How to Set Up a Cryptocurrency Trading Company - SPK Regulations Guide 2025

Setting up a cryptocurrency trading company in Turkey is a process regulated by Law No. 7518 "Amending the Capital Markets Law", which came into effect on July 2, 2024. This guide will examine in detail all legal requirements and processes for establishing a crypto asset service provider company.

🏛️ Legal Framework: Law No. 7518

SPK Regulation

Law No. 7518, published on July 2, 2024, has established a clear legal framework for crypto asset service providers. According to this regulation:

• ✅ Crypto asset service providers are subject to SPK supervision
• ✅ Licensing requirement has been introduced
• ✅ Capital adequacy conditions have been determined
• ✅ Customer protection measures have been defined

Scope of the Law

Law No. 7518 allows crypto asset service providers to conduct the following activities:

1. Crypto Asset Trading Platform Operations

   • Spot trading (instant buy/sell)
   • P2P (peer-to-peer) transactions
   • OTC (over-the-counter) transactions

2. Crypto Asset Custody Service

   • Hot wallet management
   • Cold wallet storage
   • Multi-signature systems

3. Crypto Asset Transfer Service

   • Crypto asset transfers
   • Wallet management
   • Blockchain transactions

📋 Company Establishment Requirements

1. Company Type Requirement

According to Law No. 7518:

• ✅ Must be established as a Joint Stock Company (A.Ş.)
• ❌ Limited company (Ltd. Şti.) is not accepted
• ❌ Collective or commandite companies are not accepted

Reasoning: Joint stock company structure is preferred due to high capital requirements and corporate governance standards.

2. Capital Requirements

Minimum Paid-in Capital:

• [fiyat bilgisi kaldırıldı] (Fifty Million Turkish Liras) paid-in capital requirement
• The entire capital must be in cash
• In-kind capital is not accepted
• All shares must be registered

Capital Adequacy:

SPK may impose additional capital adequacy requirements for operating license. These conditions:

• May vary based on transaction volume
• Depend on risk management requirements
• Must be sufficient to protect customer assets

3. Company Name

Required Phrase:

The company name must include the phrase "crypto asset trading platform".

Example Names:

• "ABC Crypto Asset Trading Platform Inc."
• "XYZ Crypto Asset Services Inc."

4. Share Structure

Share Characteristics:

• ✅ Must be registered (cannot be publicly traded)
• ✅ Must be issued in cash
• ❌ In-kind capital is not accepted
• ❌ Cannot be publicly offered

📝 Licensing Processes

1. Establishment Permit

Application to SPK:

To establish a crypto asset service provider company, an establishment permit must first be obtained from SPK.

Application Documents:

1. Draft Articles of Association

   • Name including "crypto asset trading platform" phrase
   • Capital structure (50 million TL)
   • Share structure (registered, cash)
   • Business activities exclusively limited to SPK-authorized activities

2. Business Plan and Feasibility Report

   • Market analysis
   • Competition analysis
   • Revenue projections
   • Risk analysis

3. Technical Infrastructure Report

   • Software architecture
   • Security measures
   • System capacity
   • Backup and disaster recovery plans

4. Risk Management System

   • Risk management policies
   • Internal control system
   • Compliance procedures
   • Audit mechanisms

5. Board of Directors Information

   • CVs of board members
   • Suitability documents
   • Experience and competency evidence

6. Capital Proof

   • Bank deposit certificate
   • Capital commitment documents
   • Financial status report

2. Operating Permit

After obtaining the establishment permit, a separate application must be made for the operating permit.

Operating Permit Requirements:

1. Information Systems Infrastructure

   • System tests completed
   • Security tests performed
   • Performance tests passed
   • MKK (Central Registry Agency) technical integration tests completed
   • Compliance with Tebliğ VII-128.10 (Information Systems Management)
   • Compliance with TÜBİTAK Infrastructure Criteria

2. Customer Asset Protection

   • Cold wallet infrastructure (%95+)
   • Multi-signature systems
   • Insurance coverage
   • Segregation system
   • Contract with SPK-authorized custody institution
   • Bank account for customer cash

3. KYC/AML Systems

   • Customer identification (KYC) system
   • Anti-money laundering (AML) system
   • Suspicious transaction reporting system
   • Risk assessment models

4. Personnel Adequacy (SPK Tebliğ III-35/B.1 Articles 13-14):

   • General Manager: At least 7 years of professional experience in financial markets, information systems, information technology, or financial technology
   • General Manager: Must be resident in Turkey, full-time, exclusively employed for this position
   • Personnel: Minimum 4-year bachelor's degree (associate degree sufficient for operations personnel)
   • Compliance officer
   • Risk management specialist
   • Information security officer
   • Internal auditor
   • Internal control personnel
   • Technical team

⚖️ Legal Obligations

1. MASAK Notification

Under Law No. 5549:

Crypto asset service providers are considered obligated parties under the Law on Prevention of Laundering Proceeds of Crime.

