Turkey has emerged as one of the most significant digital-asset markets in the world by trading volume, and its regulatory regime has shifted from near-silence to active statutory supervision within a short span of years. For an exchange, custodian, token platform or payment service seeking to operate in or from Turkey, the central legal question is now concrete: the Capital Markets Board of Turkey – known by its Turkish abbreviation SPK (Sermaye Piyasası Kurulu) – holds exclusive licensing authority over crypto-asset service providers (CASPs), and operating without that authorisation exposes a business to enforcement, mandatory shutdown and severed banking relationships. This page maps the regime, the licensing process, the cross-border considerations and the structural questions an inbound operator must resolve before committing capital.
The Regulatory Regime: SPK and the 2023–2024 Statutory Framework
Turkey's crypto-asset service provider licensing regime was formalised through amendments to the Capital Markets Law, enacted in 2023, that placed all CASP activity squarely under SPK supervision. Before that change, digital-asset platforms operated in a legal vacuum – the Central Bank of Turkey had imposed restrictions on crypto use for payments, but no entity held authority to license or supervise trading platforms. The 2023 amendments closed that gap decisively.
Under the applicable provisions, a crypto-asset service provider is any entity that operates a trading platform, provides custody of crypto assets on behalf of clients, executes orders, or offers related transfer and settlement services within or directed at Turkey. The SPK has since published secondary rules governing the application process, technical and organisational requirements, capital standards and ongoing obligations. The regime is still young, and SPK continues to issue guidance as the market matures.
Turkey is also an active member of FATF, the Financial Action Task Force, which means the domestic AML/CFT baseline tracks FATF Recommendation 15 on virtual assets. Platforms must implement know-your-customer procedures, transaction monitoring, and – on applicable transfers – the Travel Rule (the obligation to pass originator and beneficiary data with a transfer). Regulators in Turkey, as in other FATF member states, have made AML compliance a threshold condition of licensing, not an afterthought.
The cross-border dimension is acute from the start. Turkey's large population and high domestic trading volumes make it an attractive market. But an operator sitting offshore and directing services at Turkish residents without SPK authorisation faces the same risk as a domestic operator with no licence. The SPK has signalled that it will assess the substance of the offering – not merely the seat of the entity – when determining jurisdiction.
Who Needs a Licence Under the Turkish CASP Regime?
Any entity offering crypto-asset trading, custody, transfer, initial offering or related intermediation services to persons in Turkey is required to hold SPK authorisation, regardless of where the entity is incorporated. The licensing obligation is activity-based and user-facing, not entity-based.
In our practice, we advise clients to run the substance-over-form test at the earliest stage of market planning. The question is not whether a company is registered in Cayman, BVI or a European jurisdiction. The question is whether it offers services – through a website, app or sales effort – that a Turkish resident can access and use. If the answer is yes, the SPK licensing obligation is engaged.
The categories of regulated activity under the Turkish CASP regime cover broadly:
- Operation of a crypto-asset trading platform (exchange services);
- Custody and safeguarding of crypto assets on behalf of clients;
- Order execution and brokerage in crypto assets;
- Transfer and settlement services involving crypto assets;
- Initial sales or distribution of crypto assets.
A business that provides only software infrastructure or technology services – and does not itself hold client assets, execute client orders or operate a trading venue – may fall outside the perimeter. That boundary is fact-specific. We regularly advise technology providers on where their stack crosses from infrastructure into regulated activity, because the SPK's definitions are broad and enforcement risk is real for operators who misjudge the line.
The process above describes the standard licensing path. Your facts – the entity structure, the user base, the banking relationships and the service layer – determine whether one licence covers the full operation or whether separate authorisations are required across activities. For a scoped assessment of your position under the Turkish CASP regime, contact OBOLUS at info@oboluslaw.com.
What Does the SPK Licence Application Require?
