On 3 September 2026, Turkey’s Capital Markets Board (Sermaye Piyasası Kurulu – CMB/SPK) published Communiqué No. III-42.1.b, amending the country’s rules on remote identification and electronic establishment of contractual relationships.

The amendment is particularly relevant for foreign investors, internationally mobile individuals, Turkish investment institutions and crypto asset service providers.

Most importantly, the new rules create a specific legal framework under which a non-Turkish individual may complete remote identity verification using a qualifying passport rather than being physically present in Türkiye for the onboarding process.

1. Who is covered by the new rules?

The framework applies to customer onboarding performed by:

• brokerage firms;
• portfolio management companies; and
• crypto asset service providers subject to the relevant Turkish capital markets framework.

2. Foreign individuals can now be identified remotely using a passport

The newly introduced Article 8/A establishes a dedicated remote identification procedure for individuals who are not Turkish nationals.

A participating institution may establish the customer relationship remotely where the individual uses a passport that:

• complies with ICAO Document 9303 standards;
• contains a readable electronic chip; and
• supports Near Field Communication (NFC).

Information stored on the passport chip must be electronically checked against the information appearing on the physical passport.

3. A video identification process remains part of the framework

Remote identification must generally be conducted through a video interview by personnel specifically trained in passport-based remote customer identification.

During the interview, images showing both the individual and the information displayed on the passport must be recorded.

The regulation also expressly accommodates the use of qualifying artificial intelligence-based applications for functions such as:

• liveness detection; and
• facial/photo comparison.

This provides a regulatory foundation for increasingly automated KYC processes, while maintaining human and AML controls around the onboarding process.

4. Address verification is a critical condition

Remote identification does not end with passport verification.

The customer’s address must also be obtained and subsequently verified through acceptable evidence, which may include:

• a residence certificate;
• a recent electricity, water, gas or similar utility bill;
• a document issued by a public authority; or
• publicly available databases of the relevant foreign jurisdiction, using a risk-based approach.

Where applicable, supporting documentation must generally be sufficiently recent, and address verification must be completed within the regulatory timeframe.

5. IP address, device and geolocation data become part of KYC

The institution must evaluate technical information obtained from the electronic environment through which the customer is transacting.

This may include:

• IP and port information;
• device identifiers;
• geographical location;
• browser information; and
• similar technical data.

These data points must be assessed together with the passport information under a risk-based AML approach.

Where inconsistencies or suspicious circumstances are identified, the remote identification process must be terminated.

6. Foreign customers onboarded by passport are treated as high risk

One of the most significant compliance elements of the amendment is that individuals identified remotely through the passport procedure are to be monitored within the high-risk customer category.

Institutions will therefore be expected to apply enhanced monitoring and respond where transaction patterns are inconsistent with:

• the customer’s known profile;
• the stated purpose of the relationship; or
• the expected nature and volume of investment activity.

In other words, the regulation improves accessibility for foreign investors while simultaneously increasing the importance of ongoing AML and transaction-monitoring systems.

7. Funding the account: strict own-account and SWIFT rules

The new framework contains a particularly important restriction concerning funding.

For customers identified remotely using the passport procedure, money may initially be transferred to the relevant customer account only from a foreign bank account held in the same customer’s own name.

The regulation also requires the relevant cross-border money transfer process to operate through the SWIFT system.

Institutions must compare identifying information included in SWIFT messages with the information collected during customer onboarding.

These controls must be completed before other transactions are carried out in the customer account.

8. Turkish companies can also be remotely onboarded

The amendment goes beyond individual foreign customers.

It also introduces detailed procedures for the remote identification of legal entities registered with the Turkish trade registry.

The identity and representation authority of the company’s authorised representative must be verified.

Information may be cross-checked using Turkish public and commercial databases including:

• MERSİS – the Central Registry Record System;
• Turkish Trade Registry Gazette; and
• Revenue Administration databases.

9. Beneficial ownership is a mandatory part of corporate onboarding

Institutions must take the necessary steps to identify the company’s ultimate beneficial owner.

The remote onboarding process must be terminated where:

• the beneficial owner cannot be identified;
• information supplied by the customer conflicts with official records; or
• suspicious circumstances are identified.

This is particularly relevant for international corporate structures involving foreign shareholders, holding companies or multi-jurisdictional ownership chains.

10. Existing representatives may receive a faster corporate onboarding route

Where a person authorised to represent a Turkish legal entity already maintains an account with the same brokerage firm, portfolio management company or crypto asset service provider, the new corporate relationship may in certain cases be initiated through the institution’s existing internet banking-style interface or mobile application.

This may materially simplify onboarding for founders, directors and professional managers responsible for multiple corporate investment relationships.

11. New quarterly reporting to MASAK

Institutions accepting customers through the passport-based remote identification procedure must report relevant information to Turkey’s Financial Crimes Investigation Board (MASAK) on a quarterly basis.

The reporting covers information regarding such remotely acquired customers as well as their portfolio sizes and investment amounts.

This reporting obligation reinforces the broader policy direction: remote access is being expanded, but within a highly traceable regulatory environment.

What actually changes?

What does this mean for foreign investors?

For international investors, the amendment could be commercially significant.

Subject to the relevant institution implementing the new procedure, a foreign investor may potentially establish a Turkish investment relationship without travelling to Türkiye simply to complete identification formalities.

This may be especially relevant for:

• foreign individuals investing in Turkish capital markets;
• internationally mobile entrepreneurs;
• foreign shareholders and directors of Turkish companies;
• HNWI and family-office clients;
• foreign users of regulated Turkish crypto asset platforms; and
• international businesses establishing investment or treasury operations in Türkiye.

However, the communiqué gives regulated institutions a legal route to use remote identification. It should not be read as requiring every Turkish institution to immediately offer remote onboarding to every foreign applicant.

Individual institutions may continue to apply their own risk appetite, internal compliance procedures and documentary requirements.

The bigger picture: easier access, stronger traceability

Strategically, the amendment reflects a wider shift in Turkish financial regulation.

The direction is not simply toward easier digital access. It is toward digitised but traceable access.

Three themes are visible:

1. Remote access: physical presence requirements can increasingly be replaced by technology.
2. Data integration: passport chips, MERSİS, registry records, tax databases and technical device data are increasingly interconnected.
3. AML intensity: broader digital access is accompanied by enhanced monitoring, beneficial ownership checks and MASAK reporting.

Action checklist for foreign investors

1. Check your passport.
   Confirm that it is an electronic biometric passport with a functioning NFC-readable chip and ICAO-compliant data structure.
2. Prepare recent proof of address.
   Utility bills, residence documents or equivalent public records should be available.
3. Use a bank account in your own name.
   Ensure the overseas funding account exactly matches the identity used during onboarding.
4. Expect enhanced KYC.
   Source-of-funds, investment profile and transaction-purpose questions may form part of the institution’s risk assessment.
5. For corporate investors, map the ownership chain.
   Company representatives should ensure that corporate registration records, representation authority and beneficial ownership information are current and consistent.

Effective date

Communiqué No. III-42.1.b was published in Official Gazette No. 33359 on 3 September 2026 and entered into force on the same date.