SPK Remote Identification: 7 Critical Compliance Mistakes (2026) | TENHA LAW FIRM

Last Updated: 03 March 2026 | Reading Time: 9–11 minutes
Author: Arslan Tenha, Senior Partner at TENHA LAW FIRM

Introduction

If your organization must redesign its SPK remote identification processes in 2026, you are not alone. With the recent amendment to Communiqué (III-42.1.a), the Capital Markets Board of Türkiye (SPK) has significantly updated the framework governing remote identity verification and electronic contract formation—most notably by explicitly including crypto asset service providers (CASPs) within its scope.

This regulatory shift affects far more than customer onboarding. It directly impacts information systems compliance, workflow design and testing, mandatory risk assessment prior to video calls, enhanced safeguards against deepfake fraud, and the legal status of electronically executed contracts.

In this comprehensive guide, TENHA LAW FIRM translates the new rules into an actionable compliance roadmap—highlighting where risks arise, what controls are mandatory, and how institutions can prepare for SPK scrutiny.

(For firm credentials, visit: About TENHA LAW FIRM)

SPK Remote Identification: What Has Changed?
SPK Remote Identification: What Has Changed?

The amended communiqué updates both the title and purpose, formally extending the remote identification regime beyond intermediary institutions and portfolio management companies to include crypto asset service providers.

From a compliance perspective, the reform rests on three pillars:

1. Expanded scope — CASPs (including platforms and custody providers) are now explicitly regulated.
2. Process security — stricter requirements for IT systems, workflow documentation, testing, and fraud prevention.
3. Legal effect — electronic contracts executed via approved methods are deemed legally written agreements.

For regulated entities, remote onboarding can no longer be treated as merely a user-experience feature. It must be built as an end-to-end compliance architecture covering onboarding, monitoring, contracting, and record retention.

Expansion of Scope to Crypto Asset Service Providers
The inclusion of CASPs is one of the most consequential developments. In practical terms, any crypto platform or custody provider conducting remote customer onboarding in Türkiye must now align its processes with SPK standards.

This amendment complements the broader 2025 regulatory package governing the establishment and operation of crypto asset service providers and signals the regulator’s intention to build a fully supervised digital onboarding ecosystem.

TENHA LAW FIRM Insight:
CASPs must ensure that their remote onboarding flows are simultaneously compliant with:

• SPK regulations
• MASAK AML/KYC rules
• Turkish data protection law (KVKK)
• Electronic contracting requirements

(See our Crypto & Fintech Legal Services)

Information Systems, Workflow Procedures, and Testing Obligations
Perhaps the most operationally demanding requirement is the obligation to:

• establish a formal workflow procedure,
• test the effectiveness of the remote identification process, and
• document the results in writing before deployment.

If testing reveals deficiencies, the institution must update the procedure and cannot proceed until adequacy is confirmed.

Additionally, the remote identification procedure must be:

updated whenever security breaches, regulatory changes, or fraud risks emerge.

reviewed at least twice per year, and

What SPK Will Likely Expect to See
Institutions should prepare a defensible audit trail, including:

Change-management records

Version-controlled workflow documents

Structured test scenarios (including deepfake simulations)

Test reports with remediation plans

Periodic review minutes

Pre-Video Risk Assessment and MASAK Integration
Under the new framework, before initiating the video identification session, institutions must:

1. Collect the application electronically via form,
2. Perform a risk assessment using the collected data, and
3. Terminate the process if the risk profile warrants it.

Importantly, the minimum data set must align with MASAK General Communiqué No. 19, clearly linking remote identification with Türkiye’s AML/KYC regime.

Practical Compliance Design
A robust onboarding model should include:

• Risk scoring engine (country risk, PEP status, device integrity, etc.)
• Red-flag triggers
• Automated rejection or escalation scenarios
• Documented decision logic

This confirms that remote onboarding is no longer just digital convenience—it is a core AML control function.

Liveness Detection, Deepfake Risks, and Burden of Proof
The communiqué explicitly requires:

• liveness detection methods during video verification, and
• additional safeguards against synthetic face (deepfake) attacks.

