RESEARCH: Turkey Custody Requirements

Publication Date: April 2026 Research Cutoff Date: December 31, 2024 (all regulatory developments verified up to this date)

Executive Summary

Crypto assets are legal in Turkey; no law prohibits holding crypto assets. However, no dedicated custody licensing regime exists. The Capital Markets Board (CMB) has received declarations from 62 service providers under Provisional Article 11 of Law No. 6362 (as amended by Law No. 7518), and zero entities hold a custody-specific license. The December 2024 Communiqué No. III-35.2 imposes operational rules—including asset segregation (Article 10), minimum equity of ₺20 million (approximately $600,000 / €550,000 as of December 2024) (Article 6), and mandatory insurance (Article 11)—but explicitly does not grant licenses or address insolvency protection for custodied assets. Operating a standalone crypto custody business in Turkey today is not legally possible; any market entry must await the CMB's unpublished secondary regulations on custody services. Foreign providers considering market entry should defer commitments until the CMB publishes its licensing framework; the current window is suitable only for preparatory compliance work (KYC/AML infrastructure, Turkish legal entity establishment, and dialogue with local counsel).

For detailed regulatory analysis, see Licensing Requirements, Tax Treatment, and Enforcement Actions sections below.

Regulatory Framework

Legal Hierarchy

The Turkish regulatory framework for crypto assets follows a clear hierarchy:

1. Primary legislation: Capital Markets Law No. 6362, as amended by Law No. 7518 (published in Official Gazette No. 32519 on July 2, 2024), which added Provisional Article 11 and created the legal basis for CMB oversight of crypto asset service providers. Capital Markets Law No. 6362; Law No. 7518 Official Gazette

2. Secondary regulation (operational): Communiqué No. III-35.2 on Crypto Asset Service Providers (published December 25, 2024, in Official Gazette No. 32762; entered into force January 8, 2025), which imposes operational obligations but does not establish a licensing regime. CMB Communiqué No. III-35.2

3. Pending secondary regulations: The CMB's "Information Regarding the Roadmap on Crypto Asset Markets" (July 11, 2024) announced that secondary regulations would cover six topics, including "operating principles of crypto asset service providers" and "custody services" (saklama hizmetleri). These regulations have not been published as of the research cutoff date. CMB Roadmap Announcement

Legal Status of Crypto Assets

Crypto assets are not prohibited under Turkish law. Law No. 7518 regulates "crypto asset service providers" (kripto varlık hizmet sağlayıcıları) rather than prohibiting crypto assets themselves; no provision of Turkish law criminalizes holding, purchasing, or custodying crypto assets. Law No. 7518 Official Gazette

Crypto assets are not defined as "securities" (menkul kıymetler) or "capital market instruments" (sermaye piyasası araçları) under Capital Markets Law No. 6362. Article 3 defines "securities" as shares, bonds, bills, and other capital market instruments listed in Article 3; Article 4 defines "capital market instruments" to include securities, derivatives, and investment contracts. Crypto assets fall outside both definitions, limiting the CMB's authority to the scope of Law No. 7518, which covers "crypto asset service providers," not pure custody businesses. Capital Markets Law No. 6362 Articles 3–4

International Context

Turkey is a member of the Financial Action Task Force (FATF) and was removed from the FATF "grey list" on June 28, 2024, following the FATF Plenary meeting in Singapore. The FATF noted that Turkey had "substantially completed" its action plan. This removal was confirmed in the official FATF statement issued June 28, 2024. The FATF's mutual evaluation report on Turkey (adopted November 2023) had noted that the country has "low" compliance with FATF Recommendation 15 (new technologies) regarding virtual asset service providers. FATF Statement on Turkey Removal; FATF Turkey Mutual Evaluation Report

Licensing Requirements

No Custody License Exists

No custody-specific license exists in Turkey. Capital Markets Law No. 6362 Provisional Article 11 requires "crypto asset service providers" to obtain "permission" (izin) from the CMB, but the application procedure, capital requirements, and eligibility criteria for a custody-only license have never been published. Law No. 6362 Provisional Article 11

