In a Forex investigation, working at the same company, being in a messaging group or holding a managerial title does not, on its own, show membership of a criminal organization. The structure of the organization and each person’s knowledge, intent and concrete contribution must be proven separately. The value of WhatsApp, CRM, HTS and IP records also varies according to the method by which they were obtained, whose use they are linked to and which act they explain. The annulment of TCK 220/6 has not eliminated the provisions on aiding the organization and on participation in fraud. The annulment decision issued in 2026 concerning CMK 134, for its part, will take effect on February 25, 2027. These distinctions should be addressed together, both so that the victim turns to the right persons and so that the suspect can mount an effective defense. [1] [2] [3] [6]
The First Question in a Forex Investigation: Which Person Is Linked to Which Act?
When an investor cannot withdraw their money, they may see the representative they spoke with on the phone as responsible for the entire system. A person employed by the company, on the other hand, may consider that they have nothing to do with the investigation, pointing to their payroll record and employment contract. Both assessments must be completed with concrete records. Criminal liability is personal; another person’s act cannot be attributed to someone merely because they were at the same workplace. Conversely, an employment contract does not make a knowingly made contribution to an offense lawful. The examination should focus on what the person did, and on what they knew while doing it, before their job title. [1] (Arts. 20–21, 37–40)
This distinction is especially important in current investigations. In the statement of the Istanbul Chief Public Prosecutor’s Office (İstanbul Cumhuriyet Başsavcılığı) relayed in the Anadolu Agency (Anadolu Ajansı) report of September 18, 2026, it was alleged that customer information was distributed to employees via CRM, that different teams were used to obtain the first investment and to secure new payments, and that people were steered with false identity and earnings narratives. The blocking of withdrawal requests and demands for new payments are also among the investigation’s allegations. These are statements made in a particular investigation; they are not a final conviction or a finding covering all Forex businesses. [5]
In investigating such allegations, the organization chart is a starting point. It cannot be presumed that the person in each box of the chart shared the same purpose. It must be explained who selected customers, who altered the false earnings screen, who stopped withdrawals and who was aware of these operations. Just as much as the investor’s inability to reach their savings, the consequences for work and family life of an accusation directed at the wrong person require this investigation to be conducted with care. Individualization does not weaken the victim’s application; it ensures that the claim is directed at the persons actually responsible and at concrete acts.
When Is a Company or Work Team a Criminal Organization Under TCK 220?
At least three persons, criminal purpose, hierarchy, continuity and suitability
Under TCK 220, there must be at least three persons. In addition, the association must have the purpose of committing offenses, show a hierarchical bond and continuity, and be suitable, by its structure and means, for committing the intended offenses. These criteria, set out in the decision of the Criminal General Assembly of the Court of Cassation (Yargıtay Ceza Genel Kurulu) of February 19, 2013, E. 2012/6-1490, K. 2013/59, were also addressed in the Constitutional Court’s (Anayasa Mahkemesi) decision No. 2024/189. An agreement to jointly commit a single specific offense therefore does not by itself form an organization. [1] (Art. 220/1) [3] (§§5–6) [4]
The fact that three people work in the same office is not enough to show that the numerical requirement has been met in the legal sense. What is examined is the link of three or more persons to a structure formed for the purpose of committing offenses. Continuity is not measured solely by how many years the company has been open, either. The continuity of the division of labor and of the commitment directed at committing offenses must be explained. The hierarchy need not necessarily be based on written instructions; however, it must be shown who gave instructions to whom in which criminal activity and how those instructions were carried out. [3] [4]
The completion of the intended offense is not a necessary condition for the existence of the organization. Nevertheless, the fact that no offense has yet been committed is different from the criminal purpose not having been proven. The mere existence of sales targets, staff meetings or customer tracking software does not establish an unlawful purpose. In a Forex case, the suitability assessment may be linked to concrete capabilities such as control over a fake platform, the ability to communicate with customers and an arrangement for collecting money. This link must be based on the data in the file. [1] (Art. 220/1) [3] (§6) [4]
How is business management distinguished from directing criminal activity?
