(4)). For customers working for liquidity provision, market making or arbitrage, an exemption from the waiting rules in Art. 4 of MASAK General Communiqué No. 29 may be granted with the approval of the platform’s board of directors.

Where are customer assets held?

The principle is that customers keep their crypto assets in their own wallets; otherwise the assets are held at banks authorised by the Board and approved by the BRSA, or at other custodians authorised by the Board. A platform keeps at least 95% of these assets at a custodian; customer cash is held at banks (CML Art. 35/C(6); Communiqué III-35/B.2, Art. 41).

Must the servers be in Turkey?

Yes. The CMB’s Communiqué VII-128.10 requires primary and secondary systems to be kept in Turkey (Art. 27(1)); private key shards are also kept in Turkey together with their backups (Communiqué III-35/B.2, Art. 27(2)). Information systems must also comply with TÜBİTAK criteria (CML Art. 35/B(2)).

What is the penalty for providing crypto services without permission?

Natural persons, and the authorised officers of legal persons, operating as a crypto asset service provider without permission are punished by three to five years’ imprisonment and a judicial fine of five thousand to ten thousand days (CML Art. 109/A). The CMB may also order an access ban (Art. 99/A(3)(c)).

What are a crypto platform’s MASAK obligations?

Platforms are obliged parties under the Regulation on Measures (Art. 4(1)(ü)). The travel rule threshold was raised to TRY 30,000 by an amendment published on 7 October 2026 (Art. 24/A). Under MASAK General Communiqué No. 29, withdrawals within its scope are made after 48 hours, or 72 hours for the first withdrawal, and stablecoin limits of USD 3,000 per day and USD 50,000 per month apply.

What do platforms pay to the CMB and TÜBİTAK?

Each year, platforms pay 1% of their previous year’s revenues, excluding interest income, to the CMB and 1% to the TÜBİTAK budget by the end of May (CML Art. 130(5)). A fee under the Law on Fees is also paid before the certificate of authorisation is issued (Communiqué III-35/B.1, Art. 17(6)).

Related guides

• Legal Guide for Foreign Investors in Turkey — company, stock exchange, mining, energy, real estate, tax and arbitration
• Can Foreigners Establish a Payment Institution or E-Money Institution in Turkey? — CBRT permission and share acquisition
• Can Foreigners Establish a Bank or Buy Into a Bank in Turkey? — BRSA permissions and founder requirements
• Buying a Turkish Company as a Foreign Investor: Which Approvals Do You Need? — Competition Board and sector approvals
• Can a Foreigner Be a Board Member or Manager of a Turkish Company? — foreign managers and work permits
• Company Formation in Turkey for Foreigners — capital, documents and formation
• Kripto Borsası Kurma Şartları 2026 — establishment permission, operating permission and certificate of authorisation in detail (in Turkish)
• İzinsiz Kripto Hizmeti ve Yurt Dışı Platform Riski — the user’s position (in Turkish)
• MASAK Rehberi — account freezes, suspicious transaction reports and seizure (in Turkish)
• Can Foreigners Invest in a TV, Radio or Internet Broadcaster in Turkey? — RTÜK licence for platforms abroad broadcasting to Turkey
• Yabancı Kripto Borsası Türkiye’de Platform Kurabilir mi, Türk Platformuna Ortak Olabilir mi? — Turkish version of this article