RESEARCH: Turkey Travel Rule

Executive Summary

• Crypto assets are legal in Turkey, but the regulatory landscape is rapidly evolving, with the primary framework established by the "Law on the Regulation of Crypto-Asset Service Providers" (Law No. 7518), published in the Official Gazette on July 2, 2024, and entering into force on the same date. Official Gazette of the Republic of Turkey - Law No. 7518
• The primary regulator is the Capital Markets Board of Turkey (CMB, Sermaye Piyasası Kurulu – SPK), which is responsible for licensing and oversight of Crypto Asset Service Providers (CASPs) under Law No. 7518. CMB - Law No. 7518 Information Page
• The CMB began accepting license applications following the enactment of Law No. 7518. As of October 27, 2025, the CMB's Authorized Institutions registry lists 101 entities in the crypto asset service provider category, of which 8 have received full operating licenses and the remainder hold provisional licenses pending final review. CMB - Authorized Institutions Registry (Crypto Asset Service Providers)
• The practical reality is moving from a "gray market" to a regulated one; entities must now comply with the CMB's licensing, AML, and operational requirements, including the phased implementation of the Travel Rule under FATF Recommendation 16. MASAK - Crypto Asset Service Provider Obligations

Should I operate here? Prospective CASP operators should evaluate the jurisdiction based on the CMB licensing trajectory and MASAK compliance requirements. As of Q4 2025, the regulatory framework includes Travel Rule transposition in progress, but entities must secure a license and meet capital thresholds (minimum 30 million TL) to operate legally. Entities should monitor CMB announcements and ensure operational readiness for AML/Travel Rule obligations before launching services. CMB - Authorized Institutions Registry, Regulation on Operation Principles of CASPs

Regulatory Framework

• The primary regulator for crypto assets is the Capital Markets Board of Turkey (CMB / SPK), designated under Law No. 7518 as the sole licensing and supervisory authority for CASPs. Law No. 7518, Articles 2, 4
• The primary legislation is the Law on the Regulation of Crypto-Asset Service Providers, numbered 7518, published in the Official Gazette dated July 2, 2024, issue 32191, which entered into force on the same day. Official Gazette, Issue 32191, July 2, 2024
• Compliance with anti-money laundering (AML) and countering the financing of terrorism (CFT) obligations falls under the Financial Crimes Investigation Board (MASAK), operating under the Ministry of Treasury and Finance. CASPs are designated as "obliged parties" under Law No. 5549. Law No. 5549 on Prevention of Laundering Proceeds of Crime
• Turkey is a member of the Financial Action Task Force (FATF). In June 2024, Turkey was removed from the FATF's "grey list" following progress on its AML/CFT framework, which included enactment of Law No. 7518 and associated crypto regulations. FATF - Turkey Jurisdiction Report
• Secondary legislation implementing Law No. 7518 includes:
  • Regulation on the Operation Principles of Crypto-Asset Service Providers (Official Gazette, December 25, 2024, Issue 32791) – covering licensing conditions, organizational requirements, and capital adequacy. Official Gazette - Regulation on Operation Principles
  • Regulation on the Suspicious Transaction Reporting for Crypto-Asset Service Providers (Official Gazette, January 31, 2025, Issue 32813) – establishing reporting obligations and thresholds. Official Gazette - Suspicious Transaction Reporting Regulation
  • Communiqué on the Principles of Remote Identity Verification with Cryptographic Methods in the Capital Market (Official Gazette, December 4, 2024, Issue 32744) – governing digital onboarding processes. Official Gazette - Remote Identity Verification Communiqué
  • CMB Board Resolution on Amendment to the Communiqué on Remote Identity Verification (CMB Decision No. 13/246, March 20, 2025) – updating technical requirements for biometric verification. CMB Decision No. 13/246
• The CMB has published a "Frequently Asked Questions on Crypto Asset Service Providers" document (updated October 15, 2025) providing interpretative guidance on licensing and operational matters. CMB FAQ on CASPs

Licensing Requirements

Note: The background on the legal basis for licensing and the regulatory framework is covered in the Regulatory Framework section above. This section focuses on the specific application requirements and current licensing status.

