Remote VASP serving residents in Turkey
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Turkey with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- CASP must register with MASAK as an 'obliged entity' and implement AML/KYC protocols enforced by MASAK (tr.licensing.financial-crimes-investigation-board-masak)
- Travel Rule applies at TRY 75,000 threshold (tr.travel-rule.status, tr.travel-rule.official-gazette-amendments-dec-25)
- Customer identification, record-keeping, and suspicious transaction reporting obligations under MASAK Regulation on Measures (tr.travel-rule.masak-regulation-on-measures-httpswwwmasakgovtrenmevzuatregulation-on-measures-regarding-prevention-of-laundering-proceeds-of-crime-and-terrorism-financing)
- AML obligations updated under December 2024 AML Legislative Amendments (tr.licensing.aml-amendments-december-2024)
- Compliance with MASAK's AML/CFT regulatory framework for CASPs (tr.licensing.masak-enforces-aml-for-casps)
Key Restrictions
- Must establish a Turkish-incorporated entity with Turkish-resident board members — cross-border remote service from a foreign entity is not permitted under the 2024 Crypto Assets Law (tr.licensing.vasp)
- Must obtain a CASP license from SPK/CMB with TRY 50M (~$1.5M) minimum paid-up capital (tr.licensing.vasp, tr.licensing.exchange)
- Cryptocurrency payments for goods and services are banned — CBRT Regulation (April 2021) remains in force and prohibits using crypto as payment even under the licensing framework (tr.licensing.central-bank-regulation-official-gazette, tr.licensing.exchange)
- Custody must be provided only by authorized banks or institutions; foreign CASPs face restrictions (tr.custody.only-authorized-banks-or-institutions)
- At least 95% of customer crypto assets must be held in cold wallets managed by authorized custodians; max ~5% in hot wallets (tr.custody.at-least-95-in-cold)
- Must integrate with MKK (Turkish Central Securities Depository) for reconciliation and reporting (tr.custody.integration-with-mkk-turkish-central)
- Must use TÜBİTAK-compliant secure hardware modules for private key management (tr.custody.use-tbitak-compliant-secure-hardware-modules)
- Platforms must register in the CMB's 'kurum kaydı' (institutional ledger) system and comply by June 30, 2025 for existing operators (tr.custody.platforms-must-register-in-the)
Key Risks
- Unlicensed remote operation carries criminal penalties under the Crypto Assets Law (2024), enacted partly in response to the Thodex fraud (tr.licensing.legislation-crypto-assets-law)
- CMB has demonstrated willingness to block unlicensed platforms (e.g., PancakeSwap in 2024) (tr.licensing.capital-markets-board-cmb-primary)
- Crypto payments prohibition (CBRT 2021) creates operational complexity for any service that could be construed as facilitating payments (tr.licensing.central-bank-regulation-on-prohibition)
- High enforcement risk: Turkish authorities (prosecutors/law enforcement) actively pursue unlicensed crypto operators (tr.enforcement.regulatorprosecutor-turkish-prosecutors, tr.enforcement.regulator-turkish-authorities-likely-law)
- Foreign-entity-only structure is effectively illegal — local incorporation with Turkish-resident directors is mandatory
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Crypto Assets Law (2024) — CASP licensing, investor protection, criminal penalties for unlicensed operation. Came after Thodex fraud (2021, CEO fled with ~$2B).
VASP: Crypto Asset Service Provider License from SPK under Crypto Assets Law (2024). TRY 50M (~$1.5M USD) minimum paid-up capital. Must establish Turkish entity with Turkish-resident board members. 6-12 months. One of world's highest crypto adoption rates.
EXCHANGE: CASP license — TRY 50M minimum. Crypto PAYMENTS banned (CBRT regulation, April 2021) — ban remains despite licensing framework. Criminal penalties for unlicensed operation.
Central Bank Regulation: Official Gazette No. 31456, April 16, 2021 (prohibits crypto as payment, no direct custody impact).
Capital Markets Board (CMB): Primary authority for licensing CASPs, enforcing operational rules, sanctions, and blocking unlicensed platforms (e.g., PancakeSwap in 2024).
Financial Crimes Investigation Board (MASAK): Enforces anti-money laundering (AML) regulations concerning cryptocurrencies and classifies CASPs as "obliged entities" subject to strict AML and Know-Your-Customer (KYC) protocols.
MASAK enforces AML for CASPs, including custody.
Evidence fact tr.licensing.aml-amendments-december-2024 not found (may have been renamed).
Travel Rule adopted — threshold: TRY 75,000
Official Gazette amendments (Dec 25, 2024): https://www.resmigazete.gov.tr/ (search MASAK communiqués)
Only authorized banks or institutions may provide custody; foreign CASPs face restrictions.
At least 95% in cold wallets managed by authorized custodians (max ~5% in hot wallets for operations).
Use TÜBİTAK-compliant secure hardware modules for private keys.
Integration with MKK (Turkish Central Securities Depository) for reconciliation and reporting.
Platforms must register in the CMB's “kurum kaydı” (institutional ledger) system and comply by June 30, 2025, for existing operators.
Regulator/Prosecutor: Turkish prosecutors
Regulator: Turkish authorities (likely law enforcement)
Capital Markets Board (CMB): The primary regulatory authority responsible for establishing regulatory measures, making decisions, and implementing sanctions related to crypto assets. The CMB grants operating licenses to crypto asset service providers (CASPs).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a remote VASP cannot serve Turkish residents from a foreign entity without a local license; the operator must incorporate a Turkish entity, obtain a CASP license from CMB (TRY 50M minimum capital), register with MASAK for AML/CFT compliance (including Travel Rule at TRY 75,000), comply with strict custody requirements (95% cold storage, TÜBİTAK-compliant key management, MKK integration), and accept the ongoing ban on crypto payments — unlicensed cross-border operation carries criminal penalties and active enforcement risk.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?