The Capital Markets Board of Turkey (SPK/CMB) now regulates all crypto asset service providers (CASPs) under Law No. 7518, enacted in June 2024. Any entity that operates a crypto trading platform, provides custody services, or facilitates crypto transfers in Turkey must obtain an SPK license. Operating without a license is a criminal offense punishable by imprisonment. This article provides a step-by-step guide to the SPK crypto license application process in 2026, prepared by Attorney Bilal Alyar (Istanbul Bar Association, Reg. No: 54965).

Who Needs an SPK Crypto License?

Under Law No. 7518, the following activities require SPK authorization: operating a crypto asset trading platform (exchange), providing crypto asset custody/wallet services, offering crypto asset transfer services, providing crypto asset portfolio management, and acting as an intermediary for crypto asset transactions. This covers centralized exchanges, OTC desks, custodians, and any entity that holds customer crypto assets.

Minimum Capital Requirement

SPK requires a minimum paid-in capital of 50 million TRY (approximately $1.5 million USD at current rates) for crypto trading platform operators. This capital must be fully deposited before the license application is submitted and maintained throughout the licensing period. The capital requirement may vary for other CASP categories. The company must be established as a Joint Stock Company (Anonim Şirket — AŞ) under Turkish law.

Shareholder and Management Fit-and-Proper Tests

All shareholders holding 10% or more, board members, and senior management must pass SPK’s fit-and-proper assessment. This includes: clean criminal record (no convictions for fraud, financial crimes, or organized crime), financial soundness (no bankruptcy or significant debt defaults), relevant professional qualifications and experience, and no prior regulatory sanctions from SPK or other financial regulators. These requirements apply to both Turkish and foreign shareholders/managers.

IT Infrastructure Requirements

SPK mandates comprehensive technology standards including: cyber security framework aligned with ISO 27001 or equivalent, penetration testing by independent third parties, business continuity and disaster recovery plans with regular testing, system capacity sufficient to handle peak trading volumes, data center redundancy (primary and backup facilities in Turkey), and real-time monitoring and incident response capabilities. These requirements are detailed in SPK’s communiqués and must be demonstrated during the application.

AML/KYC System Integration

Applicants must demonstrate a fully operational MASAK-compliant AML/KYC system including: customer identity verification before any transaction, ongoing transaction monitoring with automated alert systems, sanctions screening against UN and Turkish lists, suspicious transaction reporting infrastructure, Travel Rule compliance for crypto transfers, and record keeping for a minimum of 8 years. The system must be tested and auditable.

Application Process: Step by Step

Step 1: Establish an AŞ with the required minimum capital and register on MERSIS. Step 2: Appoint qualified board members, compliance officers, and IT management. Step 3: Develop and implement the required IT infrastructure, AML/KYC systems, and internal procedures. Step 4: Prepare the license application dossier including all required documents, technical specifications, and compliance evidence. Step 5: Submit the application to SPK. Step 6: SPK reviews the application, which may include on-site inspections and requests for additional information. Step 7: SPK issues the license or rejection decision.

Timeline and Costs

The complete process from company formation to license issuance typically takes 6-12 months. Key cost components include: 50 million TRY minimum capital, legal and consulting fees ($50,000-200,000 depending on complexity), IT infrastructure setup ($100,000-500,000+), ongoing compliance costs ($200,000-500,000/year), and SPK application and annual supervision fees. These are approximate figures; actual costs depend on the scope and scale of operations.

Transitional Provisions for Existing Exchanges

Crypto exchanges that were operating before Law No. 7518 took effect had until December 31, 2024, to submit license applications and until July 2, 2025, to meet all requirements. Platforms that missed these deadlines must cease operations. Customers of unlicensed platforms should transfer their assets to licensed platforms to ensure regulatory protection.

Frequently Asked Questions

Can a foreign company apply for an SPK crypto license?

The applicant must be a Turkish-registered AŞ. However, the shareholders can be foreign nationals or foreign legal entities. There is no restriction on foreign ownership of licensed CASPs in Turkey. The company formation process for the Turkish entity must be completed before the SPK application.

What happens if my application is rejected?

