Recent Developments
The Communiqué on Remote Identification Methods to be used by Brokerage Firms and Portfolio Management Companies and Electronic Agreement (the “Communiqué”) was published in the Official Gazette No. 31744 on 8 February 2022 and will come into force one month later.
With the Communiqué, it is possible for brokerage firms and portfolio management companies to identify and execute contracts with their clients in electronic media. Accordingly, the opportunity, provided for in the Regulation on Remote Identification Methods to be used by Banks and Electronic Agreements, published in the Official Gazette No. 31441 dated 1 April 2021, has also been recognized for brokerage firms and portfolio management companies. For information on the relevant regulation regarding banks, you can refer to our legal alert dated 6 April 2021 here.
What’s New?
Remote Identification
- General principles
- Remote identification will be carried out through a virtual meeting between the client and the person assigned by the brokerage firm or portfolio management company to manage the remote identification process and through their communication via this meeting with each other.
- The remote identification method will be similar to the face-to-face method and will be designed in a way that minimizes risk. Adequate security measures will be adopted in the video call method, taking into account possible technological and operational risks.
- Before the brokerage firm and portfolio management company implement the remote identification process, they will set out a workflow procedure, test the effectiveness of the process and record the results. They will review the remote identification procedure periodically. In the event that the test results are not successful, the necessary updates will be made to the procedure. The process will not be implemented unless efficiency and adequacy are ensured.
- Personnel and remote identification process
- Trained personnel will carry out the video call phase of remote identification.
- In the remote identification process, the client’s application will be received via an electronic form before the video call starts, and their risk assessment will be carried out. During the remote identification process, no sensitive personal data, other than biometric data, can be obtained in order to enable remote identification. The client’s explicit consent regarding this will be recorded electronically.
- The video call phase of remote identification will be carried out in real time, without interruptions. The video call will be end-to-end encrypted.
- A centrally generated OTP will be sent to the person via an SMS generated only for the identification process. The client will forward the OTP back online via the application interface. If the system successfully approves this SMS OTP, the client’s mobile phone number will be verified.
- The brokerage firm or portfolio management company will take necessary measures to serve disabled people.
- Methods for remote identification
- An identity document with visually distinguishable security elements under white light, a photograph and a signature will be required.
- Identity information on the chip of the identity document will be verified through near field communication to constitute the necessary match and identify the person from the identity document.
- In the event that verification cannot be made using near field communication, the person’s identity will be verified during the remote identification process via video call. At least four of the visual security elements of the identity document, which has a photograph and signature, should match the security elements that can be visually distinguished under white light in terms of form and content. In addition to the identification made by verifying only visual security elements, the first financial transaction prior to the establishment of the continuous business relationship will be made through another financial institution, where the principles of client identification are applied.
- Personnel will take photographs and/or screenshots showing the person and the front and back of their identity document, along with the information on the document presented by the person during the video call. Personnel will ensure that the identity document is fully visible at the right angle, along with all visually distinguishable security elements under white light, and that there are no indications of alteration at the transition points between the parts on the identity document by using images of the person’s movements.
- Identity verification and retention of documentation
- During the video call, person’s identity will be ensured and the Personnel will verify whether the identity document satisfies the criteria set forth by the competent authority, and that it belongs to the person. At the end of the video call, the Personnel will obtain the person’s verbal confirmation that they will become the brokerage firms/portfolio management company’s client. The brokerage firm/portfolio management company will confirm that the necessary measures are in place to avoid potential risks of deep-fake technology.
- The remote identification process will be recorded and stored in full and will be available for any audits. The Communiqué on Document Registration will be taken into account when determining relevant data retention periods. The documents will be stored for 10 years.
- Responsibility for remote identification
- The brokerage firm/portfolio management company will be responsible for ensuring that its remote identification solutions are used to minimize the risk of misidentifying the potential client and will monitor those remotely identified in a different risk profile. The brokerage firm/portfolio management company will apply additional security and control methods depending on the type and amount of the transactions made by these potential clients. The burden of proof lies with the brokerage firm/portfolio management company regarding transactions that impose obligations on third parties.
- The Capital Markets Board may restrict or stop the remote identification process, in the case that the brokerage firm and/or portfolio management company do not comply with the provisions on remote identification.
Establishing Agreements in Electronic Media
- Following the remote identification made in accordance with the methods set out in the Communiqué, the client’s declaration for establishing a contract must be received after verifying their identity with an identity verification mechanism consisting of at least two components. These two components will be selected from these elements: what the client “knows” and “owns,” or a “biometric characteristic.” It is also possible to receive the client’s declaration for establishing the contract during the video call.
- To execute an agreement electronically, (i) all terms and conditions of the electronic agreement must be conveyed to the client through the internet or mobile applications in a manner legible and understandable to them; (ii) the client’s declaration of intent for the establishment of the electronic agreement, together with the agreement itself, must be conveyed to the brokerage firm and portfolio management company with a secret encryption key exclusive to the client; and (iii) the content of the agreement provided to the client and the agreement executed by the client must be exactly the same.
Conclusion
The Communiqué is a great convenience in capital market services, and clients can now take advantage of these institutions’ services without having to physically visit the brokerage firm and/or portfolio management company. As this possibility, previously used for banking services, has also been introduced for capital market services, we expect that the number of brokerage firms and portfolio management companies’ clients will increase and the conditions of competition in the market will improve.
