Crypto Exchange Licensing in Turkey: 2026 Rules, Costs & Restrictions

Trying to launch a cryptocurrency exchange in Turkey without a license is no longer just risky-it’s impossible. The regulatory landscape shifted dramatically in early 2025 when the Turkish government moved from vague warnings to a hard-coded legal framework. If you are looking at the Turkish market now, you need to understand that this is not a "wild west" environment anymore. It is a highly regulated financial sector with strict capital requirements, intense anti-money laundering (AML) checks, and zero tolerance for unlicensed operations.

The Central Bank of Turkey (TCMB) has long prohibited using cryptocurrencies as a means of payment. However, trading them as an asset class is legal, provided you go through authorized channels. This distinction is crucial. You cannot build a platform that allows users to buy coffee with Bitcoin, but you can build an exchange where they trade Bitcoin for Ethereum or Turkish Lira-if you have the proper paperwork. The stakes are high. In July 2025 alone, authorities blocked 46 unlicensed exchanges, including major decentralized platforms like PancakeSwap. If you want to operate here, you need to play by the Capital Markets Board's (CMB) rules.

The Regulatory Foundation: Communiqués I and II

To navigate this space, you first need to understand the two pillars of Turkish crypto regulation. These were published in the Official Gazette on March 13, 2025. They transformed how Crypto Asset Service Providers (CASPs) must operate.

Communiqué I (III-35/B.1) defines the founding and operational principles. It sets the stage for who can own these companies, what their corporate structure must look like, and the basic ethical and legal standards they must meet. Think of this as the "who you are" document.

Communiqué II (III-35/B.2) gets into the nitty-gritty of daily operations. It details capital adequacy, technical infrastructure, risk management, and compliance procedures. This is the "how you work" document. Together, these communiqués create a framework that many experts compare to the European Union’s MiCA (Markets in Crypto-Assets) regulation, though Turkey’s approach is often stricter regarding capital thresholds and foreign participation.

The primary authority overseeing this process is the Capital Markets Board (CMB). The CMB is the regulatory body responsible for licensing and supervising crypto asset service providers in Turkey.. Unlike some jurisdictions where multiple agencies share the burden, the CMB is the main gatekeeper. However, they do not work in isolation. They coordinate closely with the Financial Crimes Investigation Board (MASAK) for AML/KYC enforcement.

Capital Requirements: How Much Money Do You Need?

One of the biggest hurdles for new entrants is the minimum paid-in capital. Turkey wants serious players only. The regulations require exchanges to be established as joint-stock companies with shares issued in cash and registered by name. No anonymous ownership structures allowed.

*USD values are approximate based on mid-2026 exchange rates and fluctuate with inflation.

If you are planning to offer custodial services-holding user assets on behalf of clients-you need significantly more capital. The 500 million TL requirement reflects the higher risk associated with custody. For comparison, this is lower than the UK or Singapore, which often demand tens of millions in equity, but it is much higher than many emerging markets. This middle-ground approach filters out hobbyists while remaining accessible to well-funded fintech startups.

Note that this capital must be fully paid in before the application is even considered. You cannot pledge future earnings or assets. It must be liquid cash deposited into a Turkish bank account under the company’s name.

Ongoing Costs: Fees and Operational Burdens

Getting the license is just the start. The ongoing costs in Turkey are structured to ensure continuous compliance and contribution to the national research ecosystem. There are no simple "annual renewal fees" listed as a flat rate. Instead, the cost is tied to your revenue.

Licensed platforms must pay an annual fee of 1% of their total income (excluding interest income) to the Capital Markets Board (CMB). Additionally, they must pay another 1% of total income to the Scientific and Technological Research Council of Türkiye (TUBITAK). This brings the total regulatory fee burden to 2% of gross revenue.

This model aligns the regulator’s interests with your success-if you grow, they get a cut. However, it also means that during low-volume periods, your fixed overhead remains high relative to your income. You need to factor this into your financial projections. Beyond these direct fees, you face significant indirect costs:

• Risk Management Teams: You must hire dedicated staff to monitor transactions in real-time.
• Technology Infrastructure: Mandatory investment in systems that track suspicious activity, including canceled and unexecuted orders.
• Audit Fees: Regular external audits to verify compliance with CMB and MASAK standards.
• Legal Counsel: Navigating Turkish corporate law requires local expertise, often costing $10,000-$20,000 per month for specialized firms.

AML/KYC Compliance: The MASAK Factor

In Turkey, Anti-Money Laundering (AML) and Know-Your-Customer (KYC) rules are not suggestions-they are enforced with severe penalties. The Financial Crimes Investigation Board (MASAK. MASAK is Turkey’s financial intelligence unit responsible for combating money laundering and terrorist financing.) holds immense power. They can freeze crypto and bank accounts linked to suspicious activity without prior court approval.

