All Eyes on Payment Institutions!
Payment institutions create demand with advantages such as contributing to the e-commerce system, providing financial services at lower costs and faster, and also make significant contributions to the financial system. However, the seizure of two institutions in this category on the grounds that they abused the system has led to attention being drawn to the payment institution system.
Payment institutions create demand with advantages such as contributing to the e-commerce system, providing financial services at lower costs and faster, and also contribute significantly to the financial system. Payment institutions, whose most fundamental difference from traditional banking services is that they do not have the authority to collect deposits, can provide basic banking services such as money transfer, prepaid cards, and bill payments. Although they have the authority to control customer account movements through legislative regulations, the activities of some of these institutions, especially those aimed at money transfer and laundering, have led to the questioning of the system.
As part of the investigations launched on charges of illegal betting and laundering criminal assets, some payment institutions including Payfix and Papara were seized and TMSF was appointed as trustee for these institutions. The seizure of the two institutions within a month of each other has drawn attention to payment institutions, whose numbers have increased tenfold in the last 10 years. While the Central Bank imposed administrative fines of 160 million liras on 55 institutions that did not comply with the regulations, MASAK imposed administrative fines of 663 million liras on 19 institutions for transactions in 2023 and 634 million liras on 4 institutions for transactions in 2024.
Nazmi Karyağdı, who served as the Head of Strategy Development, Audit and Compliance Management and Taxpayer Services Department at the Revenue Administration, and Osman Dereli, who served as the President of MASAK between 2016 and 2020, analyzed the working principles of payment and electronic money institutions and the issues that the system is open to abuse for ECONOMY.
What are the transactions carried out by Payment and Electronic Money Institutions?
These organizations offer a wide range of financial transactions in a digital environment, quickly and securely. Their main services are:
■ Money transfer from person to person, IBAN or mobile phone,
■ Automatic payment instructions and bill payments,
■ Virtual and physical POS services for e-commerce activities,
■ Collection via QR code and payment link,
■ Virtual or physical prepaid cards,
■ Loading money and paying via digital wallets,
■ International money transfers,
■ Bulk salary payments for companies,
■ Providing promotional card services on behalf of institutions such as chambers and unions.
What are the conditions of establishment?
Payment institutions and electronic money institutions that want to operate in the field of payment services may do so provided that they obtain permission from the Central Bank.
The electronic money institution must be established as a joint stock company, and those who have a share of ten percent or more in its capital and those who have control must have the qualifications sought for bank founders in the Banking Law No. 5411.
It is essential that they take the necessary measures regarding the continuity of the activities they will carry out within the scope of Payment and Electronic Money and the security and confidentiality of funds and information regarding electronic money users, and have a transparent and open partnership structure and organizational chart that will not hinder the audit to be carried out by the Central Bank.
“The funds are not insured under the TMSF”
■ What are the differences from traditional banking?
Payment institutions and electronic money institutions can only operate to provide payment services and/or to issue electronic money. They do not have the authority to collect deposits; in this respect, they differ significantly from banks. Because one of the basic functions of banks is to collect deposits and to contribute these resources to the economy as loans. These institutions offer fast, user-friendly and low-cost payment solutions in line with the needs of the digital age; they stand out especially with their digital infrastructures that can be accessed via mobile devices and online platforms.
Customer funds held by payment and electronic money institutions are not insured by the Savings Deposit Insurance Fund (TMSF). However, deposits in banks are under the TMSF guarantee up to a certain limit.
“Obligation to report suspicious transactions to MASAK”
■ What is its status in terms of MASAK legislation?
Payment and Electronic Money Institutions have the status of “obliged” under the MASAK legislation within the scope of Combating Proceeds of Crime and Preventing the Financing of Terrorism. These institutions are required to fulfill their customer recognition (KYC) obligation by obtaining identity information from their customers and verifying the accuracy of this information.
In case of any information or suspicion that the assets subject to the transactions carried out by the customers are obtained by illegal means, used for illegal purposes or have connections with terrorist organizations, these institutions are obliged to report suspicious transactions to MASAK. In addition, they have the obligation to provide continuous information within the scope specified in the MASAK legislation and are obliged to keep all information and documents related to these processes for at least 8 years and present them upon request.
“Additional precautions are required for every transaction”
■ What precautions do they have to take?
Since Payment and Electronic Money Institutions are classified as “financial liable”, they must establish a comprehensive compliance program in addition to their standard obligations.
In addition, when establishing a continuous business relationship with customers (for example, during the account opening phase), they must apply strict measures with a risk-based approach. These measures include;
Obtaining information about the purpose and nature of the business relationship,
Obtaining information about the assets and sources of funds subject to the transaction,
Additional measures, which are applied only to high-risk transactions for normal financial liabilities, are mandatory for every transaction for payment and electronic money institutions. In this context, one or more of the following measures must be applied:
a) Updating the identity information of the customer and the real beneficiary more frequently and obtaining additional information,
b) Obtaining detailed information about the nature of the business relationship,
c) Gathering as much information as possible regarding the source of assets and funds,
d) Obtaining information regarding the purpose of the transaction,
d) The initiation, continuation of the business relationship or the realization of the transaction must be subject to the approval of the senior manager,
e) Increasing the frequency and number of controls, determining the types of transactions that require additional control and keeping the business relationship under close surveillance,
f) Requiring that the first financial transaction in a continuous business relationship be made through another financial institution where customer recognition principles are applied.
“3.7 million liras fine for violation”
■ What are the duties of MASAK within the scope of supervision and audit of these institutions?
MASAK creates and regularly updates AML/CFT (Prevention of Money Laundering and Financing of Terrorism) legislation in accordance with FATF (Financial Action Task Force) standards. It audits liable groups annually according to risk criteria and imposes administrative fines when non-compliance with the legislation is detected.
