Resources · Controls and security

Money transfer instruction flow, from login to the bank

Mundi is not a bank or an investment firm and does not hold customer money. Your bank balances stay at your banks, and the Automated Treasury Account is opened in your company's name at Tacirler Yatırım. Your fund assets are held at Takasbank in your company's name and recorded at MKK. Money transfer instructions go through the Preparer and Approver steps, and your bank carries out the transfer.

Morning

  1. 09:12

    Step 1: User A logs in

    After the password comes a second verification step. This step is on for every user and cannot be turned off.

    Control · Two-factor authentication, mandatory

    Verification code

    Second step

    The code is sent to your phone or email address.

  2. 09:13

    Step 2: Selects the source account

    The company has four banks. Only Bank A and Bank B are assigned to User A, who sees only those two in the list.

    Control · Account visibility set per user

    Source account

    • Bank A current account ₺4,218,640
    • Bank B current account ₺2,874,310

    Bank C and Bank D are not assigned to this user and do not appear in the list.

  3. 09:14

    Step 3: Selects the beneficiary, enters the amount

    User A selects Supplier A from the list. User B approved this beneficiary on 2 October, and its IBAN was recorded that day. User A enters ₺184,500 as the amount and "September invoice" as the description.

    Control · The beneficiary is approved first

    Beneficiary

    Supplier A Approved · 2 Oct

    TR** **** 7735 · Approver: User B

    Amount ₺184,500

    It could stop here. If the beneficiary had not been approved yet, the instruction could not have been approved. The Approver's screen leads to the beneficiary approval first, and the instruction joins the queue after that.

  4. 09:14

    Step 4: The instruction goes for approval

    User A's screen has no Approve button. The instruction lands in User B's Money Transfers list, and User A sees only its pending status.

    Control · The person who enters it cannot approve it

    User A's list

    Supplier A · ₺184,500 Pending approval

    Approver: User B

    This list has no approve button.

  5. 11:05

    Step 5: User B approves

    User B, in the Approver role, sees the instruction on one line with the source account's balance and the description. User B has also logged in with two-factor authentication.

    Control · Approver role, limit and balance in view

    Approval · User B

    Pending approval
    Supplier A ₺184,500

    Bank A current account · Balance ₺4,218,640 · September invoice

    It could stop here. User B can reject it and, if they wish, write a reason. A rejected instruction goes back to User A's list with its status.

  6. 11:05

    Step 6: The instruction is sent to Bank A

    The approved instruction goes to your bank, and Bank A executes the transfer. The money does not pass through Mundi, and Mundi does not hold customer money. You follow the instruction's status in the same list.

    Control · Your bank executes the transfer

    Bank connections

    Money Transfers

    Supplier A · ₺184,500 Sent to bank

    Bank A · 11:05 · Approver: User B

    The money in your investment account does not take this path. It stays at Tacirler Yatırım. Your assets are held not at Mundi but in your investment account, opened in your company's name at Tacirler Yatırım. Fund assets are held at Takasbank in your company's name and are also recorded at MKK. Cash balances in your investment account are protected by the Investor Compensation Center (YTM) within the applicable limits.

    Investment transactions are executed through Tacirler Yatırım Menkul Değerler A.Ş., licensed by SPK. Mundi does not give investment advice. Your company decides which products to use.

    Custody of assets

  7. 11:05

    Step 7: The record is complete

    Every step of the path is in the audit log, with who acted, when and with what information. You can view and report on the log, and no user can delete or change it. The amounts and times are examples.

    Control · Immutable audit log

    Audit log · ₺184,500 instruction

    Cannot be changed
    1. 09:12 Login · User A · second verification passed
    2. 09:14 Instruction created · User A · Bank A current account · Supplier A
    3. 09:14 Sent for approval · Approver: User B
    4. 11:05 Approved · User B · balance seen: ₺4,218,640
    5. 11:05 Sent to Bank A · system

Data

Protecting your data

  • AES-256 encryption

    Your sensitive data is encrypted with AES-256 at rest, and all your communication with the platform runs over an encrypted connection.

    Infrastructure and data protection

  • ISO 27001 and KVKK compliance

    Mundi has ISO 27001 certification. Your data is stored in data centers in Türkiye, in line with KVKK (Türkiye's personal data protection law, Law No. 6698).

    Infrastructure and data protection

  • Mandatory two-factor authentication

    Two-factor authentication is mandatory for every user.

  • Immutable audit logs

    User actions on every transaction can be viewed and reported on.

You

The next instruction could be yours

In a 30-minute call we set up the roles to fit your team, send an instruction for approval together and read the log together.

Book a demo

For your security team

You can write to us to report a vulnerability. We get back to you quickly.

destek@getmundi.app Read the Information Security Policy

Mundi is not a bank and does not give investment advice. Investment transactions are executed through Tacirler Yatırım Menkul Değerler A.Ş., licensed by SPK.

Let's schedule a call