Can a Foreign Crypto Company Serve Turkish Customers Without a Turkish License?

The regulatory starting point in 2026

Turkey moved crypto-asset service providers into a formal capital-markets regulatory framework with Law No. 7518, which amended Capital Markets Law No. 6362 in July 2024.

The Capital Markets Board of Turkey (SPK) subsequently issued Communiqués No. III-35/B.1 and III-35/B.2 in March 2025, covering establishment, authorisation, operations, custody, transfers, systems, internal controls and capital adequacy.

This distinction is critical for international exchanges, custodial-wallet providers, embedded-finance businesses and crypto-card issuers.

1. What does reverse solicitation mean for crypto firms in Turkey?

In practical terms, reverse solicitation describes a situation in which the customer initiates the relationship without the foreign provider soliciting that customer in Turkey.

Turkish crypto rules recognise an important distinction between Turkey-facing activity and services obtained from an overseas provider solely on the initiative of the Turkish resident.

Communiqué No. III-35/B.2 provides a basis for treating certain services received from foreign crypto-asset service providers as outside the local framework where there has been no promotion, advertising or marketing directed at persons resident in Turkey and the Turkish resident acts entirely on their own initiative.

For a foreign platform, the practical evidential question is therefore whether the company can demonstrate that the relevant Turkish customer relationship arose organically rather than through Turkey-specific customer acquisition.

2. When is a foreign crypto platform treated as targeting Turkey?

Capital Markets Law Article 99/A sets out important indicators. A foreign platform may be treated as directing its activities to persons resident in Turkey where, among other things, it:

• opens a place of business in Turkey;
• creates a Turkish-language website; or
• conducts promotion or marketing for its crypto services directly, or through persons or institutions resident in Turkey.

SPK may also determine additional criteria. That means a compliance review should not be limited to three formal checkboxes. The total user-acquisition architecture matters.

What about Google Ads, influencers, affiliates and Telegram?

Turkey-targeted paid search, local social-media campaigns, Turkish influencers, Turkish affiliates, local introducers, referral programmes specifically designed for Turkish users and Turkey-focused community channels all make a reverse-solicitation position materially harder to defend.

The statutory wording is broad enough to capture both direct and intermediary-led promotion.

What about a Turkish-language mobile app?

The statute expressly refers to a Turkish-language website. A Turkish-language mobile-app interface is not worded identically in Article 99/A.

That does not mean it is automatically safe. In a real regulatory assessment, a Turkish app interface would be considered together with local onboarding flows, marketing, customer support, pricing, referral activity, geo-targeting and other evidence of Turkey-facing commercial intent.

3. Can a foreign company offer a custodial crypto wallet to Turkish residents?

Potentially, but the answer depends on the cross-border fact pattern.

Custody is a regulated crypto-asset service under Turkish capital-markets law. Where a foreign provider is actively targeting Turkish residents, a Turkish authorisation analysis is triggered.

Where, by contrast, the Turkish resident independently seeks out the foreign provider and the conditions for the reverse-solicitation exclusion are genuinely met, the analysis is different.

In that scenario, it is not correct to assume that every Turkish resident using an overseas custodial wallet automatically converts the foreign provider into a locally licensed Turkish crypto-asset service provider.

The operational file should nevertheless be robust. A foreign provider relying on a reverse-solicitation position should be able to map:

• the source of the lead;
• the customer acquisition channel;
• website and application language;
• referral source;
• geographic advertising campaigns;
• customer-support routing; and
• any Turkey-specific commercial adaptations.

4. Can a foreign crypto company issue a crypto or payment card to customers in Turkey?

This is the most sensitive part of the analysis.

Turkey’s Regulation on the Non-Use of Crypto-Assets in Payments prohibits crypto-assets from being used directly or indirectly in payments.

It also prohibits payment service providers from developing or offering payment-service and electronic-money business models in which crypto-assets are used directly or indirectly.

A typical crypto-card structure can therefore create a problem where the card transaction relies on the user’s crypto balance being converted, netted or otherwise used to fund a payment.

The fact that final settlement to the merchant occurs in fiat currency does not, by itself, eliminate the need to analyse the “indirect use” prohibition.

However, the regulatory conclusion should not be reduced to the statement that every foreign-issued card held by a Turkish resident is automatically unlawful.

