The Regulation Amending the Regulation on Program of Compliance with Obligations of Anti-Money Laundering and Combating the Financing of Terrorism has been published.
Under the amendment:
ARTICLE 1 – Subparagraph (a) of the first paragraph of Article 3 of the Regulation on Program of Compliance with Obligations of Anti-Money Laundering and Combating the Financing of Terrorism, published in Official Gazette No. 26999 dated 16/9/2008, has been amended as follows, and the following subparagraph has been added to the same paragraph.
“a) Ministry: the Ministry of Treasury and Finance,”
“j) Financial group: the group consisting of financial institutions resident in Turkiye that are affiliated with, or under the control of, a parent entity whose headquarters are located in Turkiye or abroad, together with their branches, agencies, representatives, commercial proxies and similar affiliated units,”
ARTICLE 2 – The following article has been added to the same Regulation, to follow Article 3.
“Nature of the financial group
ARTICLE 3/A – (1) A financial institution is deemed to be affiliated with, or under the control of, a parent entity where the parent entity, without any requirement to hold at least fifty percent of the capital, directly or indirectly owns the majority of that institution’s capital; or, without owning such a majority, holds privileged shares or disposes of the majority of the voting rights under agreements with other shareholders; or in any other way holds the power to appoint or remove the majority of the board members needed to pass a decision.
(2) Under the first paragraph, financial institutions resident in Turkiye that are affiliated with, or under the control of, a parent entity whose headquarters are located in Turkiye or abroad, together with their branches, agencies, representatives, commercial proxies and similar affiliated units, constitute the financial group. If the parent entity is itself a financial institution, it is designated as the parent financial institution; otherwise, one of the financial institutions affiliated with or controlled by the parent entity is designated as the parent financial institution.
(3) The parent financial institution notifies the Presidency of the titles, shareholding and control status, and contact details of the headquarters of the group’s parent entity, of the parent financial institution forming the financial group and of the other financial institutions, within ten days from the date on which the conditions for the formation of the financial group are met. The Presidency may designate another financial institution in the group as the parent financial institution in place of the one determined under the second paragraph and notified to the Presidency.
(4) Where financial institutions subsequently join or leave the financial group, this is notified to the Presidency within thirty days from the date on which the change occurs.
(5) Public institutions and organizations that hold stakes in financial institutions, such as the Turkey Wealth Fund, the Savings Deposit Insurance Fund and the General Directorate of Foundations, are not regarded as parent entities for the purposes of forming a financial group. In forming a financial group, the financial institutions within the structure of the institutions and organizations listed above are assessed separately in respect of the entities with which they have a relationship of affiliation and control.”
ARTICLE 3 – In subparagraph (c2) of the first paragraph of Article 4 of the same Regulation, the phrase “General Directorate” has been replaced with “Joint Stock Company”; the following subparagraphs have been added to the same paragraph; the following paragraph has been added to the same article to follow the first paragraph, and the other paragraph has been renumbered accordingly; and the following sentence has been added to the existing second paragraph of the same article.
“d) Group A authorized institutions as defined in the foreign exchange legislation,
e) Financing, factoring and financial leasing companies,
f) Portfolio management companies,
g) Precious metals intermediary institutions,
g2) E-money institutions,
h) Payment institutions (excluding those that exclusively provide bill payment intermediation services, exclusively provide payment initiation services and exclusively provide account information services),”
“(2) The financial group establishes a compliance program at group level. This does not remove the obligation of each financial institution in the group to establish a separate compliance program that observes the standards and policies determined at group level.”
“Where the legislation of the relevant country does not permit the implementation of the measures within the scope of the compliance program, the Presidency is notified and additional measures are taken.”
ARTICLE 4 – The third paragraph of Article 5 of the same Regulation has been amended as follows, and the following paragraph has been added to the same article.
“(3) In addition to the measures set out in the first paragraph, the compliance program of the financial group includes measures for establishing policies and procedures on customer identification and on the secure sharing of information on accounts and transactions within the group. The compliance programs of the financial institutions in the group are also prepared and implemented with regard to the compliance program of the financial group.”
“(4) The measures set out in the first and third paragraphs within the scope of the compliance program are reviewed at least every two years and updated as necessary.”