More critically, the regulation places responsibility on the institution to minimize misidentification risk. In certain disputes, the burden of proof rests with the intermediary institution, portfolio manager, or CASP.

Compliance Implications

Do not treat fraud prevention tools as merely vendor features. SPK will evaluate whether your institution exercised sufficient oversight.

Recommended control stack:

• Passive + active liveness detection
• Deepfake analytics
• Session recording and timestamping
• Decision logs
• Personnel training on customer intent verification

Weak documentation—not weak technology—is often what fails under regulatory review.

Electronic Contracts Deemed as Written
One of the most business-critical changes is the explicit confirmation that contracts executed electronically using approved secure methods will be considered legally equivalent to written agreements.

This applies broadly, including agreements involving:

• investment services
• guarantees
• assignments
• crypto service relationships

Practical Consequences

Institutions must design the entire contract lifecycle, including:

• secure delivery to the customer
• verifiable declaration of intent
• customer-specific encryption/signature
• tamper-proof storage

In disputes, regulators and courts will ask:

Who consented, when, through which verified steps?

Your system must answer that question with forensic clarity.

(See our Compliance & Contract Advisory Services)

AI-Based Remote Identification: New Article 14/A

The newly introduced Article 14/A opens the door for AI-based remote identification, provided that the minimum standards under MASAK Communiqué No. 19 are respected. The SPK also reserves authority to issue additional rules for AI deployments.

This is permissive—but not risk-free.

Key Compliance Warnings

Institutions using AI should prepare for scrutiny regarding:

• Model explainability
• False positive/negative rates
• Human oversight mechanisms
• Model update governance
• Data minimization and KVKK compliance

TENHA LAW FIRM Recommendation:
Adopt a “human-in-the-loop” model until SPK publishes further technical guidance.

Common Challenges with SPK Remote Identification

• ❌ Procedures exist but are not properly tested
  Solution: Build regulator-ready test scenarios and remediation logs.
• ❌ Vendor solution without evidentiary framework
  Expert Tip: Logs, recordings, and audit trails are as critical as the technology itself.
• ❌ Risk assessment treated as a formality
  Legal Requirement: Pre-video risk scoring is mandatory and outcome-driven.
• ❌ Deepfake risk underestimated
  Timeline Advice: Build fraud controls into onboarding architecture—not after incidents.

Why Choose TENHA LAW FIRM?
At TENHA LAW FIRM, we approach fintech and crypto compliance at the intersection of law, process, and technology.

Our Expertise

• ✅ Capital markets and SPK regulatory advisory
• ✅ CASP-specific onboarding and compliance architecture
• ✅ Integrated MASAK AML/KYC strategy
• ✅ Multilingual support for international operators

Contact us: Contact TENHA LAW FIRM | Our Services | Client Testimonials

Taking Action on SPK Remote Identification

The SPK remote identification amendment transforms remote onboarding from a convenience feature into a fully regulated compliance domain—especially for crypto asset service providers.

Workflow documentation, testing discipline, pre-video risk scoring, deepfake safeguards, and legally robust electronic contracting must now operate as a unified control framework.

At TENHA LAW FIRM, we help financial institutions and CASPs design audit-ready, regulator-aligned, and operationally efficient remote onboarding systems.

📞 Contact TENHA LAW FIRM today for a compliance assessment.
📄 Explore our Crypto & Fintech legal services.

Key Takeaways

• ✅ SPK remote identification now explicitly covers CASPs
• ✅ Workflow procedures must be tested and documented
• ✅ Pre-video risk assessment is mandatory
• ✅ Deepfake safeguards and audit logs are critical
• ✅ Electronic contracts can qualify as written agreements

Legal Disclaimer
This article is provided by TENHA LAW FIRM for informational purposes only and does not constitute legal advice. Turkish law and secondary regulations may change. For advice tailored to your situation, please contact our office. Content current as of 03 March 2026.

Related Articles from TENHA LAW FIRM

• Crypto Asset Service Providers Compliance in Türkiye
• MASAK AML/KYC Requirements for Fintech Companies
• Electronic Signature and Digital Contract Management
• KVKK Compliance for Financial Technology Platforms