Cryptocurrency regulation in Türkiye operates through a multi-layered framework of capital markets, anti-money-laundering, banking, taxation, and consumer protection statutes, with the regulatory landscape transformed by Law No. 7415 of 2 July 2024 (Resmi Gazete 2.7.2024/32590) introducing comprehensive crypto asset service provider (kripto varlık hizmet sağlayıcı) licensing into the Capital Markets Law (Law No. 6362). The principal legal sources are: Capital Markets Law (Law No. 6362) of 6 December 2012 as amended by Law 7415 introducing Articles 35/B (crypto asset service provider definition and licensing), 35/C (custody requirements), 138/A (sanctions for unauthorised activity), and 138/B (asset blocking authority); Law on Prevention of Laundering Proceeds of Crime (Law No. 5549) of 11 October 2006 (Resmi Gazete 18.10.2006/26323) and MASAK General Communique No. 18 of 1 May 2021 designating crypto asset service providers as obligated parties; the TCMB Regulation on Disuse of Crypto Assets in Payments (Resmi Gazete 16.4.2021/31456, effective 30 April 2021) prohibiting crypto for payments and barring payment service provider intermediation; the Central Bank Law (Law No. 1211); the Banking Law (Law No. 5411); the Payment and Securities Settlement Systems Law (Law No. 6493); the Income Tax Law (Law No. 193, the "GVK"); the VAT Law (Law No. 3065); the Decree on Protection of Value of Turkish Currency (Decree No. 32) on foreign exchange controls; the Penal Code (Law No. 5237) provisions on cybercrime and fraud; and the Personal Data Protection Law (Law No. 6698, the "KVKK").
The current Turkish position permits ownership and trading of crypto assets while restricting their use as payment for goods and services, and increasingly subjecting service providers to comprehensive licensing and supervisory framework. Pre-Law 7415, the Capital Markets Board (Sermaye Piyasası Kurulu, "SPK") had issued only public warnings about ICOs and unregulated platforms (notably 27.9.2017 and 28.10.2017 statements), without formal regulatory framework. Law 7415 fundamentally transformed this landscape by establishing SPK as principal supervisory authority for crypto asset service providers, with detailed implementing regulations issued by SPK in 2024-2025. MASAK retains AML supervisory authority over crypto entities since 2021, and TCMB maintains the payment-side prohibition. The integrated framework requires multi-regulator engagement for crypto businesses operating in or targeting Turkish users. ER&GUN&ER Law Firm advises Turkish and foreign crypto businesses, investors, and counterparties on the integrated framework. Practice may vary by authority and year — check current guidance.
Law 7415 (2024) and Crypto Asset Service Provider Framework
Law No. 7415 of 2 July 2024 (Resmi Gazete 2.7.2024/32590) represents the most significant transformation of Turkish crypto regulation since the 2021 payment ban. The Law amended the Capital Markets Law (Law No. 6362) by introducing comprehensive crypto asset service provider licensing framework. The new Article 35/B defines crypto asset service provider (kripto varlık hizmet sağlayıcı) as platforms providing one or more of: trading services for crypto assets; initial sale or distribution of crypto assets; custody and management services for crypto assets and the relevant private keys; and other services determined by SPK. The framework brings under SPK supervision the principal commercial activities involving crypto assets in Türkiye.
Licensing requirements under Article 35/B include several substantive elements: minimum capital requirements established by SPK regulation; physical office in Türkiye with local management presence; appointment of compliance officer and AML compliance officer; cybersecurity infrastructure meeting SPK standards; segregation of customer assets from operational assets; insurance or guarantee mechanisms; periodic audit requirements; and ongoing reporting obligations. Crypto asset custody under Article 35/C requires segregated custody arrangements protecting customer assets from operational creditors of the service provider, with specific procedures for hot wallet and cold wallet management, key management protocols, and emergency response frameworks. Practice may vary by authority and year — check current guidance.
