Operating a virtual asset service provider (VASP) in Turkey without genuine economic substance is one of the fastest ways to lose a licence, a bank account, and access to regulated counterparties simultaneously. Turkey's Capital Markets Board – the Sermaye Piyasası Kurulu, or SPK – supervises VASP authorisation under the framework that entered force with amendments to the Capital Markets Law in 2024. The SPK's approach is explicit: a licence holder must maintain real, verifiable presence in Turkey. A brass-plate address is not presence. The analysis below maps what substance actually means in this regime, how it interacts with cross-border structures, and where the decision points sit for an inbound operator.
Turkey sits at the intersection of two regulatory realities. Domestically, the SPK has built an authorisation regime that mirrors the substance expectations of leading EU and Gulf hubs. Internationally, Turkey is a FATF member, and the Financial Action Task Force (FATF) Recommendation 15 framework – requiring that VASPs be licensed or registered in the jurisdictions where they are established – makes a nominal registration without substance a direct AML compliance problem. For a business serving Turkish users, the question is not whether substance is required. It is how much, in which form, and at what cost.
What Turkey's VASP Regime Actually Requires
The SPK's VASP regime establishes authorisation as a precondition for operating a crypto-asset service platform in Turkey, and substance is embedded in that authorisation standard rather than bolted on afterward. Under the applicable provisions of the Capital Markets Law as amended, the SPK assesses whether an applicant has the organisational capacity, the technical infrastructure, and the human resources to operate a regulated business. The regime does not permit a foreign entity to serve the Turkish market from abroad by relying on a licence in another jurisdiction; a Turkish-incorporated entity holding a Turkish authorisation is the required vehicle.
The substance expectations map across several dimensions. A physical office in Turkey, staffed by locally resident personnel who hold the relevant competencies, is a baseline expectation. Management presence matters: the SPK expects decision-making functions – compliance, risk, technology oversight – to be performed in Turkey, not delegated entirely to a foreign parent. The technical systems underpinning trading, settlement and custody must meet the SPK's operational standards, and the entity must maintain the capital and liquidity buffers the regulator sets for its licence category. Those numeric thresholds are set by the SPK and reviewed periodically; they should be confirmed against current SPK guidance at the time of application.
The SPK evaluates substance at the point of authorisation and on an ongoing supervision basis. A licence granted to an entity that subsequently hollows out its local presence is subject to suspension or revocation. That ongoing exposure is why substance planning must be treated as a recurring obligation, not a one-time box-check.
For a scoped assessment of your licensing structure before you submit to the SPK, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the user base geography, the banking relationships, the custody model – change the analysis. Map your options.
What Counts as Substance Under the SPK's Lens
Economic substance in the Turkish VASP context means a combination of organisational, operational and financial indicators that, taken together, demonstrate genuine establishment in Turkey. The SPK does not publish a fixed checklist, but practice across the leading regulatory hubs – including the VARA regime in Dubai and the MiCA CASP regime in the EU – has converged on a set of indicators that Turkish regulators apply in analogous form.
The core indicators are as follows. First, a registered office that is genuinely occupied and accessible to regulators for inspection. A serviced-office address used solely for mail does not meet this standard. Second, at least a minimum headcount of locally resident, qualified employees whose roles correspond to the regulated activities. A compliance officer domiciled in Turkey, a technical lead with access to the platform's core systems, and a senior manager with decision authority are the irreducible minimum that the SPK expects to verify. Third, management meetings conducted in Turkey, with minutes and records available for review. Fourth, material contracts – particularly infrastructure, banking and custody arrangements – entered into by the Turkish entity rather than assigned down from a foreign parent.
In our experience advising on licence structures in multiple jurisdictions, the most common substance deficiency is the compliance function. Businesses staff the revenue-generating side locally but route the compliance officer and the MLRO through a cheaper offshore hub. Under the SPK regime, and under FATF standards that Turkey has committed to implement, that structure fails the substance test. The compliance and AML function must sit inside the regulated entity in Turkey.
How Cross-Border Structures Interact With the Substance Requirement
Most operators targeting Turkey do not begin as purely domestic businesses. They arrive with an existing group structure – a holding entity in the BVI, a technology subsidiary in Eastern Europe, a payment rail in the EU – and need to understand how the Turkish VASP sits inside that architecture without creating substance gaps or unintended regulatory perimeters.
The critical interaction is between the Turkish entity and any group entity that performs functions on its behalf. If a foreign affiliate provides technology services, those services should be governed by a documented intra-group agreement at arm's length. If a foreign affiliate holds the primary banking relationship, the SPK will want to understand why the Turkish entity cannot maintain its own. If the Turkish entity routes client assets to a foreign custodian, the custody chain must be disclosed and approved. Every functional dependency between the Turkish licensee and the wider group is a potential substance gap that the SPK may identify on inspection.