Application Process and Timeline

• Under Article 4 of Law No. 7518, all CASPs must obtain an operating license from the CMB. The application process requires submission of a comprehensive application dossier covering corporate governance, operational infrastructure, AML/CFT procedures, and technical systems. Law No. 7518, Article 4
• Transitional provision: Entities operating before July 2, 2024, were required to file a "declaration of application or intention to liquidate" with the CMB within one month (by August 2, 2024). The CMB published the initial list of applicants and liquidating entities on August 16, 2024. CMB Announcement of August 16, 2024
• Applications submitted by existing entities during the one-month declaration period were considered timely; new entrants must apply before commencing operations and cannot operate pending approval, unless they hold a provisional license issued under Article 9 of the Operation Principles Regulation. Regulation on Operation Principles of CASPs, Article 9

Capital and Financial Requirements

• Initial capital requirement: The CMB Board, pursuant to Article 13(2) of the Operation Principles Regulation and CMB Board Decision No. 52/1245 (December 26, 2024), set the minimum core capital requirement for CASPs at 30 million Turkish Lira (TRY 30,000,000) , approximately USD $930,000 as of October 2025. CMB Board Decision No. 52/1245
• Capital adequacy: CASPs must maintain a minimum capital adequacy ratio of 8% , calculated as core capital divided by risk-weighted assets, per Article 13(4) of the Regulation. The CMB may impose additional capital requirements on a case-by-case basis for platforms engaging in custody services or higher-risk activities. Regulation on Operation Principles of CASPs, Article 13(4)
• Capital maintenance: CASPs must notify the CMB within 15 days if their core capital falls below the minimum threshold; failure to restore capital within 60 days results in license suspension. Regulation on Operation Principles of CASPs, Article 13(7)

Fit and Proper Requirements

• Founders, managers, and significant shareholders (holding 10% or more shares) must satisfy "good repute" requirements under Article 5 of Law No. 7518. Specifically excluded from founding or managing a CASP are persons with: (a) prior bankruptcy adjudications; (b) convictions for fraud, embezzlement, bribery, or money laundering; (c) convictions for terrorist financing; or (d) prior revocation of a capital market license. Law No. 7518, Article 5
• The CMB conducts a background verification process through the Turkish Judicial Record Database and the Banking Regulation and Supervision Agency (BDDK) records, typically completed within 60 days of application submission. CMB - Licensing Application Guidelines

Organizational Requirements

• CASPs must establish the following internal units: (1) risk management unit, (2) internal audit unit, (3) legal compliance unit, and (4) information security unit. Each unit must have a designated head reporting directly to the board of directors. Regulation on Operation Principles of CASPs, Article 17
• All data processing systems, servers, and backup infrastructure must be physically located within Turkey's borders. Offsite data replication to foreign jurisdictions requires prior CMB approval. Regulation on Operation Principles of CASPs, Article 19(1)

Current Licensing Status (October 2025)

• As of October 27, 2025, the CMB Authorized Institutions registry lists 101 entities in the crypto asset service provider category:
  • 8 entities hold full operating licenses, including: Bitget Turkey (license date September 15, 2025), Binance TR, KuCoin TR, Paribu, BtcTurk, CoinTR, Gate.io Turkey, and Bitlo. CMB - Authorized Institutions Registry
  • 93 entities hold provisional licenses (valid through June 30, 2026, subject to extension by CMB Board Decision), awaiting completion of the final review process, which includes on-site inspections and remediation of any identified deficiencies. CMB - Provisional License List
• The CMB continues to accept new applications; processing time for new applications is estimated at 120-180 days, depending on completeness. CMB - Licensing Application Guidelines