A company may have a manager, a sales supervisor and a technical director. The assessment of leading an organization under criminal law is not an automatic counterpart of these business titles. What is examined is whether the person, knowing the purpose of committing offenses, steered the structure, distributed tasks or ensured the continuation of the criminal activity. Likewise, it is possible for a person who does not appear as a manager on the payroll to actually direct the criminal activity. The legal outcome depends on the actual exercise of authority, alongside the entry in the registry. [1] (Arts. 20–21, 220/1 and 5)
For example, being able to create users in the CRM is not, on its own, directing the fraudulent taking of money from investors. By contrast, deciding which false narrative is to be presented to which customer, having a new payment condition imposed on an investor who requests a withdrawal, and monitoring its implementation are, where proven, facts of different weight. These should be assessed not as an abstract job description but together with the content, date and recipient of the instruction and the transaction that actually took place.
| Fact in the file | Link that must be investigated | Conclusion that cannot be drawn on its own |
|---|---|---|
| SGK registration and payroll | Period of employment, duties, nature of the pay and the person’s knowledge | Organization membership or definitive non-liability |
| Managerial title | Actual decision-making and instruction authority relating to the criminal activity | Criminal liability for all company operations |
| Being in a work WhatsApp group | Content of the messages, active contribution, date of joining and instructions carried out | That all members of the group shared the same criminal intent |
| High-level access authorization in the CRM | Whether the authorization was used, transaction and session logs | That every data change was made by the person concerned |
| Kinship or frequent contact | Link with knowledge of the criminal purpose and a concrete contribution | Hierarchical subordination or knowing assistance |
This table does not alter any standard of proof. Its purpose is to apply the TCK’s provisions on personal liability and intent to the concrete relationships in the file. Several facts taken together may lead to a strong conclusion; if the same facts are not linked to the person and to time, however, the problem of collective accusation persists. [1] (Arts. 20–21, 37–40, 220)
Are Organization Membership, Aiding the Organization and Participation in Fraud the Same Thing?
Being within the hierarchy versus aiding from outside
For organization membership, what is assessed is whether the person knowingly joined a structure with a criminal purpose and holds a place within the hierarchical bond. TCK 220/7, on the other hand, governs a person who knowingly and willingly aids the organization without becoming part of the hierarchical structure. The law punishes this person as a member of the organization; this does not amount to an acceptance that everyone who aids is actually within the organization’s hierarchy. Depending on the nature of the aid, it is provided that the penalty to be imposed for membership may be reduced by up to one third. [1] (Arts. 220/2 and 7) [4]
Aiding a specific fraudulent act, in turn, is examined separately under TCK 39. A contribution supporting the organization’s activity and a contribution to an offense committed against a specific victim may not have the same subject matter. The file should clearly state which form of aid is alleged. The provision of professional services, technical support or a personal relationship is not, on its own, sufficient to select one of these provisions. It must be shown how the aid is connected to the offense and whether the person acted knowing of that connection. [1] (Arts. 21, 39, 220/7)
The existence of a record showing that an employee became aware of fraudulent operations after a certain date does not automatically lead to the conclusion that they knowingly performed all earlier operations as well. Likewise, liability cannot be derived for every victim payment made outside the period of employment. Nevertheless, if an instruction given earlier or a conscious contribution affected a later act, that too must be investigated. The examination of dates should not be confined to the hiring and departure schedule.
How does the annulment of TCK 220/6 affect Forex cases?
