Webinar Replay: Crypto Regulation in Turkey 🇹🇷

🎙️ Hosted by AMLBot | August 6, 2025 | 👨‍⚖️ Speaker: Niko Demchuk

🎤 Guests: Salih Demirtaş (GT İnovasyon), Gökhan Polat (Clovera.io)

In 2025, Turkey introduced a sweeping regulatory framework for crypto, from strict licensing to AML rules and stablecoin limits. But many questions remain. 

That’s why we asked Salih Demirtaş and Gokhan Polat for an in-depth revision, where we’ll break down what compliance really looks like in Turkey right now.

📌 In this webinar:

• Navigate New Crypto Laws & Licensing Requirements
• Understand The Real Cost Of Compliance In Turkey
• Explore What’s Next For The Turkish Crypto Market

🎁 Bonuses for all attendees:

• Compliance & Licensing Consultancy Demo — a practical session where we’ll walk through the first steps and outline a strategic roadmap for aligning your operations with Turkey’s new crypto regulations. Get clear on what to do now — and what to prepare for next.
• All attendees receive 10% off any of our compliance services from AMLBot — from KYT and risk scoring to custom licensing support.

💡Key Quote from the Session: “If you want to operate in Turkey’s crypto ecosystem, you need legal and physical presence — there’s no room for reverse solicitation anymore.” – Gökhan Polat

🎥 Watch the Replay

Introduction

Niko: Good afternoon, everyone. Welcome to our webinar. My name is Niko Demchuk. I'm a lawyer at AMLBot, and I’ll be your host for today.

First of all, thank you for joining us as we explore crypto regulation around the world. We've already covered the EU, Bermuda, El Salvador, and Kazakhstan. Today, we’re focusing on Turkey.

We’ll cover licensing requirements, compliance expectations, the application process, costs, and the pros and cons of launching a crypto business in Turkey. For that, I’ve invited two experts with hands-on experience in crypto licensing there: Salih Demirtaş and Gökhan Polat.

Meet the Speakers

Salih: Thank you, Niko. And thanks to everyone joining this webinar. I hope we’ll have a great session and be able to answer all your questions.

I’m the General Manager of GT Innovation, a consultancy company in Turkey. We focus on licensing, information security, cybersecurity, and risk advisory. I previously worked for banks and telecoms, and now manage a team of 20 consultants at GT Innovation.

Gökhan: Good evening, everyone. I’m Gökhan Polat from Istanbul. I’m the founder of Clovera and also the Business Development Lead at Fintech Istanbul, which provides consultancy and training to fintech companies. We help crypto companies improve their business models and understand regulation.

I’m also involved with ISACA's Emerging Tech group and the Cloud Security Alliance’s Blockchain working group. We’ve created two blockchain standards — one for cybersecurity governance and another for privacy governance. I previously served as Enterprise Risk Director at a Turkish blockchain company.

Current State of Crypto Regulation in Turkey

Niko: In 2022, there was no concrete crypto regulation in Turkey, aside from a ban on crypto payments. Has this changed?

Salih: Yes. Previously, crypto wasn’t regulated, but starting this year, licensing is required. We now have a comprehensive regulation that includes IT systems, auditing, business operations, and licensing. About 60 companies are currently applying for licenses.

As for using crypto for payments, it’s still prohibited, but we expect that to change in the next year or two.

Gökhan: Turkey is aligning with the EU’s MiCA framework. While there were MASAK (AML regulator) rules and GDPR-like data regulations before, July 2025 brought a crypto-specific regulation. However, crypto payments remain prohibited for now. 

Regulatory Structure

Niko Demchuk: So Turkey hasn’t introduced a standalone crypto law, but instead amended existing laws. Is that right?

Gökhan Polat: Exactly. We amended the already in-use SPK legislation. They added new articles specifically addressing crypto sector requirements. We’re also seeing SPK work on second-level legislative documentation. Meanwhile, TÜBİTAK — a governmental tech agency — is defining technical standards for actors in the crypto ecosystem.

Salih Demirtaş: Unlike the EU, where one regulator handles everything, Turkey has several authorities involved.

• SPK manages governance and licensing.
• MASAK (the Financial Crimes Investigation Board) handles AML.
• The Central Bank defines high-level policy.
• TÜBİTAK oversees technical compliance.

This division of roles adds complexity but also depth to regulatory oversight.

Gökhan Polat: There are some similarities with MiCA, especially regarding investor protection and operational risk controls. But Turkey's multi-agency model is unique — and that makes navigating licensing a bit more challenging for crypto businesses unfamiliar with the environment.

Salih Demirtaş: Still, both frameworks — MiCA and Turkish law — underline strong requirements around custody, segregation of assets, and AML. So in terms of substance, the alignment is clear even if the structure is more fragmented here. 

Niko Demchuk: Which crypto services are regulated by the SPK?

Salih Demirtaş: Platforms (exchanges) and custodians are regulated. Services like trading, custody, ICOs, investment advice, and wallet services all require licensing.

