SPK Crypto License Application Turkey 2026: Step-by-Step Guide

The Capital Markets Board of Turkey (SPK/CMB) now regulates all crypto asset service providers (CASPs) under Law No. 7518, enacted in June 2024. Any entity that operates a crypto trading platform, provides custody services, or facilitates crypto transfers in Turkey must obtain an SPK license. Operating without a license is a criminal offense punishable by imprisonment. This article provides a step-by-step guide to theSPK crypto license application process in 2026, prepared by Attorney Bilal Alyar (İstanbul Bar Association, Reg. No: 54965).

Who Needs an SPK Crypto License?

Under Law No. 7518, the following activities require SPK authorization: operating a crypto asset trading platform (exchange), providing crypto asset custody/wallet services, offering crypto asset transfer services, providing crypto asset portfolio management, and acting as an intermediary for crypto asset transactions. This covers centralized exchanges, OTC desks, custodians, and any entity that holds customer crypto assets.

Minimum Capital Requirement

SPK requires a minimum paid-in capital of 50 million TRY (approximately $1.5 million USD at current rates) for crypto trading platform operators. This capital must be fully deposited before the license application is submitted and maintained throughout the licensing period. The capital requirement may vary for other CASP categories. The company must be established as a Joint Stock Company (Anonim Şirket — AŞ) under Turkish law.

Shareholder and Management Fit-and-Proper Tests

All shareholders holding 10% or more, board members, and senior management must pass SPK’s fit-and-proper assessment. This includes: clean criminal record (no convictions for fraud, financial crimes, or organized crime), financial soundness (no bankruptcy or significant debt defaults), relevant professional qualifications and experience, and no prior regulatory sanctions from SPK or other financial regulators. These requirements apply to both Turkish and foreign shareholders/managers.

IT Infrastructure Requirements

SPK mandates comprehensive technology standards including: cyber security framework aligned with ISO 27001 or equivalent, penetration testing by independent third parties, business continuity and disaster recovery plans with regular testing, system capacity sufficient to handle peak trading volumes, data center redundancy (primary and backup facilities in Turkey), and real-time monitoring and incident response capabilities. These requirements are detailed in SPK’s communiqués and must be demonstrated during the application.

AML/KYC System Integration

Applicants must demonstrate a fully operationalMASAK-compliant AML/KYC system including: customer identity verification before any transaction, ongoing transaction monitoring with automated alert systems, sanctions screening against UN and Turkish lists, suspicious transaction reporting infrastructure, Travel Rule compliance for crypto transfers, and record keeping for a minimum of 8 years. The system must be tested and auditable.

Application Process: Step by Step

Step 1: Establish an AŞ with the required minimum capital and register on MERSIS. Step 2: Appoint qualified board members, compliance officers, and IT management. Step 3: Develop and implement the required IT infrastructure, AML/KYC systems, and internal procedures. Step 4: Prepare the license application dossier including all required documents, technical specifications, and compliance evidence. Step 5: Submit the application to SPK. Step 6: SPK reviews the application, which may include on-site inspections and requests for additional information. Step 7: SPK issues the license or rejection decision.

Timeline and Costs

The complete process from company formation to license issuance typically takes 6-12 months. Key cost components include: 50 million TRY minimum capital, legal and consulting fees ($50,000-200,000 depending on complexity), IT infrastructure setup ($100,000-500,000+), ongoing compliance costs ($200,000-500,000/year), and SPK application and annual supervision fees. These are approximate figures; actual costs depend on the scope and scale of operations.

Transitional Provisions for Existing Exchanges

Crypto exchanges that were operating before Law No. 7518 took effect had until December 31, 2024, to submit license applications and until July 2, 2025, to meet all requirements. Platforms that missed these deadlines must cease operations. Customers of unlicensed platforms should transfer their assets to licensed platforms to ensure regulatory protection.

Frequently Asked Questions

Can a foreign company apply for an SPK crypto license?

The applicant must be a Turkish-registered AŞ. However, the shareholders can be foreign nationals or foreign legal entities. There is no restriction on foreign ownership of licensed CASPs in Turkey. Thecompany formation process for the Turkish entity must be completed before the SPK application.

What happens if my application is rejected?

SPK must provide written reasons for rejection. The applicant can address the identified deficiencies and re-apply. If the rejection is believed to be erroneous, it can be challenged before the Council of State (Danıştay) — Turkey’s supreme administrative court. Legal counsel experienced in SPK matters is essential for the appeal process.

Can I operate a DeFi protocol without an SPK license?