AML/KYC Requirements

• Law No. 7518 (Article 3(2)(a)) explicitly requires CASPs to comply with Law No. 5549 on the Prevention of Laundering Proceeds of Crime and the regulations issued by MASAK. Law No. 7518, Article 3, Law No. 5549
• Customer Due Diligence (CDD) : CASPs must perform CDD measures, including identification and verification of customers' identities, per the general AML framework and the "Regulation on the Prevention of Laundering Proceeds of Crime" (Official Gazette, November 9, 2006, Issue 26366, as amended by the Regulation published in Official Gazette, January 1, 2025, Issue 32780). Verification requires government-issued identification documents and, for legal entities, certified registration documents from the Turkish Trade Registry Gazette. Regulation on Prevention of Laundering Proceeds of Crime
• Risk-Based Approach and PEP Screening: Under Article 17 of the Operation Principles Regulation, CASPs must implement risk-tiered customer screening, including mandatory identification of Politically Exposed Persons (PEPs) and enhanced due diligence (EDD) for high-risk customers. EDD measures include: (1) obtaining additional documentation on source of funds; (2) obtaining approval from senior management for establishing business relationships; (3) conducting enhanced transaction monitoring for the first 180 days of the relationship. Regulation on Operation Principles of CASPs, Article 17
• Suspicious Transaction Reporting: Under the Regulation on the Suspicious Transaction Reporting for CASPs (Official Gazette, January 31, 2025, Issue 32813), CASPs must:
  • Report suspicious transactions to MASAK within 10 working days of detection, using the MASAK electronic reporting system (RUBİS). Regulation on Suspicious Transaction Reporting for CASPs, Article 4
  • Report immediate threats (e.g., terrorist financing red flags) within 24 hours. Regulation on Suspicious Transaction Reporting for CASPs, Article 5
  • The regulation imposes: (a) a general prohibition on anonymous account openings and anonymous wallet transfers; (b) mandatory restrictions on cash transactions exceeding TRY 25,000 (approximately USD $775 as of October 2025); and (c) a prohibition on providing services to customers using privacy coins (including Monero, Zcash, and Dash), effective March 1, 2025. Regulation on Suspicious Transaction Reporting for CASPs, Articles 6-8
• Record-Keeping: All transaction and customer identification data must be retained for a minimum of 10 years following the end of the business relationship or the transaction date, per Article 8 of Law No. 5549 and Article 19(2) of the Operation Principles Regulation. Records must include: customer identification data, transaction records (including wallet addresses, transaction hashes, amounts, and counterparties), and any suspicious transaction reports filed. Law No. 5549, Article 8, Regulation on Operation Principles of CASPs, Article 19(2)
• MASAK General Communiqué: MASAK's General Communiqué on the Prevention of Laundering Proceeds of Crime (Official Gazette, January 1, 2025, Issue 32780) designates CASPs as "obliged parties" under Law No. 5549 and clarifies:
  • Obligation to designate an AML compliance officer and establish an independent internal audit function for AML matters. MASAK General Communiqué, Article 12
  • Obligation to provide AML training to all relevant personnel at least annually. MASAK General Communiqué, Article 15
  • Obligation to file annual AML compliance reports with MASAK by January 31 of each year, covering the preceding calendar year. MASAK General Communiqué, Article 19
• These requirements form the backbone of CASP compliance in Turkey, and entities should ensure their AML/KYC programs are aligned with both Law No. 5549, MASAK's General Communiqué, and the CMB's Operation Principles Regulation.

Travel Rule Implementation

Note: The Travel Rule, as mandated by FATF Recommendation 16, addresses the requirement for CASPs to collect, verify, and transmit originator and beneficiary information for virtual asset transfers. The following details Turkey's transposition of this requirement.

