Secondary Legislation Regarding Crypto Asset Service Providers Has Been Published

With the Law No. 7518 on Amendments to the Capital Markets Law, published in the Official Gazette No. 32590 on 2 July 2024, and entered into force upon its publication, crypto asset service providers (“CASPs“) operating or intending to operate in Türkiye have been brought under the scope of the Capital Markets Law No. 6362 (“CML”), and the Capital Markets Board of Türkiye (“CMB“) has become the regulatory and supervisory authority for CASPs.

In this regard, various regulations concerning CASPs have been introduced through the CMB’s principal decisions dated 8 August 2024 and 19 September 2024, as well as amendments made to the legislation of the Financial Crimes Investigation Board on 25 December 2024.

The Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers (III-35/B.1) and the Communiqué on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers (III-35/B.2), published in Official Gazette No. 32840 on 13 March 2025, have introduced secondary regulations for CASPs, with various transition periods provided for CASPs to ensure compliance with these regulations.

The key regulations under the aforementioned communiqués are summarized as follows:

The key regulations introduced by the Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers (III-35/B.1) (“Communiqué No. III-35/B.1“) are summarized as follows:

• Establishment Conditions: CASPs must fulfil the following conditions in order to be granted authorization by the CMB for their establishment:
  • They must be established as joint-stock companies,
  • All of their shares must be registered shares,
  • Their shares must be issued in exchange for cash contributions,
  • Their initial capital must not be less than the minimum capital amount stipulated in the CMB’s regulations on the capital adequacy of CASPs, and must not be less than the amount to be determined by the CMB, their capital must be fully paid in cash, and their equity must not be less than this amount,
  • Their articles of association must comply with the provisions of the CML and related regulations, and their scope of activities must be exclusively determined as the performance of the activities for which they are authorized by the CMB,
  • Their founders must meet the requirements specified in the CML and related regulations,
  • The shareholding structure must be transparent and clear.

Under the Communiqué No. III-35/B.1, the requirements regarding the founders and shareholders of CASPs have been regulated  in detail. Furthermore, the platforms must include the phrase “crypto asset trading platform” in their trade names, while institutions providing crypto asset custody services must include the phrase “crypto asset custody institution” in their trade names.

• Establishment, Operating License, and Authorization Certificate: Under the Communiqué No. III-35/B.1, the conditions that CASPs must fulfil to obtain an operating license from the CMB have been specified in detail. It is stipulated that CASPs that have been granted an establishment license by the CMB will forfeit their right to obtain an operating license if they fail to submit an application for an operating license within six months following the granting of establishment license. Furthermore, it is stated that, if deemed appropriate by the CMB, CASPs will be granted an authorization certificate specifying the services and activities which they are authorized to perform, and that operations cannot be commenced prior to obtaining the authorization certificate.
• Organizational Structure: Under the Communiqué No. III-35/B.1, the requirements that the organizational structure of CASPs must meet in order to be granted an operating license are set out in detail. Pursuant to the Communiqué No. III-35/B.1, CASPs are required to establish internal audit, internal control, and risk management units within their organizational structure, and the principles governing the operations of these units are outlined in the said communiqué. It is also stipulated that, in order to be authorized to provide crypto asset custody services, a unit or units exclusively responsible for custody services must be established.
• Principles Regarding Personnel and Managers: Under the Communiqué No. III-35/B.1, the principles regarding the managers and personnel to serve at CASPs have been regulated in detail. Pursuant to the Communiqué No. III-35/B.1, the term “personnel” refers to the internal auditor, internal control personnel, risk management personnel, operations personnel, information security officer, information technology operations personnel, and investment advisor. Furthermore, the term “manager” refers to the members of the board of directors, the general manager, deputy general managers, managers at all levels of the units to which the personnel are assigned, and personnel serving at the levels between manager and personnel within these units (e.g., deputy manager, administrator, director, and similar). It is essential that managers and personnel hold a degree from an institution offering at least a four-year undergraduate education, unless otherwise stipulated in the legislation. Additionally, it is stipulated that the general manager and deputy general managers must possess at least seven years of professional experience in the fields of financial markets, information processing, information technologies, or financial technologies. Furthermore, it is required that the general manager be exclusively employed for this position, reside in Türkiye, and be appointed on a full-time basis. However, it is stated that the general manager’s membership on the board of directors of the CASP does not constitute a violation of the aforementioned provision.
• Board of Directors: Pursuant to the Communiqué No. III-35/B.1, the board of directors of CASPs must consist of at least three members, and the majority of the board members must hold a degree from an institution offering a four-year undergraduate education. Other qualifications that board members must possess are outlined in detail under the Communiqué No. III-35/B.1.
• Integration and Membership: The Communiqué No. III-35/B.1 sets out various requirements, including the integration with the Central Securities Depository of Türkiye (“CSD”), mandatory membership in the Turkish Capital Markets Association, and the obligation of CASPs to provide information about their authorized services and company descriptive information on the Public Disclosure Platform and their websites.
• Framework Agreement: It is stipulated that platforms must execute a framework agreement with the client regarding the service to be provided prior to initiating transactions, and the principles governing this requirement are set out under the Communiqué No. III-35/B.1.
  
