White-Collar Crime and
Corporate Investigations

After a whistleblower report, suspicious payment, data leak, public authority letter, search or an allegation that reaches the press, the core team that will take decisions is identified. A preservation notice preventing the deletion or alteration of records, access and duty limits, a communication protocol, management briefing and a business continuity plan are prepared. No final judgment on the type of offense is made in the initial assessment; known facts, allegations to be verified and urgent legal time limits are listed separately.

Employees are prevented from collecting records on their own initiative or from holding unplanned conversations with the suspected person. Public officials’ proceedings are not interfered with; the decision, the record of the proceeding, the seized items and the digital record inventory are followed. The aim is to establish an auditable and lawful response in place of decisions driven by panic.

• The decision, summons, notification and the nearest official proceeding date.
• Preventing the risk of loss or alteration of records limited to the event.
• Controlled communication with the authorized legal and technical points of contact.

Who assigned the review, which allegation and period it is limited to, to whom it will report, the budget and access authority, the conflict-of-interest check, the basis for data processing and the purpose for which the results will be used are put in writing. The options of the board of directors, the audit committee, the shareholders’ assembly or the authorized executive are assessed according to the type of company and the level of the allegation.

The scope document also includes the method of change and approval if a new fact emerges during the review. In this way, an unnecessary expansion of the inquiry, the use of personal data for a purpose other than the original one, or influence over the process by the person who is the subject of the allegation is prevented. It is not mandatory for every internal investigation to be conducted by an outside attorney; however, criminal risk, an allegation against senior management, a cross-border element or the possibility of an official process makes legal management important.

Where the allegation concerns a board member, the general manager, the legal department, human resources, internal audit or a shareholder, the ordinary reporting arrangement may not be sufficient. The review team’s past advisory work, personal relationships and ties with decision-makers are recorded. If necessary, direct reporting to an independent board member, the audit committee or a special committee is established.

Access to information is limited by the “need to know” principle. The authority to issue an interim report is kept separate from final decision-making authority; the review team does not decide on discipline or a criminal complaint alone. This structure serves to ensure that the investigation proceeds impartially in fact and not only in appearance, and that later disputes about the method are reduced.

The ordinary deletion cycle of email, messaging, accounting, bank, access, camera, telephone, contract, tender, travel and expense records may be suspended temporarily. The preservation notice is prepared proportionately as to person, system, date, subject and type of record; the route of retaining all company data indefinitely is not taken. Backup, version, log, access and copying methods are determined with the information technology team.

By whom, when and from what source the records were obtained, together with integrity checks and access movements, are written down. The statutory retention obligation is assessed together with the purpose limitation and erasure principles under the Personal Data Protection Law (KVKK). Lifting the preservation when the review ends, and renewing its scope if there is a continuing case or public request, is planned.

The receipt of anonymous or named reports, issuing a record number, urgency and conflict-of-interest checks, secure communication with the whistleblower, the correct explanation of confidentiality expectations and criteria for routing to a file are prepared. The existence of a report does not by itself show that an offense was committed; the allegation, verifiable detail, the source of documents, the possibility of personal hostility and the risk of recurrence are assessed together.

No absolute confidentiality or commitment to a particular result is given to the whistleblower; the situations in which identity may be disclosed because of a legal requirement are explained in advance. The risk of retaliation is monitored with regard to labor law, discrimination, personal data and sector rules. It is not assumed that there is a single, general whistleblower protection regime in Türkiye for the entire private sector; the protection that applies is established according to the specific relationship and the relevant legislation.

In the first screening, the act alleged, the persons concerned, the transaction period, the benefit or loss to the company, any public official connection, the flow of money and data, authority documents, possible types of offenses and administrative obligations are shown in a matrix. A rumor of unknown source is separated from a verified transaction record. For each allegation, it is determined by which record or interview each fact will be tested.

A preliminary assessment is not a decision declaring persons guilty or not guilty; it is a limited stage that determines whether a detailed investigation is needed and its priority. Even if an allegation appears clearly unfounded, the decision and its reasons are recorded. If there is a need for urgent notification, stopping loss or protecting assets, these steps are handled independently of the investigation timetable.

