← Regulations / Turkey / Operating Models / DeFi frontend

DeFi protocol frontend in Turkey

Operates a web frontend or aggregator that interacts with permissionless smart contracts on behalf of users. May or may not screen users / restrict regions.

Conditional AI-Generated · Unreviewed

DeFi frontend is conditionally permitted in Turkey with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • MASAK classifies CASPs as 'obliged entities' subject to strict AML/KYC protocols (tr.licensing.financial-crimes-investigation-board-masak).
  • Customer identity verification (KYC) is required under MASAK AML regulations (tr.licensing.masak-enforces-aml-for-casps).
  • AML obligations apply to all custodial CASP activity — if the frontend takes custody of assets or processes transactions, it falls under these rules.
  • December 2024 AML legislative amendments further enhance CASP requirements (tr.licensing.aml-legislation-amendments-december-2024).
  • Integration with MKK (Turkish Central Securities Depository) for reconciliation and reporting likely required for full CASPs (tr.custody.integration-with-mkk-turkish-central).

Key Restrictions

  • Crypto payments for goods/services are banned outright (CBRT Regulation, April 2021) — the frontend cannot facilitate payments, only asset trading/swaps (tr.licensing.central-bank-regulation-on-prohibition).
  • A Turkish entity with Turkish-resident board members is required (tr.licensing.vasp).
  • Minimum paid-up capital of TRY 50M (~$1.5M) for CASP licensing (tr.licensing.vasp).
  • If the frontend involves custody (e.g., holds private keys or processes user funds), strict custody rules apply: 95% cold storage, TÜBİTAK-compliant HSMs, integration with MKK (tr.custody.at-least-95-in-cold, tr.custody.use-tbitak-compliant-secure-hardware-modules).
  • Foreign CASPs face direct restrictions; operating for Turkish users likely requires a local licensed entity (tr.custody.only-authorized-banks-or-institutions).
  • Unlicensed operation carries criminal penalties (tr.licensing.exchange, tr.licensing.legislation-crypto-assets-law).

Key Risks

  • Regulatory ambiguity: the 2024 Crypto Assets Law targets 'CASPs' broadly — a DeFi frontend that aggregates smart contracts may or may not be deemed a CASP depending on whether it takes custody, charges fees, or controls the user experience.
  • Enforcement precedent: Turkish authorities have blocked unlicensed DEX frontends (e.g., PancakeSwap in 2024), showing willingness to enforce via ISP/domain blocks (tr.licensing.capital-markets-board-cmb-primary).
  • Fee-taking risk: If the frontend charges fees (e.g., interface fees, routing fees), it may be classified as a CASP requiring a full license, dramatically raising the compliance burden.
  • No clear safe harbor for 'strictly non-custodial' frontends — the law defines CASP broadly and could capture any intermediary that facilitates crypto asset transactions.
  • Criminal penalties for unlicensed operation create serious personal liability risk for founders/operators (tr.licensing.legislation-crypto-assets-law).
  • Thodex aftermath has made Turkish authorities especially sensitive to unregulated crypto platforms, increasing enforcement risk.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 40% confidence

SPK/CMB — Crypto Asset Service Provider licensing, prudential oversight

[primary] SPK/CMB
licensing 30% confidence

MASAK — Financial crimes, AML/CFT

[primary] MASAK
licensing 20% confidence

Crypto Assets Law (2024) — CASP licensing, investor protection, criminal penalties for unlicensed operation. Came after Thodex fraud (2021, CEO fled with ~$2B).

licensing 20% confidence

VASP: Crypto Asset Service Provider License from SPK under Crypto Assets Law (2024). TRY 50M (~$1.5M USD) minimum paid-up capital. Must establish Turkish entity with Turkish-resident board members. 6-12 months. One of world's highest crypto adoption rates.

licensing 20% confidence

EXCHANGE: CASP license — TRY 50M minimum. Crypto PAYMENTS banned (CBRT regulation, April 2021) — ban remains despite licensing framework. Criminal penalties for unlicensed operation.

licensing 20% confidence

Law No. 7518: Official Gazette No. 32590, July 2, 2024 (establishes CASP status, CMB licensing, segregation).

licensing 50% confidence

Central Bank Regulation on Prohibition of Payments with Crypto Assets: Published in Official Gazette No. 31456 on April 16, 2021; bans crypto use for goods/services. https://www.resmigazete.gov.tr/eskiler/2021/04/20210416-3.htm

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 20% confidence

MASAK enforces AML for CASPs, including custody.

licensing 50% confidence

Capital Markets Board (CMB): Primary authority for licensing CASPs, enforcing operational rules, sanctions, and blocking unlicensed platforms (e.g., PancakeSwap in 2024).

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 20% confidence

Financial Crimes Investigation Board (MASAK): Enforces anti-money laundering (AML) regulations concerning cryptocurrencies and classifies CASPs as "obliged entities" subject to strict AML and Know-Your-Customer (KYC) protocols.

licensing 50% confidence

CMB Communiqués and Resolutions (Secondary Legislation, post-July 2024): Cover establishment, capital adequacy, custody, risk management, and conduct; enforce 2024 licensing powers (e.g., DEX blocks).

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
licensing 50% confidence

AML Legislation Amendments: December 2024 updates enhance CASP requirements.

[primary] resmigazete.gov.tr — 20210416 3 [primary] resmigazete.gov.tr — 20240702 1
enforcement 60% confidence

Regulator/Prosecutor: Turkish prosecutors

[secondary] turkishminute.com — Turkey Seizes Assets Freezes 500 Mln In Cryptocurrency Tied To Illegal Betting Investigation [secondary] trmlabs.com — 2025 Crypto Crime Report
custody 20% confidence

Minimum capital for custodians: TRY 500 million (~$13.7 million).

custody 20% confidence

Only authorized banks or institutions may provide custody; foreign CASPs face restrictions.

custody 20% confidence

At least 95% in cold wallets managed by authorized custodians (max ~5% in hot wallets for operations).

custody 20% confidence

Use TÜBİTAK-compliant secure hardware modules for private keys.

custody 20% confidence

Integration with MKK (Turkish Central Securities Depository) for reconciliation and reporting.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a DeFi protocol frontend targeting Turkish users likely requires a full CASP license from the CMB with a TRY 50M minimum capital, a local Turkish entity, strict KYC/AML under MASAK, and a ban on facilitating payments, though the exact applicability to strictly non-custodial frontends remains legally unclear.

Questions this verdict aims to answer

  • Is operating the frontend a regulated activity even if the protocol is decentralized?
  • What geofencing or KYC obligations apply?
  • Does fee-taking change classification?