Introduction
For a long time, regulators and traditional financial actors worldwide have had crypto assets on their agendas, and now a regulatory framework is beginning to take shape. Turkey, which ranks among the top countries in the world in terms of crypto asset usage, has also been interacting with crypto assets for over a decade.[1] As interactions with crypto assets, seen as next-generation financial instruments, increase, regulation becomes equally necessary to prevent disputes. However, it is also crucial that regulation is applied in a manner that does not restrict the various features inherent in this new technology.
There are many methods to access crypto assets. Among these, the most commonly used method, due to its ease of use, is through intermediaries known as Crypto Asset Service Providers (“CASP”), which typically have a central office. Another method, particularly popularized by the introduction of Bitcoin in 2008, involves decentralized CASPs, which are a preferred option within the concept of decentralized finance (“DeFi”).
The use of crypto assets in Turkey has shown extraordinary growth, particularly following the establishment of the first domestic crypto asset exchange in 2013.[2] Subsequently, the number of domestic and foreign crypto asset exchanges operating in Turkey has steadily increased. However, it is important to note that financial instruments with complex structures, such as those derived from blockchain technology like crypto assets, have the potential to cause numerous disputes if not regulated due to their unconventional features. As expected, this has indeed been the case, with many CASPs globally exploiting this regulatory gray area, leading to significant grievances. The global scandal involving the crypto asset exchange FTX, which caused substantial losses to many users, and the Thodex scandal in Turkey, where the Thodex crypto asset exchange absconded with users’ crypto assets abroad, are examples that highlight this issue and provide important lessons.
Considering that crypto asset exchanges have been operating actively in Turkey for over 10 years, it can be said that regulation has long been anticipated by industry actors. The awaited regulation, after several draft versions, was finally presented to the Turkish Grand National Assembly, leading to the enactment of Law No. 7518 on Amendments to the Capital Markets Law (“Law”), commonly known as the Crypto Law, on July 2, 2024. The Law, particularly focused on CASPs, now makes it mandatory for CASPs to obtain an operating license from the Capital Markets Board (“CMB”).
In this article, we will examine the licensing process, which is crucial for CASPs and mandatory for all businesses that incorporate crypto assets into their business processes, given the broad definition of CASPs in the Law.
Definition and Scope of Crypto Asset Service Providers in the Law
The Law defines Crypto Asset Service Providers (“CASP”) as “Platforms, entities providing crypto asset custody services, and other entities designated to provide services related to crypto assets, including but not limited to the initial sale or distribution of crypto assets, as determined by regulations enacted under this Law.” As understood from this definition, the scope of CASPs is quite broad, encompassing not only entities providing custody services but also those involved in the initial sale or distribution of crypto assets and those offering other related services. This indicates that a wide range of businesses operating in the sector must be included within the regulatory framework.
The term “Platform” within this definition is further defined in the Law as “Entities where one or more of the following activities are conducted: the purchase, sale, initial sale or distribution, exchange, transfer of crypto assets, the custody required by such transactions, and other operations that may be specified.” This highlights that crypto asset transactions are not limited to just buying and selling but encompass a broader range of operations. Therefore, it is clear that the legislator aims to regulate the entire spectrum of activities within the crypto asset ecosystem and to include all entities offering different types of services within the scope of the Law.
Licensing Requirement for Crypto Asset Service Providers
As previously mentioned, CASPs are defined quite broadly under the Law and are required to obtain a license from the Capital Markets Board (“CMB”). With the enactment of the Law on July 2, 2024, CASPs are now obligated to apply for and obtain a license from the CMB to be established, operate, or continue their existing operations in Turkey. CASPs that successfully complete the licensing process will be issued a certificate of authorization, as anticipated for the future.
The CMB is granted extensive authority to regulate CASPs. Additionally, due to the technical complexity of crypto assets, the Scientific and Technological Research Council of Turkey (“TÜBİTAK”) is positioned as a consultant to guide the CMB on technical matters (such as ICOs, the technical criteria for security tokens, etc.). TÜBİTAK’s duties include setting technical criteria, preparing technical reports, providing opinions, and participating in inspections. Notably, TÜBİTAK is also tasked with determining the technical criteria that CASPs must meet during the licensing process, making it a significant player in this process.
The CMB announced the procedures and documents required for the license application on its official website on July 2, 2024.[3] TÜBİTAK also informed the public about its authority and duties on its official website.[4]
In this article, we will examine the timelines, procedures, and locations for CASP license applications in light of the Law and CMB announcements.
