Secondary Regulations on Crypto Asset Service Providers and Information Systems Management Published
With various communiqués published in the Official Gazette dated 13.03.2025 and numbered 32840, important regulations were made regarding crypto asset service providers.
The regulations introduced by the Communiqué on the Establishment and Operating Principles of Crypto Asset Service Providers (Communiqué No. III-35/B.1) are summarized below:
- Principles regarding the establishment, operation, activities and suspension of activities, share transfers, organizational structure, document registration system and audit infrastructures of crypto asset service providers shall be determined.
- Crypto asset service providers are obliged to comply with the principles determined during their activities, explain the general risks related to crypto assets to their customers, sign a framework agreement, and carry out identification. Furthermore, crypto asset service providers must provide transparent information on their websites, regulate customer accounts and take necessary measures in extraordinary situations.
- For the establishment of crypto asset service providers to be authorized by the Capital Markets Board (the Board), they must be established as a joint stock company, all of their shares must be registered, their shares must be issued against cash, their minimum capital amount must not be less than the amount determined by the Board and their equity must not be below this amount.
- Crypto asset service providers must also obtain permission from the Board to operate. To obtain such permission, crypto asset service providers must meet criteria such as maintaining the conditions for their establishment, paying the minimum establishment capital in cash and in full, and fulfilling the obligations regarding capital adequacy.
- For changes in the shareholding structure of crypto asset service providers, the Board's authorization is required if their capital or voting rights directly or indirectly exceed 10%, 20%, 33%, or 50%. For share transfers below these ratios, it is sufficient to notify the Board of the change in the shareholding structure.
- The business names and trademarks of crypto asset service providers must be registered, and this information, as well as their operating licenses and sanctions imposed, must be announced on the Public Disclosure Platform. Lawsuits and proceedings that will affect more than 10% of the equity and issues such as independent audit institutions should be notified to the Sermaye Piyasası Lisanslama Sicil ve Eğitim Kuruluşu Anonim Şirketi.
- Crypto asset service providers may only carry out activities authorized by the Board and may not carry out prohibited transactions such as deposit collection, real estate trading, and guaranteeing customer returns..
- Crypto asset service providers must prepare a “recovery plan” to prevent crypto asset losses. With the recovery plan, platforms must identify the actions and risks that may result in crypto asset loss and include the actions to be taken in case these risks and actions occur.
- Crypto asset service providers may temporarily suspend their activities for a maximum of two years voluntarily. The Board may limit or suspend the operating permits, take measures such as changing the managers, or revoke the permits in the event of a violation of the law or deterioration of the financial situation.
- Platforms on the Operators List must apply for an operating permit by 30.06.2025 and obtain an authorization certificate by 30.06.2026; otherwise, they will be subject to liquidation. Those not included in the activity list cannot operate without obtaining the necessary authorizations.
The regulations introduced under the Communiqué on Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers (Communiqué No. III-35/B.2) are summarized below:
- The services and activities that crypto asset service providers can offer, principles regarding platform activities, crypto assets that can be listed, custody service and transfer principles, and criteria regarding capital adequacy are regulated.
- Platforms must establish price surveillance systems, provide the necessary information and documents when opening their trading environments abroad, meet specific criteria for investment advisory activities, and inform their customers in special cases.
- Crypto assets listed on platforms cannot be sold on a leveraged basis and cannot be subject to credit purchase, short sale, and lending transactions.
- Crypto asset custody services may only be provided by authorized banks or custodians designated by the Board. Established safeguards execute transfer orders, and large transfers require managers' approval.
- For crypto asset service providers, the minimum founding capital for platforms is TRY 150,000,000, and for custodians at TRY 500,000,000. Custodians may hold up to TRY 1,000,000,000 of client assets, and if they exceed this amount, they are required to hold additional equity capital equal to 1.5% of the excess amount; no additional obligation is needed once the total equity of TRY 1,500,000,000 is reached.
- Within the scope of capital adequacy of crypto asset service providers, financial indicators such as risk provision, operating expenses, borrowing limits and position risk should be regularly monitored and reported to the Board. Possible violations should be eliminated within the specified periods.
- Clients must keep at least 95% of their client assets with custodians and a maximum of 5% in their wallets.
- The borrowing limit of crypto asset service providers cannot exceed three times their capital adequacy floor.
The regulations introduced by the Communiqué on Principles and Procedures Regarding Information Systems Management numbered VII-128.10 (Communiqué numbered VII-128.10) and the Communiqué Amending the Communiqué on Independent Audit of Information Systems numbered III-62.2.b (Communiqué numbered III-62.2.b) are summarized below:
- Communiqué No. VII-128.10 sets out the principles and procedures for the secure, sustainable and orderly management of information systems of capital market institutions and introduces comprehensive obligations regarding risk management, access controls, data confidentiality, network security, information systems continuity and outsourcing of services.
- With the Communiqué No. III-62.2.b, crypto asset service providers are also subject to independent audit, the submission processes of audit reports have been clarified and annual, biannual or triennial audit obligations have been determined for different institutions.
The Communiqué on Procedures and Principles Regarding Information Systems Management
The Communiqué Amending the Communiqué on Independent Audit of Information Systems (III-62.2).
All rights of this article are reserved. This article may not be used, reproduced, copied, published, distributed, or otherwise disseminated without quotation or Erdem & Erdem Law Firm's written consent. Any content created without citing the resource or Erdem & Erdem Law Firm’s written consent is regularly tracked, and legal action will be taken in case of violation.