Cesa Yazılım
TR EN DE

AMP • EN

Crypto Law - 2025 Regulation Updates and SPK Regulations

Crypto law in Turkey, Law No. 7518, SPK regulations, MASAK notifications and 2025 regulation updates. Legal framework for crypto asset service providers.

Crypto Law - 2025 Regulation Updates and SPK Regulations

Turkey's crypto sector has been brought into a legal framework with Law No. 7518 "Law on Amending the Capital Markets Law" which came into effect on July 2, 2024. In this guide, we will examine in detail the crypto law, SPK regulations and 2025 regulation updates.

🏛️ Law No. 7518

Scope of the Law

Law No. 7518, which came into effect on July 2, 2024, has created the legal framework for crypto assets.

Purpose of the Law:

Basic Regulations

1. Crypto Asset Definition

The law defines crypto asset as:

"Crypto asset refers to assets that are created virtually using distributed ledger technology or similar technology, shared in electronic environment and stored digitally, can be transferred digitally regardless of whether they have a counterpart, can be used as a payment instrument or can be evaluated as an investment instrument."

2. Crypto Asset Service Provider Definition

Crypto asset service provider refers to persons or organizations that carry out the following activities:

3. License Requirement

📋 SPK Regulations

1. Company Structure Requirements

Joint Stock Company Requirement:

Capital Requirements:

Company Title:

2. Licensing Processes

Establishment Permit:

  1. Application Documents:

    • Draft company articles of association
    • Business plan and feasibility report
    • Technical infrastructure report
    • Risk management system
    • Board of directors information
    • Capital proof
  2. Review Process:

    • SPK review (3-6 months)
    • Remedying deficiencies
    • Permit decision

Operation Permit:

  1. Requirements:

    • Information systems infrastructure
    • Customer asset protection
    • KYC/AML systems
    • Personnel competency
  2. Application Process:

    • Completion of system tests
    • Application to SPK
    • Audit process
    • Permit decision

3. Customer Protection Measures

Segregation:

Security Standards:

Information Obligations:

🔒 MASAK Regulations

Under Law No. 5549

Obligations:

Crypto asset service providers are considered obligated parties under the Law on Prevention of Laundering of Proceeds of Crime.

1. MASAK Notification:

2. Suspicious Transaction Reporting:

3. Customer Identification (KYC):

4. Record Keeping:

📊 KVKK Regulations

Personal Data Protection

Law No. 6698:

Crypto asset service providers are considered data controllers under the Personal Data Protection Law.

Obligations:

  1. Information Obligation:

    • What data is collected?
    • Why is data collected?
    • Who is data shared with?
    • Data retention periods
    • Rights (access, correction, deletion)
  2. Explicit Consent:

    • Explicit consent for cookies
    • Explicit consent for newsletter
    • Explicit consent for marketing
  3. Data Security:

    • Technical measures
    • Administrative measures
    • Security breach notification
  4. Data Controller Notification:

    • Notification to KVKK (if required)
    • Data processing records

💰 Tax Regulations

Current Status

As of 2025:

There is no clear regulation regarding taxation of gains from crypto assets. However:

Corporate Tax:

VAT:

Income Tax:

Expected Regulations

2025-2026 Forecasts:

⚠️ Prohibited Practices

1. Use as Payment Instrument

Central Bank Regulation (2021):

2. Unlicensed Operation

Law No. 7518:

3. Mixing Customer Assets

Segregation Rule:

📈 2025 Regulation Updates

Expected Developments

1. SPK License Processes:

2. Tax Regulations:

3. MASAK Applications:

4. International Compliance:

🎯 Compliance Recommendations

1. Proactive Approach

2. Documentation

3. Technical Infrastructure

📞 Professional Support

Get professional support on crypto law and regulations:

Legal consultancy (SPK regulations)
Compliance consultancy (MASAK, KVKK)
Tax consultancy
Technical infrastructure (KYC/AML systems)

Contact:


Conclusion

Crypto law in Turkey has been brought into a legal framework with Law No. 7518. Important points:

  1. SPK license requirement (establishment + operation permit)
  2. 50 million TL capital requirement
  3. MASAK notification (from May 1, 2025)
  4. KVKK compliance mandatory
  5. Customer protection measures
  6. Segregation mandatory

Follow current regulations and get professional support. We are with you! 🚀


Frequently Asked Questions

What is Law No. 7518 and when did it come into effect?

Law No. 7518 "Law on Amending the Capital Markets Law" came into effect on July 2, 2024. This law regulates crypto asset service providers in Turkey, requiring SPK (Capital Markets Board) licenses, capital adequacy, and compliance with regulatory requirements.

What does Law No. 7518 require for crypto companies?

Law No. 7518 requires crypto asset service providers to obtain SPK licenses (establishment + operation permit), maintain minimum 50 million TL capital, complete MASAK notification, comply with KVKK (data protection), implement customer protection measures, and maintain segregation of customer assets.

