Operating a virtual asset service provider (VASP) in Turkey without the correct regulatory authorisation exposes the business to enforcement action, suspended banking relationships and potential exclusion from the market. Turkey's crypto licensing regime is relatively young but moving fast. The Capital Markets Board of Turkey (SPK) became the primary supervisor of crypto asset service providers under legislation enacted in 2024, creating a formal authorisation track for exchanges, custodians and related businesses. Understanding what that regime demands – and where it intersects with cross-border banking, tax and AML obligations – is the first decision any inbound operator must make.
This page sets out the regulated perimeter, the authorisation process, the compliance obligations that follow, and the practical questions a business should resolve before applying.
What Activities Require a VASP Licence in Turkey?
Turkey's crypto asset legislation defines a broad regulated perimeter: any business that offers custody, trading, transfer or exchange services involving crypto assets to clients in Turkey must obtain authorisation from the Capital Markets Board (SPK). The regime applies to both domestic operators and foreign businesses serving Turkish residents through digital channels. Operating without authorisation – or while an application is pending without a transitional permission – is a criminal and regulatory offence under the applicable provisions of Turkish capital markets law.
The categories of regulated activity follow a functional logic. A platform that matches buyers and sellers of crypto assets is an exchange – the most scrutinised category. A business that holds private keys on behalf of clients falls under custody. A service that moves crypto assets between wallets or accounts on instruction is a transfer provider. Each functional category carries distinct capital adequacy expectations, personnel requirements and ongoing reporting duties.
In our practice, one of the first questions an inbound client asks is whether a foreign licence – an EU CASP authorisation under MiCA, a VARA licence from Dubai, or a MAS licence from Singapore – provides any cover for serving Turkish users. The answer is no. Turkey has not signed mutual recognition arrangements with any major crypto-licensing jurisdiction. A business that routes Turkish retail clients through an offshore entity is not exempt; it is unlicensed in Turkey and exposed to enforcement from the SPK.
The practical implication is that any serious operator targeting the Turkish market must plan for local authorisation. For businesses that also hold or seek EU, DIFC or Singapore authorisation, the Turkish licence sits alongside those frameworks rather than being replaced by them. Mapping that multi-layer stack before committing to a structure is essential – and is consistently where businesses that try to manage the process without specialist counsel run into the most time-consuming and expensive problems.
The process above describes the standard perimeter. Your entity structure, user base and banking setup change the analysis in ways that are not always obvious from the legislation itself. For a scoped assessment of whether your current or planned activities require Turkish VASP authorisation, contact OBOLUS at info@oboluslaw.com.
What Suitability and Structural Requirements Does the SPK Impose?
The SPK's authorisation criteria for crypto asset service providers cover four broad areas: corporate form, shareholding and management fitness, technical infrastructure, and financial adequacy. Each area carries conditions that a foreign-owned business or a startup without Turkish banking history may find harder to satisfy than the headline criteria suggest.
On corporate form, the SPK requires that applicants be incorporated as joint-stock companies (anonim şirket) under Turkish commercial law. A branch of a foreign entity or a limited-liability company does not satisfy the form requirement. Businesses that operate through a European holding structure need to establish a standalone Turkish subsidiary, which has direct implications for group consolidation, intra-group loan arrangements and the tax treatment of management fees passed upstream.
Management and shareholder fitness involve background checks on beneficial owners, directors and key personnel. The SPK applies a substance-over-form test: it examines whether the individuals who hold significant influence over the business – regardless of their formal titles – meet the good-standing, experience and integrity criteria. For group structures where control rests with a foreign parent, this means the parent's ultimate beneficial owners will be reviewed. That process can extend the timeline where beneficial ownership is complex or layered through intermediate holding companies.
Technical requirements address cybersecurity, hot and cold wallet management, business continuity and client data protection. The SPK has published guidance aligning these expectations broadly with international standards for crypto-asset trading systems. Applicants must demonstrate – typically through third-party audit reports and a technology due-diligence file – that their systems meet the required standards before authorisation is granted.