SPK must provide written reasons for rejection. The applicant can address the identified deficiencies and re-apply. If the rejection is believed to be erroneous, it can be challenged before the Council of State (Danıştay) — Turkey’s supreme administrative court. Legal counsel experienced in SPK matters is essential for the appeal process.

Can I operate a DeFi protocol without an SPK license?

This is a grey area. SPK’s current interpretation suggests that any platform facilitating crypto transactions targeting Turkish users may fall under licensing requirements, even if operated through smart contracts. The key factor is whether there is a centralized entity that can be identified as the service provider. Purely decentralized protocols with no identifiable operator may be outside SPK’s reach, but this remains untested in Turkish courts.

SPK License Application: Comprehensive Dossier

The SPK crypto license application requires a comprehensive dossier demonstrating that the applicant meets all regulatory requirements. The dossier typically includes:

Corporate Documents: Trade registry certificate and articles of association (AŞ — mandatory), shareholder structure diagram showing all shareholders with 10%+ ownership to the ultimate beneficial owner level, board of directors composition with CVs and professional backgrounds, organizational chart showing all departments and reporting lines, and proof of minimum 50 million TRY paid-in capital (bank statement and audited opening balance sheet). Shareholder/Management Fitness: For each qualifying shareholder (10%+), board member, general manager, and compliance officer: criminal record certificate (from Turkey and any country of residence in the past 10 years), financial soundness declaration (no bankruptcy, significant debt defaults, or tax liens), professional qualification evidence (degrees, certifications, 5+ years relevant experience), and declaration of other business interests and potential conflicts of interest.

Technology Infrastructure: System architecture documentation (matching engine, wallet management, API layer, database, monitoring), cybersecurity framework documentation (policies, procedures, incident response plan), ISO 27001 certification (or equivalent — SOC 2 Type II may be accepted), penetration test report from an independent firm (dated within 6 months), business continuity and disaster recovery plan (including RTO/RPO targets and test results), data center specifications (primary and backup, both located in Turkey), and system capacity analysis (demonstrating ability to handle 3x peak trading volumes). AML/KYC Infrastructure: Compliance program documentation (policies, procedures, risk assessment methodology), KYC system specifications (identity verification integration, PEP/sanctions screening), transaction monitoring system rules and alert management workflow, STR filing system and process documentation, Travel Rule implementation documentation, MASAK compliance officer appointment letter and registration, and training program outline (initial and ongoing).

SPK Review Process: What to Expect

Phase 1 — Completeness Review (2-4 weeks): SPK checks the application dossier for completeness. Missing documents are identified, and the applicant has 30 days to supplement. Phase 2 — Substantive Review (2-4 months): SPK examines the merits: shareholder fitness assessment (background checks, financial verification), technology review (SPK IT experts evaluate the system architecture and security), compliance assessment (adequacy of AML/KYC systems), and financial assessment (capital adequacy, business plan viability). Phase 3 — On-Site Inspection (1-2 days): SPK inspectors visit the applicant’s premises to verify: physical office exists and is adequately staffed, IT systems are operational and match the documentation, compliance systems are functional (live demonstrations requested), and organizational structure matches the submitted documents. Phase 4 — Decision (2-4 weeks after inspection): SPK issues either: license approval (with or without conditions), or rejection with specific reasons. If rejected, the applicant can address the deficiencies and reapply (no waiting period). The entire process from submission to decision typically takes 6-12 months — shorter for well-prepared applications, longer for those requiring multiple supplementary submissions.

Transitional Provisions for Existing Exchanges

Law No. 7518 established transitional provisions for crypto exchanges already operating when the law took effect: Deadline 1 — Application submission: Existing exchanges had until December 31, 2024 to submit SPK license applications. Exchanges that missed this deadline must cease operations — continued operation is a criminal offense. Deadline 2 — Full compliance: Existing exchanges had until July 2, 2025 to meet all SPK requirements (capital, technology, compliance). During the transitional period, existing exchanges could continue operating under enhanced supervision. Current status (2026): Several major Turkish exchanges (BtcTurk, Paribu, Bitay) have submitted applications and are in various stages of the review process. The SPK has begun publishing the official list of licensed platforms on its website (spk.gov.tr). Impact on users: Users should verify their exchange’s license status. Trading on unlicensed platforms carries risks: no investor protection fund coverage, no regulatory complaint mechanism, and potential difficulty demonstrating legitimate source of funds to MASAK or tax authorities.

