Crypto Law - 2025 Regulation Updates and SPK Regulations
Turkey's crypto sector has been brought into a legal framework with Law No. 7518 "Law on Amending the Capital Markets Law" which came into effect on July 2, 2024. In this guide, we will examine in detail the crypto law, SPK regulations and 2025 regulation updates.
🏛️ Law No. 7518
Scope of the Law
Law No. 7518, which came into effect on July 2, 2024, has created the legal framework for crypto assets.
Purpose of the Law:
- ✅ To regulate crypto asset service providers
- ✅ To bring customer protection measures
- ✅ To ensure financial stability
- ✅ To combat money laundering and terrorism financing
Basic Regulations
1. Crypto Asset Definition
The law defines crypto asset as:
"Crypto asset refers to assets that are created virtually using distributed ledger technology or similar technology, shared in electronic environment and stored digitally, can be transferred digitally regardless of whether they have a counterpart, can be used as a payment instrument or can be evaluated as an investment instrument."
2. Crypto Asset Service Provider Definition
Crypto asset service provider refers to persons or organizations that carry out the following activities:
- ✅ Crypto asset trading platform operation
- ✅ Crypto asset custody service
- ✅ Crypto asset transfer service
- ✅ Other services determined by SPK
3. License Requirement
- ✅ Crypto asset service providers must obtain license from SPK
- ✅ Establishment permit and operation permit must be obtained separately
- ✅ Unlicensed operation is prohibited
📋 SPK Regulations
1. Company Structure Requirements
Joint Stock Company Requirement:
- ✅ Crypto asset service providers must be established as joint stock company (A.Ş.)
- ❌ Limited company (Ltd. Şti.) is not accepted
- ❌ Other company types are not accepted
Capital Requirements:
- ✅ Minimum [fiyat bilgisi kaldırıldı] paid-up capital requirement
- ✅ Capital must be entirely in cash
- ❌ In-kind capital is not accepted
- ✅ All shares must be registered shares
Company Title:
- ✅ Title must include "crypto asset trading platform" phrase
2. Licensing Processes
Establishment Permit:
-
Application Documents:
- Draft company articles of association
- Business plan and feasibility report
- Technical infrastructure report
- Risk management system
- Board of directors information
- Capital proof
-
Review Process:
- SPK review (3-6 months)
- Remedying deficiencies
- Permit decision
Operation Permit:
-
Requirements:
- Information systems infrastructure
- Customer asset protection
- KYC/AML systems
- Personnel competency
-
Application Process:
- Completion of system tests
- Application to SPK
- Audit process
- Permit decision
3. Customer Protection Measures
Segregation:
- ✅ Customer assets must be kept separate from company assets
- ✅ Must be stored in separate wallets
- ✅ Independent accounting records must be kept
Security Standards:
- ✅ Cold wallet infrastructure (95%+)
- ✅ Multi-signature systems
- ✅ Physical security measures
- ✅ Insurance coverage
Information Obligations:
- ✅ Risk warnings
- ✅ Service terms
- ✅ Fee schedule
- ✅ Complaint application channels
🔒 MASAK Regulations
Under Law No. 5549
Obligations:
Crypto asset service providers are considered obligated parties under the Law on Prevention of Laundering of Proceeds of Crime.
1. MASAK Notification:
- ✅ Crypto exchanges will notify MASAK from May 1, 2025
- ✅ Notification will be made online
- ✅ Notification will be continuously updated
2. Suspicious Transaction Reporting:
- ✅ Suspicious transactions must be reported to MASAK within 24 hours
- ✅ Reporting will be made online through the system
- ✅ Reporting will be made in confidentiality
3. Customer Identification (KYC):
- ✅ Identity verification is mandatory
- ✅ Address verification is required
- ✅ Source of income declaration (for certain limits)
- ✅ Continuous monitoring must be performed
4. Record Keeping:
- ✅ Transaction records must be kept for at least 5 years
- ✅ Customer information must be securely stored
- ✅ KVKK compliance must be ensured
📊 KVKK Regulations
Personal Data Protection
Law No. 6698:
Crypto asset service providers are considered data controllers under the Personal Data Protection Law.
Obligations:
-
Information Obligation:
- What data is collected?
- Why is data collected?
- Who is data shared with?