The SPK CASP application is a multi-stage process requiring documentary, technical and financial preparation well before submission. The SPK evaluates the fitness of the business, its beneficial owners and its senior management in detail.
Core application requirements include a detailed business plan covering the intended activities, target market and financial projections; governance documents demonstrating a clear ownership and management structure; technical documentation establishing the security, resilience and operational continuity of the platform; AML/CFT policy and procedure manuals aligned to Turkish regulatory expectations; and evidence of adequate capitalisation. The minimum capital required varies by licence category – the SPK sets these thresholds in its secondary rules, and they are subject to change as the regime evolves. An applicant should confirm the applicable figure directly against current SPK guidance before structuring the entity.
Beneficial owners and senior managers are subject to fitness-and-propriety review. Criminal history, regulatory history in other jurisdictions and financial integrity are assessed. In practice, this means that any adverse regulatory history – a licence refusal, a suspension or a regulatory sanction in another market – must be disclosed and will be weighed. Operators we advise are encouraged to prepare a comprehensive disclosure narrative rather than allowing the SPK to surface adverse information through its own enquiries.
The authorisation timeline is not fixed in the published rules. Based on the trajectory of the regime and experience with comparable regulatory processes in markets at similar stages of development, the process is measured in months rather than weeks. Applications that arrive complete, well-organised and consistent across all documents move materially faster than those that require clarification rounds. Getting the file right before submission is the single most effective way to manage the timeline.
A practical note on language: SPK submissions are conducted in Turkish. Foreign businesses will need to prepare or translate all documentation into Turkish to a professional standard. This is not merely administrative – the SPK's substantive review is conducted against the Turkish-language materials, and inconsistencies in translation have caused real delays in the process for applicants we have seen come to us mid-application.
How Does Turkey Interact with Other Licensing Jurisdictions?
Turkey does not operate a passporting arrangement with the EU or any other bloc. An operator holding a MiCA CASP authorisation from a European member state cannot use that licence to serve Turkish users. The Turkish SPK regime is entirely domestic in its scope, and a separate SPK authorisation is required for the Turkish market regardless of how many other licences a business holds.
This is one of the first things a group-level general counsel needs to understand when building a multi-market strategy. The group may be authorised by VARA in Dubai, licensed under the MAS Payment Services Act in Singapore, and registered with the FCA in the United Kingdom – and still be fully unlicensed, and therefore exposed, in Turkey if it accepts Turkish users.
The inverse is equally important. A Turkey-headquartered exchange seeking to serve clients in the EU must hold a MiCA CASP authorisation in a member state, because the EU's regime applies on the user-facing side. MiCA, which is supervised by ESMA at the European level and national competent authorities at the state level, does not give weight to non-EU licences as a substitute for authorisation. Operators we advise on outbound expansion from Turkey are routinely surprised by this – the common assumption is that a domestic licence provides some form of international recognition. It does not.
For a business sitting between Turkey and a Gulf hub such as Dubai or Abu Dhabi, the legal question turns on which entity holds which activity licence, where client assets are custodied, and where order execution actually occurs. These are substance questions, not form questions. Group structures where a Dubai-licensed entity routes orders through a Turkish entity – or vice versa – require careful analysis under both the VARA regime and the SPK rules to ensure no activity falls into a gap.
AML, the Travel Rule, and SPK's Compliance Expectations
Turkey's AML/CFT compliance requirements for crypto-asset service providers are grounded in the country's FATF membership and its domestic financial crimes legislation. SPK-licensed CASPs are regulated entities for AML purposes and must maintain a compliance programme that meets both the SPK's rules and the requirements of Turkish financial crimes regulation.
The Travel Rule, as applied in Turkey, requires that originator and beneficiary information accompanies crypto-asset transfers above the applicable de-minimis threshold. The precise threshold is set in Turkish regulation and is subject to revision – operators should confirm the current figure against the applicable rules at the time of implementation, as it is not a fixed universal number and it has been adjusted in comparable regimes. What is fixed is the principle: transfers above the threshold must carry the data, and licensed CASPs must have the technical infrastructure to send and receive Travel Rule messages across counterparty platforms.
