MASAK compliance and customer risk in the gaming and betting sector
MASAK publishes a dedicated suspicious transaction report guide for gaming and betting operators, listing 68 sector-specific suspicious transaction types. Most relate not to the bet amount, but to the registration email, login IP, and whether the player's declared occupation aligns with their transactions. TruvaLI aggregates these indicators into a single customer view from onboarding. Email, phone, and IP data collected at registration feed subsequent transaction rules instead of remaining isolated in a separate fraud system.
Gaming and betting operators are obliged parties under Law No. 5549. The distinguishing feature of the sector is that risk is concentrated in first-contact data: email, phone, and IP are often the only verifiable information available, and occupational declarations and foreign player checks are also explicitly listed in the guide.
Who is an obliged party and how does the process work?
Gaming and betting operators are obliged parties under Law No. 5549 on Prevention of Laundering Proceeds of Crime. MASAK publishes a dedicated suspicious transaction report guide for this group and expects reports to be submitted electronically via the MASAK.Online system.
The guide does not only answer the question of "which transaction is suspicious." It also defines the fields the reporting form must contain, the reference tables used to code transactions, and the category where the suspicion should be placed. This directly determines the output an operator expects from its monitoring software.
Which indicators does the guide list?
| Group | Number of types | What it looks at |
|---|---|---|
| Customer profile | 17 | Declaration, documentation, and avoidance of declaration |
| Transactions | 36 | Email, IP, phone, amount, gaming behavior |
| Terrorist organizations and risky countries | 9 | Counterparty and geography |
| Non-profit organizations | 2 | Director and financial officer movements |
| Financing of weapons of mass destruction | 4 | Sanctions regime |
The transaction types, which form the largest group, point to signals that fall outside conventional payment controls for a betting operator: the email server where the account was opened, the login IP, and the operator to which the phone number belongs. Data not collected at onboarding cannot be generated retroactively.
First-contact data: email, phone, IP
| Type | Description | Required data |
|---|---|---|
| T-010-2.16 | Opening accounts with addresses belonging to untrusted email servers | Provider classification |
| T-010-2.17 | Identical or sequentially repeating email addresses | Similarity search between addresses |
| T-010-2.18 | Transactions with mobile phone numbers belonging to virtual operators | Number range and operator mapping |
| T-010-2.19 | Verified phone and email being similar enough to suggest they belong to someone else | Comparison of personal information with contact details |
| T-010-2.22 | Similar transactions performed via the same IP within a short period | IP history |
| T-010-2.23 | Accessing multiple accounts from the same IP address | Session log |
| T-010-2.24 | Opening multiple accounts from the same IP address | IP at registration |
| T-010-2.26 | Opening a new account from an IP address previously subject to a suspicious transaction report | IP matching with reporting history |
| T-010-2.28 | Logging into the same account from different IPs on the same day | Session log |
| T-010-3.8 | IPs from risky countries or conflict zones incompatible with the profile | IP location and customer profile |
The common feature of these ten types is that none of them look at the bet amount. They are all read from the data captured at the moment of account opening and login.
Why is occupational information important?
"Employment and occupation" is a mandatory field in the natural person section of the suspicious transaction report form, and the guide expects this information to be coded internally.
The guide also considers a lack of reasonable proportion between the customer's work, financial status, and transactions (T-010-1.4), as well as difficulties in obtaining information such as occupation, identity, address, and phone number (T-010-1.10), to be indicators of suspicion. In other words, occupation is not just a piece of information collected once at onboarding and forgotten: it is a reference to be compared against every transaction.
Foreign players
Foreign nationals whose visa or residence permit in Türkiye has expired attempting to transact (T-010-1.16) and the use of the same contact or address information by multiple foreign customers (T-010-3.9) are distinct types in the guide.
The latter cannot be detected by looking at a single account: it requires comparing the contact details of different customers with one another.
Game-specific indicators
A customer purchasing all possible outcomes in the same betting or gaming event (T-010-2.34) and a customer holding a role or position that could influence the outcome of the game they are transacting on (T-010-2.36).
The latter is mentioned alongside transactions related to Article 11 of Law No. 6222 on the Prevention of Violence and Disorder in Sports (T-010-2.35). Together, these three explain why internal lists consisting of athletes, referees, club managers, and officials who can influence the outcome of the game must be maintained. Sanctions and PEP lists do not meet this need: the list must be established by the operator itself.
Indicators related to fund movements
T-010-2.20 lists cases where the amounts of many of the customer's TRY deposits and withdrawals are equal, while T-010-2.21 covers structuring to avoid threshold limits. T-010-2.25 adds cases where a newly registered user's first transaction is for an excessively high amount that is incompatible with their financial profile.
There are three more types related to the balance itself: transferring the deposited balance to another bank account without any gaming activity (T-010-2.30), keeping the balance idle for a long time without transacting (T-010-2.31), and withdrawing a large portion of the balance without transacting (T-010-2.32).
What does the reporting form require?
Suspicious matters that do not involve monetary value are written in the description section of the form, not the suspicious transaction section. This means a case must be capable of carrying non-monetary events.