• Obligation for Approval or Notification in Case of Changes in Shareholding Structure:
  • The acquisitions of shares representing 10% or more of the share capital or voting rights of a CASP directly or indirectly, or the acquisitions of shares resulting in a shareholder’s shares exceeding 10%, 20%, 33%, or 50% of the share capital or voting rights of a CASP directly or indirectly, and the changes in the shareholding structure resulting in a decrease in a shareholder’s shares below the specified percentages require the approval of the CMB.
  • Even if it remains below the above-mentioned percentage, the transfer of privileged shares granting the right to board representation or shares carrying usufruct rights in a CASP requires the approval of the CMB, regardless of the percentage.
  • Furthermore, in the case of share transfers that do not reach or fall within the percentages specified in the Communiqué No. III-35/B.1, the CMB must be notified within ten business days following the transfer.
• Outsourcing of Services: Under the Communiqué No. III-35/B.1, the principles governing the outsourcing of services for CASPs have been regulated, specifying which services cannot be subject to outsourcing, and outlining the minimum content to be included in the agreements between CASPs and outsourcing service providers. Pursuant to the Communiqué No. III-35/B.1, the following activities of CASPs cannot be subject to outsourcing:

• • Activities that must be exclusively carried out by the board of directors of the CASP,
  • Provision of services and activities that require authorization from the CMB, as well as activities related to their marketing,
  • Accounting for the operations of the CASP and preparation of its financial reports,
  • Activities related to internal audit, internal control, and risk management systems.
• Other Regulations: The document registration system, internal audit, internal control and risk management activities of CASPs, their audit obligations, and prohibited activities have been regulated. Additionally, regulations regarding the voluntary suspension of activities by CASPs, and the waiver of their operating licenses, as well as measures to be taken against CASPs have been introduced.
• Custody Services: Specific regulations have been introduced for custody institutions and banks that will provide custody services.
• Transitional Provisions: The application period for the operating license of CASPs and the transitional provisions for CASPs to comply with the Communiqué No. III-35/B.1 are summarized as follows:

a. Among those that have submitted  establishment applications under the CMB’s principal decision i-SPK.35.B (dated 8 August 2024, no. 42/1259), the applications of platforms listed in the “List of Operating Entities” as of 13 March 2025 and the applications of platforms that have been submitted before 13 March 2025 are valid and these applications will be examined in accordance with the provisions of the Communiqué No. III-35/B.1, except for the capital requirement.

b. Among those that have submitted establishment applications under the CMB’s principal decision i-SPK.35.B (dated 8 August 2024, no. 42/1259) but whose applications have not been concluded as of 13 March 2025 will be included in the “List of Operating Entities” upon the approval of their articles of association and verification of the establishment conditions.

c. The entities referred to in paragraphs (a) and (b) above must apply for an operating license until 30 June 2025 by fulfilling the operating requirements set by the CMB, in addition, they must obtain an authorization certificate until 30 June 2026, in accordance with the principles specified by the CMB regarding operating requirements.

d. The custody institutions listed in the “List of Operating Entities” as of 13 March 2025 as well as custody institutions that have submitted applications before 13 March 2025 must apply for an operating license until 30 June 2025.

e. While certain provisions of the Communiqué No. III-35/B.1 entered into force on 13 March 2025, different transition periods have been introduced for CASPs, with some provisions set to take effect on 31 March 2025, and 30 June 2025.

