Executive summary
When a Turkish payment institution (PI) or electronic money institution (EMI) fails, the single question that matters for users and investors is: Are customer monies truly bankruptcy-remote? Under Law No. 6493 and CBRT secondary legislation, client funds must be segregated and safeguarded; in principle, they should fall outside the insolvent estate. In practice, however, operational shortcuts (e.g., mixing user balances with operating cash, delayed reconciliations, or poorly drafted bank mandates) can open a safeguarding gap after PI/EMI insolvency—a gap through which liquidators, unsecured creditors, or set-off mechanics can threaten customer balances.
This note explains (i) the legal hooks that aim to protect client money in Türkiye, (ii) how gaps arise in real life, (iii) what evidence investors should demand during diligence, and (iv) a practical fix-set: daily reconciliation covenants, trustee/escrow account structures, and step-in rights that preserve continuity of service.
1) Legal hooks: 6493, CBRT rulemaking, and insolvency-remoteness in Turkish payments
Law No. 6493 establishes the perimeter for payment services, payment institutions and electronic money issuance in Türkiye, and empowers the Central Bank of the Republic of Türkiye (CBRT) to issue the detailed rulebook and supervise the sector. Its purpose is the safe, efficient functioning of payment systems and the protection of users. Secondary legislation—the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers and related communiqués—lays down authorization, governance, information-systems, safeguarding/segregation, and operational requirements for PIs and EMIs.
While the regulation’s safeguarding clauses are distributed across several provisions (segregation of customer funds with banks, use-restriction, reconciliation, and oversight), the policy outcome is clear: end-users’ monies are to be ring-fenced and insulated from the institution’s own creditors. The CBRT’s public materials repeatedly emphasize safe and continuous operation of payment services, which is the policy basis for treating safeguarded funds as insolvency-remote when formalities are respected.
Takeaway: The statute and the CBRT Regulation intend bankruptcy-remoteness; what defeats it is operational non-compliance (commingling, late or inaccurate reconciliation, defective account titles/mandates, or sweeping/pledging of safeguarded funds).
2) Scenario analysis: how the safeguarding gap actually opens
Scenario: A PI/EMI grows fast, opens a “collection” account at a partner bank, and—contrary to policy—starts crediting both user inflows and operating receipts into the same account. Reconciliation is “T+1” or ad-hoc. The bank’s mandate and account title do not state that the account is a safeguard/trust-style account for the benefit of users. The institution grants a general account pledge to the same bank to secure its own working-capital line. The PI/EMI enters liquidation.
Resulting risks:
- Commingling + title defects: Absent clear account titling and ring-fencing language, liquidators and counterparties may argue the deposits are part of the estate, especially if books are unclear.
- Bank set-off/pledge leakage: If the safeguarded account is within the scope of a general pledge or cross-collateralization, the bank may assert set-off over those balances to cure the PI/EMI’s own debts.
- Reconciliation lag: Without D+0 reconciliation and a “sweep” to segregated accounts, user balances cannot be traced cleanly; tracing problems translate into litigation exposure and payout delays.
- Outsourcing chain gaps: If a third-party aggregator (collection service) sits between users and the safeguard account, missing trust language in that layer creates a secondary commingling risk.
These are preventable with disciplined structuring and evidence.
3) Why investors care: reputational crash + clawback vectors
- Reputational hit: If users cannot access their balances promptly, consumer harm cascades across social channels and the press. For consumer-facing payment accounts & wallets, reputation is existential.
- Clawback risk: Even when a rescue or bridge service occurs, later estate actions (avoidance claims, set-off challenges) can claw back distributions if the segregation and tracing were not pristine.
- Regulatory response: The CBRT has broad supervisory and sanctioning powers under Law 6493; safeguarding failures can lead to administrative measures and change-of-control friction, depressing exit value.
4) Evidence pack for diligence: what to request and why it matters
A. Bank confirmations & mandates
- Account title must clearly indicate “safeguard/segregated for users” (institution acting as fiduciary custodian on behalf of users).