For an exchange operator, this creates a massive compliance risk. If one of your users is involved in illicit activity, MASAK can freeze your entire platform’s assets if they suspect complicity or negligence. To mitigate this, you must implement:

1. Mandatory Identity Verification: All transactions exceeding 15,000 TRY (approx. $425 USD) require full KYC checks. This includes government-issued ID, proof of address, and source of funds documentation.
2. Real-Time Monitoring: Your system must flag unusual patterns instantly. This isn’t just about large transfers; it’s about structuring, rapid in/out movements, and connections to known darknet addresses.
3. Transaction Recording: You must keep detailed records of all transactions, including those that were canceled or never executed. This data must be available for audit upon request.
4. Fit-and-Proper Tests: Founders, board members, and key executives undergo background checks. Any history of financial crime or regulatory breaches will disqualify the applicant.

The threshold of 15,000 TRY is relatively low compared to global standards (where $1,000-$3,000 is common for enhanced due diligence). This means your KYC process must be efficient and user-friendly, or you will lose customers to peer-to-peer (P2P) markets, which are harder to regulate but still carry risks.

Foreign Participation and Market Access

If you are an international company looking to enter Turkey, you need to be aware of the restrictions on foreign participation. Turkey’s framework is notably protective of its domestic financial sovereignty. Non-resident CASPs face significant barriers.

You cannot simply set up a website and target Turkish users from abroad. Active marketing within Turkish territory is restricted for non-licensed entities. To operate legally, you generally need to establish a local entity-a Turkish joint-stock company. This means registering with the Turkish Trade Registry, obtaining a Tax Identification Number (TIN), and opening local bank accounts.

This contrasts sharply with jurisdictions like Malta or Estonia, which allow remote licensing with minimal physical presence. Turkey’s approach is closer to China’s strict control model, albeit with a legal pathway for compliant businesses. The goal is clear: prevent capital flight and maintain monetary policy control. With high inflation rates historically driving citizens toward crypto, the government sees unregulated exchanges as a threat to the stability of the Turkish Lira.

However, once licensed, foreign-owned companies can operate freely. Many successful exchanges in Turkey are backed by international investors, provided they adhere to the local corporate structure. Legal experts recommend engaging bilingual law firms specializing in fintech to navigate the translation and submission process. Misinterpretation of Turkish legal terms can lead to immediate rejection.

The Application Process: Timeline and Steps

Don’t expect a quick turnaround. The licensing process is thorough and time-consuming. Industry insiders report that comprehensive application preparation typically takes 6-12 months. Here is a realistic breakdown:

1. Corporate Restructuring (Months 1-2): Establish the joint-stock company, inject capital, and draft internal control policies. Ensure all shareholders pass integrity checks.
2. Compliance System Development (Months 3-6): Build or integrate KYC/AML software, transaction monitoring tools, and cybersecurity measures. Hire your risk management team.
3. Documentation Compilation (Months 6-8): Prepare the extensive dossier required by the CMB. This includes business plans, technical architecture diagrams, audit reports, and shareholder declarations.
4. Submission and Review (Months 9-12+): Submit the application to the CMB. Expect multiple rounds of questions and requests for clarification. The regulator may conduct on-site inspections.

The probability of success depends heavily on preparation. Well-capitalized applicants with robust compliance systems have reasonable prospects. However, there is no official statistic on rejection rates. Anecdotal evidence suggests that applications lacking clear source-of-funds documentation or weak cybersecurity plans are quickly dismissed.

Market Context and Enforcement Risks

Turkey’s crypto market is vibrant but volatile. The country has a young, tech-savvy population that adopted crypto early, largely as a hedge against inflation. Despite the ban on using crypto for payments, trading volumes remain high. Licensed exchanges benefit from reduced competition after the July 2025 crackdown, which eliminated dozens of unlicensed rivals.

However, political tensions can impact regulatory enforcement. The detention of ICRYPEX founder in July 2025 raised concerns about potential political motivations behind certain actions. While the stated reason was alleged links to funding government critics, it highlighted the risk of operating in a politically sensitive environment. Operators must remain neutral and strictly compliant to avoid scrutiny.

Looking ahead, the regulatory framework is likely to evolve. Future updates may include refinements to capital requirements, expanded definitions of service categories, and potential adjustments to foreign operator restrictions. The long-term viability of your license depends on balancing regulatory compliance with market innovation. Keep close watch on announcements from the CMB and TCMB, as changes can happen rapidly.

Next Steps for Prospective Licensees

If you are serious about entering the Turkish market, start with a feasibility study. Calculate your total cost of entry, including the 150 million TL capital, legal fees, technology stack, and ongoing 2% revenue share. Engage a local legal partner immediately to assess your corporate structure. Do not attempt to file the application yourself. The complexity of Turkish regulatory language and the severity of non-compliance penalties make professional guidance essential. Finally, prioritize building a world-class AML/KYC system from day one. In Turkey, compliance is not just a checkbox-it is your primary defense against operational shutdown.