What is a security token offering in Turkey, and what law governs it?
A security token offering (STO) in Turkey is the issuance of a blockchain-based token that confers rights equivalent to those of a traditional security – equity participation, debt entitlement, profit-sharing or a claim on an underlying asset. Under Turkish capital markets law, the governing authority is the Capital Markets Board of Turkey (CMB, or Sermaye Piyasası Kurulu), which has held for several years that tokenized instruments carrying securities-like rights fall within the scope of the Capital Markets Law and its subordinate regulations. This means that structuring an STO in or toward Turkey without CMB authorization exposes the issuer to enforcement action, regardless of how the token is labeled in a marketing document.
Turkey's digital-asset regime sits at an important junction. The country has a large, active retail crypto user base – one of the highest adoption rates in Europe and the Middle East by population – and the CMB has moved to regulate accordingly. A dedicated crypto-asset framework introduced by amendments to the Capital Markets Law brought cryptocurrency service providers under CMB supervision and established formal licensing for crypto asset service providers (CASPs) in Turkey. That same statutory foundation is the reference point for any token offering with a securities character. For inbound issuers, the practical question is not whether Turkish law applies, but how to structure the offering so it either complies with that law or is demonstrably outside its reach.
This page maps the regulated basis, the structuring options, the cross-border interaction with banking and tax, and the decision points a general counsel or founder must work through before proceeding.
How does Turkey classify tokens for regulatory purposes?
Token classification in Turkey, as in most serious jurisdictions, turns on the substance of the rights conferred – not on the label applied in a whitepaper or marketing deck. The CMB has made clear that a token presenting economic rights associated with a capital markets instrument will be treated as one, irrespective of what it is called. This is the foundational rule, and it is the rule that most first-time issuers underestimate.
Three working categories emerge from CMB guidance and the broader legal environment. First, crypto assets in the general statutory sense – digital assets distributed or traded on electronic platforms, which the CMB now supervises under the amended Capital Markets Law. Second, tokens that mirror traditional capital markets instruments – shares, debt securities, fund units or revenue-sharing instruments – and which the CMB treats as falling directly under its securities regime. Third, tokens that are purely functional (payment utilities with no investment expectation), which occupy a different, and currently less clearly defined, regulatory space.
The difficulty for most issuers is that tokens rarely sit neatly in one category. A token promising staking rewards based on platform revenue, a governance token with profit-sharing mechanics, or a fund-linked token backed by real-world assets will each attract CMB scrutiny on the securities question. In our cross-border practice, we regularly advise issuers who have drafted a whitepaper framed around utility but whose token economics clearly signal an investment product. Substance-over-form analysis – examining the actual rights, the economic incentive structure and the reasonable investor expectation – is the correct analytical approach under Turkish law and under the international standards the CMB references.
The cross-border dimension compounds this. A token issued from a BVI or Malta entity but marketed to Turkish retail investors will attract CMB jurisdiction over the offering activity, even if the issuer itself has no Turkish presence. Operators we advise routinely discover this jurisdictional reach only after distribution has begun.
For a scoped classification analysis of your token economics and rights structure, contact OBOLUS at info@oboluslaw.com. The process above describes the standard analytical path. Your specific token mechanics, your target investor base and your issuing entity's domicile all shift the analysis materially. Map your options.
What does the Turkey CASP regime require for token issuers?
The 2024 amendments to Turkey's Capital Markets Law established a CASP licensing framework that brought exchanges, custodians and other digital-asset intermediaries under direct CMB oversight. For token issuers, the CASP framework is relevant in two distinct ways: first, as the legal basis governing any Turkish platform through which the tokens will trade; and second, as the regulatory context that shapes what issuance activities require their own CMB authorization.
A token issuer that also operates its own trading or custody infrastructure in Turkey – or that white-labels such functionality – will need to engage the CASP licensing requirements directly. An issuer that confines itself to the offering and relies on separately licensed Turkish CASPs for the secondary market interaction faces a different but still substantive compliance path: it must ensure the offering itself, including the whitepaper and investor communications, meets CMB standards for public offers of capital markets instruments.
The CMB's approach to public offerings of securities – including tokenized securities – requires an approved prospectus or similar disclosure document for offers to the public above threshold sizes. The precise thresholds and exemption categories are set in CMB communiqués and are subject to periodic revision; any issuer should verify the current position directly with Turkish counsel at the time of planning. What remains constant is the structural requirement: a Turkish public offering of a securities-like token without CMB approval is not a viable path for a regulated business.
For issuers who are not seeking a Turkish public offering but whose tokens will nonetheless reach Turkish investors through secondary trading, the key structural work involves documenting that the primary offering was lawfully conducted outside Turkey – and that no solicitation directed at Turkish residents occurred in a way that activates the CMB's jurisdiction over the offer itself.
