0 / 30 SavedReset
SECTION 1 · 8 ITEMS
Obligation Determination
Identify whether your activity falls within CASP perimeter under Law No. 7518 (Official Gazette 32590 / 02.07.2024) and CMB Communiqué III-35/B.1 (Official Gazette 32840 / 13.03.2025).
01 CASP definition (CML Art. 3(1)) and licensing duty (Art. 35/B) Crypto-asset trading platforms, brokerage of crypto-assets, custody and transfer services fall within CASP scope. Activity without authorization is criminally sanctioned. (CML Arts. 3(1), 35/B and 109/A, as amended by Law 7518)
02 Platform (exchange) vs custody-only classification Platforms operating order books or matching engines require a platform license (minimum capital for 2026: TRY 250M). Custody-only services require a custody license (minimum capital for 2026: TRY 630M). (Communiqué III-35/B.1; capital under III-35/B.2 Art. 34 and CMB Bulletin 2025/68)
04 Transition regime: operators active on 02.07.2024 Operators active on 02.07.2024 had one month (to 02.08.2024) to declare to the CMB whether they would apply for a licence or wind down. Listed platforms had to apply for an operating licence by 30.06.2025 and file the information-systems audit report by 30.09.2025. By CMB decision 18/617 of 26.03.2026, the custody-contract (31.12.2025) and authorisation-certificate (30.06.2026) periods will be set once authorised custodians serve platforms at scale; watch for the new dates. A missed deadline triggers the liquidation provisions. (CML Prov. Art. 11; III-35/B.1 Prov. Art. 1)
05 Foreign CASP operators serving Turkish residents Any one of a workplace in Türkiye, a Turkish-language website, or promotion and marketing directly or through persons resident in Türkiye makes the activity directed at Turkish residents and brings a foreign operator into scope (Law No. 6362 Art. 99/A). Services a client obtains entirely on their own initiative fall outside only where there is no promotion, advertising or marketing to Turkish residents (III-35/B.2 Art. 9).
06 Token coverage scope: utility, payment, security, NFT Crypto-asset definition is technology-neutral. Security tokens may simultaneously be subject to traditional capital markets rules. NFT case-by-case (collectibles vs financial use).
07 Stablecoin and asset-referenced tokens Local fiat-pegged or asset-backed tokens face additional scrutiny. Custody and trading of such tokens within CASP scope; issuance may require parallel licensing.
08 Affiliated service exemption (advisory/software-only) Pure software vendors, non-custodial wallet developers, and informational services may fall outside CASP scope, but blurred lines (combined with order routing or custody) trigger licensing.
SECTION 2 · 8 ITEMS
License Application Preparation
Capital, governance, personnel, AML/CFT, and information security framework: all required at filing.
09 Minimum paid-in capital threshold met Platform license: capital ≥ TRY 250,000,000. Custody license: capital ≥ TRY 630,000,000 (2026 amounts, CMB Bulletin 2025/68; originally TRY 150M and TRY 500M under III-35/B.2 Art. 34, revalued each year under Art. 53). Capital must be fully paid in cash and equity may not fall below it (III-35/B.1 Art. 5 and 9).
10 Anonim şirket form with registered (nama yazılı) shares CASP must be Turkish joint-stock company (anonim şirket) with registered shares. Bearer shares (hamiline yazılı) prohibited. Single-shareholder structure permissible.
11 Founding shareholder qualifications No bankruptcy, no conviction for embezzlement, fraud, money laundering, terrorism financing, or capital markets violations. Foreign founders subject to source-of-funds review.
12 Board and senior management qualifications General manager and deputy general managers: at least seven years’ professional experience in financial markets, IT or fintech, plus integrity and reputation; the GM must be resident in Türkiye and full-time (III-35/B.1 Art. 14). Board: at least three members, the majority with four-year university degrees, each meeting the founder conditions other than financial strength (Art. 15).
13 Organizational structure: 3 lines of defense Independent internal control, internal audit, and risk management functions. Compliance officer (uyum görevlisi) and information security officer mandated.
14 AML/CFT compliance program (Law 5549 / MASAK) Compliance officer appointed, written policies, customer due diligence (CDD/EDD), transaction monitoring, suspicious transaction reporting (STR), employee training, periodic risk assessment.