The cross-border dimension also engages Turkish corporate tax. Turkey's transfer pricing rules – aligned to OECD standards – require that intra-group services be priced at arm's length. A Turkish VASP that pays management fees to a foreign parent for services that are actually performed in Turkey will attract scrutiny from the Turkish Revenue Administration (GİB) as well as from the SPK. The substance requirement and the transfer-pricing regime are, in practice, pointing at the same question: is the Turkish entity a real business, or a conduit?
Operators we advise regularly underestimate the banking interaction. Turkish banks have heightened due diligence expectations for crypto businesses, and a newly licensed VASP that cannot demonstrate genuine local operations will struggle to open and maintain the corporate accounts required to process Turkish lira. A substance structure built for regulatory compliance also, therefore, serves the banking narrative.
What Does the SPK Application Process Look Like?
The SPK application for VASP authorisation follows a structured review process that proceeds in several phases, each carrying its own documentation burden and potential for requests for additional information. The process is not brief: operators should plan for a timeline measured in months rather than weeks. The exact duration depends on the completeness of the initial application, the complexity of the business model, and the volume of concurrent applications at the SPK.
The pre-application phase is the most consequential. Before submitting, the applicant must have incorporated the Turkish entity, established the physical office, and secured the core personnel. An application submitted before these elements are in place will be returned or stalled at the first review stage. We have seen businesses lose months by filing before the substance layer was ready.
The application package itself is substantial. It covers the business plan, the governance and ownership structure, the technology architecture documentation, the AML/KYC policies and procedures, the risk management framework, evidence of capital adequacy, and the CVs and background checks for key personnel. The SPK may request translations of foreign-law documents and apostilled corporate records for any non-Turkish group entities.
Once the application is accepted as complete, the SPK conducts its substantive review. Requests for additional information are common at this stage. After review, the SPK issues its authorisation decision. Post-authorisation, the entity moves into the ongoing supervision cycle, which includes periodic reporting obligations, capital adequacy monitoring, and the possibility of on-site inspections. The substance infrastructure built for the application must be maintained – and documented – throughout the supervision period.
If a prior application to a regulator stalled or your banking was closed after an initial licence attempt, a structural review can surface the reason and the route forward. Contact OBOLUS at info@oboluslaw.com or message us via t.me/oboluslaw. Map your options.
How Tax and Banking Sit Around the Turkish Licence
A Turkish VASP that passes the SPK's substance test is, by construction, a Turkish tax resident operating a regulated financial services business. That has concrete implications for the broader group structure. Turkey applies corporate income tax to the worldwide income of resident entities, though the specific rate and any applicable exemptions should be confirmed against current Turkish tax legislation at the time of planning. The Turkish Revenue Administration scrutinises intra-group arrangements that shift profit offshore, and a substance-compliant VASP that then strips its profits through royalties or management fees to a low-tax affiliate will attract transfer-pricing challenge.
VAT treatment of crypto-asset services in Turkey has evolved alongside the licensing regime. The current treatment – whether and how specific crypto-asset transactions attract VAT – should be assessed against the most recent GİB guidance and any implementing legislation that has followed the SPK framework. This is an area where the law is still developing, and where early structuring decisions can have lasting consequences.
On banking, the substance architecture directly supports the client relationship with Turkish correspondent banks. A VASP that can demonstrate SPK authorisation, a physical office, a resident compliance officer and a documented AML framework is materially better positioned in a Turkish bank's onboarding process than a foreign-licensed entity seeking to open a Turkish account from abroad. That said, individual banks retain discretion, and the banking strategy should be developed in parallel with the licence application rather than left for after authorisation is granted.
For operators maintaining a multi-jurisdiction structure – for example, a VARA-licensed exchange in Dubai that also seeks Turkish authorisation – the substance layer in Turkey must be genuinely separable from the Dubai entity. The SPK will look through a structure where the Turkish entity is operationally dependent on the Dubai parent for its core functions. Allied counsel in the relevant jurisdictions will need to confirm that the substance split does not inadvertently create a permanent establishment problem in Turkey for the Dubai entity.
What Are the Most Common Mistakes Operators Make on Turkish Substance?
The most frequent structural error is building the Turkish entity as a sales office while keeping all regulated activity abroad. This misunderstands the SPK regime. A Turkish authorisation is not a marketing licence. It authorises the performance of crypto-asset services in Turkey, and those services must be performed by the Turkish entity with Turkish-based functions. An entity that takes Turkish user registrations but routes all order matching, custody and settlement to a foreign affiliate is not operating within its Turkish authorisation.
A second common error is the single-officer substance structure. Some applicants appoint one person as compliance officer, MLRO, technology lead and director simultaneously. Regulators across the leading hubs – and the SPK follows this pattern – treat role accumulation in a small team as a governance risk rather than a substance indicator. A compliance officer who is also the only technical staff member cannot independently escalate concerns about the platform's risk systems. The SPK expects segregation of these functions at a minimum, even in a lean staffing model.