This is a grey area. SPK’s current interpretation suggests that any platform facilitating crypto transactions targeting Turkish users may fall under licensing requirements, even if operated through smart contracts. The key factor is whether there is a centralized entity that can be identified as the service provider. Purely decentralized protocols with no identifiable operator may be outside SPK’s reach, but this remains untested in Turkish courts.

SPK License Application: Comprehensive Dossier

TheSPK crypto license application requires a comprehensive dossier demonstrating that the applicant meets all regulatory requirements. The dossier typically includes:

Corporate Documents: Trade registry certificate and articles of association (AŞ — mandatory), shareholder structure diagram showing all shareholders with 10%+ ownership to the ultimate beneficial owner level, board of directors composition with CVs and professional backgrounds, organizational chart showing all departments and reporting lines, and proof of minimum 50 million TRY paid-in capital (bank statement and audited opening balance sheet).Shareholder/Management Fitness: For each qualifying shareholder (10%+), board member, general manager, and compliance officer: criminal record certificate (from Turkey and any country of residence in the past 10 years), financial soundness declaration (no bankruptcy, significant debt defaults, or tax liens), professional qualification evidence (degrees, certifications, 5+ years relevant experience), and declaration of other business interests and potential conflicts of interest.

Technology Infrastructure: System architecture documentation (matching engine, wallet management, API layer, database, monitoring), cybersecurity framework documentation (policies, procedures, incident response plan), ISO 27001 certification (or equivalent — SOC 2 Type II may be accepted), penetration test report from an independent firm (dated within 6 months), business continuity and disaster recovery plan (including RTO/RPO targets and test results), data center specifications (primary and backup, both located in Turkey), and system capacity analysis (demonstrating ability to handle 3x peak trading volumes).AML/KYC Infrastructure: Compliance program documentation (policies, procedures, risk assessment methodology), KYC system specifications (identity verification integration, PEP/sanctions screening), transaction monitoring system rules and alert management workflow, STR filing system and process documentation, Travel Rule implementation documentation,MASAK compliance officer appointment letter and registration, and training program outline (initial and ongoing).

SPK Review Process: What to Expect

Phase 1 — Completeness Review (2-4 weeks): SPK checks the application dossier for completeness. Missing documents are identified, and the applicant has 30 days to supplement.Phase 2 — Substantive Review (2-4 months): SPK examines the merits: shareholder fitness assessment (background checks, financial verification), technology review (SPK IT experts evaluate the system architecture and security), compliance assessment (adequacy of AML/KYC systems), and financial assessment (capital adequacy, business plan viability).Phase 3 — On-Site Inspection (1-2 days): SPK inspectors visit the applicant’s premises to verify: physical office exists and is adequately staffed, IT systems are operational and match the documentation, compliance systems are functional (live demonstrations requested), and organizational structure matches the submitted documents.Phase 4 — Decision (2-4 weeks after inspection): SPK issues either: license approval (with or without conditions), or rejection with specific reasons. If rejected, the applicant can address the deficiencies and reapply (no waiting period). The entire process from submission to decision typically takes 6-12 months — shorter for well-prepared applications, longer for those requiring multiple supplementary submissions.

Transitional Provisions for Existing Exchanges

Law No. 7518 established transitional provisions for crypto exchanges already operating when the law took effect:Deadline 1 — Application submission: Existing exchanges had until December 31, 2024 to submit SPK license applications. Exchanges that missed this deadline must cease operations — continued operation is a criminal offense.Deadline 2 — Full compliance: Existing exchanges had until July 2, 2025 to meet all SPK requirements (capital, technology, compliance). During the transitional period, existing exchanges could continue operating under enhanced supervision.Current status (2026): Several major Turkish exchanges (yerli kripto borsası) have submitted applications and are in various stages of the review process. The SPK has begun publishing the official list of licensed platforms on its website (spk.gov.tr).Impact on users: Users should verify their exchange’s license status. Trading on unlicensed platforms carries risks: no investor protection fund coverage, no regulatory complaint mechanism, and potential difficulty demonstrating legitimate source of funds toMASAK or tax authorities.

Costs and Financial Planning

Capital requirement: 50 million TRY minimum paid-in capital (~$1.5 million).Technology: Platform development or acquisition: $500,000-2,000,000. Cybersecurity infrastructure: $100,000-500,000. Ongoing IT maintenance: $200,000-500,000/year.Compliance: AML/KYC system implementation: $100,000-300,000. Compliance team salaries: $200,000-500,000/year. External audit and legal fees: $50,000-200,000/year.Legal and consulting: License application preparation: $50,000-200,000. Ongoing regulatory counsel: $50,000-100,000/year.Operations: Office space, staffing, insurance, marketing.Total initial investment: $3-10 million depending on scope and scale.Annual operating costs: $1-3 million minimum. These figures make clear that the SPK licensing regime is designed for serious, well-capitalized operators — not hobby projects or minimal-viable-product startups.

