For a Turkish crypto exchange, custodian or wallet business, 1 July 2026 was the date the European market closed to anyone without a MiCA authorisation. Regulation (EU) 2023/1114 on markets in crypto-assets has applied in full since 30 December 2024, and Article 143(3) allowed providers already operating under national law to continue only until 1 July 2026 or until their application was decided, whichever came first; several Member States shortened even that. The grandfathering is over. What remains is a clear rule: a person may not provide crypto-asset services in the Union unless authorised as a crypto-asset service provider (CASP) under Article 63 or already licensed as a bank, investment firm or other listed institution, and the only exception, reverse solicitation under Article 61, is drawn so narrowly that it cannot carry a business. At the same time, Türkiye has built its own licence regime under Articles 35/B and 35/C of the Capital Markets Law No. 6362 and the CMB’s Communiqués III-35/B.1 and III-35/B.2, with its own reverse-solicitation mirror in the other direction. This article explains what MiCA requires of a Turkish firm that wants EU clients, how the authorisation works and costs, why the reverse-solicitation argument fails, and how the two licences interact for a group that wants both markets. It follows our CASP licence application guide and the note on Türkiye’s crypto advertising rules.
What MiCA regulates, and who is a CASP
Article 3(1)(16) lists ten crypto-asset services: custody and administration on behalf of clients; operation of a trading platform; exchange of crypto-assets for funds; exchange of crypto-assets for other crypto-assets; execution of orders; placing; reception and transmission of orders; advice; portfolio management; and transfer services. A crypto-asset service provider is a legal person or other undertaking whose occupation or business is providing one or more of these to clients on a professional basis and that is allowed to do so under Article 59 (Article 3(1)(15)). Title V governs CASPs; Titles II to IV govern issuers and offerors of crypto-assets, asset-referenced tokens and e-money tokens, with Title II’s white-paper requirements for ordinary crypto-assets exempting offers to fewer than 150 persons per Member State, offers whose total consideration in the Union over twelve months does not exceed EUR 1,000,000, and offers solely to qualified investors (Article 4(2)). A Turkish exchange that lists tokens, runs a launchpad, custodies keys or moves client assets is providing several of the ten services at once; the authorisation must specify each service the provider is authorised to provide (Article 59(6)).
Article 59: an EU entity, EU management, an EU director
The authorisation requirement in Article 59(1) applies to anyone providing crypto-asset services “within the Union”, and Article 59(2) attaches conditions that a Turkish company cannot satisfy from Türkiye: a CASP authorised under Article 63 must have its registered office in a Member State where it carries out at least part of its services, its place of effective management in the Union, and at least one director resident in the Union. In practice the Turkish group forms a subsidiary in a Member State (the Netherlands, Ireland, Lithuania, France, Malta and Cyprus have been common choices for different reasons), staffs it with a management body that meets the fit-and-proper standards in Article 68, capitalises it under Article 67 and applies to that Member State’s competent authority under Article 62. Article 59(5) prohibits any person who is not a CASP from using a name or marketing that suggests it is one, which reaches Turkish-language marketing that implies EU regulatory status. Once authorised, Article 65 lets the CASP notify its home authority of the other Member States it intends to serve; the authority forwards the notification within ten working days, and the CASP may begin cross-border services on receipt of the communication or at the latest fifteen calendar days after submitting the information. One authorisation, twenty-seven markets.
The United Kingdom has built its own gate, with an application window closing on 28 February 2027; what platforms with UK users must decide is in our note on the UK crypto authorisation window.
The application and its clock
Article 62(2) lists the contents of the application: identity and LEI, the programme of operations and the services to be provided, governance and the identity and suitability of management and qualifying shareholders, the ICT and security arrangements (which must also satisfy the Digital Operational Resilience Act for financial entities), the segregation of client assets, complaints handling, business continuity, conflicts of interest, AML procedures and, for each service, the specific policies the Regulation requires. Article 63 sets the timetable: acknowledgment within five working days; a completeness check within twenty-five working days, with a deadline for missing information and the right to refuse to review an application that remains incomplete; and, once complete, a fully reasoned decision within forty working days, notified within five working days, taking into account the nature, scale and complexity of the services. Article 63(10) lists the grounds for refusal, starting with a management body that poses a threat to sound and prudent management and business continuity. The statutory clock is therefore about three months from a complete file; the real clock is the time it takes to make the file complete, which for a Turkish group with a Turkish parent, Turkish shareholders and Turkish technology is dominated by the shareholder-suitability and ICT dossiers.
Capital and prudential safeguards
Article 67 requires prudential safeguards at all times equal to at least the higher of the permanent minimum capital in Annex IV and one quarter of the previous year’s fixed overheads, with a first-year provider using its projected overheads. Annex IV sets three classes: EUR 50,000 for Class 1 services (execution, placing, transfer, reception and transmission, advice, portfolio management); EUR 125,000 for Class 2, which adds custody and administration and exchange for funds or other crypto-assets; and EUR 150,000 for Class 3, which adds the operation of a trading platform. The safeguards may be own funds or an insurance policy meeting Article 67’s conditions. These figures are modest next to the Turkish requirements discussed below, which is one reason the Turkish licence, not the EU one, is usually the binding constraint on group capital.