The order of the interviews, the interviewers, the topics, the use of documents, the method of note-taking, the interpreter, requests for accompaniment and labor-law effects are determined in advance. The employee is told clearly the corporate nature of the interview, whom the attorney represents, how the information may be used and the limits of any request for confidentiality. Pressure, threats or misleading certainty are not used.

The employee’s duty of cooperation under the employment contract and the principles of the right to remain silent and not being compelled to incriminate oneself in criminal procedure are not the same concept; the person’s status and connection to an official process are assessed separately. Audio or video recording is not made without a legal basis. The interview note separates fact, interpretation and inference; critical statements attributed to the person are verified as far as possible.

In reviewing corporate email, file storage, the messaging system, access records and company devices, prior notice, a legitimate and specific purpose, the legal condition for processing, necessity, proportionality, data minimization and access security are applied together. Search terms, the group of persons, the time range and the data source are limited by written approval. Additional protection is put in place for special categories of personal data, personal correspondence and information belonging to third parties.

Access to personal devices or accounts is not treated in the same way as the review of a corporate device. The review copy is kept in a separate environment; the source, time information, integrity and authorized access of exported data are recorded. Data unrelated to the result is not carried into the report.

The internal investigation data inventory is prepared with columns for data category, data subject, source, purpose, processing condition, recipient, transfer, retention and security. The timing and content of the notice obligation are assessed in a way that does not unnecessarily compromise the confidentiality of the event but does not make the data subject’s rights invisible. Because of the imbalance of power in the employment relationship, explicit consent is not made the default basis in every review.

Transfers of data to a group company abroad, an e-discovery provider or the review team are tied to the current transfer mechanisms of Law No. 6698. Access is granted on a role basis; downloading, sharing and deletion movements are monitored. A data subject’s application is answered with reasons after the confidentiality of the investigation and third-party rights are examined together.

The attorney’s duty of confidentiality under the Attorneyship Law, the right of defense, the safeguards for searches of an attorney’s office under the CMK and internal information classification are reflected in the review plan. However, it is not assumed that every internal company communication, or copying an attorney on a message, creates an absolute and unlimited “privilege.” The purpose of the communication, its parties, the attorney’s role, its connection to legal advice or defense and the law of the country that applies are examined separately.

Legal assessment is separated from business decisions as far as possible. Authority and necessity are checked before external sharing. When an official authority makes a request, secrecy, defense and third-party rights are asserted by the proper procedure; records are neither concealed nor altered.

The report consists of sections on the assignment, scope, method, limitations, records reviewed, interviews, verified facts, allegations that could not be verified, legal assessment, control weaknesses and recommended corrective actions. The language of a criminal conviction is not used; the level of proof and uncertainty are written out openly. A short decision summary can be prepared for management, but the summary does not remove critical limitations.

The report distribution list, copy number and retention period are determined. Personal data and trade secrets are not duplicated with unnecessary detail. Sharing the report with the prosecutor’s office, a regulator, an independent auditor, an insurer, a bank or a foreign authority is not automatic; legal obligation, strategy, loss of rights and the effect on confidentiality are assessed separately.

The result of the review is turned into options such as a change of controls, separation of duties, payment approval, supplier review, policy update, training, discipline, recovery of loss, contract termination or notification. For a disciplinary sanction, the Labor Law, the employment contract, internal regulations, the collective bargaining agreement, and the provisions on defense and time limits are examined. The conclusion of a criminal investigation is not a mandatory precondition for every labor-law decision; however, a hasty and prejudiced action may also give rise to a separate dispute.

Consistency is observed for persons in similar situations. The owner, date and verification method of the corrective action are determined. Publishing a policy is not enough; whether the control works is measured by a follow-up test.

The program is built with the components of management support, risk assessment, policy, third-party review, gifts and hospitality, donations and sponsorships, relations with public officials, payment controls, a whistleblowing channel, training, monitoring and sanctions. The company’s sector, countries, sales model, public tenders, license processes, cash use and intermediary relationships change the risk level.

