Our country's first law concerning crypto-assets (the "Crypto Law") was published in the Official Gazette on July 2, 2024, and has entered into force.

We present below our summary of the Crypto Law, which adds new provisions to the Capital Markets Law. 

1. General Overview

The Crypto Law grants the Capital Markets Board (the "CMB" or the "Board") authority over (a) crypto-assets that provide rights specific to capital market instruments, and (b) crypto-assets created through the development of distributed ledger technology (DLT) or a similar technological infrastructure, the value of which is inseparable from that technology.

The CMB's authority primarily involves establishing principles for the purchase, sale, and distribution of these crypto-assets on crypto-asset platforms without being subject to other provisions of the Capital Markets Law concerning capital market instruments, and to oversee the operations of these platforms.

In other words, the Crypto Law does not regulate the blockchain technology itself or, unlike the European Union's Markets in Crypto-Assets (MiCA) regulation, the entire crypto-asset market. Therefore, crypto-assets that do not possess the characteristics described above may not fall within the scope of the Crypto Law. However, such crypto-assets may be subject to other legislation. Furthermore, if crypto-assets that are subject to other legislation at their initial sale are later traded on crypto-asset platforms, these transactions will fall under the CMB's authority, irrespective of the nature of the crypto-assets.

The Crypto Law also envisages obtaining technical reports from The Scientific and Technological Research Council of Turkey (TÜBİTAK) or other relevant institutions to determine the nature of crypto-assets.

2. Issuances

The Crypto Law will enable the issuance of capital market instruments as crypto-assets (i.e., tokenization), and the CMB is authorized to set principles for these instruments to be tracked on the systems of crypto-asset service providers instead of the Central Securities Depository (MKK). However, the CMB also has the authority to mandate integration between the records of crypto-asset service providers and the MKK system.

The CMB is also authorized to establish regulatory procedures, make decisions of a specific or general nature, and apply measures and sanctions concerning capital market instruments issued as crypto-assets.

Additionally, as mentioned above, the CMB is authorized to set principles for the sale or distribution on platforms of crypto-assets created through the development of DLT or similar technology, whose value is inseparable from that technology.

Platforms will be required to establish written listing procedures for determining which crypto-assets will be traded or initially sold or distributed on their systems, and for delisting them. The CMB is authorized to set the principles for these procedures. In setting these principles, the CMB may consult with TÜBİTAK or other institutions it deems necessary and may include technical criteria regarding the technological features of crypto-assets.

The price of crypto-assets listed on platforms will be freely determined by the market. However, actions and transactions that cannot be explained by a reasonable and economic justification and that disrupt the secure, transparent, and stable functioning of the platform's transactions will be subject to the provisions of the Capital Markets Law concerning market-distorting actions.

Under the Crypto Law, it is essential that crypto-assets belonging to platform customers are held in the customers' own wallets. Custody services for crypto-assets that customers do not wish to hold in their own wallets must be provided by (a) banks authorized by the CMB and deemed appropriate by the Banking Regulation and Supervision Agency (BRSA), or (b) other institutions authorized by the CMB to provide crypto-asset custody services. It is mandatory for customers' cash to be held in banks. This cash must be tracked in individual accounts opened on a per-customer basis, separate from the investment institution's own cash assets.

3. Crypto-Asset Service Providers (CASPs)

Definitions

The Crypto Law defines crypto-asset service providers as "platforms, custodians, and other institutions providing crypto services (e.g., initial sale, distribution) as determined by the CMB."

Platforms are, in short, the institutions and marketplaces commonly known as "exchanges." Crypto-asset custody service is defined as "the storage and management of platform customers' crypto-assets or the private keys that grant the right to transfer from the wallet, or other custody services to be determined by the CMB."

Operating License

The establishment and operation of CASPs require a license from the CMB. Service providers will only be able to perform activities determined by the CMB within the scope of their license. The CMB must enact the secondary legislation concerning licenses within six months of the Crypto Law's entry into force.

Institutions operating as CASPs on the date the Crypto Law entered into force must apply to the CMB within one month and submit a declaration stating that they will either (a) make the necessary applications to obtain an operating license by meeting the conditions to be stipulated in the secondary legislation to be enacted by the CMB, or (b) take a liquidation decision within three months without harming the rights and interests of their customers and will not accept new customers during the liquidation process. However, the practicality and consistency of being forced to make such a choice while the conditions of the secondary legislation are still unknown is debatable in the context of the constitutional principle of legal predictability.

Institutions wishing to start operations after the entry into force of the Crypto Law must, before commencing their activities, apply to the CMB and declare that they will make the necessary applications to obtain an operating license by meeting the conditions to be stipulated in the secondary legislation. After the secondary legislation enters into force, it will not be possible for new institutions to start operating without first obtaining a license.

CASPs will be required to become members of the Turkish Capital Markets Association.

