Crypto Exchange Licensing in Turkey: Rules, Costs & Restrictions for 2026

For years, operating a cryptocurrency exchange in Turkey was like walking through a minefield. You had enthusiastic users, high inflation driving adoption, and almost zero legal clarity. Then, in early 2025, the ground shifted completely. The Turkish government didn't just nudge the industry; they built a wall around it with strict rules, heavy capital requirements, and intense scrutiny.

If you are looking to launch or operate a crypto asset service provider (CASP) in Turkey today, the days of flying under the radar are over. The regulatory framework established by the Capital Markets Board (CMB) is now fully active. It demands serious money, robust infrastructure, and total transparency. This guide breaks down exactly what that means for your business, from the 150 million Lira entry ticket to the daily headaches of compliance.

The New Legal Reality: What Changed in 2025?

To understand where things stand in mid-2026, you have to look at the foundation laid on March 13, 2025. That date marks when two critical communiqués were published in the Official Gazette. These weren't suggestions; they were binding laws that defined how crypto exchanges must be founded and operated.

The first communiqué (III-35/B.1) set the basic principles for who can run these businesses. The second (III-35/B.2) got into the gritty details: operational procedures, how much cash you need in the bank, and how to prove you aren't laundering money. Before this, many operators relied on gray-area interpretations or offshore setups. Now, those setups are dead ends if you want to touch the Turkish market legally.

This shift aligns Turkey with global trends seen in frameworks like the EU’s MiCA, but with a distinctly local twist. While Europe focuses on consumer protection across borders, Turkey’s primary concern remains capital control and monetary stability. The Central Bank of Turkey (TCMB) still prohibits using cryptocurrency as a payment method. So, while you can trade crypto, you can’t use it to buy bread. This distinction shapes every part of the licensing process.

Who Is Actually in Charge?

You cannot navigate this landscape without knowing who holds the keys. The primary authority is the Capital Markets Board (CMB). They issue the licenses, review your corporate structure, and decide if your founders are "fit and proper." But they don't work alone.

Think of the CMB as the gatekeeper for entry. Once you’re inside, the Financial Crimes Investigation Board (MASAK) becomes your daily overseer. MASAK handles Anti-Money Laundering (AML) enforcement. Their power is significant-they can freeze crypto and bank accounts linked to suspicious activity without needing prior court approval. For an exchange operator, this means one wrong move in transaction monitoring could shut down your liquidity overnight.

There is also a financial relationship with the Scientific and Technological Research Council of Türkiye (TUBITAK). Platforms pay fees to them, tying the crypto sector into the national technology research ecosystem. Understanding this triad-CMB for licensing, MASAK for crime prevention, and TUBITAK for revenue sharing-is crucial for structuring your compliance team.

The Money Talk: Capital Requirements and Fees

Let’s get straight to the cost of doing business. Turkey has set the bar high to filter out fly-by-night operations. If you are planning to launch a standard crypto trading platform, you need a minimum paid-in capital of 150 million Turkish Lira. As of mid-2026, this translates to roughly $4.1 million USD, depending on daily exchange rate fluctuations.

But if you plan to offer custodial services-holding users' private keys and assets-the requirement jumps significantly. Custodial providers must hold at least 500 million TL (approximately $13.7 million USD). This reflects the higher risk associated with holding client funds directly.

These are not optional reserves. The capital must be deposited in cash, and the company must be structured as a joint-stock company with shares registered by name. Anonymous ownership is effectively banned.

Beyond the initial capital, there is an ongoing tax on your success. Licensed platforms must pay an annual fee of 1% of their total income (excluding interest) to the CMB and another 1% to TUBITAK. That is a flat 2% cut of your gross revenue. When calculating your business model, factor this in immediately. It impacts your pricing strategy and profit margins significantly compared to jurisdictions with fixed licensing fees.

Compliance Infrastructure: More Than Just KYC

Having the money isn't enough. You need systems. The regulations demand sophisticated technical infrastructure that goes far beyond basic identity checks.