Sanctions framework under Article 138/A addresses unauthorised crypto activity with substantial penalties: administrative fines for operating without licence; criminal penalties for fraudulent schemes; closure of unauthorised platforms; and asset blocking authority under Article 138/B enabling SPK to freeze assets associated with unauthorised activity pending investigation and resolution. The transitional framework under Law 7415 addresses pre-existing platforms operating in Türkiye with specific application periods for licensing applications, ongoing operations subject to compliance commitments, and sanctions for non-compliant entities. The integration between SPK supervisory framework and MASAK AML supervisory framework creates dual regulatory engagement requirement for crypto asset service providers — both regulators have distinct authority and reporting requirements with overlapping but not identical compliance frameworks. Pre-Law 7415 grandfathering for legitimate operators following compliance pathways enables ongoing operations subject to licensing application progress.
MASAK AML Framework Under Law 5549
Anti-money-laundering framework for crypto operates under the Law on Prevention of Laundering Proceeds of Crime (Law No. 5549) of 11 October 2006 (Resmi Gazete 18.10.2006/26323) and implementing regulations. MASAK General Communique No. 18 (Mali Suçları Araştırma Kurulu Genel Tebliği Sıra No: 18) of 1 May 2021 designated crypto asset service providers as "obligated parties" (yükümlüler) under Law 5549 Article 2 — bringing crypto exchanges, custodians, and similar service providers under the comprehensive AML obligations applicable to traditional financial institutions.
Customer due diligence obligations under Law 5549 Article 3 and Implementing Regulation framework apply to crypto service providers with specific thresholds. Customer identification is required for: continuous customer relationships regardless of transaction value; occasional transactions exceeding TRY 75,000 (single transaction or linked transactions); transactions involving non-Turkish resident customers with separate identification framework; and any transaction triggering risk-based monitoring concerns regardless of value. Identification includes: government-issued ID document review; address verification; beneficial ownership identification for legal entity customers under Article 3; ongoing monitoring of customer activity against expected behaviour patterns; and enhanced due diligence for high-risk customer categories (politically exposed persons, high-risk jurisdictions, complex ownership structures). Practice may vary by authority and year — check current guidance.
Suspicious transaction reporting under Law 5549 Article 4 requires submission to MASAK within 10 business days of identifying the suspicious nature — significantly different from the 3 business days sometimes cited erroneously. The reporting framework operates through MASAK's online portal with specific report categories and required information fields. Internal AML programme requirements under Article 5 include: written AML policies and procedures; designated compliance officer with appropriate authority; ongoing employee training; independent audit function; record retention for minimum 8 years; and integrated systems supporting customer monitoring and reporting. Crypto-specific considerations include: blockchain transaction analysis to identify high-risk source addresses and counterparties; integration of commercial blockchain analytics tools with internal monitoring; specific procedures for privacy coin transactions raising AML concerns; and cross-border transaction analysis under foreign exchange controls integration. Sanctions for non-compliance under Article 13 include administrative fines (TRY 50,000 to TRY 4 million per violation, indexed annually), criminal penalties for serious violations, and reputational consequences from MASAK enforcement publicity. ER&GUN&ER Law Firm advises crypto service providers on AML programme design, MASAK communique compliance, suspicious transaction reporting procedures, and enforcement defence in MASAK investigations.
TCMB Payment Ban Under 2021 Regulation
The Türkiye Cumhuriyet Merkez Bankası (TCMB) Regulation on Disuse of Crypto Assets in Payments (Ödemelerde Kripto Varlıkların Kullanılmamasına Dair Yönetmelik) of 16 April 2021 (Resmi Gazete 31456), effective 30 April 2021, established the principal restriction on crypto use as payment in Türkiye. The Regulation derives its legal authority from Central Bank Law (Law No. 1211) Article 4 and Payment and Securities Settlement Systems Law (Law No. 6493) Article 12 framework regarding TCMB authority over payment systems and instruments.
Regulation Article 3 establishes the substantive prohibition: crypto assets cannot be used directly or indirectly as payment for goods and services. The prohibition applies to direct transactions (consumer paying merchant in crypto for purchase), indirect arrangements (crypto-fiat conversion immediately preceding fiat payment), and structured arrangements designed to circumvent the prohibition. The "indirect" extension catches arrangements where crypto serves as economic payment substance even if formal payment occurs in fiat. Regulation Article 4 prohibits payment service providers from intermediating crypto-related payment services — meaning licensed payment institutions, electronic money institutions, and similar entities cannot process payment flows involving crypto on either receiving or sending side. The combined effect substantially limits commercial crypto adoption in Turkish payment infrastructure. Practice may vary by authority and year — check current guidance.
