How to Get a Crypto License in Türkiye: SPK Establishment and Operating Permits Under Law 7518

The short version: In Türkiye a crypto-asset service provider (kripto varlık hizmet sağlayıcı) needs two permissions from the Capital Markets Board (Sermaye Piyasası Kurulu, SPK): an establishment permit (kuruluş izni) to set up the company and an operating permit (faaliyet izni) before it starts business. The basis is article 35/B of Capital Markets Law 6362, added by Law 7518 (Resmî Gazete, 2 July 2024). The detail is in SPK communiqués III-35/B.1 (III-35/B.1) and III-35/B.2 (III-35/B.2). The applicant must be a joint-stock company (anonim şirket) whose only business is crypto services. For 2026, a trading platform needs at least TRY 250 million of founding capital and a custodian at least TRY 630 million, paid in cash (SPK bulletin 2025/68). Its information systems must meet criteria set by TÜBİTAK, the state research council. SPK then issues an authorisation certificate (yetki belgesi). As of 5 Nov 2026, only 3 companies, all banks acting as custodians, hold one; 4 new platforms have an establishment permit only.

VASP Tracker is an independent information service. It is not affiliated with the SPK, TÜBİTAK, MASAK or the Central Registry Agency (MKK), and this is not legal advice. Turkish terms and quotations are our translations; the Turkish texts prevail. Article numbers refer to the law and communiqués as published by the Resmî Gazete and the SPK on the date below.

What Applies

• The law. Law 7518 added articles 35/B, 35/C, 99/A, 99/B, 109/A and provisional article 11 to Capital Markets Law 6362. Article 35/B(1) says crypto-asset service providers need SPK permission both to be set up and to start business, and may carry on only the activities the SPK determines (Law 7518).
• Communiqué III-35/B.1 on establishment and operating principles. It covers founders, capital, organisation, staff, managers, internal audit and control, outsourcing, information systems and the permit procedure. It was published in Resmî Gazete 32840 of 13 March 2025 (SPK).
• Communiqué III-35/B.2 on working rules and capital adequacy. It lists the services, sets the capital amounts and covers custody, platform operations and capital-adequacy calculations (SPK).
• Information systems. SPK communiqué VII-128.10 on information systems management (SPK), TÜBİTAK's infrastructure criteria and independent information-systems audits under communiqué III-62.2 (SPK).

Firms that were already operating when Law 7518 took effect are on a separate track: the SPK “operating list”. It is not an authorisation, and their deadline to obtain one currently has no date (see the transition below). This guide covers the procedure for a firm applying now.

Who Needs a Permit

III-35/B.2 art. 5 lists the services that need SPK permission:

• receiving and executing orders in crypto-assets, their settlement, transfer and the custody these require (the platform business);
• intermediating the initial sale or distribution of crypto-assets;
• custody and management of crypto-assets or their private keys;
• investment advice on crypto-assets;
• other services the SPK determines.

Each needs permission if carried on as a regular, commercial or professional activity (art. 6). Buying, selling or moving crypto-assets for a provider's own wallet, without serving others, does not (art. 6(3)). Some ancillary services, such as NFT and in-game asset trading or general financial analysis on crypto-assets, need only a notification to the SPK, not a separate certificate. Unless the SPK objects within 20 business days, the provider may start them (arts. 7–8).

Overseas platforms. A platform based abroad that serves residents of Türkiye is treated as an unauthorised provider. Its activity counts as aimed at Türkiye if it does any one of the following (Law 6362 art. 99/A(1)):

• opens a workplace in Türkiye;
• runs a Turkish-language website;
• promotes or markets its services in Türkiye, directly or through people or firms in Türkiye.

Services a resident obtains entirely on their own initiative, with no such promotion, fall outside the communiqué (III-35/B.2 art. 9). Unauthorised crypto-asset service provision is a crime. It carries 3–5 years' imprisonment and a judicial fine of 5,000–10,000 days (Law 6362 art. 109/A). The SPK can also order access to websites blocked (art. 99/A(3); our count of SPK block decisions).

Step 1: Company Form and Capital

III-35/B.1 art. 5 sets the establishment conditions:

• a joint-stock company (anonim ortaklık);
• all shares registered and issued for cash;
• articles of association that comply with the communiqué and limit the business purpose to the activities the company will be authorised for;
• founders who meet the conditions in Step 2;
• a transparent shareholding structure in which the controlling shareholders can be identified.