How should an STO be structured for an operator looking at Turkey as part of a wider distribution?
Most international STO issuers approaching Turkey do so as part of a multi-jurisdiction distribution, not a Turkey-only raise. That fact reshapes the structuring question. The issuer's primary compliance obligation runs to its domicile jurisdiction and to the jurisdictions where it actively solicits investors; Turkey's CMB is one of several regulators whose reach must be assessed and managed.
A workable cross-border structure for an STO with potential Turkish investor participation typically has three layers. The first is the issuing entity and its home jurisdiction – the domicile governs the primary offering, the whitepaper obligations and the passporting or exemption regime available. For EU-passported offerings, MiCA (the EU's Markets in Crypto-Assets Regulation) creates a whitepaper and CASP framework that covers crypto-assets broadly, while tokenized securities that qualify as financial instruments remain within MiFID II rather than MiCA. For issuers using an offshore vehicle – BVI, Cayman, ADGM – the applicable disclosure obligations and investor eligibility rules differ materially.
The second layer is the investor eligibility and jurisdictional restriction mechanism. A well-structured STO specifies which jurisdictions are expressly excluded from the offering, where offering exemptions apply (accredited or professional investors only, for instance) and what technical restrictions apply to prevent unauthorized distribution. Turkey is typically addressed at this layer: either the offering is expressly restricted to Turkish residents, with onward secondary-market access managed through licensed CASPs, or the offering is structured around a professional-investor exemption that reduces the CMB's public-offer obligations.
The third layer is the ongoing compliance architecture – reporting obligations to the CMB if Turkish investors are present above threshold levels, secondary market monitoring and the record-keeping obligations that AML/CFT requirements impose under the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) as implemented in Turkey's own AML framework.
In our practice, we have seen structures collapse at the second layer because the issuer treated jurisdictional restrictions as a legal formality rather than an operational control. A restriction that appears in the whitepaper but is not enforced at the point of onboarding – through verified investor classification, geofencing and KYC – provides no meaningful protection against CMB enforcement.
A cross-border structuring matter: token rights reclassification
In a recent cross-border matter, a technology company domiciled outside Turkey had launched a token initially classified as a utility instrument, with governance rights and access to a software platform as the stated use case. By the time secondary-market trading had begun, the token had accrued revenue-share mechanics and the project team had publicly committed to quarterly distributions. We were engaged to assess the classification risk and the exposure to the CMB's securities regime. Working with the issuer's local counsel in the home jurisdiction and allied counsel in Turkey, we identified the specific token provisions that had shifted the instrument into securities territory under a substance-over-form analysis. The restructuring involved unwinding the distribution mechanics through a token amendment process and introducing a replacement instrument with clearly delineated utility functions. The process was completed over a period of several weeks and the issuer was able to re-engage Turkish CASP partners on a compliant basis. No enforcement action resulted.
What are the banking and tax interactions for an STO issuer with Turkish exposure?
The cross-border banking and tax picture for an STO issuer is often as consequential as the securities law question – and frequently more immediately disruptive to a transaction timeline.
On banking: Turkish crypto regulations include requirements affecting how proceeds of token sales are handled by Turkish financial institutions. An issuer expecting to receive fiat proceeds from Turkish investors through Turkish bank accounts will need to confirm that the receiving institution's internal policies permit crypto-related inflows and that the applicable CMB and banking regulatory requirements have been met. In practice, many Turkish banks apply conservative policies to crypto-related transactions; issuers we advise routinely route proceeds through accounts in jurisdictions with more developed crypto-banking infrastructure – Malta, Lithuania, or the DIFC – before repatriating or deploying capital.
On tax: Turkey applies income tax and corporate tax to gains from crypto-asset transactions, with the specific treatment of different token types depending on how they are characterized for tax purposes. A token that is treated as a security for CMB purposes will generally attract a different tax analysis than one treated as a payment crypto-asset. The Turkish Revenue Administration has issued guidance on crypto-asset taxation, and this area continues to evolve; an issuer should obtain a current tax opinion from Turkish counsel before finalizing the offering structure. Transfer pricing considerations become relevant where the issuing entity is part of a group with Turkish affiliates or where the Turkish operations derive revenue from the token ecosystem.
For groups structured through BVI or Cayman holding companies, the interaction between the home jurisdiction's tax regime, the Turkish withholding requirements and the EU tax information exchange obligations (where EU member-state investors are present) creates a layered compliance obligation that must be modeled before the offering launches, not after.
If the banking or tax layer of your structure has stalled the timeline, OBOLUS can review the architecture and identify the route forward. Write to info@oboluslaw.com or message us via t.me/oboluslaw. If a prior application stalled or a banking relationship was refused, a second read of the structure often surfaces the reason. Map your options.
