A Risk-Based Approach to The Protection of Banking Secrecy: A Functioning Regulatory Framework in Turkish Law

In regulatory activities carried out by regulatory authorities, the traditional rule-based approach characterized by rule-making, ensuring compliance with rules, and imposing sanctions for violations appears to have been replaced by a risk-based regulatory approach that grants discretion to the implementing authority. This approach is based on the prior assessment of the risks arising from activities subject to regulation, the adoption of measures appropriate to such risks, and the auditability of the assessments made within the framework of the principle of accountability. This study examines the risk-based regulatory approach from a conceptual perspective and evaluates its manifestation in banking legislation. In this context, it is observed that the risk-based approach has been explicitly and systematically adopted in European Union data protection law, whereas it has found only limited reflection in the Turkish Personal Data Protection Law (KVKK). Turkish legislation on the protection of banking secrecy, however, presents a different picture. Although this legislation does not set forth the risk-based approach systematically, the structure requiring datasharing decisions to be made by banks on the basis of risk assessment and accountability -together with the general risk management regulations -points to a de facto functioning risk-based approach. In this respect, the study aims to contribute to the literature by demonstrating that the risk-based approach in Turkish law has developed not only through explicit reference in normative regulations but also through sectoral regulations and implementation practices.