Turkey Law No. 7518 Amending the Capital Markets Law

Turkey Law No. 7518 Amending the Capital Markets Law is Turkey’s core statutory amendment for crypto assets and crypto asset service providers. The Turkish Grand National Assembly adopted the law on June 26, 2024, and it entered into force when published in the Official Gazette on July 2, 2024. The law amends Capital Markets Law No. 6362 and places crypto asset platforms, custody providers and other crypto asset service providers under the rulemaking, authorization and supervisory authority of the Capital Markets Board of Türkiye, commonly referred to as CMB or SPK.

Scope of Turkey’s crypto asset amendment

Law No. 7518 adds statutory definitions for wallets, crypto assets, crypto asset service providers, crypto asset custody services, platforms and TÜBİTAK. The framework defines a crypto asset broadly as an intangible asset created and stored electronically using distributed ledger technology or similar technology, distributed over digital networks and capable of expressing value or rights.

The law’s service-provider perimeter is platform-centered. A platform includes entities where crypto asset trading, initial sale or distribution, exchange, transfer, related custody or other designated activities are carried out. A crypto asset service provider includes platforms, crypto asset custody providers and other entities that may be designated under CMB/SPK rules, including services connected to initial sale or distribution.

Key provisions for crypto asset service providers

The law requires CMB/SPK authorization before a crypto asset service provider can be established or begin operating. CMB/SPK is authorized to set rules on establishment, operating permissions, shareholders, managers, personnel, organization, capital, capital adequacy, obligations, information systems, technology infrastructure, share transfers, permissible activities and temporary or permanent suspension.

• Technology and controls: Providers must maintain arrangements, measures, internal control units and systems for secure system management. Authorization can depend on compliance with TÜBİTAK criteria for information systems and technological infrastructure.
• Customer contracts and complaints: Customer agreements may be formed in writing or through CMB/SPK-approved electronic or remote methods. Contract clauses that remove or limit provider responsibility toward customers are invalid, and platforms must maintain internal mechanisms to resolve customer objections and complaints.
• AML identity and transfer data: Providers must identify customers under Law No. 5549 and related AML legislation. Transfer records must be secure, accessible and traceable, with sender and recipient data transmitted under CMB/SPK and MASAK rules.
• Listing and market integrity: Platforms must maintain written listing procedures and set order and transaction rules designed to support reliable, transparent, fair and stable trading.

Custody, segregation and customer-asset treatment

The law states that customers’ crypto assets should principally be kept in customers’ own wallets. If customers do not keep assets in their own wallets, custody must be provided by authorized banks approved by the Banking Regulation and Supervision Board or other CMB/SPK-authorized custody institutions, and customer cash must be held at banks.

Customer cash and crypto assets are separate from the provider’s own assets. The law provides that customer assets held by a crypto asset service provider cannot be seized, pledged, included in bankruptcy estate assets or subjected to provisional measures because of the provider’s debts, and the provider’s assets cannot be reached for customer debts. Crypto assets and related cash held at banks are not covered by Turkey’s deposit and participation-fund insurance rules.

Enforcement, transition and implementation status

Law No. 7518 creates enforcement tools for unlawful or unauthorized crypto asset service provider activity, including content removal and access blocking for unauthorized internet activity. Offshore platforms that target Turkey residents can be treated as engaging in unauthorized activity, including where they open a Turkish workplace, operate a Turkish-language website or conduct direct or indirect marketing toward residents in Turkey.

The law also adds criminal offences for unauthorized crypto asset service provider activity and for embezzlement involving crypto asset service providers. Existing providers were given a one-month declaration window from the July 2, 2024 effective date, while offshore providers targeting Turkey residents and Turkish crypto ATMs were given three months to wind down covered activity. CMB/SPK later issued secondary communiqués for establishment, operation, activities and capital adequacy. As of June 5, 2026, the law is in force, with certain CMB/SPK transition timing still subject to implementation adjustments.