ARTICLE 5 – The following sentence has been added to the first paragraph of Article 6 of the same Regulation; the phrase “and deputy compliance officer” has been added after the phrase “compliance officer” in the second paragraph; and the phrase “resident in Turkiye” has been added after the phrase “all of them,” in the third paragraph.
“Ultimately, the board of directors of the parent financial institution is responsible for overseeing the conduct of the compliance program at financial group level.”
ARTICLE 6 – The second sentence of the first paragraph of Article 7 of the same Regulation has been amended as follows, and the following sentence has been added to the same paragraph.
“At a minimum, the corporate policy includes risk management, monitoring and control, training and internal audit policies and, in financial groups, additionally the policies on information sharing within the group.”
“The matters identified within the scope of the national risk assessment are also taken into account in establishing the corporate policy.”
ARTICLE 7 – In the first paragraph of Article 9 of the same Regulation, the phrase “at the group level in the case of a financial group,” has been added after the phrase “within,”; the third paragraph of the same article has been amended as follows; and the following paragraphs have been added to the same article.
“(3) After obtaining the operating license, obliged parties establish the corporate policy within thirty days at the latest from the date on which the compliance officer is appointed. A financial group likewise establishes the corporate policy within thirty days at the latest from the date on which the compliance officer is appointed. The corporate policy is approved by the board of directors within the same period.”
“(4) Obliged parties and the financial group inform their relevant personnel about the corporate policies.
(5) The corporate policy must be presented when requested by the Presidency or by audit personnel.”
ARTICLE 8 – Article 10 of the same Regulation, together with its heading, has been amended as follows.
“Corporate policy commitment form
ARTICLE 10 – (1) The commitment forms on the corporate policy set out in Annex-1/A and Annex-1/B are signed by the board of directors, or by the board member or members to whom it has delegated its authority, and sent to the Presidency within thirty days from the date on which the corporate policy is approved.
(2) If the corporate policy changes, the commitment forms set out in Annex-1/A and Annex-1/B are redrawn and sent to the Presidency within thirty days.
(3) The Presidency is authorized to change the content of the commitment forms on corporate policies. Changes made to the commitment forms are announced on the Presidency’s official website.”
ARTICLE 9 – The phrase “, taking the necessary measures to mitigate risks” has been added after the word “ensuring” in subparagraph (c) of the first paragraph of Article 12 of the same Regulation.
ARTICLE 10 – Article 16 of the same Regulation, together with its heading, has been amended as follows.
“Appointment of the compliance officer and deputy compliance officer
ARTICLE 16 – (1) Obliged parties appoint a compliance officer to carry out the compliance program within thirty days after obtaining the operating license.
(2) The compliance officer is appointed exclusively from among the institution’s personnel, reporting to the board of directors or to one or more members to whom the board has delegated its authority. The compliance officer may hold other duties that do not hinder the conduct of the compliance program, provided that they are not related to sales and marketing.
(3) Obliged parties appoint, for the conduct of the compliance program, a deputy compliance officer who meets the conditions and qualifications required of the compliance officer. The deputy compliance officer is appointed exclusively from among the institution’s personnel, reporting to the compliance officer. The deputy compliance officer is appointed within the same period and by the same procedure as the compliance officer.
(4) The commitment form for the compliance officer and deputy compliance officer set out in Annex-2 is signed by the board of directors, or by the board member or members to whom it has delegated its authority, and sent to the Presidency within ten days at the latest from the date of appointment.
(5) The compliance officer may delegate some or all of the duties and powers within the scope of Article 19 to the deputy compliance officer, expressly and in writing. Such delegation of duties and powers does not remove the compliance officer’s responsibility in this respect.
(6) The Presidency is authorized to change the content of the commitment form for the compliance officer and deputy compliance officer. Changes made to the commitment forms are announced on the Presidency’s official website.”
ARTICLE 11 – Article 20 of the same Regulation, together with its heading, has been amended as follows.