Licensing Requirements

Niko Demchuk: Let’s talk about licensing. What are the key requirements?

Gökhan Polat: Yes, I can start with that. First of all, SPK defines some key requirements:

• Capital Adequacy: Companies must meet a minimum capital threshold. For exchanges, that’s currently set at 150 million TRY — about $4 million. For custodians, it's even higher: 500 million TRY, or around $13.5 million. These are very high compared to global standards, but the Turkish authorities want only financially resilient firms to operate.
• Corporate Governance: You need to establish clear governance roles. SPK expects firms to show the structure of their teams — including individuals with relevant experience in compliance, risk, IT, and operations. These aren’t just checkboxes; the authorities will assess whether people actually meet these standards.
• Cybersecurity: Infrastructure resilience is a big focus. TÜBİTAK, our national tech institute, defines many of the technical requirements — including how cold and hot wallets should be managed and how to integrate with the central registry.
• Internal Controls: There’s a strong emphasis on having three lines of defense — including internal control, risk management, and internal audit departments. Each of these must function independently and report directly to the board.
• AML/CTF Compliance: Companies must implement full AML programs, covering everything from customer onboarding to transaction monitoring and Travel Rule implementation. MASAK’s standards must be fully integrated.
• Asset Segregation: SPK mandates separation of exchange and custody functions. If you're an exchange, you cannot custody client funds yourself — you must partner with or establish a separate licensed custodian.

Salih Demirtaş: Yes, and I can add to that. These internal control functions are not just for show — they must be real, and they must be built into the company structure from the beginning.

Regulators require robust IT systems, with secure wallet architecture — including HSMs (hardware security modules), disaster recovery procedures, and secure integration with central systems.

Also, internal audit must report directly to the board, not management. The compliance setup needs to be transparent and regulator-facing. These are strict, but they show Turkey is taking this seriously and wants only serious players to operate here.

Travel Rule and Transaction Limits

Niko Demchuk: Is it true that users face daily and monthly crypto limits?

Salih Demirtaş: Yes, that's correct. In Turkey, FATF Travel Rule obligations are strictly enforced. Any user buying or selling cryptocurrency must provide a clear explanation of the transaction's purpose. According to current regulations, the daily transaction limit is approximately $2,000 USD, and the monthly limit is set at $50,000 USD.

These thresholds apply regardless of whether the transaction is B2C or B2B — so businesses and individuals are both affected. However, there are some important exclusions. For example, decentralized finance (DeFi) protocols and peer-to-peer (P2P) transfers currently fall outside of these limitations.

MASAK, our financial crimes investigation board, is increasingly strict in monitoring these rules and has expanded its audit activity across the crypto sector in the last year.

Niko Demchuk: Are these limits also applied to legal entities, or just individuals?

Salih Demirtaş: Yes, even legal persons — such as corporations — are subject to the same thresholds. While there have been objections to this policy, at present, the limits remain the same for both private and business users.

That said, we are aware of cases where accounts have been locked for foreign users due to incomplete KYC or lack of an officially registered Turkish address. In such cases, compliance with MASAK regulations becomes even more critical.

Gökhan Polat: And just to clarify — while DeFi and P2P aren't restricted by these thresholds, they also come with their own set of risks and are harder to supervise, which is why centralized platforms are facing the brunt of compliance obligations.

ICOs, NFTs, and DeFi

Niko Demchuk: Are ICOs, NFTs, or DeFi regulated?

Gökhan Polat: As of today, under the new crypto legislation introduced in Turkey in July 2025, ICOs, NFTs, and DeFi applications are not explicitly regulated. And this is not an oversight — it’s intentional.

The Turkish authorities decided to focus first on centralized crypto service providers, where the largest customer funds are held and where the greatest systemic risk lies. These platforms — exchanges and custodians — touch a significant portion of investor money, and that’s where regulators want control first.

Gökhan Polat: The second reason is complexity. NFTs involve collectibles, art, and entertainment — areas that don’t fit easily into traditional financial regulation. DeFi, on the other hand, is still evolving, with new protocols and risks emerging all the time. Legislators want to better understand these sectors and observe how jurisdictions like the EU apply their frameworks.

Gökhan Polat: And finally, MiCA — the EU regulation that Turkey is informally aligning with — also excludes NFTs and DeFi from its initial scope. So Turkey is choosing a phased approach: centralized first, then decentralized.

Salih Demirtaş: Yes, and I would add that the Turkish tech ecosystem is actually very active in tokenization. We have solid engineering talent here. But from a regulatory standpoint, services like DeFi lending or DAO-based projects will likely take more time to receive a green light. Stablecoins may see more movement sooner — but smart contracts and decentralized lending will stay on hold a while longer.

Why Would a Business Choose Turkey?

Niko Demchuk: So okay. So my understanding was correct. If a business somewhere else has a Turkish resident, they cannot serve them. They need to go to Turkey to first receive the license, and then they can be open to Turkish residents. Okay, that is clear.

My last question — why would a business choose Turkey as a place of their incorporation?