Financial adequacy encompasses minimum paid-in capital and, for certain categories, ongoing own-funds requirements. The precise thresholds are published by the SPK and subject to revision; we write qualitatively here because the figures are set by regulatory instrument and should be confirmed against current SPK guidance at the time of application. What is consistent across all categories is that the capital must be held in Turkey, unencumbered, and demonstrably available to the business at the point of application.
How Does the VASP Authorisation Process Work in Turkey?
The Turkish VASP authorisation process runs through the SPK in a staged sequence: a pre-application review, formal submission of the application dossier, the SPK's fitness assessment, and issuance of the licence or a reasoned refusal. Businesses that approach the SPK without a complete dossier – a common mistake in the first wave of applications under the new regime – face formal deficiency notices that restart the review clock.
Pre-application engagement with the SPK is informal but strategically important. Operators we advise regularly use this stage to map the SPK's current interpretation of technical requirements and to identify whether any aspect of the planned business model – such as staking rewards, tokenised yield products or fiat on-ramp arrangements – may be treated as an additional regulated activity requiring separate disclosure or authorisation. That conversation typically surfaces issues that would otherwise cause delays at the formal submission stage.
The formal application dossier includes: the incorporation documents of the Turkish entity; shareholder and beneficial ownership disclosures; CVs, criminal-record checks and financial-standing declarations for all qualifying persons; the technical architecture and cybersecurity documentation; the AML/CFT policy and programme; the proposed client-facing terms and risk disclosures; and evidence of minimum paid-in capital. For businesses that already hold a licence in another jurisdiction, submission of that licence and any supervisory correspondence can demonstrate regulatory good standing and may reduce the SPK's due-diligence burden, though it does not substitute for any Turkish-specific requirement.
Timeline varies. The SPK's published indicative periods have been, in practice, subject to extension where dossiers are incomplete or where the applicant's business model raises questions the SPK's review team has not addressed in earlier decisions. Operators should plan for a process that takes a number of months rather than weeks. Building a realistic project timeline – with milestones for corporate setup, capital injection, technical audit and staff vetting – is one of the first things we do with a new licensing client.
Businesses that were already operating in Turkey when the new authorisation requirement came into force were given a transitional window to apply. That window has a defined end-point. Operators that did not apply within the transition period are not in a grandfathered position; they are unlicensed and subject to the full enforcement posture of the SPK.
What AML, KYC and Travel Rule Obligations Apply?
Turkish crypto asset service providers are subject to the full suite of AML and counter-terrorism financing (CTF) obligations under Turkish financial crime legislation, with the Financial Crimes Investigation Board (MASAK) acting as the AML supervisor alongside the SPK's prudential oversight. The Travel Rule – the obligation to pass originator and beneficiary data with each transfer of virtual assets – applies to transfers above the applicable threshold set in Turkish regulation, consistent with the FATF Recommendation 15 baseline that Turkey, as a FATF member, has committed to implement.
In practice, compliance with the Travel Rule requires technical solutions: a VASP-to-VASP messaging protocol (such as TRISA or a compatible system) to transmit the required data, a counterparty due-diligence process for unhosted wallets, and a sanctions screening workflow that covers both Turkish designations and international lists including OFAC and EU consolidated lists. For exchanges that operate across multiple jurisdictions, the screening stack must aggregate all applicable lists – a point that is often underweighted in compliance programmes designed primarily for a domestic market.
MASAK has shown a willingness to issue significant administrative sanctions for AML deficiencies. Businesses that have operated in Turkey informally – including those that served Turkish users through offshore entities without local authorisation – should treat the authorisation and AML remediation processes as a single workstream. Coming into licence while carrying unresolved AML gaps is not a clean start; the SPK and MASAK have mechanisms to look back at pre-authorisation conduct during the fitness review.
For businesses with cross-border operations, Turkey's AML expectations interact with the regimes of the other jurisdictions in which the business holds licences. An EU-authorised CASP passporting across the EEA under MiCA must also satisfy MiCA's AML requirements – and, separately, Turkish AML requirements for Turkish clients. The two regimes are broadly aligned in principle but differ in some procedural specifics. Operators we advise on multi-jurisdictional compliance consistently find that building a single harmonised AML programme – with jurisdiction-specific overlays – is more efficient and more defensible than running parallel, siloed programmes.
