As you are aware, crypto asset service providers (the "CASPs") operating or planning to operate in Türkiye are regulated under the Capital Markets Law No. 6362. Following the amendment published on 2 July 2024, CASPs have fallen under the rule-making and supervisory authority of Capital Markets Board of Türkiye ("CMB"). Subsequently, CMB issued principle decisions to establish the fundamental rules for the crypto ecosystem, with the anticipated secondary regulation taking effect on 13 March 2025.
On 8 May 2025, the CMB clarified the reserve-proof framework for crypto asset transactions under the Communiqué on the Establishment and Operating Principles of CASPs No. III - 35/B. ("Communiqué") by issuing a principle decision ("Principle Decision"). This decision defines the principles and procedures for auditing platforms and custody institutions that conduct trading, initial offerings, distribution, clearing, transfer and custody services.
Key Points on Reserve-Proof Audits
Objective and Frequency of the Audit: The objective of a reserve-proof audit is to verify whether a CASP holds sufficient reserves to cover clients' crypto assets. Such audits should be conducted by independent information systems auditors as defined in the Communiqué on Independent Audits of Information Systems No. III - 62.2. They should take place four times per calendar year.
Audit Engagement and Auditor Rotation: Within the first month of each quarter, a CASP should enter into an engagement letter with an independent information systems audit firm for that quarter's reserve-proof audit. A single master engagement covering all remaining quarters of the same year is also permitted. The same audit firm should not perform more than twelve consecutive quarterly reserve-proof audits for the same CASP and the same lead auditor should not sign more than four consecutive audit reports for that CASP.
Scope of the Audit and Reserve Coverage Ratio: CASPs should provide auditors with all information, records and documents relevant to the audit. The Principle Decision lists minimum reporting items, such as the list of crypto assets held or custodied as of the audit date and the current values of client-owned crypto assets, which should appear in the audit report. Platforms should additionally report cash balances held on behalf of clients.
Auditors should include in their scope at least ten crypto assets with the highest client balances, covering at least 80% (eigthy percent) of total client assets. All assets held in the Platform's liquid reserves should be subject to audit and their results presented in a separate section. The existence of 100% (hundred percent) of scoped crypto assets should be confirmed.
Wallet Activity and Audit Reporting: For scoped assets, CASPs should provide auditors with all wallet-movement data, except for information that grants direct disposal over client assets. Auditors should select two dates at random during the audit period and reconcile client-asset records with both the CASP's own books and the distributed-ledger network. If the calculated reserve coverage ratio falls below 100% (hundred percent), auditors should immediately notify the CMB.
Auditors should confirm that notified wallet addresses belong to the CASP and describe their verification methods in the report. The independent-audit standards referenced in the Principle Decision should be applied by analogy.
Once signed by the lead auditor, the audit report becomes final and should be delivered to the CASP's board chair within 10 (ten) business days of quarter-end. The board should approve and forward the report to the CMB within 15 (fifteen) business days.
The audit report is addressed solely to the CASP's board and should not be shared with third parties outside the CMB. Although the Principle Decision allows publication on the CASP's website under certain conditions.
Conclusion
Reserve-proof audits are a critical measure designed to protect investors and enhance market integrity. Through regular, comprehensive audits, CASPs should uphold transparency and accountability, thereby fostering long-term trust and stability in the crypto asset market.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