Instead of a copied policy, approval limits and record fields tied to the actual workflow are prepared. The board of directors receives regular reports; high-risk exceptions are subject to reasoned approval. The existence of a program does not by itself remove liability, but it is the basic tool of corporate governance for prevention, detection, response and reducing the risk of recurrence.

For gifts and hospitality, setting only a monetary limit is not sufficient. Whether the recipient is a public official or a private-sector employee, timing, any connection to a tender or license, frequency, benefit provided to a spouse or relative, cash-equivalent value, business purpose and local custom are examined together. In travel support, transportation, accommodation, companions, per diem and the content of the event are separated.

For donations and sponsorships, the beneficial owner, the link to a decision-maker, visibility and the consideration for services are checked. The flow of refusal, prior approval, recording and audit should be user-friendly. Instead of vague prohibitions that would lead employees to get around the system, risk indicators and a consultation channel are created.

For agents, consultants, lobbyists, customs brokers (gümrük müşaviri), distributors, joint venture participants and sales intermediaries, the ownership, beneficial owner, public official connection, competence, reputation, need for the service, the fit of the fee with the market and the scope of work, the bank account and the use of sub-intermediaries are examined. The contract contains provisions on the definition of services, the basis of invoices, an anti-corruption undertaking, audit, training, subcontractors, record-keeping and termination.

The review is not done only before the contract; it is renewed as the risk and the relationship change. High commissions, invoices in round amounts, an account in another country, an unclear service and a promise of speeding things up are indicators that require additional review; they are not by themselves a criminal provision.

Within the framework of Article 252 of the TCK, the securing, offering or promising of a benefit to a public official, directly or through an intermediary, to perform or not perform a task related to the performance of the official’s duty is assessed; the processes of request or acceptance are assessed separately. The benefit does not have to be money.

For acts connected with foreign public officials and officials of international organizations, the scope provisions of the law are also examined. Within the company, payment, invoice, consulting, gift, travel, donation and approval records are handled together. At what stage the bribery agreement or offer arose, the role of the intermediary, the provisions on effective repentance (etkin pişmanlık) and consequences specific to legal entities are assessed according to the specific case; no general promise of immunity is given.

For persons who are not public officials as well, there is a special scope with respect to the organizations listed in Article 252/8. On the other hand, not every private-sector commission or improper payment is automatically the offense of bribery; the person, the organization, the duty and the relationship of benefit are assessed separately.

Trading in influence under Article 255 of the TCK is examined with regard to obtaining a benefit, on the claim of having influence over a public official, for the purpose of having an unjust act performed, and the conduct of the parties concerned. Expressions such as “speeding up the matter,” “resolving it through an acquaintance,” “making the outcome certain,” or a fee for a public act contingent on the result are assessed together with the context and the real service.

Legitimate legal representation, consulting or application activity is not confused with an unlawful promise of influence. The contract, meeting, message, payment, public file and the intermediary’s actual contribution are investigated. When working with a relative of a public official or a former public official, the duty, the cooling-off period, the conflict of interest and the risk of hidden benefit are examined separately.

Dispositions by public officials over property whose possession was transferred to them by reason of their duties are examined as embezzlement; obtaining a benefit by abusing the influence provided by the office as extortion by a public official; and conduct contrary to duty not separately defined as an offense in the law, if the conditions are met, under abuse of office. The use of company money by an employee of a private company is not automatically considered embezzlement; provisions on breach of trust, fraud, theft or company law may come into play.

Public affiliates, public resources, duty status and the reason the property was delivered are carefully separated. For institutions, the options of determining loss, criminal complaint, discipline, recourse and asset protection are planned together.

The embezzlement provision in Article 160 of the Banking Law is a special regime. An allegation about an employee of an ordinary commercial company is not automatically equated with this provision or with embezzlement specific to public officials.