Permitted activities outside the payment prohibition include: ownership of crypto assets as investment or store of value; trading crypto on licensed exchanges (subject to Law 7415 framework); peer-to-peer crypto transfers between individuals; crypto-fiat conversions through licensed exchanges where the conversion itself is the transaction (not payment for goods/services); and corporate treasury holdings of crypto subject to applicable accounting and tax framework. The line between permitted investment activity and prohibited payment use can blur in specific scenarios — particularly cross-border arrangements, employee compensation arrangements involving tokens, and platform models claiming "exchange" structure while functionally operating payment services. Compliance analysis typically requires structural review identifying the substance of value flows, applicable counterparties, and regulatory characterisation. Sanctions for prohibited payment use of crypto extend through TCMB enforcement against payment service providers (administrative fines, licence consequences), Banking Regulation and Supervision Agency (Bankacılık Düzenleme ve Denetleme Kurumu, "BDDK") authority over banking sector compliance, and indirect consequences through MASAK AML monitoring of suspicious payment patterns. Cross-border arrangements involving Turkish counterparties require careful structural analysis under both TCMB framework and 32 sayılı Karar foreign exchange controls.
Crypto Taxation Under GVK and Related Framework
Cryptocurrency taxation in Türkiye operates under general tax law framework rather than crypto-specific statutory regime. The Income Tax Law (Law No. 193, the "GVK") provides the principal framework with specific application varying based on the taxpayer's activity profile and the nature of crypto-related income. Several income categories may apply depending on circumstances: GVK Article 80-82 capital gains (değer artışı kazançları) potentially applicable to occasional crypto disposal by non-trader holders; GVK Article 37 commercial income (ticari kazanç) applicable to active trading constituting commercial activity in tax law sense; GVK Article 65-68 free profession income (serbest meslek kazancı) potentially applicable to specialised crypto-related professional services; and GVK general framework for diverse other crypto-related income forms.
The classification analysis requires fact-specific evaluation. Occasional trading by individual holders typically falls under capital gains framework with corresponding tax treatment. Active trading with commercial frequency, organised systematic activity, and profit-seeking commercial character typically constitutes commercial activity requiring commercial income treatment with associated bookkeeping, VAT, and similar obligations. Mining activity for profit constitutes commercial activity requiring commercial entity establishment, equipment depreciation, electricity cost deductions, and corresponding tax treatment. Staking, yield farming, DeFi participation, and similar activities require case-specific analysis with no settled statutory framework. The Turkish Revenue Administration (Gelir İdaresi Başkanlığı) has issued various guidance and rulings addressing specific scenarios but comprehensive crypto-specific tax framework has not yet been enacted as of current legal status. Practice may vary by authority and year — check current guidance.
VAT treatment under VAT Law (Law No. 3065) framework varies by transaction type. Crypto-fiat conversions are generally treated as exempt under VAT Law Article 17/4(g) financial services exemption. Service fees charged by exchanges may attract VAT depending on classification analysis. Mining equipment imports and purchases attract standard VAT subject to general business deduction rules. Token sales and ICO arrangements may attract VAT depending on substance characterisation as service supply versus financial instrument. Banking and Insurance Transactions Tax (BSMV) under Expense Taxes Law (Law No. 6802) potentially applies to certain crypto-related financial services. Foreign exchange controls under Decree on Protection of Value of Turkish Currency (Decree No. 32) and TCMB framework apply to crypto-fiat conversions involving cross-border elements with specific reporting and procedural requirements. International tax considerations for cross-border crypto arrangements include: tax residency analysis under GVK Article 4 six-months test; bilateral tax treaty application for treaty residents; permanent establishment analysis for foreign businesses targeting Turkish customers; and transfer pricing for related-party arrangements. ER&GUN&ER Law Firm coordinates Turkish crypto tax compliance with broader business structuring including entity selection, accounting framework, and integrated regulatory compliance.
Capital Markets Pre-2024 and SPK Authority
Pre-Law 7415 SPK authority over crypto operated through limited public statements rather than formal regulatory framework. The SPK statement of 27 September 2017 and follow-up of 28 October 2017 warned investors about ICOs and unregulated crypto platforms without imposing formal licensing or registration requirements. The Capital Markets Law (Law No. 6362) framework applied where specific crypto products met investment instrument definitions under Article 3 framework — for example, security tokens with rights characteristics resembling traditional securities, or investment fund structures with crypto exposure. However, the broad universe of utility tokens, payment tokens, and similar instruments operated outside formal Capital Markets Law supervision pre-Law 7415.
