← Regulations / Turkey / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Turkey

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Turkey with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • CASP (custodial wallet/SaaS operator) must register with MASAK as an 'obliged entity' and implement full AML/KYC protocols for all customers (tr.licensing.financial-crimes-investigation-board-masak, tr.licensing.masak-enforces-aml-for-casps)
  • Custodial wallet SaaS provider must conduct customer due diligence (CDD) and ongoing transaction monitoring on end users (tr.licensing.financial-crimes-investigation-board-masak)
  • MASAK AML obligations apply directly to the licensed CASP; white-label clients do not assume MASAK obligations unless they themselves are CASPs — the licensed SaaS provider bears primary AML responsibility (tr.licensing.masak-enforces-aml-for-casps)
  • CASP must report suspicious transactions to MASAK (tr.licensing.financial-crimes-investigation-board-masak)
  • AML legislation was updated in December 2024 to further enhance CASP requirements (tr.licensing.aml-legislation-amendments-december-2024)

Key Restrictions

  • Custodial wallet provider must hold a CASP license from the CMB (SPK), which for custodians requires a minimum paid-up capital of TRY 500 million (~$13.7M) — substantially higher than the TRY 50M general CASP minimum (tr.licensing.custody, tr.custody.minimum-capital-for-custodians-try, tr.licensing.cmb-resolutionscommuniqus-govern-licensing-capital)
  • At least 95% of customer crypto assets must be held in cold wallets managed by authorized custodians; no more than ~5% may be kept in hot wallets for operational purposes (tr.custody.at-least-95-in-cold)
  • Private keys must be stored using TÜBİTAK-compliant secure hardware modules (tr.custody.use-tbitak-compliant-secure-hardware-modules)
  • Must integrate with MKK (Turkish Central Securities Depository) for reconciliation and reporting (tr.custody.integration-with-mkk-turkish-central)
  • Crypto cannot be used as payment for goods/services per the CBRT ban (April 2021); this does not directly prohibit custody/SaaS but restricts how end users may use the custody service (tr.licensing.central-bank-regulation-official-gazette, tr.licensing.central-bank-regulation-on-prohibition)
  • Only authorized banks or institutions may provide custody services; foreign CASPs face restrictions in providing custody in Turkey (tr.custody.only-authorized-banks-or-institutions)
  • Must register in the CMB's 'kurum kaydı' (institutional ledger) system; existing operators must comply by June 30, 2025 (tr.custody.platforms-must-register-in-the)
  • Customer asset segregation is required under the CASP framework (tr.licensing.custody)
  • CASP must establish a Turkish entity with Turkish-resident board members (tr.licensing.vasp)
  • Custodial lending/proprietary use of customer assets is prohibited per CMB Resolution of September 19, 2024 (tr.custody.cmb-resolution-dated-september-19)

Key Risks

  • Criminal penalties (including imprisonment) apply for unlicensed CASP operation — a real risk for SaaS providers serving Turkish clients without proper licensing (tr.licensing.vasp, tr.licensing.exchange)
  • Regulatory landscape is relatively new (Crypto Assets Law 2024) and secondary legislation is still evolving, creating interpretation risk (tr.licensing.law-on-amendments-to-the, tr.licensing.cmb-communiqus-and-resolutions-secondary)
  • High enforcement activity: CMB has actively blocked unlicensed platforms (e.g., PancakeSwap 2024) and Turkish prosecutors pursue crypto fraud vigorously post-Thodex (tr.licensing.capital-markets-board-cmb-primary, tr.enforcement.regulatorprosecutor-turkish-prosecutors)
  • The CBRT payment ban creates confusion for custodial wallets that facilitate transfers; operators must carefully avoid any payment/payment-instrument characterization
  • AML December 2024 updates may impose additional obligations that are not yet fully clarified in guidance (tr.licensing.aml-legislation-amendments-december-2024)
  • White-label client relationship creates AML allocation risk — the licensed SaaS provider is the regulated entity vis-à-vis MASAK, even if the white-label partner interacts with end users

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

custody 20% confidence

Minimum capital for custodians: TRY 500 million (~$13.7 million).