In our cross-border practice, we regularly advise clients that Travel Rule implementation is a technical and legal compliance challenge that sits underneath the licensing layer. A business can obtain SPK authorisation and then face a secondary enforcement risk if its Travel Rule messaging system is inadequate. The two must be built in parallel. Compliance with FATF Recommendation 15 is not satisfied by a policy document – it requires a working data-exchange mechanism and counterparty onboarding protocols.
Sanctions screening is a related and equally critical requirement. Turkish CASPs are required to screen against applicable sanctions lists and to maintain records sufficient to demonstrate ongoing monitoring. Given Turkey's position at the intersection of several geopolitically complex corridors, sanctions exposure in the Turkish crypto market requires active management, not a one-time setup exercise.
Banking and Financial Infrastructure for Turkey-Licensed CASPs
Securing a banking relationship is one of the most operationally challenging aspects of running a licensed CASP in Turkey. Turkish banks have historically taken a cautious approach to crypto-business clients, and while SPK authorisation improves the position of a licensed entity relative to an unlicensed one, it does not guarantee account access.
Operators we advise approach banking as a parallel work-stream to licensing, not a downstream consequence of it. The banking pitch requires a clear compliance narrative: the SPK licence, the AML programme, the beneficial ownership structure, the source-of-funds documentation and the transaction monitoring architecture. A bank that is satisfied on compliance is more likely to onboard a licensed CASP than one presented with a licence certificate alone.
The Turkish regulatory environment also intersects with EU and US correspondent-bank concerns. A Turkish CASP that handles fiat in euros or US dollars is operating through correspondent networks that carry their own compliance expectations, often aligned with FCA, ESMA or FinCEN standards. That means a Turkish-licensed business with European or US dollar settlement rails needs to satisfy not only SPK requirements but also the compliance expectations of the foreign correspondent institutions in its payment chain.
For groups that combine a Turkish entity with an offshore structure – for example, a BVI or Cayman holding company above the Turkish operating entity – the banking layer requires a consolidated view of the group's AML and regulatory posture across all jurisdictions. Allied counsel in the relevant jurisdiction assist us in ensuring the offshore elements of the structure satisfy local requirements without creating friction for the Turkish banking relationship.
If a banking relationship has been closed or a licence application has stalled, a structural review can identify the underlying cause and map the path back. To discuss your situation, write to info@oboluslaw.com or message us via t.me/oboluslaw.
How Does Turkey Compare to Other Licensing Hubs for Inbound Operators?
For an operator choosing between a Turkish presence and an alternative licensing hub, the comparison is not straightforward – because Turkey is primarily a market-access licence, not a passporting hub. The decision architecture is different from, say, choosing between Malta and Lithuania for EU access under MiCA.
An inbound operator assessing Turkey should ask the following questions in sequence. First, is Turkey a target market – meaning, are Turkish users a meaningful part of the intended customer base? If yes, the SPK licence is not optional. Second, is Turkey the best seat for the operating entity, or is the intent to access the Turkish market from an offshore entity? If the latter, the operator still needs SPK authorisation to serve Turkish users, and the offshore entity must be structured to satisfy SPK substance requirements. Third, does the business require passportable EU access? If yes, Turkey cannot provide it, and a MiCA CASP authorisation in a member state is required alongside any Turkish registration.
Compared to the VARA regime in Dubai, the Turkish SPK regime is more prescriptive in its documentation and capital requirements and has a shorter operational track record as a licensing authority. VARA has established a detailed activity-based rulebook with published fees and timelines. SPK's published framework is more recently built, and some secondary guidance is still emerging. That is not a disqualifying factor – it is a market-entry consideration that affects how an operator sequences its application and manages the timeline uncertainty.
