A participant calls the call center. They claim they never received the pre-contract disclosure. They claim the fund allocation shown in their mobile app on the day of enrollment was different from what ended up in their contract. They claim the state contribution calculation was wrong for three months in 2022. They file a complaint with the Sigorta Tahkim Komisyonu.
Now you have thirty days to reconstruct reality.
And this is where every pension pipeline I've worked on — and I've owned the EGM submission stack across multiple institutions — reveals the same structural problem: the data exists, but the evidence infrastructure was never built.
The Difference Between Data and Evidence
Your data warehouse can tell you what the fund allocation was on 14 March 2022 at 10:47. That's data. What it cannot tell you, in a way that survives arbitration scrutiny, is:
- Who saw that allocation on the screen
- What version of the disclosure PDF was actually rendered to the participant
- Whether the SMS confirmation was delivered, opened, or bounced
- Which upstream system state produced that value at that exact moment
- Whether the row you're looking at today is the row that existed then, or a row that was silently corrected by a downstream reconciliation job in April
Most pipelines are built to produce correct current state. Evidence infrastructure is built to produce provably unchanged historical state. These are different engineering problems, and confusing them is why complaint teams end up screenshotting Excel exports and hoping the arbitrator doesn't ask hard questions.
What Actually Fails Under Scrutiny
When the Insurance Arbitration Commission or the Financial Consumer Protection mechanism requests documentation, here is where the typical pension stack breaks:
Silent overwrites. The participant's risk profile field was updated three times. Your table has one row. The change data capture was either not enabled on that column or was purged after the 90-day retention window because storage was expensive.
Reconciliation rewrites. The EGM daily submission failed on 12 March. The retry on 13 March succeeded with a corrected value. The audit log shows the successful submission. It does not show that the value the participant saw on 12 March was different, or that the failure occurred, or who approved the correction.
Disclosure versioning. The KID document is generated from a template. The template was updated in October. The complaint concerns an enrollment in July. Can you produce the exact bytes of the PDF that was served to that specific participant in July, and prove those bytes were served? In most stacks, no — you can regenerate a July-style document, but regeneration is not evidence.
Clock drift and timezone assumptions. The mobile app logs UTC. The core system logs Turkey time. The EGM submission uses date-only. The SMS gateway uses its own timestamp. When the arbitrator asks for a sequenced timeline, you assemble it from four sources that disagree by up to three hours, and you have no signed record of which clock is authoritative.
Missing intent records. The participant clicked "I have read the disclosure." You have a boolean flag set to true. You do not have the session recording, the scroll depth, the timestamp of the click relative to when the document was rendered, or the hash of the document that was in the DOM at the moment of the click.
Why This Keeps Happening
Regulatory reporting stacks in Turkish pension are built for EGM submission first, MASAK reporting second, internal MIS third. Complaint defensibility is treated as a downstream problem for the legal department, who then ask IT to "pull the data," and IT pulls current state because that is what the schema was designed to expose.
Nobody funds forensic infrastructure until the first six-figure arbitration loss. Then everyone funds it, badly, by bolting append-only logs onto systems that were never designed to emit them.
What Evidence Infrastructure Actually Requires
Based on rebuilding this after the fact more times than I'd like:
- Immutable event streams for every participant-facing state. Not CDC on the transactional database — an explicit event emission at the moment the state is presented, with a cryptographic hash of the rendered artifact.
- Document snapshotting at delivery, not at generation. Store the exact bytes served, with delivery confirmation, indexed by participant and timestamp. Regeneration must be forbidden as an evidence source.
- Signed, sequenced timelines across systems. One authoritative clock, one sequence number space, one canonical event log that references all subsystem events with their native timestamps preserved but ordered by the authoritative sequence.
- Retention aligned to statute of limitations, not to storage budgets. BES contracts have long tails. Ten-year evidence retention is not optional, and it is not something you retrofit from tape.
- Chain of custody on exports. Every time a complaint team pulls data, that pull is itself an event, signed, with a hash of what was extracted. Otherwise the arbitrator has no way to know whether the Excel file in front of them matches what was in the system.
The Uncomfortable Test
Run this exercise on your own stack. Pick a random participant who enrolled 18 months ago. Without touching production and without regenerating anything, produce:
- The exact disclosure document they received
- The fund allocation shown on their screen at enrollment
- Every state change to their contract since, with the identity of who or what made the change
- A signed timeline that a third party could verify against your logs
If you cannot do this in an afternoon, you do not have evidence infrastructure. You have data that happens to be correct today, which is not the same thing, and the difference becomes visible only when a participant, a lawyer, and an arbitrator are waiting for an answer you cannot produce.
The pipeline was never the problem. The pipeline works. The problem is that nobody built the thing next to the pipeline that makes the pipeline's outputs legally defensible — and that thing costs ten times more to build after the first complaint than before it.