The first question international crypto businesses ask about the Turkish market is what license it takes to operate a virtual asset service provider with fiat capabilities in Turkey. The model in question is a service that accepts crypto assets from customers, holds them, executes their conversion into Turkish Lira upon the customer's instruction, and transfers the proceeds to the customer's local Turkish bank account, with the same journey available in reverse. This article sets out the answer under the framework currently in force: The required authorization, the establishment conditions, the capital thresholds, and the structural rules that govern the fiat leg of the model.

A brief note on terminology. The regulated entity category is the Crypto Asset Service Provider, or KVHS (Kripto Varlık Hizmet Sağlayıcısı), introduced into the Capital Markets Law No. 6362 by Law No. 7518, published in the Official Gazette of 2 July 2024, No. 32590. The licensing and supervisory authority is the Capital Markets Board of Turkey, the SPK. The detailed establishment and operating conditions are set out in two communiqués published in the Official Gazette of 13 March 2025, No. 32840: Communiqué III-35/B.1 on establishment and operating principles, and Communiqué III-35/B.2 on working procedures and capital adequacy. The broader vocabulary used here, including crypto asset, fiat money, scriptural money, and electronic money, follows the concept map set out in Crypto assets, fiat money and electronic money: the statutory categories under Turkish law, and those terms are not redefined in this article.

This article is a condensed overview rather than an exhaustive treatment. Several structural questions that the model raises, including the treatment of customer Turkish Lira balances pending conversion and the regulatory position of decentralized structures, are noted briefly here and warrant separate examination.

The activities that make up the model, accepting crypto assets from customers, holding customer crypto assets, converting crypto assets into Turkish Lira and vice versa upon customer instruction, and transferring crypto assets to external wallets, are each regulated crypto asset services under Article 35/B of the Capital Markets Law. Carrying out any of them as a regular occupation or commercial activity directed at persons resident in Turkey requires authorization from the SPK as a KVHS platform. There is no lighter registration tier, no sandbox, and no de minimis exemption.

Three characterizations frequently assumed by international operators should be dispensed with at the outset. First, the model is not a banking activity. It does not involve accepting deposits or extending credit, and no banking license is required or available for it.

Second, it is not a payment services model. Customer money cannot sit with the platform or with a payment or electronic money institution, because holding client money balances is, as discussed in Section IV below, reserved to banks.

Third, and critically for groups already licensed elsewhere: Foreign authorizations confer no rights in Turkey. A MiCA CASP license from the European Union, a VARA license from Dubai, a Canadian MSB registration, or any equivalent foreign permission does not substitute for Turkish authorization, and Turkish law contains no passporting or mutual recognition mechanism. Serving Turkish residents requires a Turkish authorization; there is no exception.

The scope of the license is activity-based, and its territorial reach is broad. A platform established abroad is deemed to be conducting unauthorized activity in Turkey where any one of the following is present; a place of business in Turkey, a Turkish-language website or application, or promotion and marketing directed at Turkish residents, whether directly or through local intermediaries.

The framework applies to any structure performing the regulated activities regardless of its technical architecture; the fact that a service is built as a decentralized protocol does not remove it from the licensing perimeter, a point the SPK has already enforced in practice, and which shall be examined in a separate article.

The licensed entity must be a joint stock company incorporated in Turkey. All shares must be registered and issued against cash. The articles of association must confine the company's business scope exclusively to the activities for which the SPK authorizes it. The shareholding structure must be transparent and traceable, and shareholders, board members, and senior managers must satisfy fit and proper conditions, including integrity requirements and the absence of disqualifying circumstances in areas such as capital markets offences and money laundering.

There is no Turkish citizenship requirement, no local shareholder requirement, and no minimum Turkish capital proportion: A wholly foreign-owned joint stock company can be authorized, provided all conditions (such as work permit or work permit exemption requirements) are met.

The minimum establishment capital for a platform is 250,000,000 Turkish Lira for 2026, fully paid in cash. The figure derives from the original baseline of 150,000,000 Turkish Lira set in March 2025 and was revised upward for 2026 by SPK Bulletin No. 2025/68; annual revaluation should be expected. Equity must remain at or above the minimum throughout the life of the operation, not merely at establishment. Standalone custody institutions are subject to a separate threshold of 630,000,000 Turkish Lira for 2026; a platform that fulfils its custody obligations through a third-party authorized custodian is not itself required to meet the custody capital threshold.

Beyond corporate and capital conditions, the infrastructure requirements are substantial. Information systems and security infrastructure must comply with the technical criteria determined by TÜBİTAK, covering cybersecurity, data security, business continuity, backup, disaster recovery, access control, and independent information systems audit. Systems integration testing with the Central Securities Depository (MKK) must be completed. Internal control, risk management, and internal audit systems must be established and operational, and a comprehensive MASAK compliance framework must be in place before operations commence.

On key management, there is a hard localization rule at Communiqué level. Under Article 27(2) of Communiqué III-35/B.2, where private keys are divided into shares through mechanisms such as multi-party threshold cryptography, each share and the mechanisms in which those shares are used, including their backups, must be held in Turkey, and control over them must rest with the crypto asset service provider. Article 27(1) of the same Communiqué requires compliance with the TÜBİTAK Infrastructure Criteria in the management of, and access to, private keys and the mechanisms used to generate and back them up. For an operator whose signing architecture is built on distributed key shares, this is a design question rather than a compliance item, and it has been in force since 13 March 2025.