Frequently Asked Questions

Can a foreign company apply for an SPK crypto license?

The applicant must be a Turkish-registered AŞ. However, the shareholders can be 100% foreign — there is no Turkish ownership requirement.Company formation for the Turkish entity must be completed before the SPK application. Many international crypto companies establish Turkish subsidiaries specifically for SPK licensing.

How long does the process take?

From company formation to license issuance: 8-14 months. Breakdown: company formation (2-4 weeks), technology development/deployment (3-6 months, can run in parallel), application preparation (1-2 months), SPK review (4-8 months). The longest variable is SPK review time, which depends on application quality, inspector availability, and the volume of pending applications.

Post-License: Ongoing Compliance Obligations

Obtaining theSPK crypto license is the beginning, not the end, of regulatory compliance. Licensed CASPs face extensive ongoing obligations:Financial Reporting: Monthly balance sheet and income statement to SPK. Quarterly regulatory capital adequacy report. Annual audited financial statements (by an SPK-registered independent auditor). Real-time customer asset segregation reporting (customer assets must always be segregated from company assets — any shortfall triggers immediate regulatory action).Technology Compliance: Annual penetration testing by an independent firm — results submitted to SPK. Bi-annual business continuity test — documented and available for SPK inspection. Continuous system monitoring and incident reporting — material security incidents must be reported to SPK within 24 hours. System capacity maintenance — the platform must always be able to handle 3x peak trading volume.MASAK Compliance: Monthly compliance reports to senior management. Quarterly STR filing statistics to MASAK. Annual AML program review and update. Ongoing employee training (documented, with completion records).SPK Inspections: The SPK conducts both scheduled (annual) and unannounced inspections. Focus areas: customer asset verification, technology security, trading surveillance (market manipulation detection), AML/KYC file sampling, and complaint handling procedures.

The TAKASBANK Integration: What It Means for Licensed Exchanges

TAKASBANK (İstanbul Takas ve Saklama Bankası A.Ş.) — Turkey’s central clearing and custody institution — is developing institutional-grade infrastructure specifically for the crypto market:Customer Asset Custody: TAKASBANK will provide centralized custody for customer crypto assets, replacing individual platform custody. This means: customer assets are held by a regulated custodian (TAKASBANK), not the exchange, dramatically reducing the risk of exchange-level theft or mismanagement. The exchange’s insolvency would not affect customer assets held at TAKASBANK. This addresses one of crypto’s biggest historical risks — the loss of customer funds when exchanges collapse (Thodex, FTX, Mt. Gox).Trade Settlement: TAKASBANK provides delivery-versus-payment (DVP) settlement — the buyer’s payment and the seller’s crypto transfer happen simultaneously through TAKASBANK, eliminating counterparty risk. This institutional-grade settlement mechanism is unique globally — most crypto exchanges use their own internal donanım cüzdanıs for settlement.Custody Reporting: TAKASBANK provides regular custody reports to SPK and the exchange — enabling independent verification of customer asset holdings. This transparency is a significant trust factor for institutional investors and forMASAK oversight.Implementation Timeline: TAKASBANK integration is being rolled out in phases. Exchanges licensed under Law 7518 must connect to TAKASBANK within the timeframe specified in their license conditions (typically 6-12 months after license issuance). The full system is expected to be operational across all licensed platforms by late 2026.

Turkish Crypto and Technology Law: Spk Crypto License Application

Turkey’scrypto and blockchain regulatory framework is anchored by Law No. 7518 (Amendment to the Capital Markets Law), enacted June 2024. This landmark legislation brought all crypto asset service providers (CASPs) under the oversight of the Capital Markets Board (SPK/CMB), requiring licensing for exchanges, custodians, and transfer service providers. TheFinancial Crimes Investigation Board (MASAK) enforces AML/KYC requirements, while the Central Bank (TCMB) maintains the prohibition on crypto payments for goods and services (April 2021 regulation). Despite the payment ban, holding, trading, and investing in crypto assets remains fully legal.