The founding capital must be fully paid in cash, and equity must not fall below it. The trade name must include “kripto varlık alım satım platformu” (crypto-asset trading platform) or “kripto varlık saklama kuruluşu” (crypto-asset custodian), and using a brand name needs SPK permission (III-35/B.1 art. 7).

Minimum capital. III-35/B.2 art. 34 sets the minimum founding capital at TRY 150 million for platforms and TRY 500 million for custodians. The SPK can revalue these amounts every year (art. 53). For 2026 it has set them at TRY 250 million for platforms and TRY 630 million for custodians (decision 68/2461, SPK bulletin 2025/68). Revalued amounts must be met by the end of June of the year (art. 34(3)). Other ongoing tests also apply (III-35/B.2):

• Equity may never be below the founding capital (art. 35(1)).
• A platform's equity may not be below its liquid-reserve obligation (art. 35(3)).
• A custodian needs extra equity of 1.5% of client assets above a threshold, unless its equity reaches a set amount. For 2026 the threshold is TRY 1.25 billion and the amount is TRY 1.9 billion (SPK bulletin 2025/68).

Banks that offer custody do not need a separate company. They need a prior opinion from the banking regulator BDDK and BDDK approval to extend their activities (III-35/B.1 arts. 5 and 9).

Step 2: Founders, Shareholders and Managers

The fit-and-proper conditions come from Law 6362 art. 35/B(3) and III-35/B.1 art. 6. They apply to founders, to shareholders with 10% or more of the capital or votes, and to anyone who controls the company. For a legal-person shareholder, they also apply to the people behind it. Each such person must not:

• be bankrupt or in a concordat (konkordato) or restructuring;
• have held 10% or more of, or controlled, a financial institution whose licence was revoked, other than by voluntary liquidation;
• have been convicted of the listed offences, including embezzlement, fraud, money laundering, terrorist financing and tax evasion, or sentenced to 5 years or more for an intentional crime;
• be under a trading ban under Law 6362 art. 101(1)(a);
• have received an administrative fine under art. 104 in the last 5 years.

They must also have the financial strength, honesty and reputation the business requires. A shareholder who loses these qualities must transfer the shares within 6 months, and any transfer of shares needs SPK permission (Law 6362 art. 35/B(1), (3)).

People. III-35/B.1 also sets rules for the people who run the firm:

• Board: at least 3 members, the majority with a four-year degree (art. 15).
• General manager and deputies: at least 7 years' experience in financial markets, IT or financial technology, and SPK approval before appointment. The general manager must work full-time for the firm only and live in Türkiye (art. 14).
• Managers and staff: they must meet the same character conditions as founders. In principle they need a four-year degree, but an associate degree is enough for IT operations staff. The SPK can require licences or certificates (art. 13).

Step 3: Establishment Permit

The founders apply to the SPK with the draft articles of association and documents showing that they meet the art. 6 conditions. The SPK may ask for more information, and it may require a special independent audit or a rating of the applicant or its corporate shareholders (III-35/B.1 art. 8). Later changes to the articles need SPK approval. The SPK announces establishment permits in its weekly bulletin. In the bulletins we have read since January 2025, it has granted 4 for new platforms:

• Yapı Kredi Kripto Varlık Alım Satım Platformu AŞ (founder Yapı Kredi Blokzincir Teknolojileri AŞ), 26 Mar 2026 (SPK bulletin 2026/18)
• Fiba Kripto Varlık Alım Satım Platformu AŞ (founder Fiba Yatırım Menkul Değerler AŞ), 4 Jun 2026 (SPK bulletin 2026/34)
• Goldtag Kripto Varlık Alım Satım Platformu AŞ (founder Fintag Yazılım Danışmanlık AŞ), 4 Jun 2026 (SPK bulletin 2026/34)
• Ahlatcı Kripto Varlık Alım Satım Platformu AŞ (founder AHL Gold E-Ticaret AŞ), 16 Sep 2026 (SPK bulletin 2026/59)

None of these has an operating permit yet (our lists). The clock starts at the establishment permit. A firm that does not apply for its operating permit within 6 months loses the right to one, although the SPK can extend this to 1 year in total. If it does not apply, or is refused, it must either decide to dissolve within 3 months or remove crypto services from its trade name and purpose (art. 17(1)–(2)).