Token classification analysis under pre-2024 framework involved factual analysis of: voting rights or governance participation; profit participation or revenue sharing; redemption rights against issuer; underlying asset backing; trading on regulated venues; and similar securities-indicia factors. Tokens meeting securities characteristics fell under full Capital Markets Law framework with corresponding offering registration, prospectus requirements, ongoing disclosure obligations, and platform licensing. Tokens falling outside securities classification operated under more limited regulatory framework including general consumer protection (Law No. 6502, the "TKHK"), MASAK AML obligations from 2021, and TCMB payment restrictions from 2021. Practice may vary by authority and year — check current guidance.
Post-Law 7415 transformation extended SPK authority comprehensively over crypto asset service providers regardless of underlying token classification. The 2024 framework establishes specific licensing pathways with corresponding compliance obligations for platforms, custodians, and similar service providers. Tokens themselves remain subject to case-specific classification analysis — security tokens under Capital Markets Law general framework, utility tokens with limited regulatory treatment, payment tokens subject to TCMB restrictions, and similar typology. The integrated framework now requires service providers to maintain SPK licensing, MASAK AML compliance, TCMB payment restriction adherence, KVKK data protection compliance, consumer protection compliance for retail customers, and integrated tax compliance. Strategic legal planning for crypto businesses entering or operating in Turkish market involves comprehensive multi-regulator engagement, with single-regulator focus generally insufficient for sustainable operations.
Consumer Protection and Investor Rights
Consumer protection framework applies to crypto retail customer relationships under Consumer Protection Law (Law No. 6502, the "TKHK") integrated with crypto-specific frameworks. TKHK provisions applicable to crypto include: Article 4 (general fair commercial practice obligations); Article 5 (proportionality and transparency in contractual terms); Articles 7-12 (distance contracts framework applicable to online crypto platform relationships); Article 48 (financial consumer protection); Article 61 (advertising regulation); Article 62 (unfair commercial practices). Pre-contractual information requirements under TKHK for distance contracts include: clear identification of the service provider; service description; price and fee structure; right of withdrawal information (with specific limitations for crypto in volatile markets); dispute resolution and applicable law information; and customer support contact information.
Unfair contract terms (haksız şartlar) under TKHK Article 5 and Civil Code framework address one-sided contractual provisions in retail crypto platform terms of service. Common problematic provisions include: unilateral modification rights; broad exclusions of liability; arbitrary account termination authority; one-sided dispute resolution requirements; and similar imbalanced provisions. Successful unfair terms challenge results in unenforceability of the specific provisions while preserving the remainder of the agreement. Consumer disputes operate through Consumer Arbitration Committees (Tüketici Hakem Heyetleri) for smaller disputes (currently TRY 30,000-90,000 thresholds, indexed annually) and Consumer Courts (Tüketici Mahkemeleri) for larger disputes. Practice may vary by authority and year — check current guidance.
Fraud and misrepresentation in crypto contexts trigger multiple legal frameworks. Civil law remedies under Turkish Code of Obligations (Law No. 6098, the "TBK") include: Article 30 mistake (hata); Article 36 fraud (hile); Article 27 nullity for violation of mandatory rules; Article 49 tort liability. Criminal liability under Penal Code (Law No. 5237) includes: Article 158 qualified fraud (nitelikli dolandırıcılık) typically applicable to crypto Ponzi schemes and ICO fraud, with penalties ranging 3-10 years imprisonment plus judicial fines; Article 245 misuse of bank or credit cards including digital payment instruments; Articles 243-244 cybercrime provisions for unauthorised system access and data manipulation; Article 142 theft applicable to crypto theft scenarios. Criminal complaint procedure operates through public prosecutor with subsequent indictment and trial in appropriate criminal court (typically Asliye Ceza Mahkemesi or Ağır Ceza Mahkemesi depending on severity). Recovery from fraud cases combines criminal prosecution with civil compensation actions, with crypto tracing through blockchain analysis providing evidence support but cross-border recovery remaining practically challenging due to jurisdictional limitations and cross-chain laundering techniques.