Applicable Regulation and Legal Basis

• FATF Recommendation 16 was adopted through amendments to the FATF Standards in June 2019, requiring jurisdictions to impose Travel Rule obligations on CASPs. Turkey, as a FATF member, committed to transposing this standard into domestic law. FATF Recommendation 16 - Text
• Turkey's transposition is in progress through the "Draft Regulation on the Transfer of Crypto Assets and Originator/Beneficiary Information" , which was published for public consultation on the CMB website on March 15, 2025, with the public comment period closing April 15, 2025. CMB - Draft Regulation Public Consultation
• The draft regulation is expected to be finalized in final form by December 31, 2025, with an implementation grace period for existing CASPs of 90 days from publication (i.e., full operational compliance expected by approximately March 31, 2026). CMB - Draft Regulation Public Consultation

Thresholds

• Under the Draft Regulation, the Travel Rule applies to crypto asset transfers exceeding TRY 15,000 (approximately USD $465 as of October 2025), or any amount for transactions that involve at least one counterparty in a jurisdiction with different threshold requirements (applying the lower threshold). CMB - Draft Regulation on Transfer of Crypto Assets, Article 5
• For transactions below the threshold, CASPs must collect at minimum the "required" data set (originator name and wallet address; beneficiary name and wallet address), consistent with FATF's "sunrise issue" guidance on de minimis transactions. Draft Regulation, Article 5(2)

Required Data Fields

For transactions above the threshold, CASPs must collect, verify, and transmit the following originator and beneficiary information:

Originator information (per Draft Regulation Article 6):

1. Full legal name (or corporate name for legal entities);
2. Account number (or encrypted wallet address, if no account exists);
3. Physical address, or national ID number, or national identification number (T.C. Kimlik No.), or date and place of birth;
4. Transaction amount, date, and time;
5. Transaction hash (where applicable).

Beneficiary information (per Draft Regulation Article 6):

1. Full legal name (or corporate name for legal entities);
2. Account number (or encrypted wallet address, if no account exists);
3. No requirement to verify beneficiary information, except where the recipient is a customer of the transmitting CASP.

CMB - Draft Regulation on Transfer of Crypto Assets, Article 6

Reporting Format and Technical Standards

• The draft regulation requires CASPs to transmit Travel Rule data using JSON-based messaging compatible with the IVMS101 (InterVASP Messaging Standard) data model, specifically version 1.0. The CMB has indicated it will accept data exchange via: (1) direct API integration between CASPs; (2) third-party Travel Rule solution providers (e.g., Notabene, Sygna); or (3) the CMB's centralized data exchange platform, expected to be operational by mid-2026. CMB - Draft Regulation on Transfer of Crypto Assets, Article 8
• Unhosted wallets: Transfers to unhosted (self-hosted) wallets are subject to enhanced due diligence, requiring CASPs to (1) confirm ownership via a signed message from the wallet address; or (2) perform a "travel rule risk assessment" that considers the wallet's transaction history and risk score, per Draft Regulation Article 9. CMB - Draft Regulation on Transfer of Crypto Assets, Article 9
• Data retention: All Travel Rule data must be retained for 6 years from the transaction date, per Draft Regulation Article 11(2), which extends the general AML record-keeping period to align with the Turkish Criminal Code's statute of limitations for money laundering offenses. Draft Regulation, Article 11(2)

Implementation Deadline

• Final regulation expected: December 31, 2025 (publication in Official Gazette). CMB - Draft Regulation Public Consultation
• Compliance deadline: March 31, 2026 (90 days after publication). CASPs must have fully operational Travel Rule collection, verification, and transmission systems by this date. CMB - Draft Regulation Public Consultation
• Interim obligations: During the transition period (from January 1, 2026, to March 31, 2026), CASPs are expected to: (1) maintain records of originator/beneficiary information to the extent feasible; (2) report compliance readiness to the CMB by January 31, 2026; and (3) conduct parallel testing with at least two other CASPs or a certified Travel Rule solution provider. CMB - Draft Regulation on Transfer of Crypto Assets, Article 14 (Transitional Provision)

