Critical turning point in crypto regulations in Turkey: Last day March 31

Source: BTCHaber Original Title: Critical Turn in Turkey’s Crypto Regulations: Deadline March 31 Original Link: The critical phase has begun for crypto asset service providers operating in Turkey to continue their activities without interruption. The deadline for platforms to sign an custody agreement with a custodian institution and to comply with the information system and technological infrastructure criteria published by TÜBİTAK is March 31, 2026.

The operational procedures and principles for crypto asset service providers, as determined by secondary regulations published by the Capital Markets Board (SPK) in March 2025, mark a critical period in the compliance process with the legal regulations known in the public as the “crypto law” (KVHS).

The countdown has begun for the requirement that crypto asset platforms must sign an agreement with a custodian institution as part of their license application process, and for compliance with TÜBİTAK KVHS Information Systems and Technological Infrastructure Criteria, with the deadline set for March 31, 2026.

Sign at least one custody agreement by March 31

In the Circular No. III-35/B.1 on Principles of Establishment and Operation of Crypto Asset Service Providers, published by the Capital Markets Board on March 13, it was stated that entities completing their license applications by June 30 must sign an agreement with at least one custodian institution and implement the necessary technical processes and integrations within the framework of the reconciliation system by the end of December 2025. This decision was extended to March 31, 2026, with a principle decision published on December 4.

Accordingly, crypto asset trading platforms are expected to sign custody agreements with custody institutions and submit these agreements to the Capital Markets Board by March 31, 2026.

Deadline for TÜBİTAK Infrastructure Compliance is March 31

The deadline for compliance with TÜBİTAK’s KVHS Information Systems and Technological Infrastructure Criteria was set for March 31, 2026. The criteria require crypto asset service providers to work with an active custody institution in Turkey, including provisions such as “Primary and secondary (yedek) systems will use secure hardware within Turkey, along with the necessary software, servers, and similar components.”

A representative of a custody institution sharing their assessment stated that Turkey’s crypto regulation has a very clear approach, equating crypto asset custody with control over private keys. According to the regulations, wallet keys and the software and servers managing these keys cannot be taken outside Turkey, and compliance with TÜBİTAK criteria is mandatory for custody technology providers.

It was also noted that regulators want to be able to access the assets held by organizations responsible for safeguarding user assets when necessary, and to find a legal counterpart. In other words, providing crypto asset custody technology as a service alone will no longer be sufficient starting from March 31. The current operational models of crypto asset platforms operating in Turkey will be considered non-compliant with TÜBİTAK regulations after March 31.

TÜBİTAK criteria detail the technological infrastructure of KVHS

TÜBİTAK Infrastructure Criteria, which aim to strengthen wallet security in crypto asset custody services, are designed to guarantee Turkey’s digital sovereignty in the crypto space. The criteria published in May specify that cold wallets must be kept completely offline, hot wallet private keys must be protected in secure hardware or environments, and key management must be performed solely by the relevant KVHS.

The criteria include multi-approval systems and threshold cryptography for transfer operations, multi-factor authentication for authorized users, and all transactions must be recorded in an auditable manner. Additionally, it emphasizes that information security policies should be established under senior management responsibility, and operational details such as address definitions, key ownership, and transfer limits should be regulated with clear policies.