Why reverse solicitation does not carry a business
Article 61(1) exempts a third-country firm from the authorisation requirement where a client established or situated in the Union initiates the service “at its own exclusive initiative”. The second subparagraph then removes the room that Turkish firms hoped for: where the third-country firm, including through an entity acting on its behalf or having close links with it, solicits clients or prospective clients in the Union, “regardless of the means of communication used”, the service is not deemed to be provided at the client’s own initiative, and the third subparagraph makes this apply notwithstanding any contractual clause or disclaimer stating otherwise. Article 61(2) adds that a client’s initiative does not entitle the firm to market new types of crypto-assets or services to that client. ESMA’s guidelines under Article 61(3) specify when a third-country firm is deemed to solicit clients in the Union, and they read solicitation broadly: promotional activity directed at EU clients counts whatever the channel, from websites and advertising to influencer campaigns and sponsorships. The exemption therefore covers a genuinely unsolicited EU resident who finds a Turkish exchange on his own and asks for an account, for the services he asked for, and nothing more; it does not cover a Turkish exchange with a European growth strategy. A “we do not target EU residents” disclaimer on a Turkish site with an English interface and euro pairs is exactly what the third subparagraph disregards.
Two licences, two directions
The Turkish regime is the mirror image. Article 35/B(1) of Law 6362 requires CMB permission for the establishment and commencement of crypto-asset service providers, which perform only the activities the CMB determines, and makes share transfers subject to CMB permission; Article 35/B(2) requires compliance with TÜBİTAK’s criteria for information systems and technological infrastructure before permission is granted. Article 99/A treats activity by a foreign-resident platform directed at Turkish residents as unlicensed crypto-asset service provision, and lists opening a workplace in Türkiye, creating a Turkish-language website and promoting or marketing directly or through Turkish-resident persons as the indicators of targeting; Provisional Article 11(4) required foreign providers to end such activity within three months of Law 7518’s entry into force in 2024. The CMB’s Communiqué III-35/B.2 (Official Gazette 13 March 2025, No. 32840) mirrors MiCA’s reverse solicitation in Article 9: services that Turkish residents obtain from foreign providers entirely on their own initiative are outside the Communiqué, provided the provider does not promote, advertise or market to Turkish residents, and a Turkish workplace, Turkish website or direct or indirect marketing brings the provider within scope. Article 34 of the same Communiqué set the founding capital at a minimum of 150,000,000 lira for platforms and 500,000,000 lira for custodians; the CMB re-sets these amounts each year under Article 53, and for 2026 they are 250,000,000 lira and 630,000,000 lira (CMB Bulletin 2025/68). Custodians also need additional own funds once client assets exceed a threshold set at one billion lira in the Communiqué and at 1,250,000,000 lira for 2026. A group that wants both markets therefore needs a Turkish joint-stock company with CMB permission, TÜBİTAK-compliant infrastructure and Turkish-scale capital for Turkish residents, and a separate EU subsidiary with MiCA authorisation for EU residents, each marketing only to its own side, with intra-group arrangements for technology, liquidity and custody documented under both regimes’ outsourcing and conflict-of-interest rules. Neither licence is recognised by the other side; MiCA has no third-country equivalence for CASPs, and Law 6362 has none for MiCA firms.
Our EU users signed up on their own. Can we keep serving them?
Only those who did so without any solicitation attributable to you or your affiliates, and only for the services they asked for. If your site, app-store listing, ads or affiliates reached the EU, Article 61 does not apply and serving those users is unauthorised provision. Onboarding them to an authorised EU entity is the compliant path.
Can our EU subsidiary use the Turkish parent’s matching engine and custody?
Yes, as outsourcing under Article 73 of MiCA, with the CASP retaining responsibility and the arrangements documented, auditable and terminable; custody of EU clients’ assets must satisfy Article 75’s segregation rules. On the Turkish side, the CMB’s rules on outsourcing and on custody through licensed custodians apply to the parent.
Does a MiCA licence help with the CMB application, or vice versa?
Not formally. Each regulator assesses its own file. In practice the governance, AML and ICT documentation overlaps substantially, and a group that has built one dossier to a high standard will build the second faster; the shareholder-suitability and capital requirements differ and must be met separately.
Related: MiCA · CASP · crypto-asset white paper · KVHS licence · RWA tokenisation.
Sources. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), OJ L 150, 9 June 2023 (Articles 3, 4, 59, 61–63, 65, 67, 68, 73, 75, 143, 149, Annex IV); ESMA, Guidelines on reverse solicitation under MiCA (Article 61(3)); Capital Markets Law No. 6362 (Articles 35/B, 35/C, 99/A, Provisional Article 11, as amended by Law No. 7518); Capital Markets Board, Communiqués III-35/B.1 and III-35/B.2 (Official Gazette 13 March 2025, No. 32840), III-35/B.2 Articles 9, 34–35. Statute links open the official texts.
This article is provided for general information only and does not constitute legal advice. Please seek legal support for an assessment of any specific matter.
