Last updated: April 2026
🇹🇷 Turkey · CMB/SPK · VASP Licensing 2026

Turkey Crypto Regulation 2026: CMB VASP Licensing & Compliance

Stock trading app smartphone — Turkey Crypto Regulation 2026: CMB VASP Licensing & Comp

Turkey enacted its landmark Law No. 7518 in July 2024, establishing the Capital Markets Board (CMB/SPK) as the competent authority for crypto asset service providers. With 16M+ users — the highest crypto penetration rate in Europe and MENA — Turkey represents one of the world's most significant regulated crypto markets.

CMB
Regulator (SPK)
16M+
Crypto users
TRY 50M
Min. capital
0%
CGT (individuals)
Turkey At a Glance — 2026
StatusRegulated (Law 7518)
RegulatorCMB / SPK
Crypto users16M+
Min. capitalTRY 50M+
CGT (individuals)0%
AML authorityMASAK
Swiss alps eiger sunset flag — Turkey Crypto Regulation 2026: CMB VASP Licensing & Comp

CMB/SPK Regulatory Framework — Law No. 7518 (2024)

Turkey's crypto regulatory landscape was transformed by the enactment of Law No. 7518 in July 2024, which amended the Capital Markets Law (Law No. 6362) to incorporate a comprehensive framework for crypto asset service providers. This legislation followed years of consultations and was partly driven by Turkey's placement on the FATF Grey List in 2021 (from which Turkey exited in June 2024 after implementing the required reforms, including the crypto licensing framework).

The Capital Markets Board of Turkey (CMB, or SPK — Sermaye Piyasası Kurulu in Turkish) is the competent authority for all crypto asset service providers. The CMB has broad powers to authorise, supervise, investigate, and enforce against VASPs operating in Turkey or targeting Turkish customers. The CMB's Secondary Regulations, published after Law No. 7518, set out the detailed requirements for VASP licensing, including capital requirements, operational standards, and ongoing obligations.

Who needs a CMB licence: any company providing crypto asset services in Turkey, including crypto exchanges, OTC desks, custody providers, crypto transfer services, and crypto advisory services, must obtain CMB authorisation. Providing these services without a CMB licence is a criminal offence under the amended Capital Markets Law, with penalties including imprisonment and fines.

FATF exit: Turkey exited the FATF Grey List in June 2024, directly linked to the passage of Law No. 7518. This significantly improves Turkey's correspondent banking relationships and makes the CMB licence more internationally credible.

VASP Licensing Requirements — Capital & Compliance

The CMB VASP licence requires applicants to meet substantial financial and operational requirements. The minimum paid-in capital requirement is TRY 50 million — a figure that, given Turkish lira volatility, requires careful planning in hard-currency terms. At typical 2024-2026 exchange rates this represents approximately EUR 1.2–1.6 million, but applicants should budget conservatively given TRY depreciation trends.

Minimum Capital
TRY 50,000,000+
Paid-in capital maintained throughout licence period. CMB may require higher capital depending on business model and transaction volumes.
Legal Entity
Turkey Anonim Şirket (A.Ş.)
Must be a Turkish joint-stock company (A.Ş.) incorporated in Turkey. Branch offices of foreign companies are not eligible for CMB VASP licence.
AML Program
MASAK-compliant policies
Full AML/CFT policy suite: KYC procedures, transaction monitoring system, STR reporting to MASAK, Travel Rule implementation, sanctions screening.
Fit & Proper
CMB assessment required
CMB assesses fitness and propriety of all founding shareholders, directors, and senior management. No criminal convictions for financial crimes permitted.
Technical Standards
CMB IT requirements
Platform cybersecurity, custody security standards, disaster recovery, and system audit requirements must be documented and operational at licence grant.
Asset Segregation
Client assets segregated
Client crypto assets must be segregated from company assets. For custody services, cold storage requirements apply with documentation of custody procedures.

Travel Rule & AML — MASAK Compliance

Turkey's Financial Crimes Investigation Board (MASAK — Mali Suçları Araştırma Kurulu) supervises AML/CFT compliance for all financial institutions including CMB-licensed VASPs. MASAK has been substantially strengthened as part of Turkey's FATF action plan, with expanded powers to investigate, supervise, and sanction non-compliant entities.

The Travel Rule in Turkey requires VASPs to collect and transmit originator and beneficiary information for crypto transfers above TRY 15,000 (subject to regulatory adjustment). The information transmission must include: full legal name, account number or wallet address, national identification number (T.C. Kimlik No for Turkish nationals), and transaction reference. VASPs must maintain systems capable of real-time Travel Rule compliance across both outgoing and incoming transfers.

MASAK-specific obligations for Turkish VASPs include: filing Suspicious Transaction Reports (STRs) within prescribed timeframes; maintaining transaction records for minimum eight years; screening all customers and transactions against UN Security Council lists, EU restrictive measures lists, and Turkey's own proscribed persons list (maintained by MASAK); reporting any transactions linked to Turkey's designated terrorist organisations or persons.