A third error – and this is one that surfaces late in the supervision cycle rather than at application stage – is allowing the substance infrastructure to degrade after authorisation. Operators who successfully staff a Turkish office for the application then gradually shift those employees to remote roles or redeploy them to other group entities. The SPK's ongoing supervision function exists precisely to detect this. A licence review triggered by a substance deficiency is considerably more damaging than getting the structure right at the outset.
In a recent structuring matter, a payments group sought Turkish VASP authorisation having already established a Gulf-based exchange. The initial structure routed compliance, technology and senior management through the Gulf entity, with the Turkish company acting as a referral conduit. We identified the substance gap early, restructured the intra-group services agreement, relocated the compliance function and redrove the banking narrative. The application proceeded on the revised structure. The cost of the restructuring was a fraction of the cost of a failed application and the attendant regulatory record.
Which Profile Should Choose Turkey, and on What Terms?
Turkey is not the right first-licence jurisdiction for every operator. The SPK regime is meaningful – it carries genuine substance obligations, capital requirements and ongoing reporting – and the Turkish market is large enough to justify that investment only for operators with real commercial intent toward Turkish users or the Turkish financial system.
Profile A: a regional exchange with existing operations in the Gulf or Eastern Europe, seeking to add Turkish retail users. This profile can justify the Turkish substance investment, because the commercial revenues from the Turkish user base will support the local office cost. The decision axis is whether the intra-group structure can be carved at the Turkey boundary without creating a tax or banking problem for the wider group. Timeline: a well-prepared application, where the substance layer is in place before filing, typically runs to several months of review.
Profile B: a token issuer or DeFi protocol that has Turkish users but no Turkish entity, assessing whether authorisation is required. The analysis turns on whether the protocol's activities constitute crypto-asset services under the Capital Markets Law as amended. If they do, serving Turkish users without authorisation is the risk that the SPK's enforcement posture is designed to address. The right approach here is a regulatory perimeter analysis before onboarding Turkish users at scale, not after.
Profile C: an offshore-licensed VASP (BVI, Cayman, or similar) that markets to Turkish users and relies on the offshore licence for its regulatory position. This profile carries the highest enforcement risk. The SPK does not recognise offshore licences as a substitute for Turkish authorisation where the operator is serving Turkish residents. The FATF framework reinforces this: FATF Recommendation 15 requires VASPs to be licensed or registered in the jurisdictions where they are established, which in substance means where they conduct business.
A common assumption is that a single offshore licence is sufficient to serve clients globally. It is not, and it has not been for some time. The leading regulatory hubs – including the SPK in Turkey, VARA in Dubai, the FCA in the UK and the MAS in Singapore – each assert jurisdiction over operators who serve users in their territory, regardless of where the operator is incorporated. The travel-rule and AML frameworks layer additional obligations onto cross-border activity. An operator relying on a single offshore registration to cover multi-jurisdiction activity is accumulating regulatory exposure in every jurisdiction it serves without a local licence.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – how we map the full licence stack across operating, custody and payment layers
- VASP licence application in Malta – the MiCA transition and what it means for EU-passported operations
- Pre-exit tax restructuring: a cross-jurisdiction comparison – structuring before a liquidity event across the major digital-asset hubs
FAQ
How long does a crypto licence take to obtain?
The timeline varies significantly by jurisdiction and application quality. In Turkey, a well-prepared SPK application – with substance infrastructure in place before filing – typically takes several months through the review cycle. Jurisdictions with more streamlined regimes may process applications more quickly. The most common delay in any jurisdiction is an incomplete initial submission, which resets the clock when the regulator requests additional information.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on where your users are, where your banking relationships will sit, your capital base, the activities you intend to conduct, and the tax consequences of each option. Turkey is appropriate for operators with genuine commercial intent toward Turkish users. For EU access, a MiCA CASP authorisation through a member state offers passport rights. For Gulf operations, VARA and the ADGM/FSRA regime serve different operator profiles. A licence-stack analysis mapped to your specific structure is the starting point.
Do I need a separate custody licence?
In most leading regimes, custody is a regulated activity distinct from exchange or brokerage. Under MiCA in the EU, custody and administration of crypto-assets is a separately authorised CASP activity. VARA in Dubai similarly categorises custody as a standalone regulated service. In Turkey, the SPK's framework addresses custody obligations within the VASP authorisation structure. Whether a separate instrument is required depends on the specific activities performed and the jurisdiction in question; operators should not assume that a trading licence covers custody without confirming this with current regulatory guidance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the structure you build is the one that survives regulatory scrutiny. Our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP authorisation strategies and multi-jurisdiction licence-stack design across the Gulf, EU and emerging markets.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.