The process itself has two distinct stages which are establishment and the operating permit. Incorporating the company is not sufficient; a separate operating permit must be granted by the SPK, which examines the shareholding structure, managers, capital adequacy, activity model, information systems, custody structure, internal systems, and compliance processes in detail. The current regulations do not prescribe a fixed period within which applications will be concluded. Operating without the required authorization is a criminal offense.

The transition timetable applicable to entities already operating when the regime took effect is currently open. By its decision of 26 March 2026, the SPK postponed both the deadline for platforms to contract with an authorized custody institution and the deadline for obtaining the authorization certificate, stating that the new dates will be set only once authorized custody institutions begin serving platforms on a widespread basis.

The defining structural feature of the model under Turkish law is that its entire Turkish Lira operation must run through banks. The reason is the deposit-taking monopoly of banks: Under Banking Law No. 5411, only banks may collect deposits or participation funds, and a KVHS is expressly prohibited from doing so. Customer Turkish Lira balances therefore cannot sit on the platform's books and must be held in designated client accounts at banks, with transfers accepted only through electronic transfers executed via banks.

The Regulation on the Non-Use of Crypto Assets in Payments, issued by the Central Bank and in force since 30 April 2021, separately prohibits payment institutions and electronic money institutions from intermediating fund transfers to or from crypto asset platforms. The practical consequence is that the fiat leg cannot involve fintech wallet providers or payment institutions at any point in the flow, and the platform's banking relationships with local Turkish banks become one of the most critical dependencies of the entire venture.

Customer funds must be held in designated accounts at banks, segregated from the platform's own assets and subject to the statutory protection mechanisms. The license permits the operation of the conversion and transfer model; it does not permit the platform to hold customer money balances on its own books in a manner that could be characterized as deposit-taking. How transitional Turkish Lira balances pending conversion should be structured within this constraint is a genuinely good question under the current framework and shall be addressed in a separate article.

A related and frequently overlooked point concerns naming. Under Article 150(2) of Banking Law No. 5411, using the word “bank” or any expression creating the impression of banking activity in trade names, documents, announcements, or advertisements without authorization is a criminal offense. A crypto business marketed internationally as a “new age bank” or “neobank” must not carry that terminology into any Turkey-facing communication. The product must be branded in Turkey strictly as a crypto asset platform.

Three further elements complete the picture and are noted here in summary form.

First, custody: Customer crypto assets must be held predominantly with an authorized custody institution or a bank authorized to provide custody services; a platform may not simply hold customer assets itself, and the use of technical infrastructure providers, such as MPC technology vendors, does not in itself constitute legal custody for the purposes of Turkish law.

Second, scope restrictions: The license covers only the authorized crypto asset services. Leveraged transactions, derivatives, margin trading, short selling, lending, return commitments, and any commercial activity outside the authorized scope are prohibited. A KVHS also may not engage in foreign currency trading or transfer foreign currency abroad; it cannot operate as an exchange bureau. Dollar-pegged stablecoins remain available for trading, as they are crypto assets rather than foreign currency under Turkish law. Genuine foreign exchange services follow a different path entirely: Intermediary investment firms licensed under the Capital Markets Law may provide foreign currency services as an ancillary service under Article 38(1)(b) of Law No. 6362 and Communiqué III-37.1, limited to connection with their authorized investment services, and that permission does not extend to a KVHS by virtue of its own license. A full-service model offering both crypto trading and foreign exchange therefore requires two separately licensed legal entities, typically presented to the customer through a single interface, a structure that shall be examined in a separate article.

Third, anti-money laundering: Crypto asset service providers have been MASAK obliged parties since May 2021, with full customer due diligence, suspicious transaction reporting, and compliance program obligations. The travel rule applies to crypto asset transfers of 15,000 Turkish Lira and above, and the first financial movement in any customer relationship must originate from a bank account or payment card verified in the customer's own name.

A VASP with fiat rails is legally implementable in Turkey, and the path is well defined: A Turkish joint stock company holding a KVHS platform authorization from the SPK, with fully paid cash capital of 250,000,000 Turkish Lira for 2026, TÜBİTAK-compliant infrastructure, MKK integration, an authorized custody arrangement, a MASAK compliance organization, and a fiat operation built exclusively on local banking relationships. The structure is, for the purposes of Turkish law, not a bank and not a payment institution; it is a licensed capital markets institution that uses banking infrastructure.

The framework requires early and precise structuring. The capital commitment is substantial and subject to annual revision, the licensing examination is detailed and has no statutory deadline, the banking relationships require as much attention as the license itself, and several structural questions, most notably the treatment of transitional customer balances, remain unresolved at the regulatory level and demand specific engagement rather than assumption.

This article does not cover every aspect of the framework. As with every other aspect of foreign investment in Turkey, the cost of getting these questions wrong, up to and including criminal liability, significantly exceeds the cost of obtaining competent legal counsel before taking any step.