Costs and Financial Planning

Capital requirement: 50 million TRY minimum paid-in capital (~$1.5 million). Technology: Platform development or acquisition: $500,000-2,000,000. Cybersecurity infrastructure: $100,000-500,000. Ongoing IT maintenance: $200,000-500,000/year. Compliance: AML/KYC system implementation: $100,000-300,000. Compliance team salaries: $200,000-500,000/year. External audit and legal fees: $50,000-200,000/year. Legal and consulting: License application preparation: $50,000-200,000. Ongoing regulatory counsel: $50,000-100,000/year. Operations: Office space, staffing, insurance, marketing. Total initial investment: $3-10 million depending on scope and scale. Annual operating costs: $1-3 million minimum. These figures make clear that the SPK licensing regime is designed for serious, well-capitalized operators — not hobby projects or minimal-viable-product startups.

Frequently Asked Questions

Can a foreign company apply for an SPK crypto license?

The applicant must be a Turkish-registered AŞ. However, the shareholders can be 100% foreign — there is no Turkish ownership requirement. Company formation for the Turkish entity must be completed before the SPK application. Many international crypto companies establish Turkish subsidiaries specifically for SPK licensing.

How long does the process take?

From company formation to license issuance: 8-14 months. Breakdown: company formation (2-4 weeks), technology development/deployment (3-6 months, can run in parallel), application preparation (1-2 months), SPK review (4-8 months). The longest variable is SPK review time, which depends on application quality, inspector availability, and the volume of pending applications.

Post-License: Ongoing Compliance Obligations

Obtaining the SPK crypto license is the beginning, not the end, of regulatory compliance. Licensed CASPs face extensive ongoing obligations: Financial Reporting: Monthly balance sheet and income statement to SPK. Quarterly regulatory capital adequacy report. Annual audited financial statements (by an SPK-registered independent auditor). Real-time customer asset segregation reporting (customer assets must always be segregated from company assets — any shortfall triggers immediate regulatory action). Technology Compliance: Annual penetration testing by an independent firm — results submitted to SPK. Bi-annual business continuity test — documented and available for SPK inspection. Continuous system monitoring and incident reporting — material security incidents must be reported to SPK within 24 hours. System capacity maintenance — the platform must always be able to handle 3x peak trading volume. MASAK Compliance: Monthly compliance reports to senior management. Quarterly STR filing statistics to MASAK. Annual AML program review and update. Ongoing employee training (documented, with completion records). SPK Inspections: The SPK conducts both scheduled (annual) and unannounced inspections. Focus areas: customer asset verification, technology security, trading surveillance (market manipulation detection), AML/KYC file sampling, and complaint handling procedures.

The TAKASBANK Integration: What It Means for Licensed Exchanges

TAKASBANK (İstanbul Takas ve Saklama Bankası A.Ş.) — Turkey’s central clearing and custody institution — is developing institutional-grade infrastructure specifically for the crypto market: Customer Asset Custody: TAKASBANK will provide centralized custody for customer crypto assets, replacing individual platform custody. This means: customer assets are held by a regulated custodian (TAKASBANK), not the exchange, dramatically reducing the risk of exchange-level theft or mismanagement. The exchange’s insolvency would not affect customer assets held at TAKASBANK. This addresses one of crypto’s biggest historical risks — the loss of customer funds when exchanges collapse (Thodex, FTX, Mt. Gox). Trade Settlement: TAKASBANK provides delivery-versus-payment (DVP) settlement — the buyer’s payment and the seller’s crypto transfer happen simultaneously through TAKASBANK, eliminating counterparty risk. This institutional-grade settlement mechanism is unique globally — most crypto exchanges use their own internal ledgers for settlement. Custody Reporting: TAKASBANK provides regular custody reports to SPK and the exchange — enabling independent verification of customer asset holdings. This transparency is a significant trust factor for institutional investors and for MASAK oversight. Implementation Timeline: TAKASBANK integration is being rolled out in phases. Exchanges licensed under Law 7518 must connect to TAKASBANK within the timeframe specified in their license conditions (typically 6-12 months after license issuance). The full system is expected to be operational across all licensed platforms by late 2026.