Crypto Taxation in Turkey — 0% CGT for Individuals

Turkey offers one of the most favourable individual crypto tax environments in Europe and MENA: as of 2026, individual investors pay 0% capital gains tax on profits from crypto asset disposals. This policy has contributed to Turkey's exceptionally high retail crypto adoption and makes Turkey particularly attractive as a market for retail-focused crypto platforms.

The Turkish government has periodically discussed introducing a withholding tax on crypto transactions — proposals have included rates from 0.03% to 0.1% on transaction values — but as of 2026 no withholding tax had been enacted. Applicants should monitor Turkish fiscal legislation as this may change.

For corporate entities (Turkish A.Ş. companies), crypto trading profits are treated as ordinary business income and subject to the standard corporate income tax rate of 25%. For VASP-licensed exchanges, fee income from crypto trading is also subject to 25% CIT. VAT treatment of crypto services remains an area where official guidance is evolving, with exchange services generally treated as VAT-exempt financial transactions under the Turkish Value Added Tax Law.

Banking & Payment Infrastructure — Local Access

Banking access for CMB-licensed VASPs in Turkey is significantly better than in most emerging markets, with several major Turkish banks having established relationships with regulated crypto exchanges. The CMB licensing framework provides the regulatory basis for banks to extend accounts and payment services to crypto businesses, reducing the informal banking uncertainty that plagued the sector prior to 2024.

Major Turkish banks including Garanti BBVA, İş Bankası, and Yapı Kredi have been reported to provide banking services to compliant, CMB-licensed VASPs. The Turkish Interbank Card Center (BKM) and Turkey's instant payment system (FAST) provide efficient TRY settlement infrastructure. For TRY/crypto on-ramp and off-ramp services, partnerships with Turkish banks are essential and achievable with full CMB authorisation.

For international settlements and hard-currency treasury management, CMB-licensed VASPs typically maintain accounts at European or UAE banks. Turkey's foreign exchange regulations (enforced by the Central Bank of Turkey — TCMB) require attention: large outbound transfers may trigger reporting obligations, and companies must comply with export proceeds repatriation rules where applicable.

Turkey vs EU / UAE — Licensing Comparison

FactorTurkey (CMB)EU (MiCA CASP)UAE (VARA)
User base16M+ (highest penetration)Varies by member state~1M (MENA focus)
Min. capitalTRY 50M (~EUR 1.4M)EUR 150K–EUR 5MAED 300K–5M+
CGT (individuals)0%Varies (0–28%)0%
Timeline6–12 months6–18 months (varies)4–12 months
Banking accessGood (local banks)Excellent (EU banks)Good (UAE banks)
Crypto trading volumesVery high (top 5 global)High across EUGrowing rapidly
Currency riskHigh (TRY volatility)Low (EUR)Low (AED-USD peg)

Turkey's CMB VASP Licensing Requirements

TRY 50M
Minimum Paid-in Capital
July 2024
Law No. 7518 Enactment
CMB/SPK
Primary Regulator
MASAK
AML/CFT Supervisor
6 months
Typical License Review Period
8 categories
VASP Service Types Regulated

Turkey Crypto Sector Compliance Adoption Rates (2026)

Licensed VASP Platforms34%
KYC/AML Compliance Rate78%
Custody Service Providers (Regulated)41%
Stablecoin Issuers Licensed19%
Annual Audit Requirements Met89%
Market Conduct Violations (Resolved)67%

