Turkey's new crypto regulation deadline: platforms must complete custody and infrastructure compliance by March 2026

Source: BTCHaber Original Title: Critical Turn in Turkey’s Cryptocurrency Regulations: Deadline March 31 Original Link: Turkey’s operations for crypto asset service providers(KVHS) have entered a critical phase. According to the secondary regulations issued by the Capital Markets Board(SPK) in March 2025, crypto asset platforms are required to complete a series of compliance requirements by the deadline of March 31, 2026.

Key Compliance Requirements

According to Notice III-35/B.1 issued by the SPK, institutions that complete their license applications by June 30 must fulfill the following tasks by March 31, 2026:

• Sign custody agreements with at least one custodian
• Establish a mutual agreement framework with the custodian, completing necessary technical processes and integrations
• Submit relevant contracts to the Capital Markets Board

TÜBİTAK Infrastructure Standards Compliance

TÜBİTAK’s standards for information systems and technical infrastructure for KVHS require crypto asset service providers to cooperate with local Turkish custodians. The standards specify:

• The primary and secondary(backup) systems used during initialization and backup processes, including security hardware and related software, servers, etc., must be located within Turkey
• Private keys and the software and servers managing these keys must not be moved outside Turkey
• Custody technology providers must comply with TÜBİTAK standards

According to Abdulkadir Kahraman, General Manager of Paribu Crypto Asset Custody, Turkey’s crypto regulatory framework takes a clear stance on asset protection. Regulators require custodians to be able to access user assets when necessary and establish legal channels for contact. This means that merely obtaining custody technology from service providers will no longer be sufficient after March 2026.

Technical Requirements for Custody Services

TÜBİTAK infrastructure standards specify detailed requirements for wallet security in crypto asset custody services, aiming to ensure digital sovereignty of Turkey’s crypto ecosystem:

• Cold wallets must be completely offline
• Hot wallet private keys must be protected within secure hardware or environments
• Key management is to be performed solely by relevant KVHS
• Transfer transactions require multi-signature and threshold cryptography
• Authorized users must use multi-factor authentication
• All transactions must be recorded in an auditable manner
• Information security policies are to be formulated by senior management
• Operational details such as address definitions, key ownership, and transfer restrictions should have clear policy guidelines

Platforms that fail to meet compliance by March 31, 2026, will be considered non-compliant with TÜBİTAK regulations.