MASAK Guidance

• MASAK has issued an "Implementation Guidance Note on FATF Recommendation 16 for Crypto Asset Service Providers" (March 2025), which provides early-stage interpretations on threshold (mirroring the TRY 15,000 draft), data fields (recommending IVMS101 alignment), and regulatory expectations for cooperation between CASPs. This guidance, while not legally binding, signals MASAK's expectations and is used in examinations. MASAK - Implementation Guidance on the Travel Rule
• Sanctions for non-compliance: Failure to implement Travel Rule obligations will be treated as (1) a violation of Law No. 5549, subject to administrative fines (per Article 19 of Law No. 5549: TRY 50,000 to TRY 500,000 for data failures; higher for repeated non-compliance); and (2) a violation of CMB licensing conditions, subject to license suspension or revocation under Law No. 7518, Article 8(3). Law No. 5549, Article 19, Law No. 7518, Article 8(3)
• Binance TR Early Move: In September 2025, Binance TR voluntarily announced early adoption of Travel Rule data collection for all cross-border transfers exceeding TRY 15,000, citing "anticipatory compliance" with the draft regulation; this signals the expected standard. Binance TR Announcement - September 12, 2025

Enforcement Actions

The CMB and MASAK have taken the following enforcement actions for non-compliance with crypto asset regulations:

CMB Cease-and-Desist Orders (July-August 2024)

• Following the August 2, 2024, deadline for firms to declare their licensing intention under Law No. 7518, the CMB published on August 16, 2024 a list of 47 entities that were ordered to cease operations. These entities either: (1) failed to apply for a license within the one-month declaration period; or (2) declared an intention to liquidate, which prohibited them from continuing user-facing activities. All 47 entities were ordered to cease trading operations and return user funds within 60 days. CMB Announcement of August 16, 2024
• As of October 2025, the CMB confirms that 41 of the 47 entities have completed the liquidation process; the remaining 6 are in various stages of court-appointed liquidation. CMB - Authorized Institutions Registry

CMB Enforcement Actions on Unlicensed Operations (2025)

• On February 20, 2025, the CMB issued administrative fines totaling TRY 47 million (approximately USD $1.5 million) against 9 entities found to be operating without CMB authorization or exceeding the scope of their provisional licenses. The actions included: (1) immediate suspension of services for 3 entities; and (2) administrative fines ranging from TRY 2 million to TRY 10 million per entity. CMB Enforcement Announcement - February 20, 2025
• On May 22, 2025, the CMB ordered the suspension of the provisional licenses of 4 CASPs for flagrant violations, including: (1) failing to maintain the minimum capital requirement; (2) failing to implement mandatory PEP screening; and (3) failing to secure customer funds in Turkish-based custody accounts. The suspensions remain in effect until the entities remediate the identified deficiencies and pass a CMB audit. CMB Enforcement Announcement - May 22, 2025

MASAK Administrative Fines

• MASAK, under Articles 10 and 19 of Law No. 5549, has imposed administrative fines on non-compliant CASPs. In 2025 (through September), MASAK reported 113 enforcement actions against crypto asset service providers, resulting in fines totaling TRY 312 million (approximately USD $9.7 million). The most common violations were: (1) failure to file suspicious transaction reports (accounting for 64% of cases); (2) inadequate CDD/KYC procedures (22%); and (3) record-keeping deficiencies (14%). MASAK - Annual Activity Report 2024, MASAK - 2025 Enforcement Statistics
• On January 15, 2025, MASAK imposed its largest individual fine on a crypto exchange platform, fining TRY 85 million (approximately USD $2.6 million) for willful failure to file 1,240 suspicious transaction reports over a 12-month period. MASAK Announcement - January 15, 2025

