Critical turning point in crypto regulations in Turkey: Last day March 31

Source: BTCHaber Original Title: Critical Turn in Turkey’s Crypto Regulations: Deadline March 31 Original Link: The critical phase has begun for crypto asset service providers operating in Turkey to continue their activities without interruption. The deadline for platforms to sign an custody agreement with a custodian institution and to comply with the information systems and technological infrastructure criteria published by TÜBİTAK is March 31, 2026.

The operational procedures and principles for crypto asset service providers, as determined by secondary regulations published by the Capital Markets Board (SPK) in March 2025, mark a critical period in the compliance process with the legal regulations known in the public as the “crypto law” (KVHS).

The CMB’s requirement that crypto asset platforms must sign an agreement with a custodian institution as part of their license application process is still valid, and the countdown has begun for the March 31, 2026 deadline set for compliance with TÜBİTAK KVHS Information Systems and Technological Infrastructure Criteria.

Sign at least one custody agreement by March 31

In the Circular No. III-35/B.1 titled “Establishment and Operating Principles of Crypto Asset Service Providers” published by the CMB on March 13, it was stated that entities completing their license applications by June 30 must sign an agreement with at least one custodian institution and implement the necessary technical processes and integrations within the framework of the reconciliation system by the end of December 2025. This decision was extended to March 31, 2026, with a principle decision published on December 4. With the start of the first quarter of the new year, the critical process for compliance with the custodian criteria set by regulators has also begun.

Accordingly, crypto asset trading platforms are expected to sign custody agreements with custodian institutions and submit these agreements to the Capital Markets Board by March 31, 2026.

Deadline for TÜBİTAK Infrastructure Criteria compliance is March 31

The deadline for compliance with TÜBİTAK’s KVHS Information Systems and Technological Infrastructure Criteria was set for March 31, 2026. The criteria requiring crypto asset service providers to work with an active custodian institution in Turkey include provisions such as: “Within the scope of initialization and backup, primary and secondary (backup) systems shall use secure hardware, software, servers, and similar components located within Turkey’s borders.”

Paribu Crypto Asset Custody Company Inc. General Manager Abdulkadir Kahraman shared his views on the matter, stating, “Turkey’s crypto regulation has a very clear approach that equates crypto asset custody with control over private keys. The regulations specify that wallet keys and the software and servers managing these keys cannot be taken outside Turkey’s borders. They also require compliance with TÜBİTAK criteria for custody technology providers. Regulators want to be able to access the entities holding custody when necessary to protect user assets and to find a legal counterpart in this process. In other words, acquiring crypto custody technology as a service will no longer be sufficient starting March 31. The current way crypto platforms operate in Turkey will be considered ‘non-compliant’ with TÜBİTAK regulations from that date.”

TÜBİTAK criteria detail the technological infrastructure of KVHS

The TÜBİTAK Infrastructure Criteria, which aim to strengthen wallet security in crypto asset custody services, are designed to guarantee Turkey’s digital sovereignty in the crypto space. The criteria published in May stipulate that cold wallets must be kept completely offline, hot wallet private keys must be protected in secure hardware or environments, and key management must be performed solely by the relevant KVHS.

The criteria also include provisions for multi-approval systems and threshold cryptography in transfer processes, multi-factor authentication for authorized users, and all transactions being recorded in an auditable manner. Additionally, it emphasizes that information security policies should be established under senior management responsibility, and operational details such as address definitions, key ownership, and transfer limits should be regulated with clear policies.