- Data retention periods
- Rights (access, correction, deletion)
-
Explicit Consent:
- Explicit consent for cookies
- Explicit consent for newsletter
- Explicit consent for marketing
-
Data Security:
- Technical measures
- Administrative measures
- Security breach notification
-
Data Controller Notification:
- Notification to KVKK (if required)
- Data processing records
💰 Tax Regulations
Current Status
As of 2025:
There is no clear regulation regarding taxation of gains from crypto assets. However:
Corporate Tax:
- ✅ 25% corporate tax applies to company revenues
- ✅ Commission revenues are subject to tax
- ✅ Annual return must be filed
VAT:
- ✅ 18% VAT applies to commission revenues
- ✅ Withholding tax return must be filed
Income Tax:
- ⚠️ No clear regulation yet for individual users
- ⚠️ Regulation expected in the future
Expected Regulations
2025-2026 Forecasts:
- 📋 Income tax regulation for crypto asset gains
- 📋 Withholding tax application
- 📋 Return requirement
⚠️ Prohibited Practices
1. Use as Payment Instrument
Central Bank Regulation (2021):
- ❌ Use of crypto assets as payment instrument is prohibited
- ❌ Goods/services sales with crypto currency is prohibited
- ✅ Investment and trading are free
2. Unlicensed Operation
Law No. 7518:
- ❌ Unlicensed crypto asset service provision is prohibited
- ❌ Unlicensed operation includes criminal sanctions
- ❌ Operation can be suspended
3. Mixing Customer Assets
Segregation Rule:
- ❌ Customer assets cannot be mixed with company assets
- ❌ Customer assets cannot be used in company transactions
- ❌ Violation includes criminal sanctions
📈 2025 Regulation Updates
Expected Developments
1. SPK License Processes:
- 📋 Issuance of first licenses expected
- 📋 Clarification of license conditions
- 📋 Transition period applications
2. Tax Regulations:
- 📋 Income tax for crypto asset gains
- 📋 Return requirement
- 📋 Withholding tax application
3. MASAK Applications:
- 📋 May 1, 2025 notification requirement
- 📋 Suspicious transaction reporting systems
- 📋 Audit processes
4. International Compliance:
- 📋 Compliance with FATF standards
- 📋 Compliance with EU regulations (MiCA)
- 📋 Double taxation agreements
🎯 Compliance Recommendations
1. Proactive Approach
- ✅ Regulation tracking (SPK, MASAK, KVKK)
- ✅ Regular training
- ✅ Internal audits
- ✅ External consultancy
2. Documentation
- ✅ Business processes documentation
- ✅ Compliance reports
- ✅ Audit records
- ✅ Training records
3. Technical Infrastructure
- ✅ KYC/AML systems
- ✅ Security systems
- ✅ Reporting systems
- ✅ Monitoring systems
📞 Professional Support
Get professional support on crypto law and regulations:
✅ Legal consultancy (SPK regulations)
✅ Compliance consultancy (MASAK, KVKK)
✅ Tax consultancy
✅ Technical infrastructure (KYC/AML systems)
Contact:
- 📧 iletisim@cesayazilim.com
- 📞 +90 850 225 53 34
- 💬 WhatsApp: Regulation Consultancy
Conclusion
Crypto law in Turkey has been brought into a legal framework with Law No. 7518. Important points:
- ✅ SPK license requirement (establishment + operation permit)
- ✅ 50 million TL capital requirement
- ✅ MASAK notification (from May 1, 2025)
- ✅ KVKK compliance mandatory
- ✅ Customer protection measures
- ✅ Segregation mandatory
Follow current regulations and get professional support. We are with you! 🚀
Frequently Asked Questions
What is Law No. 7518 and when did it come into effect?
Law No. 7518 "Law on Amending the Capital Markets Law" came into effect on July 2, 2024. This law regulates crypto asset service providers in Turkey, requiring SPK (Capital Markets Board) licenses, capital adequacy, and compliance with regulatory requirements.
What does Law No. 7518 require for crypto companies?
Law No. 7518 requires crypto asset service providers to obtain SPK licenses (establishment + operation permit), maintain minimum 50 million TL capital, complete MASAK notification, comply with KVKK (data protection), implement customer protection measures, and maintain segregation of customer assets.
What is the SPK license requirement?
SPK license is mandatory for crypto asset service providers under Law No. 7518. Companies must obtain both establishment permit and operation permit from the Capital Markets Board. The license process involves meeting capital requirements, security standards, and compliance obligations.
What is MASAK notification and when is it required?
MASAK (Financial Intelligence Unit) notification is mandatory for crypto companies from May 1, 2025. Companies must implement AML/CFT (anti-money laundering and combating financing of terrorism) systems, report suspicious transactions, and maintain transaction records as required by law.
What is the minimum capital requirement under Law No. 7518?
The minimum capital requirement is 50 million Turkish Lira (TL) for crypto asset service providers. This capital must be fully paid and maintained throughout operations. Additional capital may be required based on business volume and risk profile.
What happens if a crypto company doesn't comply with Law No. 7518?
Non-compliance can result in license revocation, fines, legal penalties, business closure, and criminal liability for executives. SPK has authority to suspend operations, impose fines, and take legal action. Companies operating without licenses face severe penalties.
Can foreign companies operate crypto services in Turkey?
Foreign companies can operate in Turkey but must comply with Law No. 7518, obtain SPK licenses, meet capital requirements, and comply with all regulatory obligations. Foreign ownership restrictions may apply. Professional legal consultation is essential for foreign companies.
What is customer asset segregation under Law No. 7518?
Customer asset segregation requires crypto companies to keep customer assets separate from company assets. This protects customer funds in case of company insolvency or bankruptcy. Segregation is mandatory and must be maintained at all times.
What are the reporting requirements for crypto companies?
Crypto companies must report to SPK regularly, maintain transaction records, report suspicious activities to MASAK, comply with KVKK data protection requirements, and provide customer information as required by law. Reporting frequency and content depend on business type and volume.
How do I ensure compliance with crypto law in Turkey?
To ensure compliance, obtain SPK license, complete MASAK notification, maintain required capital, implement security measures, establish KYC/AML systems, comply with KVKK, maintain customer asset segregation, and get regular legal and compliance audits. Professional support is recommended.
