Turkey crypto regulations 2026: the complete legal framework

Turkey is on the verge of enacting its first crypto-specific tax law, capping a two-year regulatory transformation that began with Law 7518 in July 2024 and now includes a pending bill proposing a 10% withholding tax on platform gains and a 0.03% transaction tax on all crypto sales. The bill passed the TBMM Plan ve Bütçe Komisyonu on March 5, 2026, and awaits a General Assembly vote.

This regulatory overhaul — spanning SPK licensing, MASAK anti-money laundering rules, and tax provisions — was driven largely by Turkey’s placement on the FATF grey list in October 2021, its removal in June 2024, and a domestic crypto market estimated at $200 billion in annual transaction volume with over 12 million holders. What follows is the complete legal picture as of March 2026.

Law 7518 established Turkey’s crypto regulatory architecture

Law No. 7518 (Sermaye Piyasası Kanununda Değişiklik Yapılmasına Dair Kanun) was adopted by the TBMM on June 26, 2024, and published in the Official Gazette on July 2, 2024 (No. 32590). It is not a standalone statute but amends the Capital Markets Law No. 6362 (Sermaye Piyasası Kanunu), inserting crypto-specific provisions that placed the entire sector under SPK supervision.

The law defines a kripto varlık (crypto asset) as “intangible assets created and stored electronically using distributed ledger technology or similar technology, distributed over digital networks, and capable of expressing value or rights” (dağıtık defter teknolojisi veya benzer bir teknoloji kullanılarak elektronik olarak oluşturulup saklanabilen, dijital ağlar üzerinden dağıtımı yapılan ve değer veya hak ifade edebilen gayri maddi varlıklar). It also defines cüzdan (wallet), platform, kripto varlık hizmet sağlayıcı / KVHS (crypto asset service provider), and kripto varlık saklama hizmeti (custody service).

Key articles added to Law 6362 include:

• Article 35/B: Requires all KVHSler to obtain SPK permission to operate; assigns TÜBİTAK a role in setting technical infrastructure criteria.
• Article 35/C: Mandates customer self-custody as the default principle; requires non-self-custodied assets to be held by SPK-authorized banks (with BDDK approval) or authorized custodians. Customer cash must be held in banks. Customer assets must be segregated from the KVHS’s own assets and are explicitly not covered by deposit insurance under Banking Law 5411, Article 63.
• Article 99/A: Targets foreign platforms serving Turkish residents. Criteria for “targeting” include Turkish-language websites, marketing directed at Turkey, or establishing an office in Turkey. Foreign platforms had to cease operations by October 2, 2024.
• Article 109/A: Criminal penalties for operating as an unlicensed KVHS — 3 to 5 years imprisonment and 5,000 to 10,000 days judicial fine (adli para cezası).
• Article 110/A: Embezzlement (zimmet) of customer crypto assets or funds — 8 to 14 years imprisonment (standard), 12 to 22 years (aggravated, where license is revoked); judicial fine cannot be less than 3× total damages.
• Geçici Madde 11: Existing operators had one month (by August 2, 2024) to file declarations with SPK to either seek licensing or liquidate within three months.

Importantly, Law 7518 contained no tax provisions — it was purely a regulatory and licensing framework. Crypto assets are also excluded from the SPK’s Article 82 Investor Compensation Center. Liability-limiting clauses in KVHS customer contracts are void.

SPK’s licensing regime demands heavy capital and strict compliance

SPK published two foundational communiqués on March 13, 2025 (Official Gazette No. 32840), operationalizing the Law 7518 framework with detailed requirements:

Tebliğ III-35/B.1 (Kuruluş ve Faaliyet Esasları) requires KVHSler to be established as joint-stock companies (anonim şirket) with all registered shares, cash-only capital fully paid in, and a trade name including “kripto varlık alım satım platformu.” Boards of directors need a minimum of three members, and founders must pass fit-and-proper tests (no bankruptcy, no specified criminal convictions). Internal audit, internal control, and risk management systems are mandatory, as are TÜBİTAK-certified IT infrastructure audits.

Tebliğ III-35/B.2 (Çalışma Usul ve Esasları ile Sermaye Yeterliliği) sets minimum paid-in capital at 150 million TL (~$4.1M) for platforms and 500 million TL (~$13.7M) for custodians. It defines permitted activities (order execution, clearing/settlement, transfers, initial sale intermediation, custody, investment advisory, portfolio management) and prohibits leveraged trading, derivatives, short selling, margin/credit trading, guaranteed return promises, forex trading, and order-taking through social media.

Investment advisory is restricted to clients holding ≥50 million TL in crypto on the platform. Platforms must conduct independent proof-of-reserves audits (rezerv kanıt denetimi), and at least 95% of customer crypto assets must be held at authorized custody institutions.

