Regulation On Crypto Assets: Law Amending The Capital Markets Law No. 6362

The Law No. 7518 Amending the Capital Markets Law No. 6362 ("Law") was published in the Official Gazette No. 32590 dated June 26, 2024, and has entered into force. The Law regulates the procedures and principles regarding crypto assets and crypto asset service providers.

1. Definitions Added to the Law

The necessity for the regulation is detailed in the Law's proposal justification. It states that the irregular structure of crypto assets without regulation necessitates a legal framework. It explains that the term "crypto asset" is general and encompasses various types based on their usage. Accordingly, crypto assets can be used in many different sectors for different purposes. The general categorization includes:

• "Security crypto assets" that carry rights specific to securities,
• "Electronic money crypto assets" designed for electronic payments,
• Crypto assets that develop distributed ledger technology or similar technological infrastructure and whose value cannot be separated from this technology,
• "Utility crypto assets" providing access to a service or product,
• Crypto assets that create ownership evidence similar to copyright for photos, videos, audio, artwork, and other similar items.

An important principle highlighted in the justification is the "instrument independence principle." This principle, frequently emphasized in the Law's preparation and stated to be applied globally to crypto assets, implies that crypto assets are independent of the instrument. Therefore, whatever the crypto asset represents within the existing legal framework, the law relevant to that subject will apply. For example, a share in a company acquired through crypto assets should be governed by Capital Markets Law.

Based on these explanations, the additions to the definitions section of the Capital Markets Law No. 6362 are as follows:

• "Crypto asset": Intangible assets created and stored virtually using distributed ledger technology or similar technology, distributed over digital networks, and representing value or rights.
• "Wallet": Software, hardware, system, or applications that enable the transfer of crypto assets on distributed ledger technology or similar technology and store these assets or related private and public keys online or offline.
• "Crypto asset trading platform (Platform)": Institutions where crypto asset trading transactions are carried out.
• "Crypto asset service provider": Crypto asset trading platforms, institutions providing crypto asset custody services, and institutions designated to provide services related to crypto assets in regulations issued under this Law.
• "Crypto asset custody service": The service of storing customers' crypto assets or private keys allowing transfer from the wallet and other custody services to be determined by the Board.

The Law also stipulates that the principles for issuing capital market instruments as crypto assets will be determined by the Capital Markets Board ("Board"). The Board is authorized to establish regulatory procedures, make specific and general decisions, and impose measures and sanctions regarding crypto assets that provide rights specific to capital market instruments.

2. Regulations for Crypto Asset Service Providers

Starting and operating a crypto asset service provider requires obtaining permission from the Board. Due to previously encountered fraudulent activities, detailed regulations concerning the identity of the partners have been made. Accordingly, partners of Crypto Asset Service Providers must:

• Not hold 10% or more shares in any financial institution whose license has been revoked,
• Not be bankrupt or have declared concordat,
• Not have a criminal record for property crimes or crimes against state security as stated in the Turkish Penal Code,
• Not be banned under the Capital Markets Law,
• Possess the necessary financial strength and integrity required for the business ("Subjective criteria"),
• Have a transparent and clear partnership structure.

The principles and procedures that establishments must adhere to will be determined by the Board. Similar to other financial institutions under supervision and oversight, the Board is authorized to determine the conditions for operation, organizational structures, capital, information systems, share transfers, managers, and personnel. Additionally, obtaining a report from TÜBİTAK regarding technical features is envisaged, bringing another public authority into the field. Each year, 1% of all revenues of the platforms (excluding interest income) from the previous year will be paid to the Capital Markets Board and 1% to the TÜBİTAK budget for the development of blockchain and related information technologies by the end of May of the relevant year. The principles for assessment and payment will be determined by the SPK. The application of revenue registration to the SPK and TÜBİTAK budget will begin in 2025 based on 2024 revenues.

2.1. Contract Terms

Under the Law, it is mandatory to sign a contract between crypto asset trading platforms and customers wishing to trade on these platforms. These contracts can be established in writing, remotely via communication tools, or through any method that the Board deems equivalent to a written form, using an information or electronic communication device that allows for customer identity verification.

Platforms are required to verify the identities of their customers before opening accounts in compliance with the Law No. 5549 on the Prevention of Laundering Proceeds of Crime and other relevant legislation. Consequently, platforms, like banks, will establish an identity verification system for their customers.

