Once a financial institution in Turkey has successfully obtained its operating license from the relevant regulatory authority (e.g., BDDK or TCMB), it may legally commence its operations. However, licensing is not the end of the process — it marks the beginning of an intensively monitored and highly regulated operating environment.
Below is a detailed breakdown of the obligations that financial institutions must fulfill on a daily, monthly, quarterly, and annual basis after receiving their operational license:
🔹 A. Operational Kick-Off
Before serving clients, the company must ensure:
- Official Publication of License: The final operating license must be published in the Turkish Official Gazette.
- Notification to Sectoral Association: The institution must notify and complete registration with the relevant sectoral union (e.g., FKFB, TÖDEB).
- Physical Office Readiness: A fully equipped headquarters with secured IT systems, transaction monitoring tools, and record-keeping mechanisms must be operational.
- Launch of Services and Products: All marketed financial products (loans, leasing agreements, factoring services, e-wallet systems) must comply with pre-approved structures and consumer protection regulations.
🔹 B. Regulatory Reporting Obligations
Financial institutions in Turkey must submit comprehensive, standardized reports to regulatory bodies such as BDDK, CBRT, and MASAK. These include:
1. Daily Reports (if applicable)
For e-money and payment institutions:
- Real-time or end-of-day transaction volume reporting
- Fraud detection data sharing
- E-wallet balance summaries
2. Monthly Reports
- Balance sheet and income statements
- Credit exposure reports
- Liquidity adequacy ratio reports
- Customer complaint summaries (especially for consumer finance companies)
- AML/Compliance reports to MASAK (Financial Crimes Investigation Board)
3. Quarterly Reports
- Capital adequacy ratio and financial performance indicators
- Internal audit and risk management assessments
- Shareholder equity structure updates
- Corporate governance compliance statements
4. Annual Reports
- Independently audited financial statements (prepared under Turkish Financial Reporting Standards – TFRS)
- Detailed risk inventory and business continuity assessment
- Board of Directors activity report
- Internal control system effectiveness report
- MASAK risk assessment form
- Submission to the Trade Registry and publication on the company website (for public transparency)
🔹 C. Supervision and On-Site Inspections
Even after licensing, all financial companies are subject to:
- Regular on-site inspections by BDDK/CBRT inspectors
- Thematic audits, e.g., focusing on risk, data protection, or consumer protection
- Surprise or risk-based inspections, especially after suspicious activity reports (SARs)
- Penalties or license suspension if reporting is delayed, inaccurate, or manipulated
🔹 D. AML/CFT Compliance (Anti-Money Laundering & Counter-Terrorism Financing)
Under Law No. 5549 and MASAK legislation, financial institutions must:
- Perform customer due diligence (CDD) and enhanced due diligence (EDD)
- Maintain transaction records for at least 8 years
- File Suspicious Transaction Reports (STRs) to MASAK without alerting the customer
- Designate a compliance officer (Uyum Görevlisi) and establish an AML policy
- Provide periodic AML training to all relevant staff
- Report any activity exceeding legal thresholds (e.g., TRY 75,000 cash transactions)
🔹 E. Consumer Protection and Transparency Obligations
Particularly in consumer finance and leasing companies, regulators impose strict transparency requirements:
- Interest rates, fees, and total cost of borrowing must be disclosed in advance
- Standardized pre-contractual information forms must be used
- Borrowers must be given at least two business days to review contracts
- Customers must be provided access to dispute resolution mechanisms (e.g., Arbitration Committees or court)
- Regular reports on complaints and resolutions must be sent to the regulator
🔹 F. Internal Governance & Staffing Requirements
Financial companies must maintain a minimum organizational structure at all times:
- A functioning Board of Directors, holding regular documented meetings
- Internal Audit, Risk Management, and Compliance Units reporting independently
- A qualified Compliance Officer who liaises with BRSA and MASAK
- Separation of duties between business, control, and executive functions
- Hiring of qualified personnel for all sensitive roles (background checks required)
🔹 G. IT Security and Data Protection
In compliance with KVKK (Turkish Data Protection Law) and regulatory IT guidelines:
- Customer data must be encrypted and stored securely
- Companies must implement incident response procedures
- Penetration tests and system audits must be conducted annually
- Notification to regulators and customers within 72 hours of any breach
🔹 H. External Audit and Transparency
- An independent external audit firm must be selected and reported to the regulator
- Auditors must assess not only financial accuracy but also internal control effectiveness
- Companies must publish their audited financials on their official websites annually
- For public companies, reporting must also comply with Capital Markets Board (SPK) rules
✅ Summary of Key Operational Responsibilities
| Category | Obligation Example |
|---|---|
| Financial Reporting | Monthly and quarterly balance sheets |
| Risk Management | Annual risk assessment and mitigation plans |
| Consumer Compliance | Pre-contractual disclosures, complaints handling |
| AML/CTF | Suspicious activity reports (SAR), CDD, training |
| Governance | Internal control units and board oversight |
| IT & Data Protection | System security audits, KVKK compliance |
| External Audit | Appointment of independent audit firm |
🔚 Conclusion
Receiving an operating license is a milestone, but maintaining compliance in Turkey’s financial sector requires continuous operational diligence. Regulatory expectations are high, and failure to comply with even a single obligation can result in significant penalties, public warnings, or license revocation.
Hence, companies must build strong internal systems, hire competent compliance officers, and partner with legal and financial advisors to meet the strict supervision standards imposed by BDDK, CBRT, MASAK, and other authorities.
INTERN LAW FACULT STUDENT
YAĞMUR YORULMAZ
Yanıt yok