The licensing timeline involves staggered compliance deadlines:

As of late 2025, 77 platforms and 11 custody institutions appeared on SPK’s “Faaliyette Bulunanlar Listesi” (Active Operators List), but SPK explicitly states this list does not constitute formal authorization — it merely reflects entities permitted to operate provisionally. No entity has been publicly confirmed as holding a final operating license. SPK blocked access to 300+ unlicensed websites through decisions in Bulletins 2024/56–2025/7, and in July 2025 blocked 46 crypto platforms overnight, including global names like PancakeSwap. Ten platforms were restricted from accepting new customers by SPK decision dated July 17, 2025.

The pending tax bill proposes a 10% withholding and 0.03% transaction tax

Turkey’s first crypto-specific tax legislation was submitted to the TBMM on March 2, 2026 as part of the Bazı Kanunlarda Değişiklik Yapılması Hakkında Kanun Teklifi (Esas No: 2/3560) by AK Parti deputies. The bill passed the Plan ve Bütçe Komisyonu on March 5, 2026 and awaits the Genel Kurul vote. If enacted, provisions take effect two months after Official Gazette publication.

The bill introduces two distinct levies:

Kripto Varlık İşlem Vergisi (Crypto Asset Transaction Tax): A 0.03% (on binde 3) tax on the sale amount or fair market value of every crypto sale or transfer via a licensed platform. The platform is the taxpayer, not the investor. Payment is monthly by the 15th of the following month. The President can reduce the rate to zero or increase it up to 5× (0.15%). No deductions are allowed from the tax base. This is added to the Gider Vergileri Kanunu (Law No. 6802).

Gelir Vergisi Stopajı (Income Tax Withholding): SPK-licensed platforms withhold 10% on realized crypto gains on a quarterly basis. This applies to all persons — natural or legal, resident or non-resident, exempt or not. Key rules:

• FIFO (First In, First Out) is mandatory for cost basis calculation
• Commissions and the 0.03% transaction tax are deductible from the withholding base
• Losses on same-type crypto assets can offset gains within the same calendar year only — no carry-forward and no offset against other income
• Platform-to-platform transfers require communication of cost basis and purchase date
• For non-commercial investors, the withholding constitutes the final tax — no annual return is needed
• The President can adjust the rate between 0% and 20% based on token type, holding period, issuer identity, or wallet type

Gains outside licensed platforms (foreign exchanges, DeFi, unhosted wallets) must be declared via annual Gelir Vergisi Beyannamesi in March of the following year and taxed at progressive rates from 15% to 40%:

The bill also amends KDV Kanunu (Law No. 3065), Article 17/4(g) to grant a VAT exemption for crypto asset deliveries subject to the transaction tax. This is a partial exemption (kısmi istisna), meaning no input VAT credit is available.

Before this bill, Turkey had no crypto-specific tax law in force. GİB’s Deputy Head İdris Şenyurt publicly acknowledged that “investors’ gains are not currently taxable — there is no place in the law.” While gains theoretically fell under GVK Mükerrer Madde 80 (capital gains) or Madde 82 (occasional income), enforcement was minimal. The 2025 değer artış kazancı exemption threshold was 120,000 TL, and the arızi kazanç threshold was 280,000 TL.

MASAK transformed crypto AML compliance through aggressive rulemaking

MASAK (Mali Suçları Araştırma Kurulu) operates under Law No. 5549 (Suç Gelirlerinin Aklanmasının Önlenmesi Hakkında Kanun, enacted October 18, 2006, Official Gazette No. 26323). Crypto platforms became MASAK-obliged entities through Presidential Decree No. 3941 (Official Gazette, May 1, 2021, No. 31471), issued in direct response to the Thodex collapse.

A major December 2024 overhaul via Presidential Decree No. 9305 (Official Gazette, December 25, 2024, No. 32763) reclassified KVHSler as “finansal kuruluş” (financial institution) — putting them on equal regulatory footing with banks. This triggered enhanced obligations: risk-based transaction monitoring, prohibition of simplified KYC measures, senior management approval for financial institution-KVHS business relationships, and mandatory registration with MASAK’s e-notification system by January 25, 2025.

The Travel Rule took full effect on February 25, 2025, implementing FATF Recommendation 16 through new Article 24/A of the Tedbirler Yönetmeliği. For crypto transfers of ≥15,000 TL (~$425), full sender identity verification is required, and beneficiary information must accompany the transfer. For transfers to unhosted wallets or through foreign CASPs not subject to information-sharing, Turkish platforms must obtain customer declarations with identifying information.