In case of violation of obligations under MASAK legislation, an administrative fine of at least 453,160 TL, not less than 5% of the transaction amount, is applied. In case of failure to fulfill the suspicious transaction reporting obligation, the fine increases to 755,400 TL.
■ What is the criminal liability of the officers and related parties?
One-fourth of the administrative fine imposed on the responsible board member, or if there is no such person, senior manager, who does not comply with the obligations within the scope of the compliance program is applied, provided that the specified warnings are given and the deadlines are complied with.
In addition, persons who mediate the transfer of funds consisting of proceeds of crime, without participating in the crime of money laundering, and who purchase, accept, possess or use the value of the property constituting the subject of this crime, knowing this feature, are punished with imprisonment from two to five years in the event of a court decision to this effect.
■ Which institution is responsible for the supervision of payment and electronic money institutions?
The issuance of operating permits, regulation and supervision of payment and electronic money institutions were carried out by the Banking Regulation and Supervision Agency (BDDK) until 2020. However, this authority was transferred to the Central Bank after 2020.
“Fighting through artificial intelligence is mandatory”
■ Why have trustees been appointed to some payment and electronic money institutions recently?
Today, crimes are committed in virtual environments, especially in addition to traditional methods, and the virtual world is becoming a more attractive and easy-to-perform medium for criminal organizations. Payment and electronic money institutions also carry a high risk of being exploited by such criminal organizations because they operate in a virtual environment.
In Türkiye, illegal betting and gambling activities are often carried out on virtual platforms and these transactions are carried out using the possibilities of the fintech sector. Therefore, payment and electronic money institutions must combat criminal organizations using the possibilities of technology, including machine learning and artificial intelligence. Otherwise, it becomes difficult to continue this fight with traditional methods.
Number of electronic money institutions for years:
| Year | Payment Institutions | Electronic Money Institutions | Total |
| 2015 | 5 | 4 | 9 |
| 2016 | 10 | 6 | 16 |
| 2017 | 15 | 9 | 24 |
| 2018 | 20 | 12 | 32 |
| 2019 | 25 | 18 | 43 |
| 2020 | 27 | 22 | 49 |
| 2021 | 30 | 26 | 56 |
| 2022 | 30 | 42 | 72 |
| 2023 | 27 | 53 | 80 |
| 2024 | 26 | 63 | 89 |
“Abuses can be prevented”
■ Are the measures to be taken for compliance costly?
The recent situations that some electronic money and payment service providers have faced clearly show how critical compliance with AML/CFT measures is. Brand value and corporate reputation are the product of years of effort for institutions. However, being associated with criminal organizations can seriously damage this reputation, and for some companies, it can even reach a point where they cannot continue their activities.
However, investments in the field of compliance, made on time and with reasonable budgets, can prevent criminal organizations from abusing these systems. In this context, it should not be forgotten that investments in the field of compliance are among the investments that will provide the highest return in the long term.
■ Do these crimes in the virtual environment usually occur by using the accounts of others?
One of the most critical issues encountered in the sector is that criminal organizations engaged in illegal betting and gambling activities mostly use bank or payment institution accounts of young people, the unemployed and low-income individuals.
If these people allow their accounts to be used by criminal organizations, they may face serious legal sanctions and even imprisonment in the future. On the other hand, payment and electronic money institutions should effectively analyze their customers when opening accounts for their customers and during the transaction process, and should constantly check whether the transactions they carry out are compatible with the financial profiles of their customers.
■ How do organizations that organize illegal betting and virtual gambling crimes exploit financial institutions?
The general profile of these crimes is as follows: Since these organizations cannot collect money through legal channels, they turn to groups in need of money such as young people, university students, the unemployed, low-income individuals and housewives in order to open bank and payment accounts that will allow money to enter and exit their systems. The accounts opened in the names of these people by giving them certain amounts of money are advertised on betting sites and people who want to enter the system as players deposit money into these accounts. The actual control of the accounts is in the hands of the organizations.
Payments to people who earn money from betting are also made through these accounts. In some cases, a person who wants to withdraw money from the system is given the account information of someone else who wants to deposit money into the system and the transfer is carried out and the process is managed in this way. All this money flow is managed by people called “cashiers” within the organization.
Initially, small amounts of money are collected in many personal accounts, but after reaching a certain amount, they are transferred to a smaller number of different accounts. The funds accumulated in these intermediate stages are eventually directed to an even smaller number of individual or corporate accounts, and then transferred from these accounts to cryptocurrency exchanges, in an attempt to erase the traces of the criminal connection.
This process reflects the typical characteristics of the “smurfing method”, one of the known methods of money laundering. In this method, many small transactions are carried out in order not to attract attention. The three classic stages of money laundering, placement, separation and integration, are clearly observed in the cases recently revealed within the scope of these crimes:
During the placement phase, small amounts of illegal betting and virtual gambling money are introduced into the financial system using the smurfing method.
During the layering phase, these funds are transferred several times to different real or legal person accounts. During this process, company accounts are created in the form of fake shopping sites to make so-called shopping transactions or to transfer money through high-priced product purchases. At the end of these transactions, the funds in many accounts in the first stage are collected in fewer accounts, and the number of accounts decreases at each stage while the transaction amounts increase. Ultimately, these funds are transferred to crypto asset accounts and tracking is made even more difficult.
In the integration phase, these funds, which consist of criminal proceeds, are used to make legal purchases or are included in the financial system in a laundered form under a legal guise through different methods, thus ensuring a return to “home”.
As stated in the news reports made by Anadolu Agency on the subject, MASAK reports clearly reveal that, in accordance with this crime profile, many small-scale accounts were merged into fewer and fewer accounts in the detected incidents and eventually directed to the crypto asset market.