For spk crypto license application specifically, the regulatory environment includes:SPK licensing requirements (minimum 50M TRY capital for exchange operators), MASAK AML/KYC obligations (customer verification, transaction monitoring, suspicious transaction reporting within 10 business days), the 0.03%transaction levy on all crypto sales through licensed platforms, and Turkey’s unique position as aregulatory alternative to the EU’s MiCA framework. The absence of a separate capital gains tax for individual crypto investors makes Turkey one of the world’s most tax-efficient jurisdictions for crypto trading.

Regulatory Requirements and Compliance

Key compliance requirements for spk crypto license application:SPK: All CASPs must obtain an SPK license. Operating without a license is a criminal offense (2-5 years imprisonment). Customer assets must be segregated from company assets. TAKASBANK integration required for custody and settlement.MASAK: Full KYC before any transaction, ongoing transaction monitoring with automated alerts, STR filing within 10 business days, Travel Rule compliance for transfers above 15,000 TRY threshold, and 8-year record retention.Tax: 0.03% BSMV on each sale transaction (withheld by platform), no separate capital gains tax for individuals, 25% corporate income tax for companies, andmining income potentially classified as commercial income.

Frequently Asked Questions

Is spk crypto license application legal in Turkey?

Yes. Crypto holding, trading, and investing are fully legal. Only using crypto as payment for goods/services is prohibited. Licensed platforms operate under SPK oversight with full regulatory protection.

What tax do I pay on crypto?

Individual investors: 0.03% transaction levy per sale only — no separate capital gains tax. Corporate entities: 25% corporate income tax plus 0.03% BSMV. See ourcrypto tax guide.

What if MASAK freezes my account?

Engage an attorney immediately. Prepare documentation proving legitimate fund sources. File an objection within prescribed deadlines. See ourMASAK freeze guide. Contact: +90 545 199 25 25.

Can foreigners start crypto businesses in Turkey?

Yes. No restrictions on foreign ownership. The company must be a Turkish AŞ meetingSPK requirements.Company formation can be done remotely. Total investment: $3-10M.

Practical Implementation: Spk Crypto License Application

The practical implementation of spk crypto license application in Turkey requires careful coordination with Turkish government agencies, courts, and professional service providers. Based on extensive experience handling these matters for foreign nationals, Attorney Bilal Alyar (İstanbul Bar Association, Reg. No: 54965) provides the following practical guidance. The Turkish legal system’s civil law framework — rooted in Swiss, German, and Italian codifications — provides predictable procedures and outcomes for spk crypto license application, though navigating the bureaucratic requirements benefits significantly from professional legal guidance.

Key regulatory authorities for spk crypto license application: the Ministry of Interior (İçişleri Bakanlığı) for immigration and citizenship matters, the Ministry of Justice (Adalet Bakanlığı) for court procedures and judicial cooperation, the Revenue Administration (Gelir İdaresi Başkanlığı) for tax matters, the Capital Markets Board (SPK) for financial market regulation, the Banking Regulation Agency (BDDK) for banking matters, the MASAK for anti-money laundering compliance, and the Land Registry Directorate (Tapu ve Kadastro Genel Müdürlüğü) for property transactions. Understanding which agency handles your specific matter is the first step toward efficient processing.

Documentation Practices for Spk Crypto License Application

Proper documentation is critical for success in spk crypto license application. Common causes of delays and rejections include: improperly apostilled documents (the apostille must be on the ORIGINAL document, not a copy), expired translations (though no formal expiration exists, some authorities reject translations older than 6 months), inconsistencies between documents (name spelling differences between passport and birth certificate, for example), and missing supporting documents (financial evidence, insurance certificates). To avoid these issues: have your Turkish attorney review ALL documents before submission, obtain apostilles on originals before translating, ensure consistent personal information across all documents, and prepare a complete file checklist based on the specific requirements of your matter.

Turkey’s e-Devlet (e-Government) portal and the UYAP (National Judiciary Informatics System) have digitalized many processes. Foreign nationals with a Turkish tax ID and e-Devlet access can: track application status online, verify document submissions, access court case files (through UYAP for judicial matters), and download official certificates. Your Turkish attorney can also access these systems on your behalf through their BAROKart (attorney digital ID) authentication.

Additional Considerations and FAQ

What are the most common mistakes foreigners make with spk crypto license application?

The five mistakes are: (1) Not engaging a Turkish attorney until problems arise — early professional guidance prevents most issues. (2) Relying on informal advice from friends or online forums rather than verified legal information. (3) Missing statutory deadlines — many Turkish legal procedures have strict time limits (30 days for administrative appeals, 60 days for judicial appeals, 1 year for certain claims). (4) Not maintaining proper records — the Turkish system relies heavily on documentary evidence. (5) Underestimating the importance of the Turkish language requirement — all official proceedings are in Turkish, and mistranslation can have serious consequences.