What is the SPK license requirement?

SPK license is mandatory for crypto asset service providers under Law No. 7518. Companies must obtain both establishment permit and operation permit from the Capital Markets Board. The license process involves meeting capital requirements, security standards, and compliance obligations.

What is MASAK notification and when is it required?

MASAK (Financial Intelligence Unit) notification is mandatory for crypto companies from May 1, 2025. Companies must implement AML/CFT (anti-money laundering and combating financing of terrorism) systems, report suspicious transactions, and maintain transaction records as required by law.

What is the minimum capital requirement under Law No. 7518?

The minimum capital requirement is 50 million Turkish Lira (TL) for crypto asset service providers. This capital must be fully paid and maintained throughout operations. Additional capital may be required based on business volume and risk profile.

What happens if a crypto company doesn't comply with Law No. 7518?

Non-compliance can result in license revocation, fines, legal penalties, business closure, and criminal liability for executives. SPK has authority to suspend operations, impose fines, and take legal action. Companies operating without licenses face severe penalties.

Can foreign companies operate crypto services in Turkey?

Foreign companies can operate in Turkey but must comply with Law No. 7518, obtain SPK licenses, meet capital requirements, and comply with all regulatory obligations. Foreign ownership restrictions may apply. Professional legal consultation is essential for foreign companies.

What is customer asset segregation under Law No. 7518?

Customer asset segregation requires crypto companies to keep customer assets separate from company assets. This protects customer funds in case of company insolvency or bankruptcy. Segregation is mandatory and must be maintained at all times.

What are the reporting requirements for crypto companies?

Crypto companies must report to SPK regularly, maintain transaction records, report suspicious activities to MASAK, comply with KVKK data protection requirements, and provide customer information as required by law. Reporting frequency and content depend on business type and volume.

How do I ensure compliance with crypto law in Turkey?

To ensure compliance, obtain SPK license, complete MASAK notification, maintain required capital, implement security measures, establish KYC/AML systems, comply with KVKK, maintain customer asset segregation, and get regular legal and compliance audits. Professional support is recommended.

Sıkça Sorulan Sorular

What is Law No. 7518 and when did it come into effect?

Law No. 7518 "Law on Amending the Capital Markets Law" came into effect on July 2, 2024. This law regulates crypto asset service providers in Turkey, requiring SPK (Capital Markets Board) licenses, capital adequacy, and compliance with regulatory requirements.

What does Law No. 7518 require for crypto companies?

Law No. 7518 requires crypto asset service providers to obtain SPK licenses (establishment + operation permit), maintain minimum 50 million TL capital, complete MASAK notification, comply with KVKK (data protection), implement customer protection measures, and maintain segregation of customer assets.

What is the SPK license requirement?

SPK license is mandatory for crypto asset service providers under Law No. 7518. Companies must obtain both establishment permit and operation permit from the Capital Markets Board. The license process involves meeting capital requirements, security standards, and compliance obligations.

What is MASAK notification and when is it required?

MASAK (Financial Intelligence Unit) notification is mandatory for crypto companies from May 1, 2025. Companies must implement AML/CFT (anti-money laundering and combating financing of terrorism) systems, report suspicious transactions, and maintain transaction records as required by law.

What is the minimum capital requirement under Law No. 7518?

The minimum capital requirement is 50 million Turkish Lira (TL) for crypto asset service providers. This capital must be fully paid and maintained throughout operations. Additional capital may be required based on business volume and risk profile.

What happens if a crypto company doesn't comply with Law No. 7518?

Non-compliance can result in license revocation, fines, legal penalties, business closure, and criminal liability for executives. SPK has authority to suspend operations, impose fines, and take legal action. Companies operating without licenses face severe penalties.

Can foreign companies operate crypto services in Turkey?

Foreign companies can operate in Turkey but must comply with Law No. 7518, obtain SPK licenses, meet capital requirements, and comply with all regulatory obligations. Foreign ownership restrictions may apply. Professional legal consultation is essential for foreign companies.

What is customer asset segregation under Law No. 7518?

Customer asset segregation requires crypto companies to keep customer assets separate from company assets. This protects customer funds in case of company insolvency or bankruptcy. Segregation is mandatory and must be maintained at all times.

What are the reporting requirements for crypto companies?

Crypto companies must report to SPK regularly, maintain transaction records, report suspicious activities to MASAK, comply with KVKK data protection requirements, and provide customer information as required by law. Reporting frequency and content depend on business type and volume.

How do I ensure compliance with crypto law in Turkey?

To ensure compliance, obtain SPK license, complete MASAK notification, maintain required capital, implement security measures, establish KYC/AML systems, comply with KVKK, maintain customer asset segregation, and get regular legal and compliance audits. Professional support is recommended.