Compared to the AIFC in Kazakhstan – which uses a common-law framework within a special economic zone – the Turkish SPK regime is a mainstream capital-markets supervisor operating under civil-law principles. For a business that needs common-law contractual infrastructure alongside the regulatory licence, the AIFC framework may be more appropriate. For a business whose primary need is access to the Turkish retail and institutional market, SPK authorisation is the answer regardless of how other hubs compare on process efficiency.
A micro-matter from our practice is instructive here. In a recent licensing mandate, a European payments group sought to expand into Turkey after obtaining a MiCA CASP authorisation in the EU. The group assumed – incorrectly – that the EU licence would support a light-touch Turkish registration. We advised that a full SPK application was required and worked with the client to restructure the Turkish subsidiary's governance to meet SPK fitness standards. The application was submitted in a single filing round and proceeded without a clarification round. Early structural preparation was the operative factor.
A Common Assumption About Offshore Licensing
A common assumption among operators expanding into Turkey is that a well-regarded offshore licence – a Cayman VASP registration, a BVI FSC authorisation or a Singapore MAS licence – provides a sufficient compliance basis for serving Turkish users. It does not. The SPK licensing obligation is engagement-based and user-facing. An offshore licence demonstrates that a business has met another regulator's standards; it does not substitute for Turkish authorisation and does not shield the business from SPK enforcement action directed at unlicensed activity.
This is not unique to Turkey. Most major retail crypto markets now have their own domestic licensing requirements that operate independently of offshore structures. The era when a single offshore licence could serve as a global compliance solution has effectively ended in the jurisdictions that matter commercially. MiCA in the EU, the SFC VATP regime in Hong Kong, MAS in Singapore, and SPK in Turkey all apply on the user-facing side, regardless of where the entity sits.
We map the full licence stack – operating, custody and payment layers – across all jurisdictions where a client's users are located before any structural commitment is made. That mapping exercise is the most cost-effective compliance investment a scaling operator can make, because it identifies multi-jurisdiction licensing obligations before the business has committed to a structure that cannot easily accommodate them.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – the firm's full cross-jurisdictional licensing practice, covering 70+ regulatory regimes.
- Digital-Asset Custody Licensing in the Cayman Islands – offshore custody structures and CIMA registration under the Cayman VASP Act.
- Corporate Bank Account Opening in ADGM – banking access for digital-asset businesses in Abu Dhabi's financial free zone.
FAQ
How long does a crypto licence take to obtain?
In Turkey, the SPK authorisation process is measured in months rather than weeks. The exact timeline depends on the completeness of the application, the complexity of the ownership structure and any clarification rounds the SPK initiates. Comparable jurisdictions at a similar stage of regulatory development typically see timelines ranging from several months to over a year for complex applications. Preparation quality – a complete, well-organised file submitted in Turkish – is the most significant controllable factor in the timeline.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on where your users are located, which activities you intend to conduct, your capital structure and your banking requirements. A business serving Turkish users needs SPK authorisation regardless of where it is incorporated. A business seeking EU passporting needs a MiCA CASP authorisation. Most commercially significant operations require a stack of licences across multiple regimes, not a single jurisdiction. We map that stack before any structural commitment is made.
Do I need a separate custody licence?
In Turkey, custody of crypto assets on behalf of clients is a regulated activity under the SPK framework, and an operator providing custody must hold the appropriate authorisation for that activity. Whether a separate licence is required – or whether custody can be covered within a combined CASP authorisation – depends on the scope of the application and the SPK's current rules for the relevant activity category. In other jurisdictions, custody is frequently a standalone regulated activity requiring its own capital and safeguarding standards. Each market must be assessed individually.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit – so structural decisions are made with a complete picture of the obligations they carry. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when enforcement action is required. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in multi-jurisdictional CASP authorisation, VASP registration and the cross-border licence stacks that support digital-asset businesses operating across emerging and established regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.