MaSAK negligence in Fintech organizations leads to an average administrative fine of 1.5M-5M TL.
Most frequent omissions
- KYC form is missing (no phone, address verification).
- STR automation is inadequate; manual review 14+ days.
- Sanctions list (UN, OFAC) scanning missing.
- Compliance unit single-person.
BRSA centers of control
- STR reporting delay.
- Customer acceptance policy.
- Internal control and reporting.
- MASAK training certificates.
Harmony investment priority
- Automation: STR system 5 min SLA.
- Training: annual MASAK certificate for the entire operations team.
- Audit: annual external compliance audit.
Frequently asked
BRSA warning came; How to respond?
Action plan + written commitment within 30 days.
Should STR reporting be within 24 hours?
Once a suspicious transaction is noticed, "without delay" — practically 24 hours.
Can the internal control unit be outsourced?
Yes; However, the ultimate responsibility lies with the license holder.
Relevant legislation
- Law No. 5549 on the Prevention of Laundering Proceeds of Crime Article 19 — 7-day temporary measure in suspicious transactions.
- 5549 SK article 13 — Administrative fines (obliged person, manager, employee).
- Turkish Penal Code art.282 — Laundering of proceeds of crime (3-7 years + judicial money).
- CMK article 128 — Confiscation of goods and rights; peace penalty approval.
- 5549 SK Implementation Regulation — Suspicious transaction reporting (STR), regular activity reporting.
Legal notice: This article is for general information purposes; A meeting with a lawyer is required for a concrete case.