THE REGULATION EMPOWERING CRYPTO ASSET SERVICE PROVIDERS (CASPS) TO "SUSPEND ACCOUNTS" AND GRANTING THEM IMMUNITY FROM LEGAL LIABILITY HAS COME INTO EFFECT.

Law No. 7571, published in the Official Gazette on December 25, 2025, and numbered 33118, introduced Article 128/A to the Code of Criminal Procedure (CMK) No. 5271. This regulation confers significant authority to Crypto Asset Service Providers (CASPs), alongside Banks and Payment Service Providers, to enhance the speed and efficacy of efforts to combat crimes perpetrated through information systems.

1. Scope and Terms of Application

According to the regulation, restrictions may be imposed on relevant accounts if there is reasonable suspicion that the following offenses have occurred:

Qualified Theft: Theft perpetrated through the use of information systems (Turkish Penal Code Article 142/2-e).

Qualified Fraud: Fraud perpetrated through the utilization of information systems, banks, or credit institutions as instruments (Turkish Penal Code, Article 158/1-f and l).

Misappropriation of Bank or Credit Cards: (Turkish Penal Code Article 245).

2. Suspension Protocol and Procedure

The procedures to be implemented by KVHS (Knowledge, Health, and Safety) are governed by a defined control mechanism:

48-Hour Suspension: In instances of reasonable suspicion, any account that has been used or attempted to be used in a criminal activity may be suspended for a duration of up to 48 hours.

Immediate Notification Requirement: The transaction, along with all pertinent information and documentation, must be promptly reported to the Public Prosecutor's Office and the account holder.

Prosecutor's Review: In response to the account holder's objection, the public prosecutor will render a decision within 24 hours.

Transfer Notification: Should it be established that the benefit has been transferred to another institution prior to the completion of the suspension process, this will be promptly communicated to the receiving institution.

Seizure Mechanism: Assets in a suspended account may be seized by order of the prosecutor in situations where delay would be detrimental, and typically by a judge's ruling. Seizures conducted without a judge's ruling must be submitted for approval within 24 hours; if the judge's decision is not rendered within 48 hours, the seizure is automatically revoked.

3. "Legal Immunity" for COVID-19 Patients

The most striking provision of the regulation, and one that provides a safeguard for GDPRs, is the principle of immunity from legal liability:

"Individuals and legal entities (CVHS) that decide on the suspension process pursuant to this article shall not be held legally liable." Thanks to this provision, CVHS are legally protected against compensation claims or breach of contract allegations that may arise due to the suspension process, while taking the initiative in combating cybercrimes.

4. Data Sharing and Administrative Fines

In cooperation with judicial authorities, new deadlines and sanctions have been determined for GDPR violations:

Information and documents requested as part of an investigation or prosecution must be submitted within 10 days.

• Failure to submit documents or submitting incomplete documents will result in an administrative fine of between 50,000 TL and 300,000 TL imposed by the public prosecutor.
• This regulation aims to strengthen the integrity of the financial system, prevent victimization by rapidly blocking proceeds of crime, and increase the effectiveness of actors in the crypto asset ecosystem in legal processes.