Cybercrime, Theft, and Criminal Liability
Criminal liability framework for crypto-related conduct operates principally under Penal Code (Law No. 5237) cybercrime, fraud, and theft provisions. TCK Article 243 (bilişim sistemine girme — unauthorised system access) addresses unauthorised access to computer systems with imprisonment up to 1 year, with aggravations for unauthorised access with intent to obtain data (Article 243/2) or with intent to harm system (Article 243/3). TCK Article 244 (sistemi engelleme, bozma, verileri yok etme veya değiştirme) addresses system disruption, destruction, or data manipulation with imprisonment 1-5 years, with aggravations for systems serving public functions or critical infrastructure.
TCK Article 245 (banka veya kredi kartlarının kötüye kullanılması) addresses misuse of bank or credit cards extending to digital payment instruments through judicial interpretation, with imprisonment 3-6 years. TCK Article 245/A (yasak cihaz veya program kullanma) specifically addresses use of prohibited devices or programs for cybercrime including specialised hacking tools, malware, and similar instruments, with imprisonment 1-3 years. TCK Article 158 (nitelikli dolandırıcılık — qualified fraud) is the principal provision for crypto Ponzi schemes, ICO fraud, fake exchange operations, and similar large-scale crypto fraud, with imprisonment 3-10 years for the basic qualified offence and aggravations for organised crime, public servant involvement, or other qualifying circumstances. Practice may vary by authority and year — check current guidance.
Crypto theft scenarios operate principally under TCK Article 142 theft framework, with specific application addressing unauthorised crypto transfers from victim wallets through phishing, hacking, social engineering, or insider attacks. The theft characterisation requires unauthorised taking of property — applicable to crypto despite intangible character through judicial interpretation. Money laundering involving crypto operates under TCK Article 282 and Law 5549 framework with crypto's pseudonymous and cross-border characteristics creating both opportunities for laundering and challenges for enforcement. Terrorist financing involving crypto operates under Law 6415 (Prevention of Financing of Terrorism Law) with specific framework addressing crypto-related financing channels. Practical investigation challenges include: cross-border crypto flows with limited international cooperation; pseudonymous addresses without identity attribution; mixing services and privacy techniques obscuring transaction flows; and decentralised exchange structures lacking traditional record-keeping. Strategic legal management for crypto crime victims involves: prompt criminal complaint with comprehensive evidence package; civil compensation action under TBK Article 49 tort framework; international cooperation through bilateral mutual legal assistance treaties where applicable; blockchain forensic analysis with chain-of-custody documentation; and integrated recovery strategy combining criminal, civil, and regulatory pathways.
Cross-Border Considerations and Foreign Exchange
Cross-border crypto arrangements involving Turkish counterparties operate under integrated framework addressing foreign exchange controls, tax residency, regulatory jurisdiction, and contract law. The Decree on Protection of Value of Turkish Currency (Decree No. 32, the "32 sayılı Karar") establishes Turkish foreign exchange controls applicable to crypto-fiat conversions involving cross-border elements. While crypto-crypto transactions generally fall outside formal foreign exchange framework, conversions to or from Turkish lira involving foreign counterparties or foreign accounts trigger Decree No. 32 application with specific reporting requirements through authorised intermediaries (typically licensed banks and authorised foreign exchange institutions).
Tax residency analysis under GVK Article 4 framework determines individual income tax residency based on the six-months presence test (more than 6 months in Türkiye in a calendar year). Resident individuals are taxable on worldwide income including crypto income from foreign exchanges and DeFi platforms. Non-resident individuals are generally taxable only on Turkish-source income, with crypto activities through Turkish exchanges or with Turkish counterparties potentially constituting Turkish-source income depending on classification. Bilateral tax treaties (Türkiye party to over 80 such treaties) may provide treaty residency tiebreakers and allocation of taxing rights for crypto-related income, though treaty application to crypto-specific income categories often requires case-specific analysis given the limited crypto-specific treaty provisions. Practice may vary by authority and year — check current guidance.