- Mandate language should: prohibit set-off, exclude cross-default/cross-collateralization, and affirm the bank’s notice obligations before any change.
- Comfort letter from the bank acknowledging the purpose-limited nature of funds and agreeing not to exercise any lien/pledge over them.
Why it matters: Title/mandate defects are the #1 cause of leakage in insolvency. (Aligns with CBRT safeguarding policy under the payments rulebook.)
B. Trust/escrow documentation
- A trustee/escrow account agreement (under Turkish law structures) designating beneficiaries as end-users (or a statutory category) and limiting uses to permitted payment operations/redemptions.
- Clear waterfall for receipt, reconciliation, payout, and redemption; change-control and termination protections.
C. Daily reconciliation logs
- D+0 reconciliation of ledger vs. bank balance; automated variance alerts with dual-control sign-off.
- Evidence of intraday sweeps from collection to safeguard accounts; immutable logs.
Why it matters: Reconciliation is the practical backbone of bankruptcy-remoteness—if you cannot trace, you cannot protect.
D. Policy stack & independent audits
- Safeguarding policy, accounting policy (treatment of client money), outsourcing/critical vendor policy, incident response.
- Latest independent audit report including information-systems audit (a CBRT expectation for PIs/EMIs).
E. Regulatory correspondence
- Any CBRT on-site/desk review findings relating to safeguarding; evidence of timely remediation.
5) The fix-set: design patterns that close the safeguarding gap
(i) Daily reconciliation covenant (D+0)
- What: Binding covenant that the institution will reconcile user ledger to safeguarded bank balances each business day (and intraday above a volume threshold), with variance limits (e.g., ≤ 0.1% of safeguarded funds or a fixed TRY cap).
- How: Automated jobs + manual dual-control approval; exception tickets must be closed within 24 hours; board-level KPI reporting.
- Why: Meeting the CBRT’s safeguarding intent depends on continuous, provable reconciliation; delays are what liquidators exploit.
(ii) Trustee/escrow structure with explicit no-set-off
- What: Open the safeguarded account in the name of the trustee/escrow agent for the benefit of users, or—if held by the PI/EMI—use account titling and mandates that replicate trust effects under Turkish law (beneficiary, purpose limitation, no lien/pledge).
- Key clauses:
- “Bank acknowledges that funds do not belong to PI/EMI’s estate; no bank lien or right of set-off applies.”
- “Use of funds is limited to user payouts/redemptions and permitted payment operations under Law 6493/CBRT Regulation.”
- “Change of terms requires prior written consent of [Trustee]/[Investor] and notification to CBRT.”
- Why: This translates the insolvency-remoteness policy into binding documentation at the bank relationship level.
(iii) Waterfall & sweep mechanics
- What: All inflows land in a collection account with automatic same-day sweep into the safeguarded account; collection accounts are capped at a low residual balance and expressly outside any pledge pool.
- Why: Minimizes commingling duration and simplifies tracing.
(iv) Step-in rights for investors/sponsor bank
- What: A direct agreement among the PI/EMI, the safeguarding bank(s), key processors, and the investor (or designated “emergency servicer”), granting step-in upon pre-defined triggers (CBRT enforcement action, covenant breach, insolvency filing, material service outage).
- Rights include: (a) data and API access, (b) right to instruct banks to continue honoring user redemptions using safeguarded funds, (c) assignment of core vendor contracts, (d) license to use IP necessary to run the wallet for a transition period.
- Why: Step-in preserves continuity of service and avoids a value-destroying cliff while a sale or orderly wind-down proceeds—aligned with CBRT’s systemic-safety objective.
(v) No-sweep / no-cross-collateral representations
- Ensure credit facilities exclude safeguarded accounts from collateral packages; the bank’s general lien is expressly disapplied for these accounts.