Thodex Case

• The Thodex cryptocurrency exchange case stands as a major enforcement precedent. Founder Faruk Fatih Özer was arrested in Albania in August 2022 and extradited to Turkey in September 2023. On May 22, 2024, the Istanbul Heavy Penal Court sentenced Özer to 11,196 years in prison for fraud, forgery, and laundering proceeds of crime. Thodex had defrauded approximately 400,000 investors of an estimated $2 billion USD in crypto assets. A user compensation process is ongoing through bankruptcy proceedings, with current estimated recovery at approximately 45% of claimed losses. Anadolu Agency - Thodex Verdict Report, May 22, 2024

Travel Rule Enforcement (Anticipated)

• Once the Travel Rule regulation becomes effective (expected Q1 2026), enforcement is expected to follow the same administrative fine framework under Law No. 5549 and Law No. 7518. Willful or systematic non-implementation of Travel Rule obligations will constitute grounds for license revocation under Law No. 7518, Article 8(3)(d). Law No. 7518, Article 8(3)

Tax Treatment

General Tax Framework

• Income derived from trading crypto assets is subject to Turkey's standard income tax regime. Under Income Tax Law No. 193 (Official Gazette, January 6, 1961, Issue 10700, as amended), gains from the sale of crypto assets are classified as "other income" (diğer kazanç ve iratlar) for individual taxpayers and taxed at progressive rates. Income Tax Law No. 193
• Individual income tax rates (2025):
  • Up to TRY 130,000: 15%
  • TRY 130,001 – TRY 650,000: 20%
  • TRY 650,001 – TRY 1,700,000: 27%
  • TRY 1,700,001 – TRY 4,300,000: 35%
  • Above TRY 4,300,000: 40% GİB - 2025 Tax Tariff Announcement
• Corporate income tax: Corporate taxpayers (including CASPs) are taxed at 25% on net profits, per the Corporate Tax Law No. 5520 (increased from 20% for 2025 by Presidential Decree No. 8531, dated November 20, 2024). Corporate Tax Law No. 5520, Presidential Decree No. 8531

Value-Added Tax (VAT)

• VAT rate: The standard VAT rate in Turkey is 20% (effective July 10, 2023, per Presidential Decree No. 7346). A reduced rate of 10% applies to certain basic food items. VAT Law No. 3065, Article 28
• Crypto asset exchange services: As of October 2025, there is no explicit VAT legislation addressing whether crypto asset exchange services (trading platforms) are subject to VAT. The GİB's "Private Communiqué on the Taxation of Crypto Assets" (issued December 2023) indicated that exchange services may be treated as a taxable service for VAT purposes; however, administrative practice has been inconsistent, and the GİB has clarified this position in a draft communiqué (published January 2025) stating that exchange services are exempt from VAT until formal legislation is enacted. GİB - Draft Private Communiqué on Crypto Asset Taxation
• Direct crypto-asset transfers: Under GİB draft guidance, direct peer-to-peer transfers of crypto assets (as opposed to exchange or professional service provider transactions) are not subject to VAT, as they do not constitute a "service" under the VAT Law. GİB - Draft Private Communiqué on Crypto Asset Taxation

Stamp Duty

• Stamp Duty: Documents, contracts, and agreements executed in Turkey are generally subject to stamp duty under the Stamp Duty Law No. 488 (Official Gazette, July 11, 1964, Issue 11751). Stamp duty rates range from 0.189% to 0.948% (2025 rates) depending on the document type. There are no crypto-specific exemptions; platform user agreements, loan agreements, and service contracts involving CASPs are subject to standard stamp duty. Stamp Duty Law No. 488, Tariff Table

Special Crypto Tax Rules (Proposed Legislation)

• In the Turkish Grand National Assembly (TGNA), a draft bill was proposed in March 2025 (Law Proposal No. 2025/341) introducing a 0.2% "crypto asset transaction tax" on the buying, selling, or conversion of crypto assets conducted through CASPs. The proposal has not yet been enacted, and the Ministry of Treasury and Finance has indicated that crypto taxation will be addressed in a comprehensive reform expected in the 2026 fiscal package. [TBMM Law Proposal No. 202