Crypto Exchange Licensing in Turkey: Rules, Costs & Restrictions for 2026

Running a crypto business in Turkey without a license is no longer just risky; it’s illegal. Since March 2025, the regulatory landscape has shifted from a gray area to a strict, structured environment governed by the Capital Markets Board (CMB). If you are looking to launch or operate a crypto exchange in this market, you need to understand that the days of operating under the radar are over. The government has closed dozens of unlicensed platforms, and the penalties for non-compliance include account freezes and criminal charges.

This guide breaks down exactly what it takes to get licensed, how much it costs, and where the hidden traps lie. Whether you are an international firm eyeing the Turkish market or a local startup trying to legitimize your operations, these rules dictate your survival.

The Regulatory Framework: Who Controls What?

To navigate this space, you first need to know who holds the power. In Turkey, cryptocurrency exchanges fall under the category of Crypto Asset Service Providers (CASPs). The primary regulator here is the Capital Markets Board (CMB), which oversees the issuance of licenses and operational standards. However, you cannot ignore the Financial Crimes Investigation Board (MASAK), which handles anti-money laundering (AML) enforcement.

The foundation of this system was laid on March 13, 2025, with two official communiqués published in the Official Gazette:

• Communiqué I (III-35/B.1): Sets the founding and operational principles for CASPs.
• Communiqué II (III-35/B.2): Details operational procedures, capital adequacy, and compliance measures.

While the Central Bank of Turkey (TCMB) still prohibits using crypto for payments-a rule established in 2021-the CMB now controls the trading infrastructure. This creates a unique dynamic: you can trade crypto legally if you are licensed, but you cannot use it to buy groceries or pay rent. For an exchange, this means your platform must facilitate investment and speculation, not daily commerce.

Licensing Requirements: The High Barrier to Entry

The Turkish government wants serious players only. The barriers to entry are designed to filter out fly-by-night operators and ensure financial stability. Here is what you need to have ready before you even think about submitting an application.

Corporate Structure

You cannot register as a simple limited liability company. To qualify for a CASP license, your entity must be established as a joint-stock company. Furthermore, all shares must be issued in cash and registered by name. This transparency requirement prevents anonymous ownership structures that were common in earlier years of the industry.

Minimum Capital Requirements

Capital adequacy is one of the most significant hurdles. The regulations set specific minimum paid-in capital thresholds based on the type of service you provide:

Note that these figures are based on exchange rates around mid-2025. Given Turkey’s inflation history, always verify current USD equivalents with a local financial advisor. While $4.1 million might seem high compared to some emerging markets, it is lower than requirements in jurisdictions like Singapore or the UK, positioning Turkey as a middle-ground option for regional expansion.

Fit-and-Proper Tests

Your money isn’t enough; your people matter too. Founders, board members, and key management personnel must pass strict "fit-and-proper" tests. This includes:

• Demonstrated financial integrity.
• Clean legal records with no prior convictions related to financial crimes.
• Proof of relevant professional experience in finance or technology.

The CMB conducts thorough due diligence on corporate and ownership structures. If any shareholder has a questionable background, the entire application can be rejected.

Ongoing Costs and Operational Fees

Getting the license is just the start. The ongoing cost of doing business in Turkey is substantial, driven by both direct fees and compliance infrastructure needs.

Annual Revenue Fees

There is no fixed annual licensing fee listed in the regulations, but there is a revenue-based tax structure. Licensed crypto-asset trading platforms must pay an annual fee of 1% of their total income (excluding interest income) to two separate bodies:

1. The Capital Markets Board (CMB).
2. The Scientific and Technological Research Council of Türkiye (TUBITAK).

This results in a total annual fee burden of 2% of gross revenues. For a high-volume exchange, this adds up quickly. You need to factor this into your pricing model and margin calculations.