How do I choose the right attorney for spk crypto license application?

All practicing attorneys in Turkey must be registered with their local Bar Association. Verification can be done through the bar association’s website. For spk crypto license application, look for: specific experience in this practice area, ability to communicate in your language (English, Arabic, Russian, etc.), transparent fee structure (compliant with the TBB Minimum Fee Schedule), and accessibility (responsive communication, clear timelines). Attorney Bilal Alyar (İstanbul Bar, Reg. No: 54965) provides bilingual legal services covering the full spectrum of Turkish law for foreign nationals. Contact: +90 545 199 25 25 | info@bilalalyar.av.tr | Cevizli, Enderun Sk. No:10C D:58, 34865 Kartal/İstanbul.

What is the cost-benefit analysis of professional legal assistance for spk crypto license application?

While attorney fees represent an upfront cost, the return on investment is typically significant: faster processing (weeks vs. months when errors cause rejections and reapplications), higher success rates (properly prepared applications have 90%+ approval rates vs. 60-70% for self-prepared), risk mitigation (avoiding penalties, fines, or deportation from procedural errors), and long-term compliance (ongoing obligations are properly managed). For spk crypto license application, the minimum attorney fee under the TBB schedule is published annually — our office provides transparent fee quotations during the initial consultation.

Cryptocurrency Regulation Framework in Turkey

Attorney Bilal Alyar, registered with the İstanbul Bar Association (Registration No: 54965), has extensive experience in this field and provides professional legal services to both domestic and international clients. For effective resolution of complex legal issues, it is recommended to seek professional counsel at an early stage. Contact us at +90 545 199 25 25 or info@bilalalyar.av.tr.

SPK Compliance and Licensing Requirements

Attorney Bilal Alyar, registered with the İstanbul Bar Association (Registration No: 54965), has extensive experience in this field and provides professional legal services to both domestic and international clients. For effective resolution of complex legal issues, it is recommended to seek professional counsel at an early stage. Contact us at +90 545 199 25 25 or info@bilalalyar.av.tr.

AML/KYC Obligations Under Turkish Law

Attorney Bilal Alyar, registered with the İstanbul Bar Association (Registration No: 54965), has extensive experience in this field and provides professional legal services to both domestic and international clients. For effective resolution of complex legal issues, it is recommended to seek professional counsel at an early stage. Contact us at +90 545 199 25 25 or info@bilalalyar.av.tr.

Cryptocurrency Taxation in Turkey

Attorney Bilal Alyar, registered with the İstanbul Bar Association (Registration No: 54965), has extensive experience in this field and provides professional legal services to both domestic and international clients. For effective resolution of complex legal issues, it is recommended to seek professional counsel at an early stage. Contact us at +90 545 199 25 25 or info@bilalalyar.av.tr.

Investor Protection and Dispute Resolution

Attorney Bilal Alyar, registered with the İstanbul Bar Association (Registration No: 54965), has extensive experience in this field and provides professional legal services to both domestic and international clients. For effective resolution of complex legal issues, it is recommended to seek professional counsel at an early stage. Contact us at +90 545 199 25 25 or info@bilalalyar.av.tr.

Resmi Kaynaklar

• Mevzuat Bilgi Sistemi (mevzuat.gov.tr)
• Yargıtay Karar Arama (karararama.yargitay.gov.tr)
• UYAP Vatandaş Portalı (uyap.gov.tr)
• İstanbul Barosu (istanbulbarosu.org.tr)
• T.C. Adalet Bakanlığı (adalet.gov.tr)
• Türkiye Barolar Birliği (barobirlik.org.tr)

Hazırlayan Hukuku

Av. Bilal ALYAR — İstanbul Barosu Sicil No: 54965

Marmara Üniversitesi Hukuk Fakültesi mezunu (2015). Aile hukuku, ceza hukuku, kripto para hukuku, bilişim hukuku, şirketler hukuku ve vergi hukuku alanlarında faaliyet göstermektedir.

Bu içerik yalnızca genel bilgilendirme amaçlıdır; somut hukuki görüş ya da avukat-müvekkil ilişkisi oluşturmaz. Her dosya kendine özgü koşullar içerdiğinden, hukuki süreçlerde ilgili mevzuat çerçevesinde bilgilendirme alınması yararlı olabilir.

Contact | About Us