TCK 220/6, in the form re-enacted by Law No. 7499, contained a separate sanction for committing an offense on behalf of an organization without being a member of it, and applied only to armed organizations. The Constitutional Court annulled this paragraph by its decision of November 5, 2024, E. 2024/81, K. 2024/189. The decision was published on January 9, 2025; after a six-month deferral, the annulment took effect on July 9, 2025. As of October 18, 2026, the paragraph appears as annulled in the official text of the TCK. [1] [3] (§§7–9, 20–32 and operative part)
Therefore, in a current assessment, a general conclusion that someone “acted on behalf of the organization and is also punished for membership” cannot be built on 220/6, which is no longer in force. Moreover, the fact that the last text before the annulment was limited to armed organizations shows that the former provision cannot be applied indiscriminately to a Forex organization alleged to be unarmed either. [3]
The annulment has not eliminated genuine organization membership, knowing and willing aid under 220/7, or participation in fraud. For acts committed earlier and for final decisions, the date of the offense, the paragraph applied, the status of the decision and the principle of the more favorable law in TCK 7 are examined together. It cannot be said that every case will be closed directly or that every convicted person will be released automatically. Nor is it sufficient to write in another offense name in place of the annulled provision without discussing its elements. [1] (Arts. 7, 37–40, 220) [3]
How are the penalties for the organization offense and aggravated fraud related?
The current TCK 220 provides for imprisonment of five to ten years for establishing or leading an organization and of two to five years for membership. These are the sentencing ranges after Law No. 7571; the law applicable to past acts is determined separately. TCK 158/3, for its part, provides for an increase by one half where fraud is committed jointly by three or more persons, and by one fold where it is committed within the activities of an organization formed to commit offenses. [1] (Arts. 7, 158/3, 220/1–2)
Three persons jointly committing fraud and fraud within the scope of a criminal organization are not the same assessment. In the first, joint commission must be explained; in the second, the existence of the organization and the link between the specific offense and the organization’s activities. The number of staff in the company cannot be directly equated with the number of persons who committed the offense jointly. The decision should show which fact the increase is based on; the same fact that is an element of the offense or an aggravating circumstance should not be counted twice by being reused in determining the base sentence. [1] (Arts. 37, 61/3, 158/3)
TCK 220/4 provides for separate punishment for offenses committed within the organization’s activities. 220/5 governs the additional liability of the organization’s leaders as perpetrators for the offenses within the organization’s activities. The person concerned here is someone shown to have led the criminal organization. The same consequence cannot be applied to everyone listed as a manager in the trade registry. In the case of an organization member, too, participation in a specific fraudulent act should not be confused with the special liability provided for leaders. [1] (Art. 220/4–5)
Searching Phones and Computers: What Does CMK 134 Provide?
The 2026 AYM decision and the significance of February 25, 2027
By its decision of February 12, 2026, E. 2023/128, K. 2026/36, the Constitutional Court annulled the core search and seizure provisions of CMK 134, together with the other provisions that could no longer be applied. The decision was published in the Official Gazette (Resmî Gazete) of May 25, 2026, No. 33264. Because the entry into force of the annulment was postponed by nine months, the date is February 25, 2027. As of October 18, 2026, CMK 134 is in force. For procedures carried out at later dates, whether a new provision exists should be checked separately. [2] [6] (§§69–73 and operative part)
The main reason for the annulment is not that digital examination is prohibited altogether. The AYM addressed the lack of adequate statutory safeguards for the retention, deletion and restriction of processing, after the proceedings have become final, of the personal data obtained, and for the person’s rights in relation to them. The decision shows that what becomes of family photographs, third parties’ correspondence or health information unrelated to the file is also legally significant. [6] (§§60–68)
The annulment decision does not cause every digital record obtained in the past to be automatically disregarded. The authority for the specific search, its scope, the method of obtaining the data and its use in the proceedings are examined separately. Nevertheless, the reasoning of the decision is of direct importance for making specific such questions as why data unrelated to the file were kept and who has access to them. [6] (§§45–59, 64–73)
Search order, copying and return of the device
Under CMK 134 as currently in force, there must be strong grounds for suspicion based on concrete evidence, and no other means of obtaining evidence must be available. A judge may issue the order; where delay would be prejudicial, the public prosecutor is also authorized. The prosecutor’s order is submitted to the judge for approval within twenty-four hours; the judge decides within twenty-four hours at the latest. If the time limit expires or a contrary decision is given, the copies made and the decrypted texts are destroyed immediately. [2] (Art. 134/1)
Not every digital examination requires the device to be held until the end of the proceedings. Where the password cannot be broken, hidden information cannot be accessed or the procedure will take a long time, the device may be seized for the necessary procedures. Once the password has been broken and the necessary copies have been made, the device is returned without delay. During the seizure, the data in the system are backed up; a copy made from the backup is given to the suspect or their attorney, and the procedure is recorded in an official report. It is also possible to make a copy without seizing the device. [2] (Art. 134/2–5)
An employee’s use of the company’s computer and the ownership of the device are different matters. The law refers to the system used by the suspect. When a shared server or computer is examined, it must be determined which user, period and criminal allegation the search concerns. Sarsıkoğlu’s study of CMK 134 also addresses the problems that arise in multi-user systems regarding the scope of the search and third parties’ data. This issue shows that making a broad copy is not the same as freely using all content unrelated to the file. [2] (Art. 134) [6] (§§48–57) [9] (pp. 293–294)
Are WhatsApp Messages and HTS Records Subject to the Same Procedure?