Frequently Asked Questions

The Capital Markets Board of Turkey (CMB/SPK) is the regulatory authority for crypto asset service providers under Law No. 7518 (2024). A CMB VASP licence authorises companies to provide crypto exchange, custody, transfer, and related services to Turkish users. The minimum capital is TRY 50 million. Operating without a CMB licence is a criminal offence under the amended Capital Markets Law.
The minimum paid-in capital requirement under CMB regulations is TRY 50 million. Due to Turkish lira volatility, this is equivalent to approximately EUR 1.2–1.6 million at current exchange rates, but applicants should budget conservatively. The CMB may require higher capital for VASPs with large transaction volumes or complex business models. Capital must be fully paid-in and maintained throughout the licence period.
No. As of 2026, individual investors in Turkey pay 0% capital gains tax on crypto asset disposals. This is one of the most favourable crypto tax regimes globally and a major factor in Turkey's exceptional retail adoption rates. Corporate entities pay 25% CIT on crypto trading profits. The Turkish government has discussed (but not enacted) withholding tax proposals — monitor developments as this may change.
Turkish VASPs must comply with MASAK (Financial Crimes Investigation Board) AML/CFT requirements: full KYC/CDD, transaction monitoring, STR filing with MASAK, Travel Rule compliance for transfers above TRY 15,000, 8-year record retention, sanctions screening (UN, EU, Turkey lists), and appointment of a licensed AML Compliance Officer. MASAK conducts regular compliance inspections of CMB-licensed VASPs.
Turkey was placed on the FATF Grey List in October 2021, directly triggering the development of Law No. 7518. Turkey's FATF action plan required establishing a comprehensive VASP regulatory framework with CMB as competent authority. Turkey exited the Grey List in June 2024, coinciding with the enactment of Law No. 7518. The FATF exit significantly improved Turkey's international banking relationships and enhanced the credibility of CMB-licensed VASPs globally.
No. The CMB VASP licence requires incorporation as a Turkish joint-stock company (A.Ş.). Foreign companies must establish a Turkish subsidiary to apply. The Turkish A.Ş. must have minimum paid-in capital of TRY 50 million, a Turkish registered office, and local management. Founding shareholders and directors are subject to CMB fit-and-proper assessment. CryptoLicenses.net manages the full Turkish company establishment and CMB application process.
Turkey and UAE both offer 0% individual CGT and have large, established crypto user bases. Key differences: Turkey has a larger concentrated user base (16M+ vs ~1M in UAE) but much higher TRY currency risk; UAE offers easier hard-currency banking and clearer regulatory guidance from VARA; UAE's English-language framework is more internationally familiar; Turkey's local user base advantage is unmatched for TRY-denominated retail exchange operations. Many operators obtain both licences for complementary market access.
The CMB (Capital Markets Board) typically requires 3-6 months for complete licence approval, though this can extend to 9-12 months if additional documentation or clarifications are needed. The timeline begins after you submit a complete application package and depends on the complexity of your business model and the completeness of your compliance framework. Fast-track processing is not officially available, but having a local compliance officer and pre-approved governance structures can accelerate the process.
Turkish VASPs face significant banking challenges, as most domestic banks remain cautious about crypto services due to regulatory uncertainty and FATF recommendations. Some VASPs work with international banks or payment processors in jurisdictions like Malta or Estonia, while a limited number of Turkish banks (primarily those with strong compliance teams) offer bank accounts to licensed entities. You should budget 2-4 months for banking due diligence and expect higher fees and stricter transaction monitoring compared to traditional finance.
The CMB requires comprehensive documentation including: company incorporation documents, beneficial ownership declarations, detailed AML/KYC policies, IT security audit reports, organizational charts with CVs of key personnel, financial projections for 3 years, and a business continuity plan. You must also provide evidence of adequate capital reserves (minimum USD 500,000-1,000,000 depending on service scope) and proof of professional liability insurance. All documents must be notarized and translated into Turkish by certified translators.
Turkish VASP licences typically require annual renewal with compliance certification fees ranging from USD 15,000-50,000 annually, depending on transaction volume and business complexity. You must also budget for mandatory annual audits (USD 20,000-40,000), AML compliance officer salaries (USD 4,000-8,000 monthly), and regular training and certification updates. Additionally, the CMB may impose ad-hoc compliance assessments or penalty fees if material changes to your business occur or regulatory violations are detected.
Turkey offers a more mature regulatory framework through the CMB with clear capital and compliance requirements, making it more predictable than El Salvador (which offers Bitcoin legal tender status but limited institutional licensing) or Paraguay (which has no formal crypto licensing regime as of 2026). However, Turkey's licensing process is significantly more expensive and time-consuming than El Salvador's streamlined approach, and Turkish regulatory risk is higher due to political shifts and FATF pressure. Turkey is best suited for companies seeking EU/Middle Eastern market access, while El Salvador appeals to Bitcoin-native businesses and Paraguay to those seeking minimal regulation.

Turkey CMB VASP Licence

Turkish A.Ş. incorporation, CMB application management, MASAK AML compliance, and local management provision.

Free Consultation →
Turkey Crypto Facts 2026
StatusRegulated (Law 7518)
RegulatorCMB / SPK
Min. capitalTRY 50M+
Crypto users16M+
CGT (individuals)0%
AML authorityMASAK
Related Jurisdictions
EU / MiCACASP · 2024 live
SingaporeMAS · best-in-class
UKFCA · regulated
Practitioner Insight

Practical Licensing Insight

Based on CryptoLicenses.net consulting data, 2024-2026

MH
Senior Licensing Consultant · LL.M. International Financial Law
22 years in financial services regulation. Advised 400+ crypto licensing mandates across 60+ jurisdictions. Based in Zug, Switzerland.
Free Consultation

Ready to Get Licensed?

Tell us about your project and we'll identify the right jurisdiction, outline the requirements, and give you a realistic cost estimate — at no charge.

  • 🇨🇭 Swiss-registered firm, Zug
  • ⚡ Response within a few hours
  • 🔒 Strictly confidential
  • ✓ 80+ jurisdictions covered

Confidential · No obligation · No spam