General Notice Of The Financial Crimes Investigation Board (Serial No. 5) Notice On Amendments (Serial No. 31) Entered Into Force

1)Purpose and Legal Basis The Financial Crimes Investigation Board General Circular (Serial No: 5), establishes the legal framework for simplified customer identification measures that may be applied by obligated entities. 2)Concept of Simplified Measures and General Principles Simplified measures are an exceptional regime that allows for the more limited application of customer due diligence obligations within a risk-based approach for transactions and customer types where the risk of money laundering and terrorist financing is assessed as low. In this context, simplified measures only apply to:

• Identity verification,
• Determining whether the transaction is being conducted on behalf of another person,
• Identification of the beneficial owner,
• Monitoring of customers and transactions

and shall be limited to the transaction types listed in Section 2.2 of the Circular. Simplified measures do not constitute an automatic exemption and require a separate risk assessment for each customer and transaction. 3)Cases Where Simplified Measures Cannot Be Applied Simplified measures cannot be applied under the following circumstances:

• If the transaction or customer is assessed as risky in terms of money laundering or terrorist financing,
• The customer is a politically exposed person (PEP),
• There is a suspicion of a suspicious transaction regarding the transaction or customer.

In such cases, standard or enhanced measures are applied by the obligated party, and a suspicious transaction report is filed if necessary. 4)Simplified Identity Verification in the Insurance and Pension Sector The process has been simplified for insurance and pension companies when making damage and compensation payments to third parties (other than the insured/policyholder): NVİ Query: Identity information will be queried from the General Directorate of Population and Citizenship Affairs database. Bank Account Matching: The bank account to which the payment will be made must match the identity information of the beneficiary exactly. Exception: If these two conditions are met, the requirement to verify identity and obtain a signature sample using the traditional method is waived. 5)"Money Transfer" Condition for Remote Customer Acceptance (Effective: February 1, 2026) Security has been enhanced for customer acceptance via video calls or other digital methods: Verification Account: Before customer acceptance, it is mandatory for the person to transfer money from a bank/credit card account registered in their name to a "verification account" designated by the institution for this purpose. Service Limit: Customer acceptance cannot be completed and no financial services can be provided until this transfer is made. 6)Special Regime for Accounts Opened at the Request of Public Institutions A new clause (2.2.13) has been added for accounts opened at the request of public institutions for the purpose of making mandatory payments (social assistance, compensation, etc.): Limited Monitoring: Continuous monitoring and information update frequency may be reduced for these accounts. Blocking Condition: The account will not be permitted for use until identity verification is fully completed. Data Verification: Subject to inquiry through the NVİ, signature samples and detailed verification documents may be exempted. Implementation Schedule

Article 3 & 4: Mandatory money transfer for verification  purposes in remote customer acceptance(February 1, 2026)

Other Articles: PEP transactions, insurance payments, and public account exemptions (January 7, 2026 (Publication Date)) 7)Conclusion and Evaluation  The simplified measures introduced by the MASAK General Circular (No. 5) establish a compliance mechanism based on the principle of proportionality for obligated parties, but also require careful and reasoned risk assessment in practice. In this context, simplified measures must:

• Compatibility with internal compliance policies and procedures,
• Monitored by internal control and internal audit mechanisms,
• Be documented in a justifiable manner for supervisory authorities,

are important for the management of legal and administrative risks.