Distinguishing stored messages, communication traffic and interception
Examining old messages stored on a phone and intercepting ongoing communications are different procedures. In the first, the method of obtaining the records on the device and the safeguards of CMK 134 come into play; in the second, the conditions of CMK 135. Where a cloud account or remote server is involved, it must be explained where the data are actually located, from whom they were requested and on what authority. The expression “WhatsApp record” does not by itself indicate the legal basis of these procedures. [2] (Arts. 134–135) [9] (pp. 298–299)
HTS records are traffic records used to investigate between whom, when and for how long communication took place; they are not a transcript showing the words of a conversation. CMK 135/6 separately governs the identification of communications (iletişimin tespiti). In the investigation phase, an order of a judge or, where delay would be prejudicial, of the prosecutor is required; in the prosecution phase, a court decision is required. For the prosecutor’s order, there are safeguards requiring submission for approval within twenty-four hours and a decision by the judge within twenty-four hours at the latest. [2] (Art. 135/6) [7] (§§29–33)
For interception, recording and the evaluation of signal information, the list of offenses in 135/8 is also important. Aggravated fraud is on this list. The reference to the organization provision, however, concerns not all paragraphs of TCK 220 but its third paragraph. Therefore it cannot be said that the conditions for all communication measures are met simply by calling it an “organization case.” The distinction between traffic identification and the interception list should be maintained, and the type of procedure requested should be specified. The special safeguards concerning communication with defense counsel should also be observed. [2] (Arts. 135–136)
How are messages submitted by a victim or an employee assessed?
A person attaching to their application a correspondence to which they are a party is not the same as obtaining content by accessing someone else’s account without authorization. For a record submitted by a private individual as well, the manner in which it was obtained, the scope of the sharing and the confidentiality of communication are examined. The fact that a screenshot has been submitted to the file does not end the questions about its source and accuracy. The principles that unlawfully obtained evidence must be excluded and that the judgment must be based on lawfully obtained evidence apply here as well. [1] (Arts. 132–136, 243) [2] (Arts. 206/2-a, 217)
The sender information and dates of the correspondence, and the integrity of the relevant conversation, should be preserved. Submitting a few messages cut out of context may leave out the explanation preceding an instruction or the objection following it. On the other hand, it is not necessary to add every private message to the file either. It should be stated which allegation the relevant part of the conversation explains, and where examination of the source is needed, a lawful examination should be requested. This approach protects both the reliability of the proof and the privacy of third parties. [6] (§§48–57) [9]
To What Extent Do Digital Records Show Individual Responsibility?
The link between username, session, transaction and person
A user’s name appearing in a record and a specific person having performed that transaction are not the same finding. First, it must be understood what the record shows: the assignment of an authorization, the opening of a session, the viewing of data or the change of a balance? Then the record must be linked to the person concerned. A shared computer, shared account, shift change or delegation of authority is investigated if it has support in the file. These are not ready-made excuses to be applied to every file.