Step 4: Operating Conditions and Systems

III-35/B.1 art. 9 sets the conditions for the operating permit. All providers need:

• the establishment conditions still met and the minimum capital paid in cash;
• compliance with the capital-adequacy rules in III-35/B.2;
• the organisation required by art. 10, staff meeting art. 13 and managers meeting art. 14;
• a working security infrastructure that complies with VII-128.10 and the TÜBİTAK infrastructure criteria;
• internal audit, internal control and risk management systems;
• completed technical and system integration tests with the Central Registry Agency (MKK);
• private-key storage and distributed-ledger integration as required by III-35/B.2.

Platforms also need the following:

• a contract with at least one SPK-authorised custodian, with the reconciliation integration in place;
• a bank account for client cash;
• a complaints mechanism with a written procedure;
• a market surveillance system.

Custodians need a dedicated custody unit with enough staff. Platform and custody staff must be separate (art. 9(7)).

The custody requirement comes from the law itself. Platforms' client crypto-assets are in principle kept in clients' own wallets. Where clients do not choose that, custody must be with banks authorised by the SPK and approved by BDDK, or with other SPK-authorised custodians, and client cash must be held at banks (Law 6362 art. 35/C(6)). The first custodian permits went to three banks on 4 Jun 2026 (SPK bulletin 2026/34).

Law 6362 art. 35/B(2) makes compliance with TÜBİTAK's criteria a condition of both permits. For the application, the SPK can have information systems audited together with TÜBİTAK and other public bodies (III-35/B.1 art. 9(4)). In each case the SPK may also set extra conditions or require professional liability insurance (art. 9(8)–(9)). Crypto-asset insurance and cyber insurance are optional (art. 16).

Step 5: Filing, Fee and Authorisation Certificate

The operating-permit application must show that the general and special conditions are met and be signed by those authorised to represent the company (III-35/B.1 art. 17(4)). Applications that do not meet the SPK's standards are returned without review. If extra documents are not filed within the time the SPK sets, which is at least 10 days, the application is removed. Neither communiqué sets a time limit for the SPK's decision.

If the SPK approves, it issues an authorisation certificate (yetki belgesi) listing the services the firm may provide. No business may start before it is issued (art. 17(5); Law 6362 art. 35/C(10)). Before the certificate is issued, the firm must pay the fee (harç) under Fees Law 492 and file the receipt. If the receipt is not filed within 1 month of the SPK's notice, the permit is cancelled (art. 17(6)). The communiqué does not state the fee amount, and we have not verified a 2026 figure, so we do not give one.

After authorisation:

• A loss of any condition must be reported to the SPK within 3 business days (art. 17(8)).
• Platforms pay 1% of their previous year's revenue, excluding interest income, to the SPK and another 1% to TÜBİTAK by the end of May each year (Law 6362 art. 130(5)).
• An independent information-systems audit by an SPK-listed auditor is required at least once a year, and a proof-of-reserves audit at the end of each quarter. The first yearly audits are for 2026 (III-35/B.1 art. 48 and provisional art. 1(11)). Banks are partly exempt.

AML and the Travel Rule

Crypto-asset service providers must identify their customers under Law 5549 on the Prevention of Laundering Proceeds of Crime and related rules (Law 6362 art. 35/C(1)). For crypto transfers they must follow the rules set by the SPK and MASAK, Türkiye's financial intelligence unit. They must send the originator and beneficiary information those rules require, securely and within the set times (art. 35/C(5)). Records of wallets and accounts used for transfers must be kept securely and in a traceable form. Client cash and crypto-assets are kept separate from the provider's own assets and are protected from the provider's creditors (art. 35/C(5), (7)). Neither the SPK permit nor the listing of a token is a public guarantee, and crypto-assets are not covered by investor compensation (art. 35/C(2), (4)).