Steps in the License Application Process
In its guidance on the licensing process for CASPs, the CMB outlines the necessary information and documents required during the license application process, which are listed as annexes to the announcement: Application Documents (ANNEX -1) and Information Form (ANNEX – 2). Since the entire application process is quite new, it is crucial that the documents specified as ANNEX-1 and ANNEX-2 are meticulously prepared during the pre-application phase, which continues until August 2, 2024.
General Information and Documents to be Submitted
Key information and documents about the managers and principal shareholders of CASPs must be included in the application. Specifically, if CASPs are applying for an operating license, they need to provide the board of directors’ decision on this matter, along with the criminal record certificates from the last six months of the CEO, board members, and company partners. Additionally, if these individuals are Turkish citizens, copies of their identity cards, and if they are foreign nationals, copies of their passports, as well as copies of their diplomas and resumes, should be included in the application file.
Moreover, given that detailed information and documents about the information systems infrastructure of CASPs, technical details on how customers’ assets are safeguarded, and especially the custody infrastructure are requested, it is essential for CASPs to carefully review the documents in ANNEX-1 and ANNEX-2. Although the law does not explicitly mandate the employment of a compliance officer for CASPs, considering the current operations and risks, employing a compliance officer and including this position in the organizational chart is regarded as a critical aspect.
Additionally, it might be considered advantageous for CASPs to include their detailed business plans in the license application file submitted to the CMB. Due to the complex nature of blockchain technology, business processes can also be quite intricate. Therefore, clearly and comprehensively outlining the business plan that will be implemented post-Law enactment could be beneficial in the application process.
Among the documents that could be valuable to submit to the CMB, a detailed organizational chart of the CASP, along with resumes of the core team and information on significant partnerships they have entered into, should be included.
Compliance Policies to be Implemented During and After the Application Process
Given that blockchain technology is relatively new in the financial sector, it is important to not only comply with the Law but also anticipate potential disputes by thoroughly understanding the technology and preparing and gradually implementing appropriate compliance policies. These compliance policies should include familiar elements such as Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT), Know Your Customer (KYC) policies, data protection and privacy policies, policies related to information technology, and risk management policies. Additionally, policies addressing the specific features of blockchain technology, such as those related to custody and transfer processes, should be incorporated. It is crucial to ensure that these compliance policies are not only followed during the application process but also maintained after the license is successfully obtained.
Considerations for Foreign Exchanges
Even if a CASP does not have a physical presence in Turkey, it must obtain a license from the CMB if it targets Turkish customers through advertising, maintains a Turkish-language website, or indirectly creates any community targeting Turkish users. CASPs that do not intend to obtain a license must commence liquidation by October 2, 2024. They must also announce this on their websites and inform the CMB. This is particularly significant for foreign CASPs because, under the new Law, even activities such as advertising and marketing related to crypto assets may require a license from the CMB. Failing to comply with this requirement could lead to both criminal and administrative sanctions under the offense of “unauthorized provision of crypto asset services.”
Conclusion
The new Crypto Law, which came into effect on July 2, 2024, marks a significant step in establishing the rules of the game for the crypto asset sector. As a key result of this development, CASPs wishing to continue their operations must gather the necessary information and documents to submit a proper and lawful application to the CMB by August 2, 2024. In preparation for the application process, CASPs will benefit from support not only from compliance officers but also from legal experts, financial advisors, and technical staff, considering the range of technical, financial, and legal documentation required.
[1] https://www.bbc.com/turkce/articles/cjmyvywk8yzo (S.E.T.: 16.07.2024)
[2] https://kripto.btcturk.com/kurumsal/hakkimizda (S.E.T.: 16.07.2024)
[3] SPK, Kripto Varlık Hizmet Sağlayıcılara İlişkin Duyuru, 2 Temmuz 2024. (https://spk.gov.tr/duyurular/basin-duyurulari/2024/kripto-varlik-hizmet-saglayicilara-iliskin-duyuru) (S.E.T.: 17.07.2024)
[4] TÜBİTAK, Kripto Varlıklara İlişkin Düzenlemeler İçeren Kanun Teklif TBMM’de Kabul Edildi, 3 Temmuz 2024. (https://tubitak.gov.tr/tr/haber/kripto-varliklara-iliskin-duzenlemeler-iceren-kanun-teklifi-tbmmde-kabul-edildi) (S.E.T.: 17.07.2024)