The link among deceptive conduct, the capacity to deceive, the victim’s being misled, the disposition, benefit to the perpetrator or a third party, and loss is examined. The use of a company, bank or information system as a tool; the act of a merchant or company executive in the course of commercial activity; an act to the detriment of a public institution or other aggravated circumstances are assessed according to the specific case.

Not every breach of contract is fraud; initial intent, a statement contrary to fact, the use of payment and a performance difficulty that arises later are separated. The lawful acquisition and integrity of email, offer, invoice, shipment, bank, session and communication records are protected. If the company is the victim, loss calculation and asset measures are prepared; if it is the suspect side, a defense by act and by role is prepared.

Disposition, other than for the purpose of the transfer, of property whose possession was transferred to be used or kept in a particular manner, or denial of the fact of delivery, is assessed under Article 155 of the TCK. An employee’s, executive’s, agent’s, shareholder’s, warehouse manager’s or service provider’s access to company assets does not by itself form all the elements of the offense.

By whom, for what purpose and with what authority the property was delivered; personal use, repayment, accounting entry and loss are examined. Internal control records matter for company cards, the cash register, inventory, vehicles, collections and customer assets. Labor-law and compensation options are planned separately from the criminal process; care is taken not to create a double recovery or a contradictory account of the facts in the same event.

The nature of the document, who issued it, its capacity to deceive, creating a forged document or altering a genuine one, use, and the element of intent are examined. Invoices, bank instructions, signature circulars, board resolutions, delivery documents, licenses, certificates, payroll and digital records can have different legal natures.

Incorrect information in a document is not forgery in every case; the probative force of the document, authority and purpose of use matter. For electronic signatures, scanned signatures, templates and system outputs, the technical record and the authority to issue are investigated together. The conditions of the provisions on false or misleading documents in the Tax Procedure Law and of the forgery offenses in the TCK are assessed separately; the effect of the same act in different processes is coordinated.

In tenders for the purchase and sale of goods or services and for leasing carried out on behalf of public institutions or the organizations listed in the law, fraudulent conduct, access to confidential information, obstructing participation, bid agreements and allegations of force or threats are examined under Article 235 of the TCK. Laws No. 4734 and 4735, the tender documents, estimated cost, bid files, commission minutes, Electronic Public Procurement Platform (EKAP) records and communications with competitors are handled together.

A violation of procurement legislation is not a criminal offense in every case; the conduct and intent conditions of the criminal norm are additionally required. In the internal review, the relationships of the sales team, intermediaries, subcontractors and public officials are mapped process by process.

An allegation that goods delivered, work done or a service provided after the tender is contrary to the contract and specification may arise not only as a contractual defect but, if the conditions are met, also under Article 236 of the TCK. Quantity, quality, acceptance, samples, tests, progress payment, the inspection commission, subcontractors, change orders and payment records are examined.

Technical opinion and legal assessment are separated; a quality problem that arises later is not treated as the same as fraudulent conduct at the time of delivery. The calculation of public loss, termination, debarment, security and the criminal investigation may proceed in parallel. Statements made on behalf of the institution or the contractor should rest on a consistent set of facts across the processes.

Under Article 239 of the TCK, the Turkish Commercial Code, the Banking Law, employment contracts and data protection provisions, the secret nature of the information, the manner in which it was obtained, its disclosure, giving, use, authority and loss are assessed. Not every piece of company information is a trade secret; economic value, limited access and reasonable protection measures matter.

An employee’s conveying information to the employee’s own attorney in order to defend oneself is not treated in the same way as a bulk data transfer to a competitor; necessity, scope and legal rights are examined. The access of departing employees, suppliers, consultants and shareholders is closed; log and download records are preserved. Options in criminal law, unfair competition, labor law and interim injunction are coordinated.

Not only the executive’s title but also actual decision-making authority, instructions, knowledge, approval, duty of supervision, personal or corporate benefit and conduct after the event are examined. Authority in the signature circular does not by itself show that all transactions were known; likewise an internal directive does not make actual participation invisible. Board minutes, the authority matrix, budget, email, risk reports and earlier warnings are handled together.