For example, in assessing a transaction made at night with an account opened in an employee’s name, that night’s working situation and the pattern of use of the account may be meaningful. Where transactions of different users appear under a single company-wide IP address, the relevant user, session and time data are compared. If a dynamic IP or VPN argument is raised, it should be explained which record supports the argument and how it affects the outcome. Naming a technical possibility does not refute a concrete record; nor does the existence of a technical record, on its own, explain the person’s intent. [10] (sec. 3.2)
| Type of record | Fact it may explain | Examination that must be completed |
|---|---|---|
| WhatsApp message | Instruction, transfer of information, objection or contact with a customer | Source, context of the conversation, sender and actual use |
| CRM transaction log | Customer assignment, access, note or change to a transaction | Type of authorization, session in which the transaction was made, time and consistency with other records |
| HTS printout | Communication traffic and frequency of calls | Purpose of the call, user of the line and link to the incident; content is investigated through other evidence |
| IP and session log | Connection directed at a particular system or network | Date, time zone, user and the shared-use pattern of the system |
| Balance screen on the platform | Amount displayed to the user | Actual transactions, record changes, withdrawal authorization and payment documents |
| Hash value | Integrity of the compared data copies | What was compared; who created the document and for what purpose is investigated separately |
The headings in the table address different questions of proof. Showing that a person called customers does not by itself show that they made fraudulent promises in the conversation. By contrast, consistency between the content of the conversation, the CRM note and a payment instruction on the same day may change the assessment. Records should be addressed through links that can be explained for each victim and each person. [1] (Arts. 20–21) [2] (Art. 217) [8] [10]
What does a hash value prove, and what does it not prove?
A hash is a numerical digest value calculated from a specific data set. Comparing copies taken in the same manner helps check whether the examination was performed on the same data. This check does not, on its own, prove who wrote a message, that a statement in the file is true or the person’s criminal intent. The report should make clear which file or copy was compared, by which method and when. [10] (sec. 3.1.2)
Particular care is also needed with phone data. The SWGDE guideline, version 1.2, dated September 17, 2020, states that data on running mobile devices can change and that the hash values of extractions made from the same device at different times may differ. For this reason, an allegation that a fixed copy was later altered should be distinguished from a difference resulting from a new extraction of data from the phone. A mismatch should be investigated; not every difference should be treated directly as forgery. This technical guideline does not replace the decision and procedural requirements of Turkish law. [11] (sec. 3, 6.3.1)
Are only the incriminating parts of the records sufficient?
CMK 160/2 places the prosecutor under a duty to collect and preserve evidence both in favor of and against the suspect. Therefore, alongside instructions thought to support the criminal allegation, messages requesting that withdrawal requests be met, objections to misleading practices or records showing that the person did not have the relevant access should also be assessed. The existence of an exculpatory record does not always eliminate the suspicion of an offense; however, it must be explained why it was not considered decisive for the outcome. [2] (Arts. 160/2, 230)
For the victim as well, rather than submitting only a screenshot of a high balance, it is more informative to request that records showing the deposit, trading and withdrawal process be assessed together. In its Forex decision of February 12, 2026, E. 2021/41895, K. 2026/1604, the 11th Criminal Chamber of the Court of Cassation (Yargıtay 11. Ceza Dairesi) called for a comparison of the computer records of the company and of the intervening parties (katılan), an investigation of the investors’ actual trading and withdrawal authorizations, and the resolution of contradictions in the reports. The Chamber reversed the judgments of acquittal on the ground of incomplete investigation. This decision is not in itself a conviction; it shows the matters that need to be investigated in the specific case concerning the company’s shareholders. [8]
How Is an Effective Objection to an Expert Report Built?
