CMS Expert Guide to Crypto Regulation in Turkiye

The December 2024 amendments to the AML legislation impose further obligations on cryptoasset service providers to enhance transparency and accountability. The following sections provide detailed insights into certain obligations of cryptoasset service providers under AML legislation:

• Financial Institution Status

Financial institutions, such as banks, insurers, and portfolio management firms, are subject to extended obligations and certain opportunities under the AML legislation, compared to obligors, which encompass financial institutions as a subset. With the December 2024 amendments, cryptoasset service providers are now classified as financial institutions. Consequently, regulations that already apply to financial institutions are now extended to include cryptoasset service providers. These regulations involve taking measures against technological risks, utilizing the third-party principle (acting based on measures taken by another financial institution), and managing relationships with high-risk countries.

• KYC Procedures

Cryptoasset service providers must identify customers in the following scenarios:

1. Establishing a continuous business relationship, regardless of the transaction amount.
2. Carrying out transactions whose amount, or the total amount of more than one interconnected transaction, exceeds TRY 15,000.
3. Conducting electronic transfers and crypto-asset transfers when the transaction amount or the total amount of more than one interconnected transaction exceeds TRY 15,000.
4. When there are suspicious transactions or doubts regarding previously obtained customer information, irrespective of transaction size.

Effective from 25 February 2025, cryptoasset service providers must include the following information in cryptoasset transfer messages for transactions of TRY 15,000 or more.

1. Name/title/trade name of individuals and entities.
2. Wallet address of the sender, or a transaction reference number in the absence of a wallet address.
3. At least one identifying detail, such as address, customer number, ID number, tax ID number, passport number, or other unique identifiers.

The accuracy of these details must be verified before the transaction is processed. For recipients, information under (i) and (ii) must be included in the transfer message; however, verification of recipient details is not mandatory.

For transactions below TRY 15,000, transfer messages must still include the information under (i) and (ii) for both sender and recipient, but no verification obligation applies.

All cryptoasset service providers intermediating the transfer must include the required information for sender in the transfer messages.

If a transfer message lacks the required information, the receiving cryptoasset service providers must request the missing details from the sender cryptoasset service providers. If the information is not provided, the receiving cryptoasset service providers are obligated to return the transfer. In cases of repeated non-compliance, the receiving cryptoasset service providers should consider rejecting further transfers from the sender cryptoasset service providers or terminating the business relationship altogether.

In cross-border transfers involving foreign cryptoasset service providers or financial institutions that are not required by their own legislation to share information about the sender and the recipient, the service provider shall obtain from the customer involved in the transfer a declaration regarding at least one piece of information that can be used to identify the sender or the recipient.

• Compliance Program

Cryptoasset service providers must implement a compliance program designed to address risks associated with money laundering and financing of terrorism. The program must be operational within one month of appointing a compliance officer. The deadline for the appointment of a compliance officer, who will oversee the implementation and operation of the program is set for 25 January 2025.

The compliance program must include a comprehensive set of internal policies and procedures tailored to the specific risks cryptoasset service providers face. These policies should cover risk assessment, management, and mitigation strategies. Cryptoasset service providers must establish mechanisms for monitoring transactions, identifying suspicious activities, and reporting them to the Financial Crimes Investigation Board. Additionally, they must integrate measures for freezing assets and monitoring customer transactions.

Certain limitations are imposed on payment service providers and payment and electronic money institutions under the Regulation on the Disuse of Crypto-assets in Payments. Accordingly:

• payment service providers cannot develop business models that involve the direct or indirect use of crypto-assets in the provision of payment services and the issuance of electronic money, nor can they offer any services related to such business models, and
• payment and electronic money institutions are prohibited from acting as intermediaries for platforms that offer trading, custody, transfer, or issuance services for crypto-assets, or for fund transfers made from these platforms.

The Law and its secondary legislation

Some of the key provisions of the Law and its secondary legislation are listed below.

• Crypto-asset service providers must apply to the Turkish Capital Markets Association to become members within three months after obtaining their certificates. The activities of crypto-asset service providers that fail to fulfil this membership obligation will be ceased by the CMB.
• The Law sets forth requirements for the shareholders, directors, representatives of the crypto-asset service providers.
• The articles of association of crypto-asset service providers must stipulate that their activities are limited to crypto-asset trading, initial sale or distribution, custody, etc.
• The phrase “crypto-asset trading platform” should be included in the trade names of crypto-asset service providers to indicate the services they will offer.
• The shareholding structure should be transparent and open.
• Share transfers exceeding certain thresholds or involving privileged shares must receive prior approval from the CMB to be valid. Transfers below the threshold must be notified to the CMB within 10 days of completion.
• Crypto-asset service providers are allowed to invest without any limit in financial institutions such as capital market institutions, exchanges, precious metal intermediary institutions, insurance companies, private pension companies, financial leasing, factoring, financing, savings financing, and asset management companies, and other financial institutions approved by CMB. However, they are not allowed to invest in:
  • Companies where they own more than 10% of the paid-in capital, or
  • Companies where their managers, individually or together, hold more than 25% of the capital.

Additionally:

Their total investments in companies outside the permitted categories listed above cannot exceed 25% of their equity.

• If crypto-asset service providers fail to meet their transfer obligations or if their financial structure weakens, the CBM can take various measures, up to and including the withdrawal of the licences of crypto-asset service providers.
• In response to certain unauthorized activities on the Internet, the CMB may decide to block access to the offending site or to remove the content.
• Investment advisory services may only be offered to customers whose current value of crypto-assets on the relevant platform is at least TRY 50,000,000.

Individuals and individual representatives of entities who conduct unauthorized crypto-asset service activities will be subject to imprisonment for three to five years and a judicial fine ranging between TRY 500,000 to TRY 5,000,000.