Amendments implemented by the Ministry of Treasury and Finance, Financial Crimes Investigation Board (“MASAK”) to the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism (“Measures Regulation”), Regulation on Program of Compliance with Obligations of Anti-Money Laundering and Combating the Financing of Terrorism (“Compliance Regulation”) and Regulation on Procedures and Principles Regarding the Electronic Notification System of the Financial Crimes Investigation Board (“E-Notification Regulation”) were published in the Official Gazette on 25/12/2024.

1. Amendments to Measures Regulation

With the amendments, cryptoasset service providers (“CASPs”) are now classified as “financial institutions” and therefore have become subject to the obligations and rights imposed on financial institutions in the legislation. The obligations that the CASPs will be subject to regarding “Identification” and “Cryptoasset transfers” are explained below.

1.1 Identification

CASPs are now obliged to carry out identification at the beginning of a permanent business relationship regardless of the amount; and in transactions of TRY 15,000 and above, including related transactions. CASPs that intermediate trading or custody of privacy-based cryptoassets are not allowed to perform remote identification.

During the establishment of permanent business relationships with real person customers, remote identification will be carried out within the scope of the procedures and principles through taking tightened measures regulated by the General Communiqué of the Financial Crimes Investigation Board (Serial No: 19); deposits and withdrawals will be executed through a bank or credit card account compatible with the customer’s identity information.

Pursuant to the General Communiqué of the Financial Crimes Investigation Board (Serial No: 5), the identification of customers onboarded by CASPs until the effective date of these amendments shall be completed through new procedures by 25/04/2025 at the latest.

1.2 Cryptoasset transfers

Information and confirmation rules applicable to the senders and receivers (travel rules), varying according to the transaction amount, have been stipulated for cryptoasset transfer transactions intermediated by CASPs; in addition, rules governing have been set for incomplete information sent between CASPs and for information that shall be included in the transfer chain between CSDs.

In cryptoasset transfers executed through entities authorised to send cryptoassets that are resident abroad and do not have information and confirmation obligations pursuant to their own legislation, or transfers from wallet addresses that are not registered with the CASPs (e.g. cold wallets), CASPs will have to receive a declaration from their customers for identification of the counterparty. Within the framework of the risk-based approach, CASPs are authorised to expand the scope of the declaration, and to abstain from executing the transfer, limit the transactions or terminate the business relationship with the relevant financial institution, in case of insufficient information.

2. Amendments to Compliance Regulation

With the amendments to the Compliance Regulation, CASPs are included in the list of “obligors to establish a compliance program” and the risk group and measures to be taken have been determined.

2.1 Obligation of composing compliance program

In line with a risk-based approach for the prevention of laundering proceeds of crime and financing of terrorism and for compliance with relevant legislation, CASPs shall prepare a compliance program covering the matters below:

1. Establishment of corporate policies and procedures,
2. Carrying out risk management activities,
3. Carrying out monitoring and control activities,
4. Appointment of a compliance officer and assistant and establishment of a compliance unit,
5. Carrying out training activities,
6. Conducting internal audit activities.

In the monitoring and control activities within the scope of the institution’s policy, measures for continuous monitoring of customers and transactions shall be taken by considering the asset freezing decisions and potential matching criteria, paying special attention to the sender and recipient information in the crypto asset transfer messages.

Operating CASPs are obliged to appoint a compliance officer and deputy compliance officer until 25/01/2025 and to establish a compliance program within one month following the relevant appointments. The corporate policies determined within the scope of the compliance program shall be sent to MASAK together with a commitment letter. 

2.2 Risk classification and measures

CASPs are included in the high-risk group; as a result of that classification, the measures listed below shall be adopted for establishing the business relationship between financial institutions and CASPs, between CASPs and their customers, as well as other transactions requiring identification:

1. Obtaining as much information as possible about the source of the assets subject to the transaction and the funds belonging to the client,
2. Obtaining information about the purpose of the transaction, and
3. Increasing the number and frequency of the controls applied and keeping the business relationship under close supervision by identifying the types of transactions that require additional controls.

In addition, appropriate measures shall be taken to set limits on the amount and number of transactions. The business relationship to be commenced between financial institutions and CASPs is subject to the approval of the senior official.

3. Amendments to E-Notification Regulation

Within the scope of the E-Notification Regulation, notifications to be executed by MASAK within the scope of the Law on the Prevention of Laundering Proceeds of Crime and the Law on the Prevention of Financing of Terrorism are to be executed electronically, and a deadline was given until 25/01/2025 for Operating CASPs to apply for opening an account.