“Departure of the compliance officer and deputy compliance officer from their post
ARTICLE 20 – (1) If the compliance officer or deputy compliance officer loses the conditions required by this Regulation, or it is later understood that they do not meet those conditions, or they leave their post, the obliged party notifies the Presidency in writing within ten days from the date of departure, and a new appointment is made in accordance with Article 16 within thirty days at the latest from the date of departure. The commitment form for the appointment set out in Annex-2 is signed by the board of directors, or by the board member or members to whom it has delegated its authority, and sent to the Presidency within ten days from the date of appointment.
(2) Until a compliance officer is reappointed under the first paragraph, the deputy compliance officer acts in that capacity.”
ARTICLE 12 – The following articles have been added to the same Regulation, to follow Article 20.
“Appointment of the financial group compliance officer and the compliance unit
ARTICLE 20/A – (1) To carry out the compliance program at group level, the financial group designates the compliance officer of the parent financial institution as the financial group compliance officer. The deputy compliance officer of the parent financial institution is designated as the financial group deputy compliance officer. The financial group compliance officer and deputy compliance officer are appointed so as to report to the board of directors of the parent financial institution or to one or more members to whom the board has delegated its authority, and paragraphs three to five of Article 16 apply to the appointment.
(2) The duties and responsibilities of the financial group compliance officer are as follows:
a) To carry out the necessary work to ensure the financial group’s compliance with the Law and the regulations issued under the Law at group level, and to provide the necessary communication and coordination with the Presidency.
b) To establish the policies and procedures of the financial group and submit the group’s policies for the approval of the board of directors.
c) To establish the risk management policy of the financial group and carry out risk management activities.
c2) To establish the monitoring and control policies of the financial group and carry out the related activities.
d) To share with the relevant financial institution in the group any matters assessed as risky as a result of risk management, monitoring and control activities.
e) To establish the information sharing policy of the financial group and take the necessary measures for the secure sharing of this information within the group.
f) To coordinate the work on the training programs of the financial institutions in the group concerning the prevention of laundering of proceeds of crime and financing of terrorism, and to oversee the effective implementation of the training programs.
(3) The compliance unit of the parent financial institution also acts as the compliance unit of the financial group. To ensure that the financial group compliance officer can effectively perform the duties and responsibilities set out in this Regulation, the board of directors of the parent financial institution ensures that sufficient personnel and resources are allocated to the compliance unit, taking into account factors such as the group’s financial size, transaction volume, number of branches and personnel, or the level of risks it may face.
Information sharing within the financial group
ARTICLE 20/B – (1) Institutions in the group may share information on customer identification and on accounts and transactions in order to ensure that the measures within the scope of the compliance program are taken at group level. Confidentiality provisions in special laws do not apply to information sharing within the group.
(2) Persons working at institutions in the group may not disclose information they learn within the scope of the first paragraph, nor use it for their own benefit or that of third parties. Those who disclose information that must be kept confidential in this context are subject to the sanctions in the relevant laws.
(3) The board of directors of the parent financial institution, together with the financial group compliance officer, is responsible for taking the measures required to share information securely within the group. This responsibility also applies to the compliance officers of the financial institutions in the group and to the boards of directors of those institutions.
(4) Financial institutions in the group may not share information on the fact that a suspicious transaction report has been filed.”
ARTICLE 13 – The following paragraph has been added to Article 21 of the same Regulation.
“(3) The training policy of the financial group is prepared so as to cover, at a minimum, establishing the corporate policy and procedures at financial group level, carrying out risk management, monitoring and control activities, and information sharing within the group, and the training topics are determined within this scope.”
ARTICLE 14 – In the second paragraph of Article 22 of the same Regulation, the phrase “a certain” has been replaced with “annual”.
ARTICLE 15 – In the first paragraph of Article 24 of the same Regulation, the word “each” has been replaced with “the following”.
ARTICLE 16 – The following paragraph has been added to Article 26 of the same Regulation.
“(3) The internal audit activities of obliged parties within the scope of the compliance program are carried out by their internal audit units or inspection board, where they have one. The internal audit of the financial group is carried out by the relevant unit of the parent financial institution. For other obliged parties, internal audit activities are carried out by the person or unit authorized by the board of directors. To ensure independent work, the personnel authorized to carry out internal audit activities must not have been given duties and powers in carrying out the other measures within the scope of the compliance program.”
ARTICLE 17 – In the first paragraph of Article 28 of the same Regulation, the word “each” has been replaced with “the following”.