First, Know-Your-Customer (KYC) rules are strict. You must verify the identity of any user conducting transactions exceeding 15,000 TL (roughly $425 USD). This threshold is low enough to catch most retail traders but high enough to allow micro-transactions without excessive friction. However, the documentation required is extensive. You need documented explanations for transactions, not just a selfie and a passport scan.

Second, real-time monitoring is non-negotiable. Your platform must capture canceled and unexecuted transactions. Why? Because wash trading and spoofing are red flags for regulators. You need automated price monitoring systems to detect suspicious trading patterns instantly. If MASAK sees a spike in unusual volume, they expect your system to flag it before they even ask.

Finally, cybersecurity is part of the license conditions. You must demonstrate robust internal controls. This usually means hiring dedicated risk management teams and undergoing regular third-party audits. International applicants often struggle here because Turkish corporate law and banking integration require specific local expertise. Relying on generic global compliance software often fails to meet the granular reporting needs of the CMB.

The Foreign Operator Dilemma

If you are based outside Turkey, listen closely. The current framework is notably restrictive regarding foreign participation. Non-resident CASPs face severe limitations on active marketing and local presence within Turkish territory.

Unlike Malta or Estonia, which actively court international crypto businesses with open doors, Turkey prefers domestic control. While you can technically apply for a license as a foreign entity, the practical barriers are high. You need a strong local footprint, local directors who pass fit-and-proper tests, and deep integration with Turkish banking rails.

In July 2025, authorities blocked 46 unlicensed exchanges, including major decentralized platforms like PancakeSwap. This wasn't a warning shot; it was a cleanup operation. The message was clear: if you aren't licensed and locally compliant, you are inaccessible to Turkish users. For foreign operators, this often means establishing a wholly-owned subsidiary in Istanbul rather than trying to serve the market remotely.

Timeline and Application Process

Don't expect a quick turnaround. Legal practitioners in Istanbul report that preparing a comprehensive application takes between 6 to 12 months. Here is why:

1. Corporate Restructuring: Converting to a joint-stock company, verifying shareholder backgrounds, and ensuring clean legal records for all key management personnel.
2. System Development: Building or integrating the mandatory transaction recording and risk monitoring systems. This requires technical resources familiar with Turkish data sovereignty laws.
3. Regulatory Submission: Compiling bilingual documents (Turkish and English) for the CMB. English-speaking legal support is crucial here, as misinterpretation of terms can lead to immediate rejection.

The probability of success is not publicly disclosed, but experts suggest that well-capitalized applications with pre-vetted compliance systems have reasonable prospects. The bottleneck is rarely the CMB's willingness to approve; it's the applicant's ability to prove readiness.

Market Context: Risks and Opportunities

Why go through this hassle? Because the market is huge. Turkey has a young, tech-savvy population that turned to crypto en masse during periods of high inflation. Despite the ban on payments, trading volumes remain robust among licensed operators.

However, the political environment adds a layer of unpredictability. In July 2025, the detention of ICRYPEX founder raised concerns about political motivations behind regulatory enforcement. While the official reason cited regulatory violations, the timing suggested broader tensions. Operators must maintain impeccable neutrality and compliance to avoid becoming collateral in policy disputes.

On the positive side, the crackdown on unlicensed competitors has concentrated market share among legitimate players. If you have the license, you have less competition from shady offshore sites. Users are increasingly wary of unregulated platforms after seeing dozens blocked. Trust is now a commodity, and your license is the proof.

Next Steps for Prospective Licensees

If you are serious about entering the Turkish market, start with a feasibility audit. Do you have access to 150 million TL in liquid capital? Can you build a compliance team that speaks both Turkish and understands MASAK protocols? If the answer is no, consider partnerships or acquisitions instead of greenfield launches.

Engage local fintech-specialized legal firms early. Don't rely on general corporate lawyers. You need experts who have navigated the CMB submission process since 2025. They will help you structure your board composition and draft the internal control policies that regulators scrutinize most heavily.

Prepare for a long game. The regulatory landscape may evolve, potentially refining capital requirements or expanding service definitions. Stay agile. Monitor updates from the CMB and TCMB weekly. In Turkey's crypto market, information speed is just as valuable as capital.