Digital asset regulation and tokenization in Turkey

A business providing crypto-asset services in Türkiye must check its precise activity and provider status with the SPK. Inclusion on the operating entities list does not amount to a final license, and company establishment is separate from permission to begin operations.

If issuing a tokenized asset, the project must also define its rights and the rules governing the represented instrument or asset. Design needs to incorporate payment restrictions, custody conditions and MASAK controls from the start rather than assume that a technically possible transfer is legally permitted.

Activities covered by the Act and SPK communiqués

Law 7518, adopted on 26 June 2024 and in force since its publication on 2 July 2024, brought crypto-asset services within Capital Markets Law 6362. The SPK describes the scope: professional trading, exchange, transfer and custody, including key management. The rules distinguish platforms, custodians and ancillary services; there is no general authorization covering every use of blockchain.

Communiqués III-35/B.1 and III-35/B.2, published on 13 March 2025, develop establishment, operations and solvency requirements. Exclusions for certain NFTs, gaming assets or own-wallet use require a functional assessment. A token's label alone cannot exclude a financial offering or an activity undertaken for customers.

Authority roles and what the public list establishes

The Capital Markets Board, SPK, authorizes and supervises services within its regime. MASAK performs anti-money laundering and counter-terrorist financing functions. The Central Bank, CBRT, regulates payments; bank custodians also need banking supervisor BDDK approval. TÜBİTAK contributes technical criteria without replacing financial authorization.

The operating-provider list expressly states that inclusion does not mean authorization. It also contains individual restrictions: an entity may continue certain services while being restricted from onboarding customers. Selecting a provider requires checking its specific status, permitted services and subsequent decisions, rather than treating the list as an approval mark.

Distinguishing establishment, operations and transition

Communiqué III-35/B.1 requires, with particular provisions for banks, a joint-stock company, registered shares, paid-up capital and transparent ownership. For 2026, the SPK updated the minimum capital to 250 million Turkish lira for platforms and 630 million for custodians. Establishment approval and operating permission are separate stages: after establishment approval, the operating-permission application must be filed within six months, extendable up to one year. Article 17 links ordinary commencement to the relevant certificate; the application must demonstrate organization, staff, infrastructure and compliance with activity-specific conditions.

For providers in transition, Decision 18/617 of 26 March 2026 defers setting deadlines for custody agreements and certificates until authorized custodians widely provide those services. June 2026 should therefore no longer be treated as a universal deadline. In its bulletin of 4 June 2026, the SPK approved crypto-asset custody operating permissions for Akbank, Türkiye Garanti Bankası and Yapı ve Kredi Bankası; no new deadlines appear in the bulletins published up to 7 October 2026. Continuation depends on transitional rules and entity-specific decisions.

Article 9 of Communiqué III-35/B.2 distinguishes a resident's exclusive initiative from solicitation targeting Turkey. A Turkish-language website, local presence or promotion through intermediaries can trigger domestic requirements. Article 99/A of Law 6362 treats activity directed at Turkish residents by foreign platforms as unauthorized, Article 109/A punishes it with three to five years' imprisonment and a judicial fine, and the SPK orders the blocking of the websites concerned. A foreign license or a platform's international accessibility does not replace this territorial assessment.

What a platform must check before distributing tokens

Article 16 of Communiqué III-35/B.2 addresses assets represented through distributed ledgers and refers to capital-market legislation where applicable. Documentation and smart contracts must reflect the issuance rights and conditions. A platform's authorization does not, by itself, permit every offering of shares, debt or investment interests. In addition, under the principle decision published in SPK bulletin 2024/48, until the SPK regulates the issuance of capital market instruments as crypto-assets under Article 13 of Law 6362, crypto-assets based on those instruments, indices, asset baskets or precious metals may not be issued or listed on platforms. No such regulation appears in the official sources consulted up to 16 October 2026.

The structure must identify the obligor, represented right, transfer arrangements and underlying-asset formalities. Recording a token in a wallet does not automatically establish real-estate or company ownership. SPK requires customer funds and assets to be separated; this operational separation does not guarantee the validity or value of the claim against the issuer.

Payment restrictions and MASAK obligations

The CBRT payment regulation, applicable from 30 April 2021, prohibits the direct or indirect use in payments of crypto-assets within its definition. It also imposes specific restrictions on payment and electronic-money providers. This should not be interpreted as an identical ban on every bank transfer or tokenized financial instrument.

Operational rules prohibit certain leveraged transactions, derivatives, credit and short sales. The MASAK guide updated in September 2025 addresses identification, transfer information, timing and amount restrictions, politically exposed persons and suspicious-transaction reporting. The travel rule requires verified originator data for transfers of 15,000 Turkish lira or more. MASAK General Communiqué No. 29, in force since 28 June 2025, requires platforms to wait at least 48 hours after a purchase, exchange or deposit before executing withdrawals to wallets not registered with a provider or to foreign providers without that information-sharing obligation (72 hours for the first withdrawal), and caps stablecoin withdrawals at USD 3,000 per day and USD 50,000 per month.

Since 3 September 2026, Communiqué III-42.1.b allows remote identification of foreign individuals by electronic passport, with fund movements limited to the customer's own bank account abroad. These controls must inform product design; technical ability to transfer a token does not determine legal admissibility.

What to verify before operating or issuing in Türkiye

Before contracting or applying, check the provider’s certificate, services and individual restrictions. Transitional operators need to assess the March 2026 decision and subsequent decisions on custody contracts and deadlines, without treating an old date as a universal expiry.

Issuance requires reviewing asset conditions, smart contract contents and distribution rules. Commercial planning must address solicitation directed at Turkish residents and payment and trading restrictions, with identification and transfer procedures suited to the actual activity.

To understand how this framework applies to your project, discuss your case with our team.