ARTICLE 18 – In the first paragraph of Article 29 of the same Regulation, the phrase “authorized institutions as defined in the foreign exchange legislation, financing and factoring companies,” has been replaced with “Group B authorized institutions as defined in the foreign exchange legislation,”, and the phrase “financial leasing companies, payment institutions, e-money institutions, portfolio management companies,” has been replaced with “asset management companies, payment institutions (those that exclusively provide bill payment intermediation services, exclusively provide payment initiation services and exclusively provide account information services),”.
ARTICLE 19 – The phrase “risk management, also taking into account the risks identified within the scope of the national risk assessment,” has been added after the word “oversight,” in subparagraph (c2) of the first paragraph of Article 31 of the same Regulation.
ARTICLE 20 – The following article has been added to the same Regulation, to follow Article 32.
“Responsibilities of obliged parties that are not required to establish a compliance program or to appoint a compliance officer exclusively
ARTICLE 32/A – (1) The obliged parties listed in subparagraphs (k), (n), (s), (s2), (t) and (u) of the first paragraph of Article 4 of the Regulation on Measures carry out training, oversight, and monitoring and control work for identifying risks, also taking into account the risks identified within the scope of the national risk assessment, and for tracking and mitigating those risks, and take the necessary measures in this context, in order to ensure compliance with the obligations imposed by the Law and by the regulations and communiqués issued under the Law.”
ARTICLE 21 – The following paragraphs have been added to Provisional Article 1 of the same Regulation.
“(4) Asset management companies that have already obtained an operating license appoint a compliance officer who meets the conditions set out in Article 30 by 1/6/2021.
(5) Precious metals intermediary institutions, together with Group A authorized institutions, portfolio management companies, financing, factoring and financial leasing companies, payment institutions (excluding those that exclusively provide bill payment intermediation services, exclusively provide payment initiation services and exclusively provide account information services) and e-money institutions that have appointed a compliance officer under Article 29, appoint a compliance officer and deputy compliance officer who meet the conditions set out in Article 17 by 1/6/2021. For the deputy compliance officer to be appointed, the conditions set out in subparagraph (d) of the first paragraph of Article 17 are not required until 1/6/2023. These institutions establish their compliance programs by 1/7/2021.
(6) Obliged parties that have already appointed a compliance officer within the scope of Article 16 appoint a deputy compliance officer, and financial groups appoint a compliance officer and deputy compliance officer, by 1/6/2021. For the deputy compliance officer to be appointed, the conditions set out in subparagraph (d) of the first paragraph of Article 17 are not required until 1/6/2022.”
ARTICLE 22 – The following provisional article has been added to the same Regulation.
“Deadline for sending financial group information and corporate policy commitment forms
PROVISIONAL ARTICLE 4 – (1) The information within the scope of the third paragraph of Article 3/A is notified to the Presidency by the parent financial institution by 1/6/2021.
(2) Obliged parties that have already established a corporate policy within the scope of the first paragraph of Article 4, and obliged parties within the scope of the fifth paragraph of Provisional Article 1, send the commitment forms set out in Annex-1/A to the Presidency by 1/7/2021.”
ARTICLE 23 – In the first paragraph of Article 34 of the same Regulation, the phrase “Minister of Finance” has been replaced with “Minister of Treasury and Finance”.
ARTICLE 24 – Annex-1/A, Annex-1/B and Annex-2, attached hereto, have been added to the same Regulation.
ARTICLE 25 – This Regulation enters into force on 1/5/2021.
ARTICLE 26 – The Minister of Treasury and Finance executes the provisions of this Regulation.
| Dates and Numbers of the Official Gazette Issues in Which the Regulation Was Published | ||
| Date | Number | |
| 16/9/2008 | 26999 | |
| Dates and Numbers of the Official Gazette Issues in Which the Regulations Amending the Regulation Were Published | ||
| Date | Number | |
| 1- | 26/9/2008 | 27009 |
| 2- | 2/1/2010 | 27450 |
| 3- | 11/6/2014 | 29027 |
| 4- | 18/3/2016 | 29657 |
The relevant regulation can be accessed at the following link:
https://www.resmigazete.gov.tr/eskiler/2021/02/20210226-2.htm