Timeline and the Transition for Listed Firms

Firms that were operating when Law 7518 took effect had to declare within one month whether they would apply or liquidate (Law 6362 provisional art. 11(1)). Those that declared they would apply make up the SPK operating list. They do not receive a separate establishment permit; their establishment conditions are reviewed as part of the operating-permit application (III-35/B.1 provisional art. 1(1)). Under provisional art. 1 as published:

• listed firms had to apply for an operating permit by 30 June 2025;
• they had to file an independent information-systems audit report by 30 September 2025, later extended to 31 December 2025 (decision 48/1627);
• platforms had to sign custody contracts by 31 December 2025, later extended to 31 March 2026 (decision 63/2219);
• they had to hold an authorisation certificate by 30 June 2026.

Firms that miss a deadline are liquidated under provisional art. 1(6). The SPK may extend any period in the communiqué (art. 55). On 26 March 2026 it decided that both the custody-contract deadline and the authorisation deadline will be set only after SPK-authorised custodians begin providing custody to platforms widely (decision 18/617). As of 5 Nov 2026, 49 companies are on the operating list (28 Oct 2026, SPK), and no new date has been published (our deadline explainer). A new entrant is not on this track: under provisional art. 11(3), it may not start business before receiving its operating permit.

The SPK has published no target processing time. On the record so far, the first operating permits, for three bank custodians, came on 4 Jun 2026. The application deadline for listed firms had been 30 June 2025.

What Is Not Yet Public

As of 5 Nov 2026, we did not find any of the following in SPK or Resmî Gazete sources:

• a new date for listed firms to obtain authorisation, or for platforms' custody contracts;
• an operating permit for any crypto-asset trading platform;
• a published SPK processing time or application statistics;
• the fee amount for the authorisation certificate, which we have not verified.

We do not estimate these here.

Türkiye Next to MiCA, the UK and Japan

• Two permits, not one. Türkiye separates permission to set up the company from permission to operate, with a 6-month window between them. Under MiCA and in the UK, an existing legal entity applies once (MiCA guide, UK guide).
• Time. The SPK communiqués set no decision period. MiCA sets 25 working days for the completeness check plus 40 working days for assessment. The UK has a 6-month statutory decision period for complete applications.
• Money. Türkiye's 2026 minimum founding capital is TRY 250 million for a platform and TRY 630 million for a custodian, plus a yearly 1% + 1% revenue levy. MiCA's minimum capital is €50,000–€150,000, depending on the services. Japan's floor is ¥10 million (Japan guide).
• Distinctive to Türkiye. Platforms cannot hold client crypto-assets themselves; they must contract with an SPK-authorised custodian. The general manager must live in Türkiye. TÜBİTAK, a state research council, sets the IT criteria that must be met for both permits.

Practical Checklist Before You File

1. Map each service against III-35/B.2 art. 5. If you serve Türkiye from abroad, check the Law 6362 art. 99/A tests: a workplace, a Turkish-language website, or promotion in Türkiye.
2. Set up a joint-stock company with registered cash shares, a crypto-only business purpose and a trade name containing the required phrase.
3. Budget the 2026 minimum founding capital, TRY 250 million for a platform or TRY 630 million for a custodian, fully paid in cash. Check the revalued amount each January.
4. Map the ownership chain and check every founder, 10% shareholder and controller against art. 6.
5. Line up a board of at least 3 members and a general manager and deputies with 7 years' experience. The general manager must be resident in Türkiye and needs SPK approval.
6. File for the establishment permit with the articles of association and the art. 6 evidence.
7. Within 6 months of the permit, build the systems: VII-128.10, the TÜBİTAK criteria, MKK integration tests, private-key storage and internal audit, control and risk functions.
8. For a platform: sign a custody contract with an SPK-authorised custodian, open a client cash account at a bank, and set up complaints handling and market surveillance.
9. Build the AML and travel-rule programme under Law 5549 and the SPK and MASAK transfer rules.
10. File the operating-permit application. Answer SPK requests within the deadline it sets (at least 10 days), then pay the fee and file the receipt within 1 month of the SPK's notice.

Checked against Law 7518 in the Resmî Gazete, SPK communiqués III-35/B.1 and III-35/B.2 as published on the SPK legislation site, SPK bulletins 2025/47, 2025/61, 2025/68 and 2026/18 and the SPK operating list on 5 Nov 2026. Not published, so not estimated here: a new authorisation deadline for listed firms, SPK processing times and the fee amount.