Regulatory jurisdiction for foreign crypto platforms targeting Turkish customers involves several considerations. Foreign exchanges accepting Turkish customer registrations potentially fall under SPK jurisdiction post-Law 7415, with case-specific analysis based on targeting indicators (Turkish-language services, marketing to Turkish residents, Turkish payment integration, etc.). MASAK AML obligations potentially apply to foreign platforms with Turkish customer relationships through extraterritorial application of obligated party framework. TCMB payment restrictions apply to Turkish-side counterparties even where foreign platform is the formal counterparty. KVKK data protection obligations under Article 9 (substantially amended by Law No. 7499 of 2 March 2024) govern cross-border data flows between foreign crypto platforms and Turkish customers, requiring lawful basis analysis and appropriate cross-border transfer mechanisms. Strategic structuring for foreign crypto businesses entering Turkish market involves: direct establishment in Türkiye with full regulatory licensing; operating from foreign jurisdiction with limited Turkish customer engagement avoiding regulatory triggers; partnership structures with Turkish licensed entities serving as compliance interface; or hybrid approaches combining elements. The current trajectory increasingly favours formal Turkish establishment given enforcement intensification post-Law 7415. ER&GUN&ER Law Firm provides Turkish-side coordination for cross-border crypto structuring within multinational structures.
Frequently Asked Questions
- Is cryptocurrency legal in Türkiye? Ownership and trading of crypto are legal. Use of crypto as payment for goods and services is prohibited under TCMB Regulation on Disuse of Crypto Assets in Payments (RG 16.4.2021/31456, effective 30 April 2021). Service providers must comply with Law 7415 (2024) licensing framework and MASAK AML obligations.
- What is Law 7415? Law No. 7415 of 2 July 2024 (RG 2.7.2024/32590) amending the Capital Markets Law (Law No. 6362) introducing comprehensive crypto asset service provider (kripto varlık hizmet sağlayıcı) licensing framework. Key new provisions: Article 35/B (definition and licensing), 35/C (custody), 138/A (sanctions), 138/B (asset blocking).
- Who regulates crypto in Türkiye? SPK (Capital Markets Board) — principal supervisor for crypto asset service providers post-Law 7415; MASAK (Financial Crimes Investigation Board) — AML supervisor since 2021 Tebliğ No. 18; TCMB (Central Bank) — payment restriction authority; BDDK (Banking Regulation Agency) — banking sector crypto exposure; Revenue Administration (GİB) — tax authority.
- Do crypto exchanges need a licence? Yes. Under Law 7415 Article 35/B, crypto asset service providers (trading, distribution, custody, related services) require SPK licensing with capital, infrastructure, compliance officer, AML programme, segregated custody, and ongoing reporting requirements. Operating without licence triggers Article 138/A sanctions including administrative fines, criminal penalties, and asset blocking under Article 138/B.
- What are MASAK AML obligations? Under Law No. 5549 of 11.10.2006 and MASAK Tebliğ No. 18 of 1.5.2021: customer identification (KYC) including continuous relationships and occasional transactions exceeding TRY 75,000; suspicious transaction reporting within 10 business days (NOT 3); written AML programme; designated compliance officer; record retention 8 years; ongoing monitoring; sanctions for non-compliance up to TRY 4 million per violation.
- Can crypto be used for payment? No. TCMB Regulation Article 3 prohibits direct and indirect use of crypto as payment for goods and services. Article 4 prohibits payment service providers from intermediating crypto-related payment services. Permitted: ownership, trading on licensed exchanges, peer-to-peer transfers between individuals, crypto-fiat conversions where conversion itself is the transaction.
- How is crypto taxed? Under general tax framework — no crypto-specific statutory regime as of current law. Possible classifications: GVK Articles 80-82 capital gains; Article 37 commercial income for active trading; Article 65-68 free profession income for specialised services. VAT under Law 3065 with Article 17/4(g) financial services exemption potentially applicable. Mining typically constitutes commercial activity requiring entity establishment.
- Is "Schedule T" a Turkish tax form? No. There is no "Schedule T (Cryptocurrency Income)" in Turkish tax forms — this is sometimes erroneously cited. Crypto income is reported under applicable general income categories with no crypto-specific schedule.
- What are foreign exchange implications? Decree No. 32 (Türk Parası Kıymetini Koruma Hakkında 32 Sayılı Karar) applies to crypto-fiat conversions involving cross-border elements through authorised intermediaries (banks, authorised foreign exchange institutions). Crypto-crypto transactions generally outside formal FX framework.
