Introduction

The Communiqué Amending the Communiqué on Remote Identity Verification Methods to Be Used by Brokerage Firms, Portfolio Management Companies and Crypto Asset Service Providers and the Establishment of Contractual Relationships in an Electronic Environment (III-42.1) (III-42.1.b) (the “Amending Communiqué”), published in the Official Gazette dated 3 September 2026 and entering into force on the same date, introduced significant amendments to remote identity verification processes. The Amending Communiqué sets out the procedures and principles governing the remote onboarding of non-Turkish natural persons and legal entities registered with the Trade Registry.

Expansion of the Scope of Remote Identity Verification

Natural person merchants and natural persons authorized to represent legal entities have been expressly included among the persons whose identities may be verified remotely. In addition, the concepts of “beneficial owner,” “Central Registry Record System (MERSİS),” “Turkish Trade Registry Gazette” and “legal entity registered with the Trade Registry” have been defined. Accordingly, in addition to individual customers, the remote customer onboarding framework now expressly encompasses natural person merchants and legal entities registered with the Trade Registry.

Passport-Based Remote Identity Verification for Non-Turkish Natural Persons

Non-Turkish natural persons may be onboarded remotely by using passports that comply with ICAO Document 9303 and support near-field communication (“NFC”). If the information stored on the passport chip cannot be verified through NFC, the remote identity verification process cannot be completed.

The customer’s address must be verified within three months at the latest, based on a risk-based approach, by means of a certificate of residence, an electricity, water or natural gas bill issued within the preceding three months, a document issued by a public authority or a publicly accessible database of the relevant country. Until the address verification process has been completed, no transfers of funds or crypto assets or transfers of capital market instruments may be carried out.

During the identity verification process, technical data obtained from the electronic environment through which the customer conducts the transaction—including IP and port information, device identification data, geographical location and browser information—will be assessed together with the passport information on the basis of a risk-based approach. If any suspicious circumstances are identified, the process will be terminated.

Persons onboarded remotely through passport-based identity verification will be monitored as high-risk customers. Where transactions inconsistent with the customer’s profile or the purpose of the business relationship are identified, the necessary measures will be taken.

Funds may be transferred into such customers’ accounts only from bank accounts held in their own names with banks located abroad. Likewise, funds may be transferred out of such accounts only to bank accounts held in the relevant customers’ own names. All such transfers must be carried out through the Society for Worldwide Interbank Financial Telecommunication (“SWIFT”) system. Before any other transaction is carried out on the account, it must be verified that the identifying information contained in the relevant SWIFT message corresponds to the customer information obtained during the remote identity verification process.

Information concerning customers onboarded through this method, together with their portfolio sizes and investment amounts, must be reported to the Financial Crimes Investigation Board (“MASAK”) during the final month of each three-month period, calculated on a calendar-year basis.

Video calls must be conducted by personnel who have received specific training on the security features of passports and passport forgery methods.

Authority to Represent Legal Entities and Beneficial Ownership Checks

The provisions of Article 4/B of the MASAK General Communiqué (Serial No. 19) will apply to the remote identity verification of legal entities registered with the Trade Registry. The representative’s identity will be verified, and their authority to represent the legal entity will be confirmed by reference to up-to-date information available through MERSİS and/or the Turkish Trade Registry Gazette.

Where a legal entity is represented jointly by more than one representative, the representatives may complete the identity verification process either during the same session or at different times. A representative who already holds an account with the relevant institution may initiate the remote identity verification application on behalf of the legal entity through the institution’s internet branch or mobile application.

Where deemed necessary, an image of the signature circular may be obtained, and the specimen signature contained in the circular will be compared with the signature appearing on the identity document and/or in MERSİS. The notarization and authenticity of the signature circular will also be verified by reference to the date and journal number indicated thereon.

Information concerning the legal entity will also be cross-checked against data obtained from MERSİS, the Turkish Trade Registry Gazette and the Revenue Administration. During the identity verification process, the necessary measures must be taken to identify the legal entity’s beneficial owner. If the beneficial owner cannot be identified, if any inconsistency is detected among the information provided or if any suspicious circumstances arise, the remote identity verification process will be terminated.

The Amending Communiqué therefore requires the relevant institutions to review their remote customer onboarding, technical verification, transaction monitoring and MASAK reporting processes in light of the new provisions.