Two years into Türkiye’s crypto licensing regime, the pattern is clear: the CASP licence is not a filing, it is a company rebuild. Law No. 7518 and the CMB‘s Communiqué III-35/B.1 set the frame; what separates approved applications from stalled ones is sequencing. This is the guide we wish every applicant read before engaging counsel; ours included.
First, confirm you actually need which licence
The perimeter covers trading platforms, brokerage/intermediation, custody and transfer services (CML Art. 35/B). Two thresholds define the cost of entry: minimum capital for 2026 is TRY 250 million for platforms and TRY 630 million for custodians (CMB Bulletin 2025/68; originally TRY 150 million and TRY 500 million under III-35/B.2 Art. 34, revalued each year), paid in full and in cash. A foreign operator with a workplace in Türkiye, a Turkish-language website, or promotion and marketing aimed at Turkish residents is in scope (Art. 99/A); services a Turkish resident obtains entirely on their own initiative fall outside only where there is no such promotion (III-35/B.2 Art. 9). Operating without authorisation is a criminal offence under Art. 109/A; this is the one perimeter question you do not want to get wrong by optimism.
The corporate skeleton
A Turkish joint-stock company (anonim şirket) with registered (nama yazılı) shares; founders and 10%+ shareholders clean on bankruptcy and financial-crime history with documented source of funds; a general manager and deputies with at least seven years’ experience in financial markets, IT or fintech, the GM resident in Türkiye and full-time (III-35/B.1 Art. 14), and a board of at least three members (Art. 15). Foreign shareholders are workable; but their KYC file becomes part of yours, so start collecting early.
The application file, in build order
- Capital in and documented; the item with the longest board-level lead time.
- Governance: three lines of defence; independent internal control, internal audit and risk functions; compliance officer and information-security officer appointed, not just named.
- MASAK program (Law 5549): written policies, CDD/EDD tiering, transaction monitoring scenarios, STR workflows, training records; regulators read the scenarios, not the cover page.
- Information security: compliance with CMB Communiqué VII-128.10 and the TÜBİTAK infrastructure criteria, penetration test, cold/hot wallet segregation with multi-signature and documented key ceremonies.
- Customer asset architecture: crypto segregated from proprietary assets with daily reconciliation and no rehypothecation; fiat in segregated accounts at licensed banks.
- Continuity: BCP/DRP with tested recovery targets.
The three most common stall points
Capital short and hoping; applications signal their weakness immediately; raise or restructure first. Paper governance; a compliance officer who reports to the person they monitor fails the independence test on org-chart review alone. Travel Rule as an afterthought. FATF R.16 information exchange with counterparty VASPs needs working tooling, and the CMB asks to see it work.
After the licence
The regime’s real weight is operational: quarterly and monthly reporting, annual independent audit by CMB-recognised auditors, KAP disclosures, continuous capital adequacy, and prior CMB approval for 10%+ share transfers, board changes and scope extensions. Budget the compliance function as a permanent cost centre; losing the licence costs more than obtaining it.
For a platform that serves EU clients, the CMB licence is one of two; we cover the MiCA side, including why reverse solicitation is narrow, in our note on MiCA for Turkish crypto firms.
Work through the 30 items in our CASP License Obligation Checklist, then map your gaps against the CASP / Crypto Compliance practice. For token-side questions the crypto practice page is the entry point.
This article is for general information only and does not constitute legal advice. It reflects the framework as of October 2026.
More on this area: our Fintech & Payments Law page.