Obligations:

• ✅ Notification to MASAK (mandatory from May 1, 2025)
• ✅ Suspicious transaction reporting
• ✅ Customer identification (KYC) procedures
• ✅ Record keeping (minimum 5 years)
• ✅ Compliance officer appointment

2. KVKK Compliance

Personal Data Protection Law:

• ✅ Information obligation must be fulfilled
• ✅ Explicit consent must be obtained (where necessary)
• ✅ Data security measures must be taken
• ✅ Data processing records must be kept
• ✅ Data controller notification must be made

3. Tax Obligations

Corporate Tax:

Company income:

• ✅ Corporate tax applies at 25%
• ✅ Withholding tax return must be filed
• ✅ Annual return must be filed

VAT:

• ✅ VAT applies to commission income (18%)

🔒 Security and Compliance Requirements

1. Cybersecurity

Required Measures:

• ✅ ISO 27001 certificate (recommended)
• ✅ Penetration tests (at least 2 times per year)
• ✅ Security audits (regular)
• ✅ Cybersecurity insurance (recommended)

2. Customer Asset Protection

Cold Wallet:

• ✅ 95%+ of funds must be stored in cold wallets
• ✅ Multi-signature system must be used
• ✅ Geographic distribution (different locations)
• ✅ Physical security measures

Hot Wallet:

• ✅ Minimum balance for daily transactions
• ✅ Automatic backup system
• ✅ Real-time monitoring and alarm system

3. Insurance

Recommended Insurance Types:

• ✅ Cybersecurity insurance
• ✅ Errors and omissions insurance
• ✅ Customer asset insurance
• ✅ Professional liability insurance

📊 Process Steps

Step 1: Preparation (1-2 months)

1. Market Research

   • Competition analysis
   • Target audience identification
   • Business model development

2. Legal Consultation

   • SPK regulation review
   • Company structure determination
   • Contract preparations

3. Technical Preparation

   • Software selection
   • Infrastructure planning
   • Security standards

Step 2: Company Establishment (2-4 weeks)

1. Notary Procedures

   • Articles of association preparation
   • Signature declarations
   • Capital commitment documents

2. Trade Registry Registration

   • MERSİS registration
   • Trade registry registration
   • Tax office registration

3. Banking Procedures

   • Company account opening
   • Capital deposit
   • Bank deposit certificate

Step 3: SPK Application (3-6 months)

1. Establishment Permit Application

   • Document preparation
   • Application to SPK
   • Review process
   • Permit decision

2. Technical Infrastructure Setup

   • Software installation
   • Security tests
   • System tests

3. Operating Permit Application

   • System tests completion
   • Application to SPK
   • Audit process
   • Permit decision

Step 4: Compliance Systems (1-2 months)

1. MASAK Notification

   • Online notification
   • System setup
   • Personnel training

2. KVKK Compliance

   • Data controller notification
   • Information texts
   • Security measures

3. Other Permits

   • ISO certificates
   • Insurance policies
   • Security certificates

Step 5: Launch (1-2 months)

1. Beta Testing

   • Limited user testing
   • System optimization
   • Security tests

2. Go Live

   • System activation
   • User onboarding
   • Monitoring and optimization

⚠️ Important Considerations

❌ Prohibited Practices

• ❌ Use of crypto assets as payment instrument
• ❌ Unlicensed operations
• ❌ Mixing customer assets
• ❌ Public offering (shares must be registered)

✅ Legal Practices

• ✅ Crypto asset trading platform operations
• ✅ Custody service (custody) provision
• ✅ Portfolio management services
• ✅ Consulting services
• ✅ Education and content production

🎯 Recommendations for Success

1. Get Professional Support

• ✅ Legal consultation (SPK regulation expert)
• ✅ Accounting consultation (tax and accounting)
• ✅ Technical consultation (software and security)
• ✅ Compliance consultation (MASAK, KVKK)

2. Allocate Sufficient Capital

• ✅ 50 million TL minimum capital
• ✅ Additional capital (for working capital)
• ✅ Reserve fund (for unexpected expenses)

3. Prioritize Security

• ✅ Cybersecurity measures
• ✅ Cold wallet infrastructure
• ✅ Regular audits
• ✅ Insurance coverage

4. Ensure Continuous Compliance

• ✅ Regulation monitoring (SPK, MASAK, KVKK)
• ✅ Regular training
• ✅ Internal audits
• ✅ External audits

📞 Professional Support

Get professional support for setting up a cryptocurrency trading company:

✅ Legal consultation (SPK regulations)
✅ Company establishment (notary, trade registry)
✅ Licensing processes (SPK applications)
✅ Compliance systems (MASAK, KVKK)
✅ Technical infrastructure (software, security)

Contact:

• 📧 iletisim@cesayazilim.com
• 📞 +90 850 225 53 34
• 💬 WhatsApp: Crypto Company Setup

Note: This guide is provided free of charge for informational purposes only. No fees are required to access this content.## Conclusion

Setting up a cryptocurrency trading company in Turkey is a comprehensive process regulated by Law No. 7518. To succeed:

1. ✅ Sufficient capital (50 million TL)
2. ✅ Joint stock company structure
3. ✅ SPK license (establishment + operating permit)
4. ✅ MASAK notification
5. ✅ KVKK compliance
6. ✅ Strong security infrastructure
7. ✅ Professional team

Follow current regulations and get professional support. We are with you! 🚀