Crypto-asset service providers (CASPs): exchanges, custodians, wallet providers, and broker-dealers: operate under one of the most rapidly evolving regulatory environments globally. Vircon Legal advises crypto operators preparing for Turkish CASP licensing, EU MiCA registration, and US state-level compliance: from pre-license structuring through operational audit readiness.
Turkey CASP licence: requirements, process and timeline
Crypto-asset service providers were brought inside Capital Markets Law No. 6362 by Law No. 7518, published in the Official Gazette on 2 July 2024 (No. 32590). Carrying on any of the covered activities — buying and selling, exchange, transfer, custody of crypto assets, or administration of private keys — as a regular commercial or professional activity now requires permission from the Capital Markets Board (CMB). The Board’s announcement of the same date confirmed that this applies to any environment in which those activities are carried on.
The implementing rules followed on 13 March 2025 (Official Gazette No. 32840), in two communiqués that should be read together:
- III-35/B.1 — Communiqué on the Establishment and Operating Principles of Crypto-Asset Service Providers
- III-35/B.2 — Communiqué on the Working Procedures and Principles and Capital Adequacy of Crypto-Asset Service Providers
Capital thresholds
The communiqués set minimum establishment capital by provider type:
- Trading platforms — TRY 150,000,000 (III-35/B.1, art. 34/1).
- Custodians — TRY 500,000,000 (III-35/B.1, art. 34/2).
- Equity may not fall below establishment capital, and at least 25% must be provided as paid-in or issued capital (art. 35/1 and 35/2).
- Custodians carry an additional capital charge of 1.5% on client assets held above TRY 1 billion; no surcharge applies below that level (art. 35/4).
These figures are floors for admission, not a working capital plan. A realistic application models the capital the business will need through its first supervised year, not the minimum that gets the file accepted.
The transition window has closed
Providers already operating when the law took effect had until 2 August 2024 to file either an application or a declaration that they would wind down; wind-downs were to be completed by 2 October 2024. Platforms established abroad were required to stop serving persons resident in Türkiye by the same date.
The practical consequence for anyone planning to enter today is straightforward: the market is permission-only. Authorisation is obtained before activity begins, and there is no grandfathering route left open.
What an application involves
Beyond capital, the communiqués address the corporate and operational substance the CMB expects a provider to have in place: the qualifications of founders and managers, internal audit, internal control and risk management systems, and information systems and technological infrastructure. Anti-money-laundering obligations run in parallel under the MASAK regime rather than through the CMB file.
In practice the work divides into three streams that have to move together — corporate and capital structuring, the written policy and systems architecture the Board will test, and the AML programme. Sequencing them badly is the most common reason a file stalls.
This summary reflects the position as at August 2026 and is general information, not legal advice. The framework is developing; before acting, confirm the current text of the legislation or ask us.
Our CASP and crypto compliance practice covers:
- Turkish CASP licensing. Application strategy, qualification analysis, capital adequacy planning, governance structure, and submission management with the Turkish Capital Markets Board.
- Cross-border structuring. Multi-entity architectures spanning Türkiye, EU MiCA jurisdictions, US states, and offshore CASP-friendly jurisdictions: integrated with our fund structuring and M&A practices.
- AML / KYC and Travel Rule. Onboarding flows, transaction monitoring frameworks, suspicious activity reporting, and FATF Travel Rule compliance.
- Custody and asset segregation. Hot/cold wallet policy design, insurance arrangements, segregation of customer assets, and proof-of-reserves frameworks.
- Token launch and offering. SAFT structures, token classification analysis, sale documentation, and post-launch compliance: see also our Capital Markets practice.
- Smart contract and DAO governance. Legal wrappers for DAOs, smart contract audit coordination, and on-chain governance documentation.
- Stablecoin operations. Reserve attestation, redemption mechanics, and multi-jurisdictional issuance compliance.
- Regulator engagement and enforcement defense. Pre-application meetings, response to information requests, and enforcement proceeding defense.
For operators preparing their own initial license assessment, our CASP License Obligation Checklist walks through the key compliance pillars. We work with crypto-native startups, traditional financial institutions expanding into digital assets, and infrastructure providers building the backbone of the next-generation financial system.
Founder Academy resources
Free, practical checklists for this area: CASP License Checklist.
Frequently Asked Questions
Who needs a CASP licence in Türkiye?
Platforms providing crypto-asset trading, custody, or transfer services under Law No. 7518 — exchanges first and foremost. Entities already operating were required to declare themselves for the transition process, and the CMB publishes the list of those permitted to operate while applications proceed.
What are the core compliance obligations for CASPs?
Minimum capital and organisational requirements, segregation and custody of customer assets, listing and disclosure standards, IT and security infrastructure, and full MASAK AML compliance — customer due diligence, suspicious-transaction reporting, and the travel rule for transfers. Governance expectations track those of licensed capital-markets institutions.
Can foreign exchanges serve Turkish users without a licence?
Targeting Türkiye — Turkish-language interfaces, TL pairs or local payment rails, marketing to Turkish residents — brings the activity within the licensing regime. Passive availability of a global platform is a narrow and fact-sensitive defence; regulators have already moved against unlicensed targeting.