Two 2025 communiqués further tightened the regime. Communiqué No. 28 (June 12, 2025, Official Gazette No. 32924) extended remote video/NFC identification to KVHSler while explicitly prohibiting remote KYC for platforms dealing in privacy coins. Communiqué No. 29 (June 28, 2025, Official Gazette No. 32940) imposed the sector’s most aggressive measures:

• 48-hour minimum waiting period for crypto withdrawals after purchase, swap, or deposit
• 72-hour waiting period for first-ever withdrawals
• Stablecoin transfer limits: $3,000/day and $50,000/month (doubled with Travel Rule compliance)
• 20-character minimum transaction description for all transfers
• Periodic source-of-funds documentation requirements
• Cross-platform monitoring to detect and block simultaneous multi-platform manipulation

Administrative fines for violations stand at TRY 453,342 per violation under Article 13(1) of Law 5549 (2025 rate). Repeated non-compliance triggers escalating penalties — TRY 3,777,903 after a first warning, TRY 7,555,806 after a second, and ultimately referral for activity suspension or license revocation. Suspicious transaction reports must be filed within 10 working days (or immediately in urgent cases), with all records retained for 8 years.

Turkey’s FATF grey list journey concluded on June 28, 2024, when the FATF Plenary officially removed Turkey after Law 7518 addressed the sole remaining deficiency — Recommendation 15 on virtual assets. A FATF evaluation team visited Turkey in November 2025 to verify continued compliance.

The TCMB payment ban and BDDK’s consultative role

The often-misattributed “crypto payment ban” was issued not by BDDK but by TCMB (Central Bank) on April 16, 2021 (Official Gazette No. 31456, effective April 30, 2021) — the Ödemelerde Kripto Varlıkların Kullanılmamasına Dair Yönetmelik. It prohibits using crypto assets directly or indirectly for payments and bans payment/e-money institutions from intermediating fund transfers to crypto platforms.

Crucially, banks are not banned from processing transfers to and from crypto platforms — only payment and e-money institutions (fintechs like Papara) face this restriction. Crypto trading itself was never prohibited. This regulation remains in force with no indication of revision.

BDDK’s role under the new framework is primarily consultative: SPK must obtain BDDK’s approval (uygun görüş) for banks seeking to offer crypto custody services, and BDDK must be consulted when SPK drafts regulations imposing obligations on banks. No major standalone BDDK crypto regulation has been issued in 2025–2026.

Tax penalties and criminal liability create serious compliance stakes

Turkish tax law applies several penalty mechanisms to undeclared crypto gains under the Vergi Usul Kanunu (VUK, Law No. 213):

Vergi Ziyaı Cezası (Tax Loss Penalty — VUK Articles 341 & 344): The standard penalty is 1× (100%) of the evaded tax amount. Where the evasion involves VUK Article 359 offenses (fraudulent documents, concealed records), the penalty rises to 3× the evaded tax. A post-August 2024 amendment introduced a 1.5× penalty for tax evasion through unregistered activity. Gecikme faizi (late interest — VUK Article 112) accrues daily from the original due date at rates linked to the gecikme zammı rate, which in Turkey’s inflationary environment can compound to substantial sums over multiple years.

Criminal penalties under VUK Article 359 include 18 months to 5 years imprisonment for concealing or destroying records, and 3 to 8 years for using forged documents or false invoices. Under VUK Article 371 (Pişmanlık ve Islah), taxpayers who voluntarily declare before an audit begins or criminal complaint is filed can be exempt from the entire vergi ziyaı cezası, owing only the tax principal and late interest — a strong incentive for voluntary compliance.

The upcoming OECD CARF (Crypto-Asset Reporting Framework), expected to reach full operational capacity in 2026, will enable automatic exchange of Turkish residents’ crypto data from global exchanges (Binance, Coinbase, Kraken, OKX) with GİB, dramatically increasing detection capabilities.

Exchange fraud cases shaped the regulatory response

The Thodex case remains Turkey’s landmark crypto fraud. Founder Faruk Fatih Özer shut down the exchange on April 21, 2021, fleeing with an estimated $150 million from roughly 400,000 users. Captured in Albania in August 2022 and extradited to Turkey, Özer and two siblings were sentenced by the Anadolu 9th Heavy Penal Court on September 8, 2023, to 11,196 years, 10 months, and 15 days imprisonment each, plus TRY 8.87 billion in judicial fines, for organized crime, qualified fraud, and money laundering.

The Istanbul Regional Court of Appeals (22nd Criminal Chamber) overturned the verdict on January 30, 2025, sending the case back. Özer was found dead in Tekirdağ F-Type Prison on November 1, 2025, with initial reports pointing to suicide.

