Two years into Türkiye’s crypto licensing regime, the pattern is clear: the CASP licence is not a filing, it is a company rebuild. Law No. 7518 and the CMB’s Communiqué III-35/B.1 set the frame; what separates approved applications from stalled ones is sequencing. This is the guide we wish every applicant read before engaging counsel; ours included.
First, confirm you actually need which licence
The perimeter covers trading platforms, brokerage/intermediation, custody and transfer services (CML Art. 35/B). Two thresholds define the cost of entry: platform licences require paid-in capital of TRY 150 million; custody licences TRY 500 million; fully paid, in cash, unencumbered. Foreign operators actively soliciting Turkish residents (Turkish-language UI, TRY pricing, local marketing) are in scope; the reverse-solicitation carve-out is narrow and shrinking on the ground. Operating without authorisation is a criminal offence under Art. 109/A; this is the one perimeter question you do not want to get wrong by optimism.
The corporate skeleton
A Turkish joint-stock company (anonim şirket) with registered (nama yazılı) shares; founders and 10%+ shareholders clean on bankruptcy and financial-crime history with documented source of funds; board and GM with five-plus years of relevant experience and CMB-recognised credentials. Foreign shareholders are workable; but their KYC file becomes part of yours, so start collecting early.
The application file, in build order
- Capital in and documented; the item with the longest board-level lead time.
- Governance: three lines of defence; independent internal control, internal audit and risk functions; compliance officer and information-security officer appointed, not just named.
- MASAK program (Law 5549): written policies, CDD/EDD tiering, transaction monitoring scenarios, STR workflows, training records; regulators read the scenarios, not the cover page.
- Information security: ISO 27001 or equivalent, penetration test, cold/hot wallet segregation with multi-signature and documented key ceremonies.
- Customer asset architecture: crypto segregated from proprietary assets with daily reconciliation and no rehypothecation; fiat in segregated accounts at licensed banks.
- Continuity: BCP/DRP with tested recovery targets.
The three most common stall points
Capital short and hoping; applications signal their weakness immediately; raise or restructure first. Paper governance; a compliance officer who reports to the person they monitor fails the independence test on org-chart review alone. Travel Rule as an afterthought. FATF R.16 information exchange with counterparty VASPs needs working tooling, and the CMB asks to see it work.
After the licence
The regime’s real weight is operational: quarterly and monthly reporting, annual independent audit by CMB-recognised auditors, KAP disclosures, continuous capital adequacy, and prior CMB approval for 10%+ share transfers, board changes and scope extensions. Budget the compliance function as a permanent cost centre; losing the licence costs more than obtaining it.
Work through the 30 items in our CASP License Obligation Checklist, then map your gaps against the CASP / Crypto Compliance practice. For token-side questions the crypto practice page is the entry point.
This article is for general information only and does not constitute legal advice. It reflects the framework as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call