AML and MASAK Compliance Solutions in Türkiye

Establishing written policies aligned with the institution’s own risk appetite. The policy is the constitution of the compliance program: it defines which customer falls into which risk category, which transaction goes through which approval, and under which circumstances a relationship is terminated.

This pillar calls for a management decision, not technology. But a policy that stays on paper is of no use in an audit; it has to be reflected one-to-one in the rules and thresholds of the system. In Datactive AML & KYC, scenario and threshold definitions make what is written in the policy enforceable in the system.

Classifying risks by customer, service, country and channel. The essence of the risk-based approach is to apply controls proportionate to risk instead of applying the same control to every customer. Simplified measures are applied to low-risk customers and enhanced measures to high-risk customers.

In practice, this requires setting up customer risk scoring. It is important that the score is not static: the customer’s transaction behavior, a change in ownership structure or a new adverse media record should update the score.

Datactive AML & KYC provides customer risk scoring, while DataSentinel reflects risk arising from ownership structure in the score.

Appointing an authorized compliance officer reporting to the board of directors or senior management. To become a compliance officer, one must obtain a license by scoring at least 65 points in the MASAK Compliance Officer Authorization Exam.

The compliance officer’s independence is a structural requirement: they must have a reporting line that is not influenced by commercial targets. Technology supports segregation of duties here — who may make a suspicious transaction decision and who may not change it should be defined at the system level.

Face-to-face or remote identity verification, PEP checks and continuous updating of customer data. For legal entity customers the obligation goes deeper: the ownership structure must be unraveled and the ultimate beneficial owner (UBO) identified.

Three separate controls must work together here: identity verification, sanctions and PEP screening, and ownership structure analysis. Keeping the three in separate systems is the most common reason investigations take longer.

Datactive Sanctions & PEP Screening covers sanctions, PEP and adverse media screening, while DataSentinel covers unraveling the ownership chain and identifying the UBO.

Continuously monitoring transactions that are inconsistent with the customer’s risk profile and reporting to MASAK when suspicion arises. Reports are submitted through the MASAK Online system no later than 10 business days from the date the suspicion arose.

There is a common mistake in calculating this period: the time spent on internal reporting also counts toward the 10 business days. The clock starts on the day suspicion arises among staff, not on the day the compliance officer picks up the file.

In addition, tracking asset freezing decisions published in the Official Gazette requires separate monitoring; these decisions take effect the moment they are published and may not be reflected in global sanctions lists.

Datactive AML & KYC covers transaction monitoring, alarm and case management, while Datactive Sanctions & PEP Screening covers instant detection of Official Gazette decisions.

Providing regular training to staff and testing the compliance program through internal audit. An audit examines not only the reports that were filed but also the rationale behind alarms that were generated and closed.

That is why the audit trail is not a technical detail; it is what keeps the sixth pillar of the program standing. For every screening, alarm, investigation and decision, it must be possible to show retrospectively who made it, when and on what grounds.

Saying "An alarm came up, we investigated it, we didn’t report it" is not enough; the rationale for the decision must be on record.