custody 20% confidence

Platforms must register in the CMB's “kurum kaydı” (institutional ledger) system and comply by June 30, 2025, for existing operators.

custody 20% confidence

Only authorized banks or institutions may provide custody; foreign CASPs face restrictions.

custody 20% confidence

CMB Resolution dated September 19, 2024, further details prohibitions like lending.

custody 20% confidence

At least 95% in cold wallets managed by authorized custodians (max ~5% in hot wallets for operations).

custody 20% confidence

Use TÜBİTAK-compliant secure hardware modules for private keys.

custody 20% confidence

Integration with MKK (Turkish Central Securities Depository) for reconciliation and reporting.

licensing 40% confidence

SPK/CMB — Crypto Asset Service Provider licensing, prudential oversight

[primary] SPK/CMB
licensing 30% confidence

MASAK — Financial crimes, AML/CFT

[primary] MASAK
licensing 20% confidence

Crypto Assets Law (2024) — CASP licensing, investor protection, criminal penalties for unlicensed operation. Came after Thodex fraud (2021, CEO fled with ~$2B).

licensing 20% confidence

VASP: Crypto Asset Service Provider License from SPK under Crypto Assets Law (2024). TRY 50M (~$1.5M USD) minimum paid-up capital. Must establish Turkish entity with Turkish-resident board members. 6-12 months. One of world's highest crypto adoption rates.

licensing 20% confidence

CUSTODY: Included under CASP license; customer asset segregation required

licensing 20% confidence

CMB Resolutions/Communiqués: Govern licensing, capital (TRY 500M/~$13.7M for custodians), prohibitions (e.g., Sept 19, 2024).

licensing 20% confidence

Central Bank Regulation: Official Gazette No. 31456, April 16, 2021 (prohibits crypto as payment, no direct custody impact).

licensing 20% confidence

MASAK enforces AML for CASPs, including custody.

licensing 20% confidence

Capital Markets Board (CMB): The primary regulatory authority responsible for establishing regulatory measures, making decisions, and implementing sanctions related to crypto assets. The CMB grants operating licenses to crypto asset service providers (CASPs).

licensing 20% confidence

Financial Crimes Investigation Board (MASAK): Enforces anti-money laundering (AML) regulations concerning cryptocurrencies and classifies CASPs as "obliged entities" subject to strict AML and Know-Your-Customer (KYC) protocols.

licensing 50% confidence

Capital Markets Board (CMB): Primary authority for licensing CASPs, enforcing operational rules, sanctions, and blocking unlicensed platforms (e.g., PancakeSwap in 2024).

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

Scientific and Technological Research Council of Türkiye (TÜBİTAK): Handles technical compliance and standards.

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

Central Bank Regulation on Prohibition of Payments with Crypto Assets: Published in Official Gazette No. 31456 on April 16, 2021; bans crypto use for goods/services. https://www.resmigazete.gov.tr/eskiler/2021/04/20210416-3.htm

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

Law on Amendments to the Capital Markets Law: Entered into force July 2, 2024; mandates CMB licensing for CASPs, defines operations, and sets transitional rules. https://www.resmigazete.gov.tr/eskiler/2024/07/20240702-1.htm

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

CMB Communiqués and Resolutions (Secondary Legislation, post-July 2024): Cover establishment, capital adequacy, custody, risk management, and conduct; enforce 2024 licensing powers (e.g., DEX blocks).

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

AML Legislation Amendments: December 2024 updates enhance CASP requirements.

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
enforcement 60% confidence

Regulator/Prosecutor: Turkish prosecutors

[secondary] turkishminute.com — Turkey Seizes Assets Freezes 500 Mln In Cryptocurrency Tied To Illegal Betting Investigation [secondary] trmlabs.com — 2025 Crypto Crime Report

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — custodial wallet/SaaS providers may operate in Turkey only after obtaining a CMB CASP license with the higher TRY 500M capital requirement for custodians, establishing a Turkish entity, complying with strict 95% cold-storage and TÜBİTAK hardware-module rules, integrating with MKK, and registering with MASAK for AML obligations, with existing operators needing to comply by June 30, 2025.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?