Clearly stating the technical questions that affect the outcome
A general objection along the lines of “all digital records are wrong” does not indicate which procedure needs to be examined. The objection must explain the specific finding in the report and its effect on the legal outcome. For example, if it is argued that the time of the incident was assessed in a different time zone, that a CRM authorization was confused with an actual transaction log or that the former user of an account was not taken into account, the relevant page, record and date should be specified. Any examination considered missing should be requested with the same clarity. [2] (Arts. 67, 217) [10] (sec. 3.2)
Under CMK 67, the procedures carried out by the court-appointed expert and the conclusions reached are explained in the report. The parties concerned are given the opportunity to object to the report and to request a new examination; a scientific opinion may be obtained from a specialist. Under CMK 68, it may also be requested that the court-appointed expert or the specialist who prepared the opinion be heard at the hearing. However, the court-appointed expert cannot go beyond the technical findings and make, in place of the court, the legal characterization that the person is an “organization member” or a “fraudster.” [2] (Arts. 63, 67–68)
A request for investigation can make the following questions concrete: In which data copy is the transaction found? From which function of which application was the record generated? Is the transaction a human intervention or an automated system operation? What is the record that links the account to the person? Is there a relevant explanation outside the date range examined? Why were contradictory findings in the report eliminated? It should also be stated what consequence the answers will have, not only for technical accuracy but also for knowledge of the offense and personal contribution.
Must the court respond to a decisive defense argument?
In the Constitutional Court’s Akın Üçok decision of January 6, 2026, the failure to address substantial objections concerning application traces and HTS assessments was examined in terms of the right to a reasoned decision. The absence of a technical finding that the applicant used the application, and of the necessary investigation into certain communication records, was assessed together with its effect on the determination of the sentence; a violation of the right to a reasoned decision was found and a retrial was ordered. [7] (§§39–49, 54–55)
This is not a decision given in a Forex case. Its significance here is that a technical and personal objection capable of affecting the outcome must be clearly assessed. In the same application, the AYM found the separate complaint concerning the obtaining of communication records inadmissible. The decision therefore cannot be used to argue that all HTS records are unlawful or that a similar objection will lead to acquittal in every case. [7] (§§29–33, 55 and operative part)
Access to the File, Pretrial Detention and Effects on Daily Life
Does a restriction order close off all documents?
CMK 153 governs defense counsel’s examination of the file and taking copies of documents. In investigations involving an organization charge, a restriction order may be issued by a judge on condition that access would endanger the purpose of the investigation. However, the same restriction does not apply to records containing the person’s statement, expert reports and records of judicial procedures at which the person is entitled to be present. The AYM’s decision No. 2026/36 also assessed, within this framework, the safeguards for access to data obtained under CMK 134. [2] (Art. 153) [6] (§§50–55)
When a statement is taken, disclosure of the charge, the assistance of defense counsel and the right to remain silent must be observed. A statement obtained by prohibited methods cannot be used as evidence even if there is consent. A statement taken by law enforcement without defense counsel cannot be used as the basis of a judgment unless it is confirmed before a judge or court. Being shown a digital record does not remove these safeguards. [2] (Arts. 147–148)
Is an organization charge an automatic ground for pretrial detention?
Pretrial detention requires concrete evidence showing strong suspicion of an offense, a ground for detention and an assessment of proportionality. The provision in CMK 100/3 concerning TCK 220 excludes the second, seventh and eighth paragraphs. Therefore, an “organization membership” or “aiding the organization” charge cannot be brought within the scope of this presumption merely because of its name. Outside the catalog, too, pretrial detention may be considered on concrete grounds of flight or interference with evidence; being in the catalog does not make pretrial detention mandatory either. [2] (Art. 100)
A pretrial detention order must show, with concrete facts, the suspicion, the ground for detention, proportionality and why judicial control would be insufficient. Matters such as steady employment, dependants or the fact that the devices have already been secured may be raised by linking them to the relevant risk. These do not, on their own, ensure release. The suspect may request release at any stage; the general time limit for objecting to the decision is two weeks from learning of it, unless otherwise provided. [2] (Arts. 101, 104, 109, 268)
Consequences such as loss of employment, loss of income or being unable to access one’s phone should not be left as abstract complaints. A request for return can be made concrete by documenting the professional use of the device, the date on which copying was completed and what continuing need exists. The victim, for their part, may request that communication and transaction records be collected and that the relevant persons and transactions be investigated. A person’s pretrial detention does not mean that the investor’s money will be paid back automatically; applications concerning loss and assets are pursued separately. [2] (Arts. 134, 234)
Responsibility according to the duties of company employees is addressed in the series’ article on employees; financial advisory work (mali müşavirlik) and professional transactions in the seventh article; and letting one’s account be used, money movements and asset measures in the eighth article. The digital examination in this article serves to identify the right person and the right act for these applications.
