- within Technology topic(s)
- within Food, Drugs, Healthcare, Life Sciences, Criminal Law, Media, Telecoms, IT and Entertainment topic(s)
The Communiqué Amending the Communiqué on Remote Identification Methods to Be Used by Intermediary Institutions, Portfolio Management Companies and Crypto-Asset Service Providers and the Establishment of Contractual Relationships in Electronic Environment (III-42.1) (III-42.1.b) (the “Amendment Communiqué”), published in the Official Gazette dated 03.09.2026 and numbered 33359, introduced significant amendments to remote identification processes.
The Communiqué on Remote Identification Methods to Be Used by Intermediary Institutions, Portfolio Management Companies and Crypto-Asset Service Providers and the Establishment of Contractual Relationships in Electronic Environment (III-42.1) (the “Communiqué”), which is amended by the Amendment Communiqué, sets out the procedures and principles governing the remote identification of customers by intermediary institutions, portfolio management companies and crypto-asset service providers and the establishment of contractual relationships in electronic environment.
The Amendment Communiqué enables the remote identification of non-Turkish nationals using passports and sets out the principles governing the remote identification of legal entities registered with the trade registry and the verification of their representatives’ authority. It also introduces obligations concerning high-risk customer monitoring, address verification, money transfers and periodic reporting in respect of customers identified remotely using passports.
The key amendments introduced by the Amendment Communiqué and their potential practical implications are summarized below.
Remote Identification of Non-Turkish Nationals Using Passports Has Been Enabled
The Amendment Communiqué enables intermediary institutions, portfolio management companies and crypto-asset service providers to remotely identify non-Turkish nationals, subject to certain conditions, when establishing a continuous business relationship.
For remote identification, a passport compliant with ICAO 9303 standards and equipped with near-field communication (NFC) functionality must be used. It is mandatory to verify via NFC that the identity information stored on the passport chip matches the information displayed on the passport. If such verification cannot be completed using NFC, a business relationship may not be established through remote identification.
The passport used for remote identification will be checked for compliance with ICAO 9303 standards. In addition, the controls prescribed under the Communiqué for identity documents will also apply to passports, except for the requirement to verify information through the Identity Sharing System.
Address Information Must Be Verified Within 3 Months
The address information of persons remotely identified using passports must be obtained and verified within 3 months.
Address information will be verified within 3 months using a residence certificate, utility bills relating to address-based subscriptions such as electricity, water or natural gas issued in the person’s name within the 3 months preceding the transaction date, documents issued by any public authority, or publicly available databases of the relevant country. Where publicly available databases of the relevant country are used, verification will be carried out on a risk-based basis.
Until address verification is completed, the customer will not be permitted to make transfers of funds or crypto-assets or transfers of capital market instruments.
Technical Data and Passport Information Will Be Assessed on a Risk-Based Basis
Technical data obtained from the electronic environment through which the customer conducts transactions, including IP and port information, device identity, geolocation and browser information, will be assessed together with passport information on a risk-based basis.
If a suspicious circumstance is identified as a result of this assessment, the remote identification process will be terminated.
Remote identification using passports will be conducted by personnel specifically trained in this area through a video call. Artificial intelligence-based applications satisfying the requirements set out in the Communiqué may also be used for liveness detection or photo comparison. During the video call, images of the person and of the information displayed on the passport presented by that person must also be captured.
Customers Remotely Identified Using Passports Will Be Monitored as High-Risk Customers
Natural persons remotely identified using passports will be monitored as high-risk customers.
Where transactions inconsistent with the customer profile or the purpose of establishing the business relationship are identified, the necessary measures must be taken. In addition, the controls and measures prescribed for high-risk customers under the Communiqué and the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism will apply.
Restrictions Have Been Introduced on Money Transfers for Customers Identified Using Passports
Funds may be transferred to the account of a person remotely identified using a passport only from an account held in that person’s own name with a bank abroad. Funds may also be transferred out of such account only to a bank account held in the customer’s own name.
Money transfers within this scope may only be made through the SWIFT system. It will be checked whether the distinguishing information contained in SWIFT messages matches the information obtained from the customer during the remote identification process.
The transfer and verification procedures must be completed before any other transaction is carried out in the customer’s account.
Principles Governing the Remote Identification of Legal Entities Have Been Established
The Amendment Communiqué sets out the principles governing the remote identification of legal entities registered with the trade registry.
