Türkiye Wrote the Method Into the Regulation, and Almost Nobody Noticed

No Turkish institution has used anything described here, no regulator has assessed it, and nothing below is a case study.

Regulations usually describe an outcome

A rule says a firm must be satisfied of a customer's identity to a reasonable standard, and leaves the method to the firm. That is why identity vendors spend most of a sales cycle arguing that their approach satisfies a standard nobody wrote down precisely.

Türkiye did something different on 27 June 2026.

What Tebliğ 32 actually says

MASAK's Genel Tebliğ Sıra No 32 amended Tebliğ 19, which governs remote identity verification by obliged parties under the country's anti-money-laundering regime. Two changes matter.

Crypto-asset service providers were added to the obliged parties. CASPs are now inside the remote-onboarding regime rather than beside it.

Banks, financial institutions and CASPs may now remotely identify foreign nationals. That was previously a gap, because the standard Turkish path assumes domestic identity infrastructure a foreign customer does not have.

And for that foreign-national case, the regulation names the method: an ICAO 9303 compliant passport with an NFC chip, where the chip data is read and matched against the passport's printed details.

A named international standard, a named technology, and a named verification step, inside an AML regulation.

Why that is unusual enough to build on

Because it removes the argument. A vendor does not have to persuade a compliance officer that its approach is equivalent to something; the regulation already says what the approach is. The remaining question is narrow and technical: does this implementation do the named thing correctly.

For a market where onboarding foreign customers has been the awkward case, that is a rule change with a date attached.

Where the claim has to stop, and it stops in two places

It covers foreign nationals, not the whole market. For Turkish citizens the domestic rails, e-Devlet and EKDS and the chip identity card, remain the established path. So this is about foreign customers of Turkish institutions. "MASAK requires our product" is not an honest sentence. "MASAK requires ICAO 9303 NFC chip verification for remote onboarding of foreign nationals, and that is what we built" is.

And our own chip reading is not yet proven against real documents. Passive authentication, the step that verifies the chip's signature against the issuing country's certificate, has been validated against synthetic certificates rather than real passports in production. So we can read the chip and we have not demonstrated the check that makes reading it meaningful.

Both limits belong in the same paragraph as the opportunity, because a buyer will find them and would rather find them here.

What this means for a Turkish institution today

If you onboard foreign customers remotely, the method is specified and you need an implementation of it. If you onboard Turkish citizens, the domestic rails already work and this changes nothing for you.

If you are evaluating vendors on this, the question to ask all of them, including us, is what their passive authentication has been tested against. A vendor that answers "the standard" rather than "real documents from these issuing countries" is describing a capability at the same stage ours is.