The Vebitcoin case involved a Muğla-based exchange (CEO İlker Baş) that ceased operations on April 23, 2021. MASAK blocked all bank accounts; the prosecution demanded 1,316 years imprisonment for each of the 16 defendants. The case was ongoing as of 2025 before the Muğla 3rd Heavy Penal Court.

Other cases include Bitrota (a Ponzi scheme collecting TRY 54 million) and a Dogecoin mining fraud that collected TRY 1 billion from 1,500 victims. The ICRYPEX founder Gökalp İçer was detained on July 28, 2025, on criminal charges including drug supply and attempted murder, with MASAK ordering asset seizure of bank accounts, crypto funds, vehicles, real estate, and company shares.

Common legal issues and what Turkish investors should know

Turkish crypto investors face several recurring legal challenges. Bank account freezes are common — MASAK actively monitors crypto-origin bank transfers and can freeze accounts without a court order under Law 5549 Article 19/A (initial 7-day period, extendable). MASAK’s suspicious transaction guide includes specific crypto red flags, including transfers at unusual frequency or amounts not matching the customer’s financial profile.

Inheritance of crypto assets is accepted under Turkish law — GİB confirmed in an özelge dated September 23, 2020 (No: 60938891-120.01.02.09[GVK: 3-1]-33826) that Bitcoin constitutes “property” (mal) subject to Veraset ve İntikal Vergisi. Heirs must file an inheritance tax return within 4 months, with valuation at the TRY market value at the date of death. The practical challenge remains: without the deceased’s private keys, on-chain assets are technically irrecoverable.

DeFi and smart contracts fall outside the current SPK regulatory framework, which focuses exclusively on centralized service providers. However, gains from DeFi must still be declared under general tax law, and the pending bill explicitly requires annual declarations for off-platform gains.

Sıkça sorulan sorular: what Turkish crypto users ask most

Based on Turkish-language search patterns, these are the most common questions:

• Kripto paradan vergi ödenir mi? Currently no specific crypto tax exists, but the pending bill would impose a 10% withholding. Under existing law, gains theoretically fall under GVK provisions but enforcement has been minimal.
• Kripto para vergisi ne kadar? The proposed rate is 10% on regulated platforms (final tax); 15%–40% progressive rates for off-platform gains. Plus 0.03% transaction tax on all sales.
• Kripto para kazancı beyan etmek zorunlu mu? Under the proposed system, platform gains are handled through withholding (no return needed); off-platform gains require annual declaration in March.
• Kripto para vergisi ne zaman başlayacak? The bill takes effect two months after Official Gazette publication, if enacted by the Genel Kurul.
• Kripto para satışında KDV var mı? The bill proposes a VAT exemption for crypto deliveries subject to the transaction tax.
• Kripto para zararımı kârımdan düşebilir miyim? Only against other crypto gains of the same type, within the same calendar year. No carry-forward, no offset against other income.
• Yurt dışı kripto borsasından kazanç Türkiye’de vergilendirilir mi? Yes. Turkey applies the worldwide income principle for full taxpayers (tam mükellef). Foreign exchange gains must be declared annually.
• Kripto para tutmak (HODL) vergi doğurur mu? No. Holding without disposal does not create a taxable event.
• SPK lisanslı borsada stopaj yapıldıysa beyanname vermeli miyim? Under the proposed system, no — the 10% withholding constitutes the final tax.
• Kripto para MASAK blokesi neden olur? High-frequency or high-value transfers, unverifiable source of funds, connections to flagged accounts, or non-KYC compliance.

Conclusion: a regulatory framework nearing completion

Turkey’s crypto legal framework has evolved from a near-total regulatory vacuum to one of the most comprehensive regimes among emerging markets. Law 7518 built the structural foundation in July 2024. SPK’s twin communiqués in March 2025 set operational and capital standards that will thin the field from 77 provisional operators to a smaller cohort of fully licensed platforms by the June 30, 2026 deadline. MASAK’s aggressive 2024–2025 rulemaking — the financial institution reclassification,

Travel Rule, 48/72-hour withdrawal delays, and stablecoin limits — has made Turkey’s crypto AML regime among the strictest globally. The pending March 2026 tax bill, with its 10% withholding, 0.03% transaction tax, FIFO mandate, and VAT exemption, would close the final gap in the regulatory architecture. Three things bear watching: the Genel Kurul vote timing, whether the President uses the 0–20% rate adjustment power, and how GİB will enforce the annual declaration requirement for off-platform gains once OECD CARF data begins flowing from international exchanges.

https://www.anayasa.gov.tr/tr/anasayfa/

https://www.istanbulbarosu.org.tr/Anasayfa.aspx

https://www.echr.coe.int/

Hakkımızda – En

Hizmetlerimiz – En

Makaleler – En

İletişim – En

Ana Sayfa – English