The identity of the legal entity’s representative will be established in accordance with the Communiqué, and the representative’s authority to represent the legal entity will also be verified. Where more than 1 person is jointly authorized to represent the legal entity, their identities may be verified during the same session or at different times. The authority to represent the legal entity will be verified by comparing the information obtained from the representative with the current information available in MERSİS and/or the Turkish Trade Registry Gazette.
Where deemed necessary by the intermediary institution, portfolio management company or crypto-asset service provider, a copy of the signature circular submitted by the representative will be recorded by taking a photograph and/or screenshot. The specimen signature contained in the signature circular will be compared with the specimen signature contained in the representative’s identity document and/or MERSİS. In addition, whether the signature circular has been notarized and its authenticity will be verified using the date and journal number indicated thereon.
It will also be checked whether the information concerning the legal entity obtained from the representative matches the current information available in MERSİS, the Turkish Trade Registry Gazette and the Revenue Administration’s database.
Measures Have Been Introduced for the Identification of Beneficial Owners
During the identification of the legal entity’s representative, the necessary measures will be taken to identify the beneficial owner of the legal entity.
If the beneficial owner cannot be identified, if there is any inconsistency among the information submitted, or if a suspicious circumstance is identified, the remote identification process will be terminated.
Accordingly, in the remote customer onboarding process for legal entities, both verification of the authority to represent the legal entity and identification of the beneficial owner are mandatory.
Existing Customers May Initiate a Remote Process for Legal Entities They Represent
Where a person authorized to represent a legal entity already holds an account with the relevant intermediary institution, portfolio management company or crypto-asset service provider, such person may submit a request through the internet branch or mobile application to establish a continuous business relationship on behalf of the legal entity represented.
In such case, once the representative logs into the internet branch or mobile application and verifies their identity, the identification process for the legal entity may continue uninterrupted through the same application.
Non-Turkish Representatives of Legal Entities May Be Remotely Identified Using Passports
Non-Turkish representatives of legal entities registered with the trade registry may also be remotely identified using passports.
For the identification of such persons, the information required under the applicable legislation to be obtained from authorized representatives must be obtained, and the requirements applicable to remote identification using passports must be fulfilled. In addition, the necessary measures must be taken to identify the beneficial owner of the legal entity.
Reports Will Be Submitted to MASAK on a Quarterly Basis
Information concerning persons accepted as customers following remote identification using passports, together with their portfolio sizes and investment amounts, will be reported to the Financial Crimes Investigation Board (“MASAK”).
Reports will be submitted in the final month of each 3-month period on a calendar-year basis.
Accordingly, intermediary institutions, portfolio management companies and crypto-asset service providers that accept customers remotely using passports must maintain the relevant information and submit it to MASAK within the prescribed period.
Entry into Force
The Amendment Communiqué, the provisions of which will be implemented by the Capital Markets Board, entered into force on 03.09.2026.
Assessment and Conclusion
The Amendment Communiqué introduces 2 significant changes regarding remote customer onboarding. Non-Turkish nationals may now be remotely identified using passports subject to certain conditions, while principles have been established for the remote identification of legal entities registered with the trade registry and the verification of their representatives’ authority.
Remote identification using passports facilitates the onboarding of persons located abroad while also introducing additional control and compliance obligations. Such persons must be monitored as high-risk customers, and their address information must be verified within 3 months. Money transfers may only be made through the SWIFT system to or from a bank account held in the customer’s own name with a bank abroad. In addition, information concerning these customers, together with their portfolio sizes and investment amounts, must be reported to MASAK on a quarterly basis.
For the remote identification of legal entities, the authority to represent the legal entity must be verified against current information available in MERSİS and/or the Turkish Trade Registry Gazette, and the beneficial owner must be identified. If the beneficial owner cannot be identified, if there is any inconsistency among the information submitted, or if a suspicious circumstance is identified, the remote identification process will be terminated.
Accordingly, intermediary institutions, portfolio management companies and crypto-asset service providers should review their existing remote customer onboarding processes, technological infrastructure and internal control mechanisms. In particular, their processes concerning passport and address verification, risk classification, money transfer controls, verification of authority to represent legal entities, identification of beneficial owners and MASAK reporting should be brought into compliance with the Amendment Communiqué.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