The correct review should identify:

• who legally issues the card;
• where the issuer and programme manager are licensed;
• whether the card is marketed or offered into Turkey;
• where the wallet and settlement relationship sits;
• whether crypto is automatically converted at transaction level;
• whether a Turkish payment service is being provided; and
• whether any Turkish bank, payment institution or electronic-money institution participates in the funding flow.

For this reason, reverse solicitation should not be treated as a complete answer for a crypto-linked card product.

The SPK analysis and the TCMB/payment-law analysis must be run separately and then reconciled.

5. Is it a problem if the foreign website is accessible from Turkey?

Simple technical accessibility from a Turkish IP address is not the same thing as actively targeting Turkey.

The stronger regulatory issue arises when accessibility is combined with Turkey-facing features or marketing.

6. Can the foreign provider onboard and KYC a Turkish resident?

KYC is not the same thing as solicitation.

A regulated foreign financial or crypto business will normally need to identify its customers under its home-jurisdiction AML framework.

Performing identity verification after an unsolicited customer has approached the platform does not, by itself, prove that the platform marketed into Turkey.

But KYC data can become important evidence.

If a platform has a substantial Turkish customer population and the surrounding product, support, acquisition and localisation architecture is built around those users, the overall fact pattern may be difficult to reconcile with a claim that all Turkish relationships are purely unsolicited.

What about MASAK?

Turkey has its own AML/CFT rules for crypto-asset service providers operating within the Turkish regulatory perimeter.

A foreign company should not assume that compliance with a Canadian, EU, UK or other foreign AML regime automatically substitutes for Turkish obligations if the business is in fact conducting regulated activity in Turkey.

7. Does a Canadian MSB, EU MiCA authorisation or another foreign licence cover Turkey?

No automatic passporting mechanism should be assumed.

A foreign licence may demonstrate that the provider is authorised and supervised in its home jurisdiction, but it does not replace Turkish licensing where Turkish law independently requires local authorisation.

For example, a Canadian FINTRAC registration or MSB status is relevant to the provider’s Canadian regulatory standing. It does not create a bilateral passport into the Turkish market.

The same conceptual point applies to other foreign licences unless a specific Turkish legal basis provides otherwise.

The foreign licence is therefore part of the regulatory profile — not a substitute for the Turkey perimeter analysis.

8. When should a foreign crypto business consider a Turkish structure?

A local structure becomes relevant where the commercial plan moves beyond passive cross-border access and towards an actual Turkey market strategy.

Typical triggers include:

• a Turkish-language website;
• local sales or support presence;
• a Turkish customer-acquisition budget;
• Turkish affiliates or influencers;
• local fiat rails;
• local customer acquisition partnerships; or
• a product requiring locally regulated payment functionality.

Under the current framework, establishing a Turkish crypto-asset service provider involves an SPK authorisation process, Turkish corporate substance, governance, systems and prudential requirements.

SPK also updates monetary thresholds periodically.

As of the 2026 indexed figures, the minimum establishment capital published by SPK is TRY 250 million for platforms and TRY 630 million for custody institutions.

These figures should always be re-checked at the time of an application.

A second route: B2B technology rather than direct retail distribution

Some foreign groups may not need to become the Turkish retail-facing provider at all.

Depending on the product, a structure can sometimes be designed around software, infrastructure or other B2B services supplied to a locally authorised institution.

This does not create an automatic safe harbour.

The contractual allocation of regulated functions, customer ownership, custody, payment flows, branding, outsourcing and operational control must still be reviewed carefully.

9. Reverse solicitation risk matrix for foreign crypto firms

10. What should a foreign crypto company document before accepting Turkish users?

For a serious cross-border analysis, we would normally want to review:

• legal entity and licence map;
• product flow;
• custody architecture;
• card issuer and programme structure;
• funding mechanics;
• customer journey;
• website and app language;
• geo-targeting settings;
• paid marketing campaigns;
• affiliate arrangements;
• referral programmes;
• Turkish support channels;
• KYC fields;
• fiat rails;
• settlement flow;
• local partners; and
• the intended number and profile of Turkish users.

This turns the question from a generic “Can we use reverse solicitation?” into a defensible product-by-product regulatory perimeter assessment.