Related articles: Digital Evidence in Criminal Proceedings: Phone Examination, Lawfulness and Objection; HTS and Base Station Records: Limits of Proof in Criminal Proceedings and Technical Objections; Maximum Pretrial Detention Periods: CMK 102, Time Calculation and Release; Criminal Liability of Company Employees in Forex Investigations: Role, Intent and Participation in the Offense; Criminal Liability of Accountants and Financial Advisers in Forex Investigations: Professional Duty, Intent and Participation; Criminal Liability of Those Who Let Their Bank Accounts Be Used in Forex Investigations, and MASAK Reports.
Conclusion
In a Forex investigation, the existence of the organization, the person’s link to that structure and their contribution to an act against a specific victim are separate questions. The sheer number of digital records does not remove these distinctions. It must be explained what a lawfully obtained record shows, whose use it belongs to and how it combines with knowledge of the offense. The fact that TCK 220/6 is no longer in force and the fact that the annulment decision concerning CMK 134 has not yet taken effect also have different consequences. An effective application, rather than repeating the organization label, sets out the links between person, time, instruction, transaction and loss. The same rigor requires that exculpatory records be investigated and that decisive objections be answered with reasons. [1] [2] [3] [6] [7]
Frequently Asked Questions
Is three people working at the same company enough for it to be considered a criminal organization?
No. In addition to the requirement of at least three persons, the purpose of committing offenses, a hierarchical bond, continuity and a structure suitable for committing the intended offenses are examined. It must be explained through which concrete fact the ordinary division of labor turned into criminal organization. The fact that there are more than three staff members does not show that all employees are members of an organization. [1] (Art. 220) [3] [4]
Does being in a WhatsApp group prove organization membership?
Group membership alone does not lead to this conclusion. The purpose of the group, the date the person joined, their contribution to the correspondence, the content of the instructions and the transactions they actually performed are examined together. The person’s relationship to the messages in the period during which they were in the group must be explained. On the other hand, messages knowingly directing the criminal activity may constitute important evidence when combined with other records. [1] [2] (Art. 217)
Since TCK 220/6 was annulled, has aiding the organization also ceased to be an offense?
No. The provision in TCK 220/7 on knowingly and willingly aiding the organization without becoming part of the hierarchy is in force. Genuine organization membership and participation in specific offenses are also assessed separately. In older cases based on the annulled provision, the date of the offense, the text applied and the status of the decision should be examined. [1] [3]
CMK 134 was annulled; can phones no longer be examined?
As of October 18, 2026, this conclusion is not correct. The AYM’s decision No. 2026/36 was published on May 25, 2026, and the entry into force of the annulment was postponed by nine months. The date is February 25, 2027. Until then, the requirements of the provision in force apply; for later procedures, new legislation should be checked separately. [2] [6]
Does a correct hash value establish conclusively that I wrote the message?
No. A hash comparison serves to check the integrity of the data. User identity, actual use, the context of the message and criminal intent are separate matters. Furthermore, comparing the same fixed copy should not be confused with extracting data from the phone again at different times. The reason for a technical difference should be explained in the report. [10] [11]
Does an HTS record show the content of a conversation?
HTS provides information on communication traffic; on its own, it does not show what a conversation was about. The content is investigated through other lawful records and evidence, if any. The identification of communications and interception are different measures. The scope of the decision and the procedure to be applied cannot be glossed over with the mere expression “HTS investigation.” [2] (Art. 135) [7]
When a company computer is seized, must the end of the case be awaited for its return?
CMK 134/2 provides for the device to be returned without delay once the password has been broken and the necessary copies have been made. Therefore, in a seizure made solely for examination purposes, it is not mandatory to wait for the end of the case. If there is a different protective measure or a confiscation issue concerning the device, its legal basis is assessed separately. [2] (Arts. 123, 131, 134)
If the file is restricted, can I not see the expert report either?