15 Information security framework: CMB VII-128.10 + TÜBİTAK criteria Compliance with CMB Communiqué VII-128.10 and the TÜBİTAK infrastructure criteria (III-35/B.1 Art. 9), penetration testing, vulnerability management, segregation of cold/hot wallet infrastructure, multi-signature controls, key custody procedures.
16 Business continuity and disaster recovery Documented BCP/DRP, RTO and RPO targets, offsite backup, periodic recovery testing, customer-asset reconciliation under failure scenarios.
SECTION 3 · 8 ITEMS
Operational Compliance
Day-to-day execution that determines whether the license remains in good standing.
17 Customer due diligence (KYC/CDD) Identity verification under Law 5549, simplified/enhanced due diligence tiering by risk, beneficial-ownership identification, ongoing monitoring. PEP screening and sanctions screening at onboarding.
19 Cold storage and customer asset segregation Customer crypto-assets segregated from CASP proprietary assets, majority in cold storage with multi-signature, daily reconciliation, no rehypothecation.
20 Customer fiat segregation Customer TRY/FX balances held at licensed banks in segregated accounts in customer-name pooled or individual structure, daily reconciliation.
21 Transaction monitoring and STR reporting Real-time monitoring with rule-based and behavior-based scenarios, suspicious transaction reports filed with MASAK within mandated timelines, internal escalation procedures.
22 Cybersecurity controls: penetration testing Annual external penetration test, continuous vulnerability scanning, incident response plan, 24/7 SOC capability, threat intelligence integration.
23 Record-keeping: 8 years minimum Customer records, transaction logs, communications, KYC documents retained for 8 years (Law 5549 Art. 8). Production-ready for MASAK and SPK audits within mandated timelines.
24 CMB and Public Disclosure Platform (KAP) integration Material event disclosure obligations to KAP, periodic SPK reporting (financial, operational, risk metrics), management responsibility statements.
SECTION 4 · 6 ITEMS
Post-License Monitoring
Sustained compliance, reporting, and renewal cycle: losing license is far more costly than getting it.
25 Periodic SPK reporting cadence Quarterly financial reports, monthly operational reports, ad-hoc material event disclosures, annual independent audit report submission to SPK.
26 Capital adequacy monitoring Maintain minimum paid-in capital threshold continuously; variable adequacy ratios for risk concentration, customer assets under custody, and operational risk exposure.
27 Independent annual audit Annual external audit by CMB-recognized auditor, internal audit and internal control reports, audit committee oversight.
28 Administrative and criminal penalty exposure Operating without authorization is a criminal offense under CML Art. 109/A. Authorized CASPs face administrative fines, suspension, and license revocation for violations.
29 License renewal, amendment, and change-of-control Changes in shareholder structure (≥10% threshold), board composition, scope of services, and capital require SPK approval before implementation.
30 Investor compensation and crisis management Participation in any applicable investor compensation mechanism, customer-asset return procedures in resolution scenarios, communication plan for service disruption.
Decision Matrix: Are We CASP-License Ready?
How your checked items distribute shows your license-readiness maturity:
Section 1 7+/8: License need is clear. Activity classification correct.Section 2 6+/8: Application file standing. Capital, governance, AML framework ready.Section 3 6+/8: Operational controls live. KYC, cold storage, monitoring functioning.Section 4 4+/6: Post-license reporting and audit line entrenched.Section 2 weak, capital short: Without capital increase and cash inflow, application is rejected.Section 3 weak, cold storage / Travel Rule missing: Application is not mature without operational compliance infrastructure built.Transition deadline missed: The liquidation provisions apply (III-35/B.1 Prov. Art. 1(2), (3), (6)); the custody-contract and authorisation periods await new CMB dates under decision 18/617.All four sections above threshold: Application mature. CMB pre-meetings can begin.
Legal notice. This document is for informational purposes only and does not constitute legal advice. The Law No. 7518, Capital Markets Law provisions, CMB Communiqué III-35/B.1, Law No. 5549, and FATF recommendations referenced are general references; applying them to your company requires evaluation by a lawyer experienced in CMB licensing. Vircon Legal:
[email protected] For the application itself, see our
Turkey CASP licence practice page and the
step-by-step application guide .
