İstanbul, Türkiye | Publication | September 2026

New CMB Rules on Remote Identification

Authors: Dr. Ceylan Necipoğlu, LL.M. , CIPP/E, Zeynep Uçar

The Capital Markets Board (“CMB”) amended the Communiqué on Remote Identification Methods to be Used and Establishment of Contractual Relationships in Electronic Environment by Intermediary Institutions, Portfolio Management Companies and Crypto Asset Service Providers (III-42.1) (the “Communiqué”) through an amendment published in the Official Gazette dated 3 September 2026.

The key changes introduced by the amendment are summarised below:

  • Remote identification of non-Turkish natural persons: Following the regulation introduced by the Financial Crimes Investigation Board (“MASAK”) on 27 June 2026, a similar framework has now been incorporated into the Communiqué. Accordingly, intermediary institutions, portfolio management companies and crypto asset service providers may remotely identify non-Turkish natural persons using passports that comply with International Civil Aviation Organization Standard 9303 and are equipped with near-field communication (NFC) functionality.
  • Additional SWIFT requirement: Unlike the MASAK framework, fund transfers relating to accounts opened through passport-based remote identification must be carried out exclusively through the SWIFT system and between accounts held in the customer’s own name. In addition, the identifying information contained in the relevant SWIFT messages must be matched against the information obtained from the customer during the remote identification process before any other transaction is carried out through the customer account.
  • Quarterly reporting to MASAK: Information on customers onboarded through remote identification, together with their portfolio sizes and investment amounts, must be reported to MASAK in the last month of each three-month period on a calendar-year basis.
  • Remote identification of legal entities: Intermediary institutions, portfolio management companies and crypto asset service providers may now also remotely identify legal entities registered with the trade registry. In this context, the authority of persons authorised to represent the legal entity must be verified through the Central Registry System (MERSİS) and/or the Turkish Trade Registry Gazette, and the ultimate beneficial owner must be identified.

The amendments entered into force on 3 September 2026.