How Does Turkish Banking Interact With Crypto Licensing?
Banking access is one of the most operationally critical – and most frequently underestimated – elements of the Turkish crypto licensing process. Turkish banks have historically maintained a cautious posture toward crypto businesses, even those that are SPK-licensed. Obtaining a business bank account, a fiat settlement account and a client-money account from a Turkish bank requires a parallel engagement process that should begin before the SPK application is filed, not after the licence is granted.
The key factors Turkish banks assess include: the identity and standing of the entity's beneficial owners; the source of the startup capital; the jurisdictions in which the business's counterparties are located; and the AML programme the business operates. Banks in Turkey are themselves supervised by the Banking Regulation and Supervision Agency (BDDK) and are sensitive to the risk of facilitating any unlicensed crypto activity. A demonstration that the SPK application is well advanced – with a complete dossier filed and no deficiency notices outstanding – strengthens the banking application materially.
For businesses that hold fiat balances on behalf of clients, the question of client-money segregation is important. Turkish regulation under the new VASP framework addresses the separation of client assets from the operator's own assets, and the structure of those accounts must be established in a way that satisfies both the SPK's prudential expectations and the bank's own internal policy on crypto-related accounts.
Cross-border banking adds another layer. Many Turkish VASP applicants are subsidiaries of groups that bank primarily in Europe, the UAE or Singapore. Intra-group fund flows – capital contributions, management-fee payments, inter-company settlements – must be documented in a way that satisfies Turkish foreign-exchange regulations as well as the AML expectations of both the sending and receiving jurisdictions. Where the group's banking is located in a jurisdiction that applies enhanced due diligence to crypto businesses, those correspondent banking relationships can create additional scrutiny for the Turkish entity's account applications.
If a prior banking application was declined or a banking relationship was withdrawn, identifying the structural reason matters before reapplying. For a second read on your entity structure and banking stack, write to info@oboluslaw.com.
What Tax Considerations Apply to a Licensed VASP in Turkey?
A Turkish corporate entity licensed as a VASP is subject to Turkish corporate income tax on its worldwide income, to the extent that income is attributable to the Turkish entity. The applicable rate is set by the Turkish Revenue Administration and has been subject to upward adjustment in recent years; the current rate should be confirmed against current legislation at the time of structuring. What matters structurally is the allocation of revenue and cost between the Turkish operating company and any group entities in lower-tax jurisdictions.
Transfer pricing is a live issue for group structures where the Turkish entity provides services to – or receives services from – related parties in other jurisdictions. The Turkish Revenue Administration requires that intra-group transactions be conducted at arm's length and documented in a contemporaneous transfer-pricing file. For crypto businesses, the relevant intra-group flows typically include: technology licences from an IP-holding entity; management and compliance services; and liquidity or market-making arrangements where the Turkish entity routes order flow through a group liquidity desk in another jurisdiction. Each of these must be priced consistently with the arm's-length standard and documented accordingly.
VAT treatment of crypto-asset transactions in Turkey has been addressed through specific legislative provisions: certain crypto-asset transactions are exempt from VAT under the applicable provisions of Turkish VAT law, reducing the tax cost on high-frequency exchange and settlement activity. The scope of that exemption should be confirmed against current guidance from the Turkish Revenue Administration, as the boundary between exempt and taxable activity is not always clear for novel product types such as yield-bearing stablecoin products or tokenised fund units.
For internationally mobile founders and senior staff, Turkey also applies exit-tax and personal-income-tax considerations that can interact with the business's ability to relocate functions or IP out of Turkey if the business model evolves. We regularly advise on these interactions as part of a broader cross-border structuring review, particularly where founders are residents of Turkey but the group has ambitions to expand into the EU or Gulf markets.
Practical Experience: A Cross-Border Licensing Engagement
In a recent licensing matter, a European exchange group sought to expand into Turkey following the enactment of the new VASP authorisation framework. The group held an existing CASP authorisation in an EU member state and assumed that the MiCA passport would simplify the Turkish application. We mapped the gap: Turkey's regime operates independently, and the EU authorisation provided no formal mutual recognition. We structured a standalone Turkish subsidiary, managed the SPK pre-application engagement to resolve questions around the group's liquidity arrangement with its EU parent, and coordinated the AML programme build in parallel with the banking approach. The SPK application was filed with a complete dossier on the first submission. The group's banking relationship was established with a Turkish institution in advance of licence grant, reducing the go-live gap to a matter of weeks after the authorisation issued.