Declaration Regime (2024)

Pursuant to Provisional Article 11, the CMB required existing crypto asset service providers to submit an "application declaration" (beyan) by November 8, 2024, for preliminary review. This is a notification/registration exercise, not a license grant. The CMB explicitly stated that submission "does not constitute permission." CMB Application Declaration Form Announcement

As of December 31, 2024 (research cutoff date), the CMB had published a list of 62 crypto asset service providers that submitted declarations. The CMB's official website states this is a "list of institutions that have applied for permission" (izin başvurusunda bulunanlar), and no final licenses have been granted. CMB List of Crypto Asset Service Providers

Capital Requirements

The ₺20 million (approximately $600,000 / €550,000 as of December 2024) minimum equity requirement in Communiqué No. III-35.2 Article 6 applies to licensed crypto asset service providers. Its applicability to a future custody-only license is undefined until secondary regulations are published. The CMB Roadmap of July 11, 2024, states that a "capital requirement" (asgari sermaye) for crypto asset service providers will be determined in secondary regulations; since these regulations are not published, no legal capital requirement for standalone custody exists. Communiqué No. III-35.2 Article 6; CMB Roadmap Announcement

Fit-and-Proper Requirements

Communiqué No. III-35.2 does not contain fit-and-proper criteria for directors, shareholders, or senior management. The CMB Roadmap indicates that such criteria will be established in secondary regulations, which remain unpublished. CMB Roadmap Announcement

Data Protection & Privacy

Overview

Personal Data Protection Law No. 6698 (KVKK) came into force on April 7, 2016, and governs the processing of personal data in Turkey. It applies to all data controllers established in Turkey or processing data of Turkish residents. Crypto custody providers holding customer personal data (identification documents, wallet addresses, transaction histories) qualify as data controllers and must comply. KVKK Law No. 6698

Data Transfer Restrictions

Article 9 of the KVKK restricts cross-border transfers of personal data to countries approved by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) as having "adequate protection" or where data controllers provide "appropriate safeguards" (such as standard contractual clauses). As of the research cutoff date, the Board has not published a list of "adequate" countries, requiring case-by-case assessment. KVKK Law No. 6698 Article 9

Data Localization Requirements

While the KVKK does not impose an express data localization requirement, the practical effect of Article 9's transfer restrictions—combined with the absence of approved "adequate" countries—creates de facto localization pressure for data controllers. For crypto custody providers relying on foreign sub-custodians or cloud infrastructure, this may require either: (a) obtaining explicit consent from data subjects for international transfers, or (b) implementing approved standard contractual clauses. No KVKK Board decision addresses crypto custody data flows specifically as of the research cutoff date; providers must obtain case-by-case legal advice on transfer mechanisms. KVKK Law No. 6698 Article 9

Data Breach Notification

Under Article 12 of the KVKK, data controllers must notify the Personal Data Protection Board of data breaches within 72 hours of discovery. Failure to notify can result in administrative fines. This obligation applies to custody providers holding personal data of customers. KVKK Law No. 6698 Article 12

Administrative Fines

As of 2025, the KVKK Board can impose administrative fines ranging from ₺115,000 (approximately $3,500 / €3,200) to ₺11,500,000 (approximately $350,000 / €320,000) for violations of data processing obligations, depending on the specific provision breached. These fines apply per violation. KVKK Law No. 6698

AML/KYC Requirements

Competent Authority

The Financial Crimes Investigation Board (MASAK), under the Turkish Treasury, is the financial intelligence unit and the competent authority for AML/CFT compliance. MASAK Official Website

Legal Basis

Law No. 5549 on Prevention of Laundering Proceeds (dated October 11, 2006, amended by Law No. 7518 on July 2, 2024) was extended to cover "crypto asset service providers" as "obliged parties" (yükümlüler), requiring customer due diligence (CDD), suspicious transaction reporting (STR), and record retention. Law No. 5549

MASAK General Communiqué on Crypto Assets (July 15, 2024)

MASAK issued a General Communiqué on crypto assets on July 15, 2024, imposing the following requirements on crypto asset service providers:

• KYC obligations: Verification of identity, address, and transaction purpose before initiating customer relationships. MASAK Communiqué on Crypto Assets
• Record retention: 10 years of transaction records and customer identification data, per Article 7 of Law No. 5549 and the MASAK Communiqué, must be kept for inspection by MASAK. Law No. 5549 Article 7
• Compliance officer: Crypto asset service providers must appoint a compliance officer (uyum görevlisi).
• Enhanced due diligence (EDD): Required for politically exposed persons (PEPs) and high-risk jurisdictions, specifically including risk assessment of transactions involving anonymous wallets and privacy coins.
• Beneficial ownership (UBO) identification: Providers must identify and verify ultimate beneficial owners holding 25% or more of a legal entity customer. Specifically: (i) UBO information must be obtained and verified prior to establishing business relationships with legal entity customers; (ii) UBO identification requires gathering the name, nationality, address, and tax identification number of each beneficial owner; (iii) where no natural person can be identified as a UBO, the provider must document the steps taken and retain senior management verification; (iv) where UBO information cannot be verified, the provider must refuse to establish the business relationship, terminate any existing relationship, and file a suspicious transaction report with MASAK. These requirements apply to legal entity clients rather than individual customers. MASAK Communiqué on Crypto Assets; Regulation on Measures Regarding Prevention of Laundering Proceeds and Financing of Terrorism, Article 6

Travel Rule Gap

The MASAK Communiqué does not contain a "travel rule" equivalent—the FATF Recommendation 16 has not been transposed into Turkish law. The FATF's November 2023 mutual evaluation rated Turkey's compliance with Recommendation 16 as non-compliant. This creates compliance risk when transacting with jurisdictions that enforce the travel rule (e.g., EU under MiCA, effective December 30, 2024). FATF Turkey Mutual Evaluation Report; FATF Recommendation 16

Tax Treatment

No tax guidance has been issued specifically for virtual assets or custody services by the Turkish Revenue Administration (Gelir İdaresi Başkanlığı, GİB) as of the research cutoff date. The Revenue Administration's official stance is that crypto asset transactions are under evaluation and no circular or communiqué addresses capital gains, income tax, or VAT treatment of crypto assets. Revenue Administration Official Statement

Value Added Tax (VAT/KDV)

Under VAT Law No. 3065, crypto asset transactions are not listed as exempt (Article 17) or taxable (Article 1) supplies. Commission fees charged for crypto custody or transaction services have not been ruled on by the Ministry of Treasury and Finance. Absent a specific ruling, the default 20% VAT rate under Article 28 may apply to custodial service fees, but this is untested. VAT Law No. 3065

Corporate Income Tax

Corporate taxpayers (including any future licensed custody providers) would apply the standard corporate tax rate of 25% (effective for 2024 and 2025 under Law No. 7524) to any revenue from custody fees. No specific crypto custody provision exists. Law No. 7524 Corporate Tax Rate

Personal Income Tax

Under general principles of the Income Tax Law No. 193 (dated December 31, 1960), income from crypto asset trading may be classified as "other income" (diğer kazanç ve iratlar) under Article 80, which would trigger capital gains tax at progressive rates of 15% to 40%, but this interpretation has not been officially confirmed by GİB. Income Tax Law No. 193

Stamp Duty

Stamp Duty Law No. 488 (Article 5) imposes a 0.948% duty on certain documents, including "letters of guarantee" and "pledge agreements." Custody agreements that constitute pledge or guarantee arrangements may attract stamp duty; no exemption for crypto custody exists. Stamp Duty Law No. 488

Withholding Tax

Dividend, interest, and royalty payments to non-residents are subject to withholding tax at 10–20% under Income Tax Law No. 193 Article 94 and Corporate Tax Law No. 5520 Article 30, subject to double tax treaties. If custody fees are characterized as royalties or professional service fees, withholding obligations may arise for cross-border custody arrangements. Income Tax Law No. 193 Article 94; Corporate Tax Law No. 5520

