MASAK. The regime our buyers answer to, and the requirement we do not meet

What MASAK is

Mali Suçları Araştırma Kurulu, the Financial Crimes Investigation Board, is Türkiye's financial intelligence unit, established under the Ministry of Treasury and Finance by Law No. 5549 in 2006. It is a member of the Egmont Group and implements the Financial Action Task Force's recommendations domestically.

It does not merely publish guidance: it issues binding communiqués (Tebliğ) with the force of regulation, and enforces them with administrative fines for customer-due-diligence failures and, separately, for failures to apply enhanced measures. The amounts are set in law and revalue annually, check the current figure at source rather than trust a number on a vendor's page, including this one.

What changed in 2025

Three instruments reshaped the landscape in about six weeks:

• 13 March 2025, the Capital Markets Board's communiqués III-35/B.1 and III-35/B.2 set establishment, licensing and capital-adequacy rules for Kripto Varlık Hizmet Sağlayıcıları (KVHS), Turkish crypto-asset service providers.
• 12 June 2025, MASAK Tebliğ No. 28 added KVHS to the obligated parties permitted to perform remote identity verification, and specified how.
• 28 June 2025, MASAK Tebliğ No. 29 layered enhanced due-diligence measures on top, specifically for crypto-asset service providers.

Both communiqués are public on the Resmî Gazete. Read them there.

The requirement, and our gap

Tebliğ No. 28 does not say "verify the customer." It specifies the method: a name, surname and date-of-birth match against the T.C. Kimlik Numarası in the national population registry, together with a real-time, recorded video call for accounts opened after 13 March 2025.

Against that, precisely:

• The registry match: we do not do it. A search of the verify codebase for any national registry integration returns nothing, re-run 2026-07-31. TCKN appears in our code in exactly one role: as an identifier read off a document and checked against its own arithmetic checksum. A checksum proves the number is well-formed. It says nothing about whether that person exists in the register, and the requirement is about the register.
• The recorded session: we have a version of it. Verify records the verification session, stores the chunks, computes a continuity and integrity verdict, and retains them under a window defaulting to 365 days. Whether that constitutes the "real-time video call" the communiqué intends is not our call to make, and we will not assert it.

So a Turkish crypto-asset service provider cannot satisfy Tebliğ No. 28 with our pipeline alone. That is not a nuance to surface during procurement. It belongs on the first page a Turkish compliance officer reads.

What Solidus does and does not do in this regime

Does: the identity-proofing leg, document authentication, liveness, face match, which is an input an obligated party needs.

Does not: sanctions and PEP screening, ongoing transaction monitoring, suspicious-transaction reporting to MASAK, or any enhanced-due-diligence workflow. All not-built, none on a roadmap we would ask you to rely on.

And the obligation does not move. A bank or a KVHS remains fully liable for its own MASAK obligations whether or not it uses us. We do not absorb that liability, we cannot discharge it, and no Solidus product may be described as MASAK-compliant.

Why we still publish this page

Because Türkiye is the market where this content converts, and the businesses reading it operate under this regime. Defining it accurately, including the part where we fall short, is the useful thing we can do. A vendor page that described the 2025 communiqués without mentioning the registry match would be selling into a gap it had chosen not to name.

And our Turkish content lane is not open: this is exactly the vocabulary where machine translation fails visibly, in front of the readers best equipped to notice.