- What are penalties for crypto fraud? TCK Article 158 qualified fraud (nitelikli dolandırıcılık) for crypto Ponzi schemes and ICO fraud — imprisonment 3-10 years plus judicial fines. TCK Article 142 theft for unauthorised crypto transfers. TCK Articles 243-244 cybercrime for system intrusion and data manipulation. TCK Article 245 misuse of digital payment instruments — imprisonment 3-6 years.
- What consumer protections apply? Consumer Protection Law (Law No. 6502, "TKHK") general provisions; Articles 7-12 distance contracts framework for online platforms; Article 48 financial consumer protection; Article 5 unfair contract terms; Tüketici Hakem Heyetleri for smaller disputes; Tüketici Mahkemeleri for larger disputes. Applicable to retail crypto platform relationships.
- Are ICOs allowed? Token classification analysis under Capital Markets Law (Law No. 6362) determines treatment. Security tokens fall under full prospectus and offering framework. Utility tokens have limited regulation. Post-Law 7415, distribution services for crypto assets fall under crypto asset service provider licensing under Article 35/B regardless of underlying token classification.
- What about KVKK compliance? Personal Data Protection Law (Law No. 6698, "KVKK") applies to crypto exchange customer data with Article 5 lawful basis requirements, Article 6 special category data treatment, Article 9 cross-border transfer framework (substantially amended by Law No. 7499 of 2.3.2024), Article 12 security measures, and Article 16 VERBIS registration where applicable.
- How does pre-Law 7415 framework relate? Pre-2024 SPK position involved only public warnings (27.9.2017 and 28.10.2017 statements), without formal regulatory framework. Token classification under Capital Markets Law applied case-by-case. MASAK AML obligations applied since 2021 Tebliğ No. 18. TCMB payment restrictions applied since April 2021. Law 7415 substantially expanded SPK formal authority with comprehensive licensing framework.
- Where does ER&GUN&ER Law Firm support crypto matters? Law 7415 SPK licensing applications under Article 35/B; MASAK AML programme design and Tebliğ 18 compliance; TCMB payment restriction structural compliance; tax framework analysis under GVK 193 with VAT and BSMV integration; KVKK compliance with Article 9 cross-border framework; consumer protection under TKHK 6502; criminal complaint and defence under TCK Articles 158, 142, 243-245; civil compensation under TBK 49 framework; cross-border structuring with foreign exchange controls under Decree No. 32; integrated multi-regulator engagement (SPK, MASAK, TCMB, BDDK, GİB); Bölge Adliye Mahkemesi and Yargıtay appellate representation; and strategic legal advisory for crypto businesses entering or operating in Turkish market.
Author: Mirkan Topcu is an attorney registered with the Istanbul Bar Association (Istanbul 1st Bar), Bar Registration No: 67874. His practice focuses on cross-border and high-stakes matters where evidence discipline, procedural accuracy, and risk control are decisive.
He advises Turkish and foreign crypto businesses, exchanges, custodians, token issuers, institutional investors, and individual holders across Law 7415 (2.7.2024) Crypto Asset Service Provider Licensing under Capital Markets Law (Law No. 6362) Articles 35/B, 35/C, 138/A, 138/B, MASAK AML Compliance under Law No. 5549 and Tebliğ No. 18 of 1.5.2021, TCMB Payment Restriction Structural Compliance under 16.4.2021 Regulation, Tax Framework under Income Tax Law (Law No. 193) with VAT (Law No. 3065) and BSMV (Law No. 6802) Integration, KVKK Compliance under Law No. 6698 with Article 9 Cross-border Transfer Framework (amended Law No. 7499 of 2.3.2024), Consumer Protection under TKHK (Law No. 6502), Criminal Liability under TCK Articles 158 (qualified fraud), 142 (theft), 243-244 (cybercrime), 245-245/A (digital payment misuse), Civil Compensation under TBK (Law No. 6098) Articles 30, 36, 49, Foreign Exchange Controls under Decree No. 32, Cross-border Structuring with Permanent Establishment Risk Analysis, Integrated Multi-regulator Engagement (SPK, MASAK, TCMB, BDDK, GİB), Bölge Adliye Mahkemesi and Yargıtay Appeals, and Strategic Crypto Business Legal Advisory.
Education: Istanbul University Faculty of Law (2018); Galatasaray University, LL.M. (2022). LinkedIn: Profile. Istanbul Bar Association: Official website.