Salih Demirtaş: I can start if you want, Gökhan.

Gökhan Polat: Please go on.

Salih Demirtaş: It’s a little bit easy — because more than 60 companies already applied. We have many companies. The background is about the Turkish young ecosystem, Turkish people — because we are really interested in crypto. So, the customer base or demand across the supply in Turkey. That’s the quick answer.

But, on the other hand, our finance sector is really regulated and also integrated into the global system. So any finance initiatives in Turkey always aim to expand all over the world. So I think, for these reasons, it’s a good market for crypto investors.

Niko Demchuk: Okay, thank you, Salih. I agree.

Gökhan Polat: Geography is very important. Turkey is situated in the middle of Asia, Europe, and the Middle East. It’s a strategic position. So your company may operate in other regions via Turkey. For example, Binance — Binance Turkey is the biggest one in Europe. It’s not a coincidence.

As Salih mentioned, we have a young population. They are very keen to use this kind of technology — tokenization, DeFi, staking, Web3 projects. And we also see AI supporting blockchain technologies. This is important.

The licensing process is still ongoing. It hasn’t ended yet, and there's a competitive advantage if you get licensed first. That can also be attractive for companies planning to invest in Turkey’s crypto sector.

Salih Demirtaş: They already invested. We have some international players in Turkey like Binance, OKX, KuCoin, etc. But we also have strong local players. We have strong banking — mostly for custodian services. But there are also some casualties because of the intense competition. Some smaller local platforms, or even international platforms, are now exiting due to that competitiveness.

Questions From the Audience

Niko Demchuk: Let's take also some questions from our audience. The first one is from Azamad: Is SPK — the Capital Markets Board — currently accepting license applications for crypto exchanges and custodians?

Salih Demirtaş: Yes, during the webinar we already covered this. Yes, they are accepting applications. Some platforms and custody services have submitted their files to SPK. Now they are waiting for a license or for comments from the regulator.

Niko Demchuk: Here's another question — сan the full share capital requirement be used for operational expenses after it's fully paid, including post-license?

Salih Demirtaş: No. Because companies will be reporting their financial status regularly. It is expected to remain on balance. The capital or assets can be adjusted during the process to some extent, but the limits must be respected.

Niko Demchuk: So actually, this sum needs to always be on the balance of the company. It cannot be used, cannot be reduced.

Custody Requirements

Niko Demchuk: Is there an open registry for CASPs in Turkey?

Salih Demirtaş: Yes, mostly banks have applied for custody.

Niko Demchuk: So in many countries, once the business is licensed, you can go to the regulatory authority website and see all the companies that received a license. Is it the same in Turkey?

Salih Demirtaş: CASP applications are ongoing. There are around 60 companies in this process. They are waiting for their license. I understand the question — yes, once the license is issued, it will be available in public listings.

Gökhan Polat: He’s asking if individuals can follow this process on SPK’s website.

Salih Demirtaş: Sure. Since we are in the webinar, I’ll try to find the link and share it in the chat.

Gökhan Polat: It’s transparent. You can follow the list.

Custodian license

Niko Demchuk: Next question: Does an exchange necessarily need a custodian license in Turkey?

Salih Demirtaş: Exchanges must engage with custodians. There are expectations, but they don’t need to hold a custodian license themselves. Most custodians are banks. Some platforms have set up new companies specifically for custody.

Gökhan Polat: This is part of a globally recognized internal control framework — separation of duties. If you operate as an exchange, you cannot also be the custodian. You must keep client assets with an independent custodian. Cold wallets, hot wallets — they should be managed by a separate entity.

Foreign Citizens

Niko Demchuk: While we wait, any unanswered questions in the chat?

Salih Demirtaş: Yes, there were questions regarding foreign citizens. In practice, we expect improvement here. Some foreign citizen accounts have been locked due to strict KYC requirements. If a user doesn't have a registered Turkish address, their verification can be incomplete. MASAK enforces this. The KYC regulation is strict, and some foreign users in Turkey have faced issues.

Final Words

Niko Demchuk: The results are in — it's 50/50. Half the audience believes the regulations will power the industry, and half think the requirements are overly strict.

Thank you again to our speakers, Gökhan and Salih, for your time and insights. Any final thoughts?

Gökhan Polat: Thank you for attending and thank you to AMLBot. AMLBot is providing a great range of services for building digital trust in the crypto ecosystem. With growing activity and growing threats, we need global actors like AMLBot.

We have a young population. They love technology. But we also need guidance on how to stay safe. That’s why services like KYT, KYC, and cybersecurity are crucial for Turkey.

Salih Demirtaş: Thank you. I’ll summarize it like this — don’t wait for regulation. Follow global best practices now. If you want to do crypto business in Turkey, prepare for licensing early. Work with strong advisors. Build security by design. Engage with policymakers. The foundations are already here.

Niko Demchuk: Thank you again, everyone. That’s it for today. AML compliance is clearly one of the most complex areas — and we’re here to help. Stay tuned — we’ll be back soon with another deep-dive session on a key jurisdiction.