A report can be based on a single transaction or on multiple transactions within a specific date range: in the case of multiple transactions, the total amount and date range are reported together. If suspicious transactions are concentrated in different channels or types, the form section can be repeated for each cluster.
How is the suspicion category selected?
When reporting, the suspicion is placed into one of the categories in MASAK's reference table, and each category is mapped to the relevant legal regulation. The list ranges from usury to tax evasion, and from fraud to operating or facilitating illegal betting.
This means case management must operate with this taxonomy rather than arbitrary tags. Category selection is an integral part of the report.
What is the threshold for reports with a suspension request?
The regulation based on Article 19/A of Law No. 5549, titled "Suspension of transactions," governs the suspension of transactions based on a report. The guide sets a clear threshold for this: rather than mere suspicion that the asset subject to the transaction is related to money laundering or terrorist financing, there must be supporting documents or serious indications submitted along with the justification.
This threshold directly generates a system requirement: evidence must be attached to the case, the justification must be written, and the identity of the decision-maker must be recorded.
How does TruvaLI address this?
Email score
TruvaLI uses its own proprietary provider lists: trusted providers, disposable address services, and privacy-focused forwarding services that hide the address are listed separately. Which list the address matches generates a reliability coefficient.
Next, the address itself is parsed: whether the person's first name, last name, date of birth, or initials appear in the address. Finally, a fuzzy search is performed against other addresses in the system to catch similar or sequentially ending addresses. This corresponds to types T-010-2.16, T-010-2.17, and T-010-2.19 in the guide.
IP score
The IP address is evaluated using three sources: location with ip2location, ownership with RIPE records, and the structure behind the address with rDNS. From these, the system determines whether the address belongs to a proxy, a VPN, or a real internet service provider, generating a trust score. Whether other users are registered in the system with the same IP is also factored in.
Internal lists
Internal lists are created for individuals who can influence the outcome of the game, such as athletes, referees, and club managers, and are integrated into the screening workflow. The list can be automatically extracted by providing a website URL or established by uploading an official document: names, aliases, and identity details are extracted.
Data collected at onboarding as input for subsequent rules
Email, phone, and IP scores are calculated at onboarding and remain in the customer record. The same data serves as input for transaction monitoring rules: networks of linked accounts sharing the same IP, device, and phone are identified, and the proportion between the occupational declaration and transaction volume becomes a rule for T-010-1.4.
When you notice a new pattern, you can describe the rule using a prompt and test it against historical traffic in simulation, viewing the alert volume it will generate before going live.
Case, evidence, and category
An alert turns into a case with an owner, duration, and evidence. The case can also carry non-monetary events, aggregate transactions within a date range, and generate separate clusters based on the channel. The suspicion category is selected from MASAK's taxonomy.
Evidence and decision justifications are written to an immutable audit trail, the second-pair-of-eyes approval is managed via maker/checker, and the documents and justifications required for reports with a suspension request are attached to the case. The draft report is prepared from the same case data, leaving the final signature to you.
Related scenarios: bonus abuse and multi-accounting, account takeover, customer onboarding, source of funds investigation, and regulatory reporting. The framework is on the MASAK obligations page, and the screening side is on the sanctions, PEP, and adverse media screening page.
Source
MASAK, "Suspicious Transaction Reporting Guide for Operators in the Field of Gaming and Betting", MSK-RHB-ŞİB-010, version 1.0, 12.09.2024.
This page does not constitute legal interpretation: it conveys the indicators and procedures listed in the guide. Rules, thresholds, and actions are configured according to the institution's own risk policy and obligations.
Common questions
- Are betting and gaming operators MASAK obliged parties?
- Yes. MASAK publishes a dedicated suspicious transaction report guide for this sector and expects reports to be submitted electronically via MASAK.Online.
- Do we have to write rules for all 68 types in the guide?
- The guide states the opposite: obliged parties must not limit themselves to the listed types and must submit a report even if a suspicious transaction does not match any of them. The types are a minimum common ground, not a ceiling.
- If email and IP data are not collected at onboarding, can they be generated later?
- No. If the server where the account was opened and the IP of the first login are not recorded at that moment, they cannot be retrieved retroactively. A portion of the types in the guide rely directly on this first-contact data.
- Where do the athlete, referee, and club manager lists come from?
- T-010-2.36 considers a customer holding a role or position that could influence the outcome of the game they play to be an indicator of suspicion. TruvaLI supports creating internal lists for these individuals and integrating them into the screening workflow.
- Is the gaming sector a MASAK obliged party?
- Yes. Operators in the field of gaming and betting are obliged parties under Law No. 5549 and are subject to MASAK's sector-specific guide.
- Why is first-contact data so important?
- In a remotely opened player account, email, phone, and IP are often the only verifiable information available: if this data is not collected at onboarding, it cannot be generated retroactively.
- Why is occupational information requested?
- The guide lists occupational declaration as an indicator: a disproportion between the declared occupation and gaming volume raises suspicion. Occupation is not a field left in the onboarding form: it is a rule input.
- How is multi-accounting detected?
- Clusters of accounts connecting via the same device, IP, payment instrument, and similar email addresses are uncovered through relationship networks.