Which Operator Profiles Should Pursue Turkish VASP Authorisation?
Not every business needs to establish a full Turkish licensed entity immediately. The decision turns on three factors: the volume and origin of Turkish user activity, the business's risk tolerance for enforcement exposure, and whether the Turkish market is a core or peripheral strategic objective.
For a business that has identifiable Turkish users accounting for a meaningful share of revenue or transaction volume, the risk of operating without a Turkish licence is material. The SPK has enforcement tools that include platform blocking, asset-freeze orders through Turkish courts, and referral to the public prosecutor for criminal proceedings under Turkish capital markets law. The expected benefit of delaying the application process must be weighed against those enforcement risks – and in our experience, the calculus almost always favours moving quickly toward authorisation.
For a business that has only incidental Turkish user activity – for example, a handful of institutional clients who happen to be resident in Turkey but transact primarily in other markets – a structured legal opinion on the regulatory perimeter, combined with appropriate user-onboarding controls, may provide a defensible interim position while the business decides whether to commit to full Turkish authorisation. That analysis is fact-specific and should not be relied upon without advice tailored to the business's specific activity profile.
For a startup or growth-stage exchange that is evaluating Turkey as part of a multi-market expansion into the MENA and emerging-market corridor, Turkey's authorisation offers genuine strategic value: the SPK licence signals institutional legitimacy, access to Turkish banking infrastructure, and the ability to serve one of the world's highest per-capita crypto-active populations. In that profile, the licensing process is an investment in market access rather than merely a compliance obligation.
Decision matrix in brief: an exchange with active Turkish retail distribution should apply immediately, treat the capital and corporate setup as time-critical, and build the AML programme from day one. A fund or institutional broker with limited Turkish-resident clients should obtain a legal perimeter opinion, implement user controls, and keep the licensing option on a rolling review as Turkish revenue grows. A startup targeting the Turkish market from inception should structure for the Turkish licence from the outset and not attempt to serve the market through an offshore wrapper.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – end-to-end licensing across 70+ jurisdictions, from application to ongoing compliance
- Digital-Asset Licensing in Germany: BaFin – BaFin's licensing regime for crypto businesses seeking EU market access
- Oracle and Data Feed Liability for Institutional Clients – legal risk management for DeFi infrastructure and tokenisation projects
FAQ
How long does a crypto licence take to obtain?
In Turkey, the SPK authorisation timeline depends on dossier completeness, business-model complexity and the applicant's corporate structure. A well-prepared application with no deficiency notices typically takes a number of months from formal submission to decision. Businesses with complex beneficial-ownership structures or novel product types should plan for a longer process. Pre-application engagement with the SPK is the most effective way to compress the timeline by resolving questions before formal submission.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction turns on where your users are, where your banking will sit, the products you offer, and your capital position. A Turkey-focused business needs a Turkish SPK licence regardless of any offshore authorisation it holds. A business targeting EU clients primarily may find MiCA passporting more efficient. Many businesses that serve multiple markets need a stack of licences – mapping that stack before committing to a structure is where specialist advice adds the most value.
Do I need a separate custody licence?
In Turkey, custody of crypto assets on behalf of clients is a regulated activity under the SPK framework. A business that holds private keys for clients – even as an ancillary service to an exchange function – must be authorised for custody. Whether that requires a standalone custody authorisation or falls within the scope of an exchange authorisation depends on the SPK's current category structure, which should be confirmed against the latest regulatory guidance at the time of application.
OBOLUS is an independent digital-asset law boutique acting exclusively for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence, banking and compliance stack across operating, custody and payment layers before you commit – so structural problems surface in the planning stage, not after your application is filed. To discuss your situation, contact info@oboluslaw.com or reach us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound VASP authorisation across MENA, Central Asia and emerging-market corridors, with a focus on cross-border licence stacking and SPK engagement strategy.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.