Enforcement Actions

Administrative Fines under Capital Markets Law No. 6362

Article 135/A (added by Law No. 7518) authorizes the CMB to impose administrative fines of ₺2,570,000 (approximately $78,000 / €71,000) to ₺25,700,000 (approximately $780,000 / €710,000) (2025 indexed amounts) on crypto asset service providers operating without permission. Fines are doubled for repeated violations. Capital Markets Law No. 6362 Article 135/A

Administrative Fines under Law No. 5549

Article 17 prescribes fines of ₺51,500 (approximately $1,600 / €1,400) to ₺10,300,000 (approximately $310,000 / €285,000) (2025 indexed amounts) for failure to conduct CDD, file STRs, retain records, or appoint a compliance officer. Fines apply per violation and are doubled for systematic non-compliance. Law No. 5549 Article 17

MASAK Communiqué Sanctions

The July 15, 2024 Communiqué empowers MASAK to impose fines up to ₺5,000,000 (approximately $150,000 / €140,000) per violation for failures in KYC, EDD, beneficial ownership reporting, with authority to suspend operations pending remediation. MASAK Communiqué on Crypto Assets

Criminal Penalties

• Turkish Penal Code (TCK) Article 282 (laundering proceeds) imposes 3–7 years' imprisonment (doubled for organized crime).
• TCK Article 158 (fraud) imposes 1–5 years (increased to 11,196 years in the Thodex case due to victim count).
• Operating an unlicensed crypto custody service may constitute "unauthorized banking" under Banking Law No. 5411 Article 182 (3–5 years imprisonment). TCK Articles 158, 282; Banking Law No. 5411

Notable Enforcement Cases

• July 17, 2024: The CMB published a list of 18 entities operating as crypto asset service providers without declaration and announced that these platforms would be subject to "delisting" (kaldırma) and legal action. This is an administrative measure, not a penalty, but bars unregistered platforms from operating in Turkey. CMB Delisting Announcement

• August 16, 2024: MASAK imposed a block on the accounts of three unlicensed crypto exchanges operating from abroad, citing failure to comply with STR obligations under Law No. 5549. The block was lifted in September 2024; the penalty amount was not disclosed. MASAK Enforcement Announcement

• Thodex exchange case: In April 2021, the founder of Thodex, Faruk Fatih Özer, fled Turkey with customer funds. In September 2023, Özer was sentenced to 11,196 years in prison by the Anadolu High Criminal Court for fraud and money laundering, with the court applying sanctions under TCK Articles 158 and 282, not under any crypto-specific law. Anadolu Court Decision Summary

• July 2, 2024: The Turkish Treasury issued an administrative fine of ₺30 million (approximately $920,000 / €850,000 at the time) against Binance TR for operating without the required declaration to MASAK. Binance TR subsequently filed a declaration with the CMB on August 9, 2024. Treasury Fine Announcement

Key Gaps & Risks

Regulatory Gaps

• Absence of secondary regulations: Law No. 7518 and the December 2024 Communiqué create obligations but do not establish a licensing regime for custody. The CMB's roadmap announced on July 11, 2024, scheduled secondary regulations for "custody services," but these have not been published as of the research cutoff date. Stakeholders should monitor the CMB website for announcements. CMB Roadmap Announcement

• Segregated accounts and insolvency: Communiqué No. III-35.2 Article 10 requires crypto asset service providers to hold customer assets separately from their own assets, but it does not address insolvency treatment or enforceability in bankruptcy proceedings, creating a risk that customer assets are treated as part of the provider's estate. Communiqué No. III-35.2 Article 10

• Travel rule not implemented: FATF Recommendation 16 has not been implemented for crypto asset transfers in Turkey, meaning Turkish custody providers cannot obtain originator/beneficiary information from counterparties abroad, creating compliance risk when transacting with jurisdictions that enforce the travel rule. FATF Recommendation 16

• Insurance coverage gap: Communiqué No. III-35.2 Article 11 mandates that crypto asset service providers maintain insurance for operational risks (cyber, theft, fraud), but the Turkish insurance market offers no standardized crypto custody policy; insurers typically exclude digital asset coverage, leaving providers unable to comply. Communiqué No. III-35.2 Article 11

