Crypto Asset Service Providers and AML A Maturing Framework
MASAK General Communiqué No. 32 and Türkiye’s AML/CFT Framework for Crypto Assets
The MASAK General Communiqué (Serial No. 32) that entered into force on 27 June 2026 may at first appear to be a modest amendment, yet it completes, on the MASAK side, the obligation framework built layer by layer since 2021. CASPs, which have been MASAK obliged entities since 1 May 2021, are now added to Article 5/A of General Communiqué No. 19 through this latest amendment, giving them an explicit routing for remote identity verification purposes as well.
We wanted to situate this amendment within the broader architecture of Türkiye’s AML/CFT framework for crypto assets. The aim goes beyond merely describing the communiqué: it is to assess the existing framework, the noteworthy recent developments, and the practical implications for industry participants.
1. Legal Foundation: A Five-Step Transformation
The AML and remote identity verification framework applicable to CASPs took shape through five successive steps.
As a first step, in May 2021 an amendment to the Measures Regulation brought CASPs within the scope of obliged entities for the first time, triggering customer due diligence, suspicious transaction reporting, and continuous information obligations.
The second step came with Law No. 7518, which entered into force on 2 July 2024. Provisions inserted into the Capital Markets Law defined CASPs for the first time at the statutory level and subjected them to SPK licensing.
The third step was the December 2024 amendment to the Measures Regulation, which upgraded CASPs to the status of “financial institution,” placing them in the same legal category as banks, brokerage firms, and payment institutions.
The fourth step was MASAK General Communiqué No. 29 of 28 June 2025, which introduced enhanced measures specific to CASPs: a holding period of at least 48 hours before a crypto-asset may be withdrawn or transferred following its purchase, swap, or deposit, 72 hours for the first withdrawal, stablecoin transfer limits, and source-of-funds verification requirements.
The fifth step was SPK Communiqué III-42.1.a of 28 February 2026. This amendment extended the scope of Communiqué III-42.1 to cover CASPs by name, bringing them within the same SPK remote identity verification and electronic contract framework as brokerage firms and portfolio management companies.
Communiqué No. 32 of 27 June 2026 is the completing link in the MASAK dimension of this obligation architecture: CASPs are now unambiguously positioned within Article 5/A, and the routing for remote identity verification is placed beyond doubt.
2. Articles 5/A and 4/C: Two Critical Mechanisms
Article 5/A of Communiqué No. 19 is a “routing” provision that specifies which particular communiqué or framework each category of obliged entity must follow for remote identity verification. While banks apply the general framework, brokerage firms, portfolio management companies, and CASPs are directed to SPK’s Communiqué III-42.1, and payment and e-money institutions to their own dedicated communiqués.
Prior to Communiqué No. 32, CASPs were absent from this list. The amendment places them alongside portfolio management companies. The critical background is this: SPK Communiqué III-42.1.a of 28 February 2026 had already extended the name and scope of III-42.1 to cover CASPs expressly. Communiqué No. 32 is the link that connects the two through Article 5/A; CASPs are now routed to III-42.1 in the same manner as portfolio management companies.
The second of these mechanisms is the remote identity verification regime for foreign natural persons, introduced by the new Article 4/C. Under this provision, the identity of non-Turkish natural persons may be verified remotely by means of an ICAO 9303-compliant, NFC-enabled passport combined with a video call.
For CASPs that onboard foreign users, this mechanism has direct operational significance: address confirmation must be completed within three months at the latest, nationals of countries that an obliged entity classifies as risky in its own risk assessment may not be onboarded through this method, and customers acquired via this route are automatically classified as high-risk.
In practical terms, CASPs now have a complete framework for remote identity verification on both the SPK, III-42.1, and MASAK, Article 5/A and Article 4/C of Communiqué No. 19, dimensions. AI-based liveness applications are expressly permitted under Article 4/C of Communiqué No. 19, and liveness detection is likewise provided for under III-42.1.
3. International Context: FATF and CARF
Reading this communiqué amendment through a purely domestic lens would leave the picture incomplete. Two international dynamics are determinative in the broader context.
The first is the FATF process. Türkiye was placed on FATF’s enhanced monitoring list, the “grey list,” in 2021 and was removed in 2024. During that process, aligning crypto asset regulation with international standards, most notably bringing virtual asset service providers within the scope of obliged entities under FATF Recommendation 15, featured prominently as a key commitment. The 27 June amendment serves to sustain and reinforce that commitment.
The second dynamic is CARF, the Crypto-Asset Reporting Framework developed by the OECD and to which Türkiye has committed with a 2028 implementation target. This automatic exchange-of-information framework requires CASPs to report tax-related data on their users to tax administrations.
A robust KYC infrastructure is a prerequisite for CARF to function effectively; strengthening the remote identity verification regime therefore also prepares the technical basis for the forthcoming CARF obligations.
4. Practical Implications
The regulatory change carries three practical dimensions for the sector.
Compliance programme review: Given the addition of CASPs to Article 5/A and the fact that III-42.1.a is already in force, existing compliance programmes need to be reviewed for consistency with both the SPK and MASAK frameworks. Structuring identity verification procedures, customer acceptance policies, and internal control mechanisms in accordance with the coordination requirements between III-42.1 and Communiqué No. 19 is of critical importance.
Opportunities: New Article 4/C of Communiqué No. 19 expressly permits AI-based liveness applications and the remote verification of foreign natural persons by means of an NFC-enabled passport, while III-42.1 provides the SPK-side regulatory basis for these processes. The regulatory legitimacy of CASP business models built on digital onboarding has been considerably strengthened by these two frameworks. For platforms with a foreign user base, Article 4/C also opens a practical onboarding route.
Points requiring attention: Customers acquired under Article 4/C are automatically classified as high-risk, and the money transfer restrictions that apply to them require operational processes to be designed accordingly. Because nationals of countries that the entity itself classifies as risky may not be onboarded through this method, platform policies also require country-level updates.
5. Assessment
Communiqué No. 32 of 27 June 2026 confirms that the obligation side of Türkiye’s AML/CFT framework for crypto assets has now, in large part, matured. Since 2021 the framework has come together through five steps: obliged-entity status; the statutory definition and SPK licensing under Law No. 7518; the financial institution classification; the enhanced measures of Communiqué No. 29; and the integration of CASPs into the SPK remote identity verification regime under III-42.1. Communiqué No. 32 now adds the Article 5/A routing that ties these together.
What remains is mainly a question of implementation. Three matters in particular will stay on the sector’s agenda: the foreign-customer processes under Article 4/C; the coordination of the parallel SPK and MASAK obligations; and the reporting requirements that CARF will introduce from 2028.
For CASPs, it is worth following these closely, in order to keep compliance costs manageable and to take advantage of the openings the new framework creates.