(vi) Third-party chain hygiene
- If any aggregator or PISP/AISP is in the flow, mirror the same trust/no-set-off language at that layer; require them to maintain dedicated safeguarding accounts and D+0 reconciliation to avoid “shadow commingling.”
6) Sample covenant language (short-form, to adapt under Turkish law)
Safeguarding and Reconciliation. The Company shall (i) maintain one or more safeguarded bank accounts titled to reflect that funds are held for the benefit of users in accordance with Law No. 6493 and applicable CBRT regulations; (ii) perform daily (D+0) reconciliation between user ledger balances and safeguarded bank balances; and (iii) promptly cure any shortfall by end of day. The Company shall not grant any lien, pledge, security interest, or right of set-off over safeguarded funds.
No Set-Off; Purpose-Limited Use. The safeguarding bank acknowledges and agrees that safeguarded funds do not belong to the Company’s estate, are not subject to bank lien, pledge, or set-off, and may be used solely for redemptions and permitted payment transactions.
Step-In. Upon a Step-In Trigger (including CBRT enforcement, insolvency, or material safeguarding breach), Investor (or its designee) may direct the safeguarding bank to honor user redemptions and may assume operational control of payment functions for a limited period, with access to data, APIs, and necessary IP, to ensure continuity.
(Ensure final drafting is harmonized with Turkish private law formalities, bank practice, and the CBRT rulebook.)
7) Investor diligence checklist (actionable)
- Bank letters confirming account titling, no set-off, and no cross-collateralization.
- Daily recon reports + exception logs for the last 12 months; evidence of intraday sweeps.
- Ledger architecture: separate GL accounts for user funds vs. ops cash; immutable audit logs.
- Safeguarding policy + independent audit reports (financial + IS audit cycle).
- CBRT correspondence on safeguarding; remediation proof.
- Credit documents to confirm safeguarded accounts are carved-out from security packages.
- Vendor chain: contracts with acquirers/processors confirming pass-through of safeguarding terms.
- User communications: clear disclosures on where funds are held, how safeguarded, redemption rights. (This reduces complaint risk and aligns with CBRT consumer-protection intent.)
8) Red flags that should halt an investment
- One-pot banking: A single operating account receiving both user funds and corporate cash.
- Missing/ambiguous mandates: No bank-level acknowledgement of the safeguarding purpose.
- Pledged safeguard accounts: Any general lien/pledge over safeguarded funds.
- Recon gaps: Reconciliations not daily; unexplained variances; no dual-control sign-off.
- Opaque outsourcing: Aggregators without mirrored safeguarding terms or proof of segregated accounts.
- Regulatory noise: Recent CBRT findings on safeguarding not closed with evidence
9) How this aligns with the Turkish framework (and where it’s headed)
- Today’s baseline under Law No. 6493 and the CBRT Regulation is already robust: segregation, use-restrictions, oversight, and audits are embedded in the regime.
- European trendwatch: Internationally, supervisors (e.g., UK FCA in 2025) continue to harden safeguarding regimes with clearer reconciliation and audit requirements—useful directional guidance for Turkish market practice even before formal changes land locally.
- Open banking + access obligations: As PSP-to-PSP access and data-sharing expand, more players touch user funds or instructions; your contracts must push safeguarding terms down the stack to maintain insolvency-remoteness throughout the chain.
Conclusion: Close the safeguarding gap after PI/EMI insolvency before it opens
For payment accounts & wallets, reputational survival in a stress event depends on whether safeguarded funds are traceable, segregated, and unquestionably outside the estate. The Turkish framework under Law No. 6493 and CBRT secondary rules provides the legal backbone; the rest is execution:
- Bank-level documentation (no set-off, purpose-limited use),
- D+0 reconciliation with hard variance limits,
- Trustee/escrow or trust-effect account titling, and
- Step-in mechanics to ensure continuity.
Do these four things well, evidence them, and you substantially reduce both user harm and investor clawback risk in an insolvency scenario—exactly what the safeguarding rules are designed to achieve.
Yanıt yok