TÜBİTAK Informatics and Information Security Advanced Technologies Research Center of Türkiye has published the long-awaited Information Systems and Technological Infrastructure Criteria for Crypto Asset Service Providers (“Infrastructure Criteria”). The version of the document with revision code 1.0, dated April 30, 2025, has been publicly released. This document had previously circulated in draft form, but the draft was later removed from publication.
The Infrastructure Criteria first emerged in connection with Article 35/B, added to the Capital Markets Law, which states: “For the authorization of the establishment and/or commencement of operations of crypto asset service providers by the Board, compliance with the criteria to be determined by TÜBİTAK regarding information systems and technological infrastructure shall be required.”
Later, secondary regulations concerning crypto asset service providers (published in the Official Gazette on March 13, 2025) also included provisions referencing the Infrastructure Criteria. These include, for example, the requirement of compliance with the Infrastructure Criteria in order to commence operations; compliance in the procurement of information security and distributed ledger network integration services; and compliance with the criteria for wallets, custody, and hardware.
The detailed Infrastructure Criteria, consisting of 36 pages in total, cover a wide range of topics including wallet technology and security, information and application security, top management responsibility, risk management, identity and access management, data privacy and security, change management, outsourcing, physical and environmental security, cloud computing, distributed ledger integration, and crypto asset locking.
In addition, the Infrastructure Criteria include an annex titled “Guide to Technical Infrastructure Concepts in Crypto Asset Custody”, which explains certain key concepts in detail using graphics and diagrams.
You can access the Infrastructure Criteria at the following URL:
https://bilgem.tubitak.gov.tr/kvhs/
For detailed information and professional support during the compliance process, feel free to contact us.
This Legal Alert has been prepared for general information purposes only on current legal issues, and the evaluations contained in this Legal Alert do not constitute legal advice or a legal opinion. It is not possible to impose any liability on SRP-Legal Law Office due to the content of this Legal Alert. It is recommended to obtain the opinion of a legal advisor regarding your questions and enquires within the scope of this Legal Alert.