What are the most common structural mistakes in a Turkey-facing STO?
A common assumption is that affixing a utility label to a token – calling it an access token, a governance token or a platform credit – resolves the classification question in Turkey as it might in a less rigorous environment. It does not. The CMB has demonstrated both the legal tools and the supervisory intent to look through labels to the economic substance of the instrument. An issuer that relies on the label rather than the analysis is exposed from the moment the whitepaper is published.
Four other structural mistakes appear with regularity in our cross-border practice.
First, treating Turkish investor participation as a secondary compliance concern – addressed by a line in the terms and conditions rather than an integrated jurisdictional analysis. The CMB's reach to offshore offering activity targeting Turkish residents is well established.
Second, launching the offering before the token amendment and governance documentation is finalized. Token terms are contracts; amending them post-launch requires investor consent mechanisms that are technically and legally complex, as the micro-matter above illustrates.
Third, failing to document the professional or institutional investor exemption in a way that the CMB would find credible. An exemption claimed on paper but not operationalized through rigorous KYC and investor classification will not protect the issuer on examination.
Fourth, assuming that a MiCA whitepaper (for EU-domiciled issuers) satisfies Turkish disclosure obligations. MiCA and the CMB's requirements are separate regimes. A MiCA-compliant whitepaper is a strong foundation, but it does not discharge Turkish prospectus or investor protection obligations where those apply.
Self-assessment checklist for an STO with Turkish exposure
Before engaging counsel, a general counsel or founder can work through the following questions to frame the scope of the legal analysis required.
Does the token confer any right to share in profits, revenues or residual value of the issuing entity or project? If yes, the CMB's securities analysis applies and professional legal review is essential before any public communication.
Will the token be actively marketed to residents of Turkey, or will Turkish residents be able to participate through secondary-market trading on a Turkish CASP? Each scenario carries distinct obligations.
Is the issuing entity domiciled in an EU member state, the UAE, Singapore or another jurisdiction with a defined crypto-asset regulatory regime? The home regime determines the primary disclosure obligations and the extent to which Turkish obligations are additive or exclusive.
Does the offering structure rely on a professional or institutional investor exemption in Turkey? If so, has the KYC and investor classification process been designed to operationalize that exemption from day one of the offering?
Has a Turkish tax and banking analysis been commissioned alongside the securities law work? The three disciplines interact and should not be sequenced as if independent.
If the answer to any of these questions is uncertain, the structuring work has not yet reached a stage where the offering can safely proceed.
Related at OBOLUS
- Token offerings and securities for digital-asset businesses – our practice overview covering classification, structuring and regulatory counsel for issuers globally
- Token sale agreement drafting for institutional clients – drafting and negotiation of institutional-grade token purchase and sale agreements
- Transfer pricing for crypto groups in the British Virgin Islands – intra-group pricing analysis for offshore crypto holding structures
FAQ
Is my token a security?
Whether a token is a security turns on the substance of the rights it confers, not its name or the intentions of its issuer. Turkish capital markets law, like most serious regulatory regimes, applies a substance-over-form test: if the token delivers profit expectations, revenue-sharing or claims on issuer assets, the CMB is likely to treat it as a capital markets instrument. Classification must be assessed against the actual token economics, the governance rights and the reasonable expectations of a typical purchaser.
Do I need a MiCA whitepaper?
A MiCA whitepaper is required for crypto-asset issuances within the scope of the EU's Markets in Crypto-Assets Regulation, issued by or directed at the EU/EEA market. If your issuing entity is EU-domiciled, or if you are actively distributing to EU investors, MiCA obligations apply. For Turkey, the CMB operates a separate disclosure and approval regime; a MiCA whitepaper does not substitute for Turkish regulatory compliance. Cross-border issuers typically need to satisfy both regimes independently.
How should an airdrop be structured legally?
An airdrop – a gratuitous distribution of tokens to wallet addresses, typically for promotional or community-building purposes – appears deceptively simple. Legally, the key questions are whether the distributed tokens qualify as securities (which would make even a gratuitous distribution subject to securities law), whether AML/KYC obligations apply to recipients, and whether the airdrop constitutes a taxable event in the recipient's jurisdiction. In Turkey, both the CMB and the Turkish Revenue Administration's position on airdrops should be confirmed before distribution begins.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise crypto exchanges, custodians, token issuers and funds on licensing across more than 70 jurisdictions, on disputes and on-chain asset recovery across more than 25 forums, and on the tax, banking and compliance obligations that sit around them. We assess token classification against the substance of rights, not the marketing label – which is how regulators examine the question. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specializing in token structuring, smart-contract legal analysis and cross-border STO compliance for issuers and funds.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.