SPK-Licensed Crypto Exchanges: What the Licence Actually Covers

An SPK-licensed crypto exchange is a platform authorised by Turkey's Sermaye Piyasası Kurulu (Capital Markets Board) under the crypto asset framework that took effect in 2024. The licence lets a firm run a trading platform for Turkish residents, and it's issued alongside TÜBİTAK's technical review and MASAK anti-money-laundering checks. For a Turkish trader, "SPK licensed" is the closest thing to a regulatory green light. It is not a guarantee of safety.

Why Turkey built a licensing regime

For years, lira holders treated crypto as an escape hatch. Inflation ran hot, the currency slid, and exchanges operated in a grey zone where nobody could say who was accountable when things broke. The 2024 law changed that by requiring platforms serving Turkish users to obtain SPK authorisation.

The rules landed in stages. First came the licensing framework and the ban on foreign platforms operating without permission. Then tax reporting. Then the operational requirements — custody rules, segregation of customer assets, and minimum capital thresholds that vary by licence type.

What the licence requires

Platforms must keep customer crypto separate from company holdings, maintain audited financials, and report suspicious activity to MASAK. Founders and senior managers face background checks. The SPK can suspend or revoke a licence, which is the point — it gives regulators a lever that simply didn't exist before.

What it doesn't require

An SPK licence doesn't cover deposit insurance the way a bank does. It doesn't promise your coins are safe if the exchange's internal controls fail. And it doesn't apply to platforms you reach through a VPN from abroad.

The gap between "licensed" and "safe"

Licensing raises the floor. It doesn't raise the ceiling.

Take a trader — call him Emre — who moved 180,000 lira worth of BTC onto a licensed Turkish platform in early 2025 because the licence badge made him comfortable. He reused the same password he'd used on three other sites. A credential-stuffing attack drained his account. The exchange was fully licensed and fully compliant. His coins still vanished. The licence regulated the company, not his opsec.

That isn't a knock on the SPK. It's a reminder about what regulation can and can't do.

How to check whether a platform is genuinely licensed

Don't trust a badge on a homepage. Anyone can paste an image.

• Check the SPK's own list. The board publishes authorised platforms. If a name isn't there, the claim is marketing.
• Look at the legal entity name. A licensed Turkish subsidiary is not the same as a global parent. Your counterparty is the entity on your account agreement.
• Read the custody terms. Who holds the private keys? Is customer crypto segregated? Vague answers are a signal.
• Confirm MASAK registration. Licensing and AML registration are separate steps; a serious platform has both.

Five minutes on the SPK site beats an hour in a platform's own FAQ.

Where global exchanges fit

Large international platforms have approached Turkey carefully. Coinbase, for instance, operates under a patchwork of national licences globally rather than one passport covering every market, so Turkish users should check which entity actually services them before assuming any regulatory protection applies. A familiar brand name is not the same as local authorisation.

Before you deposit

Verify the entity on the SPK register. Turn on two-factor authentication with an app, not SMS — SIM swapping is real in Turkey. Test a small withdrawal first; a 500-lira test tells you more about an exchange's withdrawal process than any review. Keep records of every trade, because Turkish tax reporting now expects them.

Licensing is a starting filter, not a finish line. Spend ten minutes on the SPK register before your next deposit — that's the whole job.