The interests of the represented company and the executive can diverge; whether to continue with a common attorney is assessed in terms of conflict of interest. A separate fact and defense file is prepared for each person. The institution’s decision to cooperate is managed without declaring the employee guilty in advance.

When company assets, secrets or reputation are harmed, the application is prepared openly in terms of the type of offense, the suspect, the date of the event, authority, loss, requests and attachments. Instead of providing the whole internal investigation report, the necessary facts and records are selected; third-party data and legal assessments are protected. A criminal complaint is not used as a means of pressure in a commercial or labor-law dispute.

For offenses subject to complaint, the time limit, authority of representation and the effect of withdrawal are examined. A request for a protective measure rests on specific facts. During the investigation, supplementary statements, expert examination, return of seized items, reconciliation (uzlaştırma), objection to a decision of non-prosecution (kovuşturmaya yer olmadığı kararı) and steps for intervention in the public prosecution (kamu davası) are followed.

Before a statement or interrogation, the accusation, the person’s status, the apprehension or summons proceeding, access to the file, the assistance of defense counsel, the right to remain silent and favorable records are assessed. The roles of the institution’s attorney and of the person’s individual defense attorney are not confused. If there is a conflict of interest, separate representation is arranged.

The defense is prepared by duty, transaction, date, authority, knowledge, instruction and benefit rather than by a general denial. The effect of statements made in the internal investigation on the criminal file is examined. A separate plan of objections is built for judicial control (adli kontrol), pretrial detention, asset measures and effects on professional licenses. If there is corporate fee support or a joint defense arrangement, confidentiality and independence of decision-making are put in writing.

A company employee or a third party may be a victim, a person harmed by the offense, a complainant, a witness or merely a person with information in the event. Status changes the duty to give a statement, the assistance of an attorney, access to the file, and requests for compensation and protection. The witness’s duty to tell the truth and the safeguards concerning a question that might incriminate the witness are assessed according to the specific situation.

A request to disclose the whistleblower’s identity, and the risks of retaliation and security, are handled by legal procedure. The employee is not given a memorized statement; the employee is enabled to review the records and to describe the facts from the employee’s own knowledge. Arrangements in accordance with procedure are made for travel, language and disability needs.

That a criminal penalty cannot be imposed on a legal entity does not mean that there will be no consequences for the company. Revocation of a permit and confiscation under Article 60 of the TCK, an administrative fine for certain offenses under Article 43/A of the Misdemeanors Law, and the license and activity sanctions in sector laws may be applied under specific conditions.

The organ or representative, the company’s benefit, the activity conducted under a permit, the benefit obtained from the offense and the conditions of the special provision are examined separately. The same event can have consequences in criminal law, administrative sanctions, debarment from public tenders, licenses, tax, labor law and compensation. The company’s defense is prepared on the basis of legal personality and facts independent of the defense of natural persons.

The addressee and scope of statements to the press, employees, customers, banks, insurers and group companies are determined. Communication is conducted on verified information while protecting the presumption of innocence, the confidentiality of the investigation, personal data and trade secrets. A public statement and a response to the competent authority are not prepared as the same document.

The notification, defense cost, exclusion and consent provisions of directors’ liability and other relevant policies are examined for the specific event. Insurance coverage or definite recovery of the loss is not assumed. If there are mandatory notification and public disclosure obligations, the communication plan cannot delay them.

A tax audit, a tax technique report, a tax evasion offense report, assessment, tax penalty and a criminal investigation carry different procedures and time limits. For allegations of false or misleading documents, presentation of books and documents, electronic records, concealment, misleading accounts and participation, the provisions of Tax Procedure Law No. 213 in force on the date of the transaction are the basis.

The roles of company management, accounting, the financial adviser (mali müşavir), suppliers and employees are separated. The defense in the tax court and the statement of facts in the criminal file are coordinated; neither is reduced to the automatic result of the other. The audit record, the letter of submission, notification and the time limit for filing suit are followed at an early stage.