Establishment and Licensing Conditions

The partners and board members of CASPs will be subject to strict conditions. For example, these individuals must (a) have the necessary financial strength and the integrity and reputation required for their activities, (b) not be bankrupt, (c) not have been convicted of infamous crimes, various financial crimes, or crimes against the state, (d) not have been sentenced to five years or more in prison for an intentionally committed crime, (e) not have a final conviction for crimes specified in the Capital Markets Law, and (f) not be subject to a trading ban for insider trading or market fraud. Real persons who own at least 10% of the capital or voting rights of legal entity partners, and partners who hold privileged shares granting the right to be represented on the board of directors regardless of this ratio, must also meet these conditions.

For CASPs to obtain an establishment and operating license, their information systems and technological infrastructures must comply with the criteria to be determined by TÜBİTAK. These systems are subject to an independent audit by independent audit firms listed by the CMB.

Furthermore, obtaining CMB approval is mandatory for share transfers of CASPs.

Platforms are required to pay one percent of all their revenues, excluding interest income, from the previous year to the CMB and one percent to TÜBİTAK by the end of May each year.

If the CMB determines that a CASP is unable or will soon be unable to meet its cash payment and crypto-asset delivery obligations, or that its financial structure is seriously weakening, or its financial situation has weakened to the point of being unable to meet its commitments, it has the authority to (a) demand the strengthening of their financial structure within a period not exceeding three months, or (b) without granting a period, temporarily suspend the service providers' activities, revoke their operating licenses, and limit or revoke the signing authorities of managers and employees whose responsibility has been established.

4. Liability and Penalties

Unauthorized Activities

Real persons and officials of legal entities who operate as CASPs without a license from the CMB will be punished with (a) imprisonment from three to five years and (b) a judicial fine from five thousand to ten thousand days.

Activities conducted by foreign-based platforms targeting persons residing in Turkey (e.g., opening a workplace in Turkey, creating a Turkish-language website, engaging in promotional and marketing activities through persons or institutions residing in Turkey) or offering a prohibited crypto-asset-related activity to persons residing in Turkey are also considered unauthorized CASP activities. Foreign-based CASPs must terminate their activities directed at persons residing in Turkey within three months of the Crypto Law's entry into force.

Additionally, the operation of ATMs and similar electronic devices that allow customers to convert crypto-assets to cash or cash to crypto-assets and to transfer crypto-assets must be terminated within three months of the Crypto Law's entry into force.

Losses

CASPs are liable for losses of crypto-assets arising from the operation of their information systems, cyber-attacks, information security breaches, and any conduct of their personnel. This liability falls under Article 71 of the Code of Obligations, which stipulates that "if damage arises from the activity of a significantly hazardous enterprise, the owner of the enterprise and, if any, the operator are jointly and severally liable for this damage."

Capital Markets Crimes

Regarding the unlawful activities and transactions of CASPs, the provisions of the Capital Markets Law concerning (a) measures for unlawful activities of capital market institutions, (b) measures for unauthorized capital market activities, and (c) measures for unlawful announcements, advertisements, and disclosures will apply. For example, the CMB can decide to remove content or block access for unauthorized activities and advertisements conducted online; advertisements and commercials made contrary to the principles determined by the CMB outside the internet can also be stopped and confiscated.

Embezzlement

The chairman and members of the board of directors and other members of a CASP who, in connection with their duties, embezzle money, securities, other goods, or crypto-assets entrusted to them or for which they are responsible for protection, custody, and supervision, will be (a) punished with imprisonment from eight to fourteen years and a judicial fine of up to five thousand days, and (b) will be obliged to compensate the CASP for the damages. Furthermore, upon the CMB's request, a court may decide on the personal bankruptcy of these individuals (and, in cases where the embezzlement was committed to provide benefits to third parties, the beneficiaries as well). The cash assets in the estates of those declared personally bankrupt will be used directly, and non-cash assets will be liquidated to compensate for customer losses.

The preamble of the Crypto Law states that "[i]f crypto-assets are held by service providers instead of in the customers' own wallets, it is very difficult to trace their trail and take necessary actions to protect investors when there is malicious intent." It is also stated that these regulations are intended to prevent potential incidents similar to the recent FTX and Thodex cases. The preamble further notes that "considering the unique nature of crypto-assets, the irreversible nature of transactions, and the difficulties in tracing assets... the penal provisions have been made more severe compared to other financial institutions."

5. Secondary Legislation

The procedures and principles for the implementation of the Crypto Law will be determined by secondary regulations to be issued by the CMB. The main topics to be covered by these secondary regulations are:

– Regulations concerning the establishment and activities of CASPs. These include principles and rules on partners, managers, personnel, capital adequacy, share transfers, information systems, permissible activities, and obligations. These regulations must be enacted within six months of the Crypto Law's entry into force.

– Procedures and principles for the initial sale, distribution, purchase-sale, exchange, transfer, and custody of crypto-assets via platforms.

– Procedures and principles for the establishment of written listing procedures by platforms for determining which crypto-assets will be traded or initially sold or distributed, and for delisting them.

– Procedures and principles regarding the drafting, scope, amendment, fees and expenses, termination, and rescission of contracts to be signed between CASPs and customers, and the minimum content of these contracts.

– Procedures and principles for providing investment advisory and portfolio management services for crypto-assets.

– Procedures and principles regarding the publications, announcements, advertisements, notices, and commercial communications of CASPs.