GENERAL CIRCULAR OF THE FINANCIAL CRIMES INVESTIGATION BOARD (SERIAL NO. 19) NOTICE REGARDING AMENDMENTS (SERIAL NO. 32)
IMPORTANT CHANGES FOR CRYPTO EXCHANGES
The Circular Regarding Amendments to the Financial Crimes Investigation Board General Circular (Serial No. 19) (Serial No. 32), published in the Official Gazette on June 27, 2026, introduces significant changes to Serial No. 19, which is MASAK’s core identity verification circular.
The main purpose of these amendments is to regulate the remote identification of non-Turkish nationals (foreigners) using NFC-enabled biometric passports compliant with the ICAO 9303 standard and to subject this process to strict controls by classifying it as high-risk.
These regulations also more clearly encompass crypto-asset service providers (CASPs) and expand certain definitions.
Below, you will find a detailed, article-by-article explanation, along with our analysis of the changes—including their practical significance and examples.
ARTICLE 1 – Update to the Definition of “Financial Institution”
Change: The definition of “financial institution” in Article 3 of Circular No. 19 has been expanded to include the entities subject to the obligations set forth in Article 3, Paragraph 1(f) of the Regulation on the Prevention of Money Laundering and Terrorist Financing.
Implications for Implementation:
The definition is now more comprehensive. In particular, it has become easier for crypto asset service providers and other new obligated entities to fall under the scope of this circular.
Example: A cryptocurrency exchange will now be classified as a “financial institution” and will be required to implement remote identity verification rules.
ARTICLE 2 – Newly Added ARTICLE 4/C (Most Important Provision)
It would be accurate to say that this provision is the heart of this circular. Rules are being introduced for the remote identification of non-Turkish citizens using ICAO 9303-compliant, NFC-enabled passports.
If we were to evaluate the detailed rules and their practical application:
a) Personnel and Method Remote identity verification must be conducted via video call by personnel who have received specialized training in passport-based remote identity verification.
Artificial intelligence (liveness detection + photo comparison) may be used, but the requirement for staff training remains in effect.
Importance of Implementation:
Banks and KVHSs are required to provide specialized training to their staff.
This will entail operational costs and time.
b) NFC Verification (The Most Critical Security Measure)
The identity information stored on the passport’s chip must be compared via NFC with the printed information on the passport. If verification fails, a remote connection cannot be established under any circumstances.
Importance of Implementation:
It largely eliminates the risk of counterfeit passports. The chip can be read using the phone’s NFC feature.
c) Address Verification
Address information obtained remotely must be verified within 3 months at the latest through the following methods:
- Proof of residence
- Utility bill from the last 3 months (electricity, water, natural gas, etc.)
- Document from a public institution
- Publicly available databases of the relevant country
- No money transfers or cash withdrawals can be made without address verification.
Example: A German citizen opens an account remotely. They provide their home address in Berlin. If the bank does not verify the address within 3 months using a German public database or a utility bill, the customer cannot send money or withdraw cash.
d) Risk Assessment Using Technical Data
Technical data such as IP address, device ID, geographic location, and browser information are evaluated on a risk-based basis. In suspicious cases, the process is automatically terminated.
e) Legal Entities
For companies registered in the commercial register, the identity verification of a foreign natural person authorized to represent the company may be conducted according to the same rules.
f) Risk Management and Reporting Obligation (Article 4/C-3)
Obligated Parties:
- Must identify, assess, monitor, and implement risk mitigation measures.
- They must develop an implementation guide.
- Those with a compliance program must incorporate these measures into their policies.
- They may not accept citizens of high-risk countries through this method.
- They must report the measures, procedures, and guidelines adopted within one month of beginning to accept customers to the MASAK Presidency.
Importance of Compliance:
This is one of the issues MASAK prioritizes most highly. Institutions are required to submit a written notification to MASAK within one month; otherwise, they risk an administrative fine.
g) Citizenship or Taxpayer Status
If a person subsequently becomes a Turkish citizen or is registered as a taxpayer in Turkey, their Turkish ID card or tax identification number must be added to the system.
h) High-Risk Customer Status and Enhanced Measures (Most Important Section)
Customers acquired through this method are automatically classified as high-risk. In addition, the following mandatory measures are applied:
First Money Transfer Requirement:
A funds transfer must be made from the customer’s own domestic or foreign bank account or credit card, consistent with their identity information. This transfer must be completed before any other transaction is conducted from the account.
The identifying information (reference) in the message must match the information provided during remote identity verification.
Example: A Swiss customer is opening an account. The bank says, “Please send 100 euros from your own UBS account.” When the funds arrive, the information in the message is verified. If this is not done, no other transactions can be performed on the account.
Account Restrictions:
Funds can only be transferred to the account from accounts held in the person’s own name abroad.
Funds may only be transferred from the account to the individual’s own accounts abroad.
(However, these restrictions are lifted if standard identity verification is performed under paragraph 2 of Article 6.)
For cash deposits and withdrawals, Article 18 of the Regulation (cash limits) applies.
i) Statistical Reporting
Statistical information regarding customers accepted through this method must be submitted to MASAK every three months.
ARTICLES 3, 4, and 5 – Other Technical Amendments
- ARTICLE 3: A reference in Article 5 has been updated (Article 4 → Article 4/A).
- ARTICLE 4: “Crypto Asset Service Providers” have been explicitly added to Article 5/A. Crypto Asset Service Providers are now more clearly subject to certain provisions of this circular.
- ARTICLE 5: In Article 6, the phrase “financial institutions and certain non-financial businesses and professions” has been replaced with “Obligated Entities” → The scope has been expanded.
General Assessment and Implementation Recommendations
|
Topic |
Importance |
Practical Impact |
Risk Level |
|
NFC Passport Verification |
Significantly reduces the risk of counterfeit passports |
Requires a system investment (NFC reader/app) |
High |
|
High Risk + First Transfer |
Makes money laundering more difficult |
Negatively impacts the customer experience |
Very High |
|
MASAK Report Within 1 Month |
Facilitates audits |
Requires preparation of emergency procedures for compliance departments |
High |
|
Inclusion of Crypto Assets |
Clearly covers KVHSs |
New compliance burden for crypto exchanges |
Medium-High |