In imports and exports, the description of the goods, tariff, origin, value, quantity, permits, transit, bonded warehouse, export proceeds and incentive records are examined. Law No. 5607 on Combating Smuggling, the Customs Law, foreign exchange, tax and product regulations may be applied together. The consistency among declaration, invoice, transport, origin, circulation and payment records is assessed with the technical team and the customs broker.

The timetables of seized goods, samples, liquidation, security, administrative fines and the criminal case are coordinated. The division of duties among the company’s foreign trade unit, supplier and customs broker is explained with specific records in determining personal liability.

The predicate offense under Article 282 of the TCK, the source of the asset value, transfer, taking it abroad or the allegation of giving it a legitimate appearance are examined transaction by transaction. For obligated parties within the scope of Law No. 5549, customer identification, beneficial owner, risk management, suspicious transaction reporting, obligations to provide information and documents, and retention and submission are a separate compliance layer. A suspicious transaction report is not the same as a criminal report, and the confidentiality of the report should be preserved.

In MASAK information requests, analysis reports, bank movements and asset measures, a legal explanation of the source is prepared. Even in companies that are not obligated parties, unusual payments and third-party accounts are investigated from the internal-control perspective.

A high transaction volume in a bank account is not, in itself, a proceed of crime or the result of laundering. The source of the transaction and its economic explanation, and the conditions of the offense and the mental element in the law, are made concrete. The fact that a suspicious transaction report has been made is not disclosed to unauthorized persons or to the counterparty to the transaction.

Under Law No. 6415 on the Prevention of the Financing of Terrorism, Law No. 7262, the implementation of United Nations decisions in Türkiye and national asset-freezing decisions, screening of customers, beneficiaries, shareholders and transactions is assessed. Foreign sanctions lists are not accepted as automatically having the same effect under Turkish law; the applicable law, the contract, bank policy and the connection with the target country are separated.

In a claim of a match, identity verification, false matches, holding transactions, notification and routes of objection are managed through a written process. The company’s risk of unjustified discrimination or breach of contract is also taken into account.

Allegations of insider trading, market fraud, irregular public offering, unauthorized capital markets activity, irregularities in books and documents or breach of trust are examined within the framework of Capital Markets Law No. 6362 and the regulations of the Capital Markets Board (SPK). Orders, transactions, account links, access to inside information, disclosure of material events, communications and the flow of benefits are handled together.

An SPK review, administrative sanction, temporary trading ban, criminal report and investor disputes can arise from the same event. The data source and approval process of the internal review and of the response to be given to the SPK are determined. A market movement does not by itself show intent; the reason for the transaction and the person’s access to the information are made concrete.

In offenses under Article 115 of the Capital Markets Law, it is also checked whether a written application by the Board is a prerequisite to the criminal proceedings (muhakeme şartı). Special procedures, including the offense and investigation provisions specific to crypto assets, are not reduced to the same general rule.

In allegations of banking embezzlement, unauthorized activity, records contrary to fact, breach of secrecy, credit processes, payment fraud, customer funds and regulatory notifications, the sector law, the TCK and the CMK are assessed together. Processes before the Banking Regulation and Supervision Agency (BDDK), the Central Bank of the Republic of Türkiye (TCMB), the SPK, MASAK and KVKK may proceed in parallel according to the type of institution.

Credit committee, transaction approval, customer identification, device, session, reconciliation and call records are preserved. A decision to refund or compensate a customer should not be automatically interpreted as an acceptance of criminal liability; the text of the communication should be consistent with the legal strategy. A multiple-approval flow that prevents incomplete or unverified data from being sent to the regulator is established.

Under Law No. 3628, in the obligation to declare assets and in an allegation of unjustified acquisition of property, the person’s status, income, dates of acquisition, debts and the lawful source of the assets are examined. It is not assumed that every company executive is an obligated person for asset declarations within the same scope.

An increase in assets is different from the total amount that passes through an account. The acquisition that needs to be explained is assessed specifically to the file by sales, inheritance, loan, donation or commercial income records. Declaration, additional declaration, investigation procedure and other allegations of offenses are handled separately.