2.2. Keeping Records of Crypto Assets

A mechanism for intervening in crypto asset prices has been established to prevent manipulation or significant losses. It is defined as a duty for platforms, with the aim of introducing supervision in this regard. Accordingly, crimes related to crypto assets are included in the scope of manipulation crimes under the Turkish Penal Code.

Due to the pseudonymous nature of crypto assets, where users can operate semi-anonymously without direct links to their real identity, various security concerns have arisen, leading to delayed regulation and skepticism towards crypto assets in many countries.

To minimize this security risk, the Law requires the tracking of records related to wallets where customers' crypto asset transfers are carried out and bank accounts where cash transfers are made by authorized institutions.

Crypto wallets can be classified into software wallets, hardware wallets, paper wallets, and brain wallets. The Law places the responsibility for crypto assets stored in wallets on the customers themselves. However, if customers receive custody services from third parties, these services must be provided by institutions authorized by the Board and deemed appropriate by the Banking Regulation and Supervision Agency (BDDK), and customers' cash must be held in banks.

2.3. Liability for Damages

Crypto asset service providers are held liable for damages resulting from cyber attacks, technical failures, operational errors, or abuses by crypto asset service provider personnel. If damages cannot be compensated by the service providers or it is evident that they cannot be compensated, the personnel may be held liable to the extent that the damages can be attributed to them based on their faults and the circumstances.

3. Sanctions

The sanctions can be summarized as follows:

• The Board is authorized to request the strengthening of the financial structure within a period not exceeding three months or to directly suspend activities, revoke activity permissions, limit or remove signature authorities of responsible managers and employees if it determines that crypto asset service providers are unable to meet their cash payment and crypto asset delivery obligations, or if their financial situation is seriously weakened.
• If it is determined that announcements, advertisements, and notices are made on the internet in violation of the principles determined by the Board, the Information and Communication Technologies Authority may block access to the relevant website upon the Board's application. If announcements, advertisements, and notices are made through non-internet media in violation of the principles determined by the Board, responsible parties may have their announcements and advertisements stopped, and documents, announcements, and advertisements that are in violation of the law may be confiscated.
• If it is determined that investment advisory and/or portfolio management services are provided in relation to crypto assets in violation of the principles determined by the Board, the Information and Communication Technologies Authority may block access to the relevant website upon the Board's application.
• Activities conducted by foreign platforms targeting residents of Turkey without authorization will be considered unauthorized crypto asset service provision. Establishing a workplace in Turkey, creating a Turkish website, or directly or indirectly promoting and marketing crypto asset services to residents of Turkey will be deemed to constitute targeting Turkish residents.
• Individuals and officials of legal entities who conduct crypto asset service provider activities without authorization will be subject to imprisonment from three to five years and judicial fines from five thousand to ten thousand days.
• Embezzlement crimes related to crypto assets are also regulated. The board members and other personnel of crypto asset service providers who embezzle funds, documents, securities, other properties, or crypto assets entrusted to them due to their duties or are responsible for their protection, safekeeping, and oversight will be punished with imprisonment from six to twelve years and judicial fines up to five thousand days, and they will be required to compensate for the damage to the crypto asset service provider and its customers. If the crime is committed with fraudulent behavior, it is considered an aggravating factor.
• Personal liability is also regulated. Accordingly, if the management board members, other personnel, or individuals who legally or factually control the management of the crypto asset service provider are found to have made decisions and actions considered embezzlement under SPK Article 110/A, they will be personally held responsible for compensating customers' damages limited to the amount embezzled, and upon the Board's request, their personal bankruptcy can be declared by the court.

4. Conclusion

To summarize the scope of the Law:

• Definition and Application Principles of Crypto Assets: Crypto assets are broadly defined as intangible assets created and stored electronically using distributed ledger technology or similar technology, distributed over digital networks, and representing value or rights. This broad definition may lead to future challenges in innovation and regulation of crypto assets.
• Authorization Requirement for Crypto Asset Service Providers: Operating as a crypto asset service provider requires authorization. The virtual marketplace transfer has ended, and unauthorized activities will result in imprisonment and judicial fines. Many issues are left to the discretion of the regulatory board.
• Transition Period and Compliance: The changes have entered into force, and secondary regulations are expected within six months. Existing operators must comply within one month, and new applicants must submit a compliance declaration before applying.
• Customer Liability and Contract Terms: Crypto asset service providers are prohibited from including any contract terms that limit or eliminate their liability to customers. All customer agreements must comply with the legal framework.
• Inclusion of Foreign Exchanges: Foreign exchanges that provide services to Turkish residents will be subject to these regulations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.