The key regulations introduced by the Communiqué on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers (III-35/B.2) (“Communiqué No. III-35/B.2“) are summarized as follows:

• Services, Activities and Obtaining Authorization from the CMB: Under the Communiqué No. III-35/B.2, the services and activities that CASPs can carry out with the authorization of the CMB are as follows:

• • Receiving and executing orders related to crypto assets, their exchange, transfer of crypto assets, and the custody services required for these activities,
  • Facilitating the initial sale or distribution of crypto assets,
  • Storage, management of crypto assets or their private keys, or other custody services as determined by the CMB,
  • Providing investment advisory services related to crypto assets,
  • Engaging in other services and activities as determined by the CMB.

Furthermore, it is stated that in order to perform each of the services and activities regulated under the Communiqué No. III-35/B.2, as a regular pursuit, commercial, or professional activity, obtaining authorization from the CMB is mandatory.

• Principles Regarding Platform Activities: The principles that platforms must comply with when conducting their activities have been regulated under the Communiqué No. III-35/B.2. Furthermore, detailed regulations have been introduced regarding the creation of a trading environment by platforms, price monitoring systems, leveraged, credit, and derivative transactions, investment advisory and portfolio management services for crypto assets, facilitation of initial sales or distributions by platforms, custody of clients’ crypto assets on the platform, order and transfer execution policies, operational principles, and the reporting of special market events.
• Listing Principles: The establishment of a listing committee has been stipulated, and the principles regarding crypto assets that can be listed on the platform have been determined. Additionally, the principles governing the procedures for listing and delisting on the platform have been regulated in detail under the Communiqué No. III-35/B.2.
• Custody Services and Transfer Principles: The principles governing crypto asset custody services, the entities that may provide custody services, regulations governing custody, special provisions regarding key access and wallet technologies, as well as the execution principles of transfer orders have been regulated in detail under the Communiqué No. III-35/B.2. Additionally, it is stipulated that the platforms and custody institutions must execute a service agreement.
• CSD Integration: Under the Communiqué No. III-35/B.2, it is stipulated that platforms and custody institutions must integrate with the CSD’s system regarding client crypto asset balance information maintained in the institution’s dematerialized system and must submit the reports requested by the CSD.
• Share Capital: Platforms must have an initial share capital of at least TRY 150.000.000, while custody institutions must have an initial share capital of at least TRY 500.000.000. Furthermore, detailed regulations regarding the capital requirements of CASPs and the related calculations have been introduced under the Communiqué No. III-35/B.2.
• Equity: The equity of CASPs must not be less than the initial share capital specified under the Communiqué No. III-35/B.2. For custody institutions, if the total amount of client assets they hold in custody is up to TRY 1.000.000.000, no additional equity is required. However, if the total amount of client assets exceeds TRY 1.000.000.000, the custody institution must maintain equity equivalent to 1.5% of the excess amount in addition to its initial share capital. If the equity amount is TRY 1.500.000.000, no additional equity is required.
• Transitional Provisions: The transitional provisions for CASPs to comply with the Communiqué No. III-35/B.2 are summarized as follows:

a. Among those that have submitted establishment applications under the CMB’s principal decision i-SPK.35.B (dated 8 August 2024, no. 42/1259), those listed in the “List of Operating Entities” as of 13 March 2025 and platforms that have submitted their applications before 13 March 2025 must ensure that their custody infrastructure complies with the custody related regulations by 30 June 2025.

b. The entities referred to in paragraph (a) above must comply with the share capital and equity requirements outlined under the headings “Share Capital” and “Equity” at the time they apply to the CMB for an operating license. Furthermore, they must ensure compliance with other provisions of the capital adequacy section of the Communiqué No. III-35/B.2 no later than 30 June 2025.

c. While certain provisions of the Communiqué No. III-35/B.2 entered into force on 13 March 2025, a transition period has been introduced for CASPs, with some provisions set to take effect on 30 June 2025.

The full text of the Communiqué No. III-35/B.1 can be reached via this link and the full text of the Communiqué No. III-35/B.2 can be reached via this link (Only available in Turkish).