Compliance Infrastructure Costs

Beyond direct fees, you must invest heavily in technology and personnel. The regulations mandate:

• Dedicated Risk Management Teams: You need full-time staff focused solely on monitoring risks.
• Price Monitoring Systems: Automated tools to detect suspicious trading activity, such as wash trading or price manipulation.
• Transaction Recording Systems: Your backend must capture every transaction, including canceled and unexecuted orders. This data must be available for regulatory audits.

Building or buying this infrastructure requires significant IT expenditure. Many firms hire specialized fintech legal consultants to help design these systems to meet CMB standards.

AML/KYC Compliance: The MASAK Factor

If there is one area where Turkey is uncompromising, it is Anti-Money Laundering (AML). The Financial Crimes Investigation Board (MASAK) has broad powers, and they are using them.

Identity Verification Thresholds

You must implement mandatory identity verification for all transactions exceeding 15,000 Turkish Lira (approximately $425 USD). Below this threshold, lighter checks may apply, but above it, strict KYC protocols are non-negotiable. Users must provide documented proof of identity and explain the source of funds for large transactions.

Real-Time Reporting and Account Freezes

The scariest part for exchanges? MASAK can freeze crypto and bank accounts linked to suspicious activity without prior court approval. This means if your user base includes someone involved in illicit activities, your platform could face immediate liquidity issues. You are required to report suspicious transactions in real-time. Failure to do so can result in heavy fines or license revocation.

For international applicants, this creates a complex compliance landscape. You need bilingual legal support to communicate effectively with regulators and ensure your AML policies align with both local laws and global standards like FATF recommendations.

Restrictions on Foreign Operators

Are you a foreign company wanting to serve Turkish customers? Be careful. Turkey’s framework is notably restrictive regarding non-resident CASPs.

• No Active Marketing: Non-resident exchanges cannot actively market their services within Turkish territory.
• Local Presence Required: To fully operate, you generally need a local entity. Simply having a website accessible in Turkey is not enough if you are targeting Turkish residents.

This contrasts sharply with countries like Malta or Estonia, which actively court international crypto businesses. Turkey’s approach is more protectionist, aiming to keep capital flows within regulated domestic channels. If you are an offshore exchange, you likely need to establish a joint-stock subsidiary in Turkey to comply.

Enforcement Reality: What Happens if You Don’t Comply?

Theoretical rules are one thing; enforcement is another. In July 2025, authorities blocked 46 unlicensed exchanges, including major decentralized platforms like PancakeSwap. This action drastically reduced options for Turkish users, forcing traffic toward licensed operators.

The message was clear: operate without a license, and you will be shut down. Additionally, the detention of the founder of ICRYPEX in late July 2025, amid allegations linking crypto funding to political dissent, highlighted the potential for political motivations in regulatory enforcement. While rare, this risk exists. Compliance is not just about following technical rules; it’s about maintaining good standing with state authorities.

How to Apply: A Step-by-Step Overview

Based on insights from Istanbul-based legal firms specializing in fintech, here is the typical path to licensure:

1. Corporate Restructuring (Months 1-3): Form your joint-stock company, secure the minimum capital, and appoint directors who pass fit-and-proper tests.
2. Compliance System Development (Months 3-6): Build or integrate AML/KYC software, transaction monitoring tools, and internal audit frameworks.
3. Documentation Preparation (Months 6-9): Compile extensive due diligence reports, internal control policies, and cybersecurity assessments. English-speaking legal teams are crucial here to translate and format documents for the CMB.
4. Submission and Review (Months 9-12+): Submit your application to the CMB. Expect rigorous questioning and potential requests for additional information.

The entire process typically takes 6 to 12 months. There is no fast track. Patience and precision are your best assets.

Market Context: Why Go Through the Trouble?

Despite the high costs and strict rules, Turkey remains an attractive market. The country has a young, tech-savvy population and high inflation rates, which historically drive crypto adoption. With many unlicensed competitors removed from the market, licensed exchanges benefit from reduced competition and increased customer trust.

Users are increasingly wary of unregulated platforms after seeing accounts frozen or platforms blocked. A CMB license signals safety and legitimacy. For serious investors, this clarity is worth the premium.