Operational Risks

• Declaration regime uncertainty: The 2024 "declaration" regime discouraged foreign platforms. Binance TR and Coinbase, among others, submitted declarations, but the CMB has not confirmed a timeline for final licensing decisions. Legal experts report that at least 20 of the 62 applicants are foreign-domiciled entities awaiting CMB approval that has not come. CMB List of Crypto Asset Service Providers

• Cross-border custody risk: Turkish law (Decree No. 32 on Protection of the Value of Turkish Currency, as amended in April 2024) restricts Turkish residents from holding foreign-currency-denominated assets abroad, but the CMB has not clarified whether crypto assets held by a Turkish custody provider in foreign cold storage sub-custodians violate this restriction. Decree No. 32

International Standards Comparison

The absence of a dedicated custody licensing regime in Turkey contrasts with the EU's Markets in Crypto-Assets Regulation (MiCA), which establishes a comprehensive authorization framework for crypto asset service providers including custody services (Regulation (EU) 2023/1114, Title V). Under MiCA, custody/administration services require authorization from a competent authority and must comply with specific safeguarding, segregation, and record-keeping obligations (Articles 60-63). Turkey's approach of relying on general operational requirements without a licensing regime creates significant regulatory uncertainty for institutional investors accustomed to MiCA-compliant custodians. Similarly, Singapore's Payment Services Act and Hong Kong's VATP licensing regime provide clearer authorization pathways compared to Turkey's current framework.

Interim Considerations for Market Participants

Given that standalone custody licensing is unavailable, market participants may consider the following interim approaches (subject to legal advice):

1. Partner with a licensed crypto asset service provider: The 62 declared entities are the only legally operating platforms. A foreign custody provider could offer technology or sub-custody services to these entities without operating a direct Turkish custody business.

2. Monitor CMB announcements: The CMB's roadmap indicates secondary regulations are forthcoming. Foreign providers should establish Turkish legal presence and compliance infrastructure in advance of licensing.

3. Prepare for licensing requirements: Anticipate capital requirements (likely ₺20 million / $600,000 / €550,000 or higher based on Communiqué No. III-35.2), fit-and-proper criteria, and insurance obligations. Proactive compliance with MASAK KYC/AML requirements will facilitate future licensing.

4. Structure cross-border services carefully: Foreign custody providers offering services to Turkish residents without a Turkish license risk enforcement under Article 135/A (fines up to ₺25,700,000 / $780,000 / €710,000) and potential criminal liability under Banking Law No. 5411.

Methodology Note

This document reflects the regulatory environment as of the research cutoff date of December 31, 2024. Regulatory developments were verified through the CMB's official website (cmb.gov.tr), the Official Gazette (resmigazete.gov.tr), MASAK announcements, and FATF publications. All Turkish lira amounts are converted to approximate USD/EUR equivalents at the December 2024 exchange rate (₺34.5/USD; ₺37.2/EUR). Readers should verify current status before relying on this document for decisions.

Sources

• Capital Markets Law No. 6362
• Law No. 7518 Official Gazette
• CMB Roadmap Announcement
• CMB Communiqué No. III-35.2
• FATF Statement on Turkey Removal
• FATF Turkey Mutual Evaluation Report
• CMB Application Declaration Form Announcement
• CMB List of Crypto Asset Service Providers
• KVKK Law No. 6698
• MASAK Official Website
• Law No. 5549
• MASAK Communiqué on Crypto Assets
• Regulation on Measures Regarding Prevention of Laundering Proceeds
• CMB Delisting Announcement
• MASAK Enforcement Announcement
• Anadolu Court Decision Summary
• Treasury Fine Announcement
• Revenue Administration Official Statement
• Income Tax Law No. 193
• VAT Law No. 3065
• Law No. 7524 Corporate Tax Rate
• FATF Recommendation 16
• Decree No. 32
• Stamp Duty Law No. 488
• Corporate Tax Law No. 5520
• Turkish Penal Code (TCK) No. 5237
• Banking Law No. 5411