CMK 153/3 excludes expert reports from the restriction provision. The same safeguard applies to records containing the suspect’s statement and records of judicial procedures at which the suspect is entitled to be present. The right of access and to take copies should be exercised by clearly specifying the nature of the document requested. [2] (Art. 153)
Does a charge of organization membership make pretrial detention mandatory?
No. Concrete strong suspicion, a ground for detention, proportionality and the insufficiency of judicial control must be assessed. In the reference in CMK 100/3 to TCK 220, the second, seventh and eighth paragraphs are excluded. The name of the charge does not replace reasoning specific to the person. Concrete grounds of flight or interference with evidence are examined separately. [2] (Arts. 100–101)
Should the investor file a complaint against all of the company’s employees?
In the complaint, the known persons and acts should be described concretely, and an investigation of those responsible whose identity cannot be determined should be requested. It is not right to attribute the same contribution to everyone on the basis of a staff list alone. Records such as the number called, the username, and payment and withdrawal dates help reach the persons actually responsible. [1] (Arts. 20–21) [2] (Art. 234) [8]
Sources and legal bases
- Law No. 5237, Turkish Penal Code (Türk Ceza Kanunu). Adopted: September 26, 2004; Official Gazette: October 12, 2004, No. 25611. In particular Arts. 7, 20–21, 37–40, 61, 132–136, 158, 220 and 243; current official text accessed on October 18, 2026. Ministry of Justice UYAP Legislation (Adalet Bakanlığı UYAP Mevzuat).
- Law No. 5271, Code of Criminal Procedure (Ceza Muhakemesi Kanunu). Adopted: December 4, 2004; Official Gazette: December 17, 2004, No. 25673. In particular Arts. 63, 67–68, 100–101, 104, 109, 123, 131, 134–136, 147–148, 153, 160, 206, 217, 230, 234 and 268; current official text accessed on October 18, 2026. Ministry of Justice UYAP Legislation.
- Constitutional Court, November 5, 2024, E. 2024/81, K. 2024/189. Official Gazette: January 9, 2025, No. 32777. In particular §§5–9, 20–32 and the operative part; annulment of TCK 220/6 and deferred entry into force. Official decision.
- Criminal General Assembly of the Court of Cassation, February 19, 2013, E. 2012/6-1490, K. 2013/59. Assessments of the elements of an organization in the decision examining the issue of intervention (katılma) and appeal concerning an organization offense. The decision does not concern a Forex dispute; the sentencing ranges in the historical text have not been used as current sanctions. Official full decision.
- Anadolu Agency, September 18, 2026, “191 suspects apprehended in Israel-linked Forex fraud investigation” (“İsrail bağlantılı Forex dolandırıcılığı soruşturmasında 191 şüpheli yakalandı”). A report relaying the statement of the Istanbul Chief Public Prosecutor’s Office on the investigation; the allegations have not been treated as a final judgment. Report.
- Constitutional Court, February 12, 2026, E. 2023/128, K. 2026/36. Official Gazette: May 25, 2026, No. 33264. On CMK 134; in particular §§45–59, 60–73 and the operative part. The entry into force of the annulment provisions was postponed for nine months from publication. Official Decisions Database.
- Constitutional Court, First Section, Akın Üçok, Application No. 2023/16601, January 6, 2026. In particular §§29–33, 39–49, 54–55 and the operative part. Review under the right to a reasoned decision concerning the response to substantial objections on communication records and application traces. Official full decision.
- 11th Criminal Chamber of the Court of Cassation, February 12, 2026, E. 2021/41895, K. 2026/1604. In particular III. Reasoning and IV. Decision; comparison of the actual trading and withdrawal authorizations on the Forex platform and of the company and intervening party records, and resolution of contradictions in the expert reports. Official full decision.
- Şenel Sarsıkoğlu, “An Assessment of the Procedures for Obtaining Evidence from Computer Systems (CMK Art. 134)” (“Bilişim Sistemlerinden Delil Elde Edilmesine Yönelik İşlemler (CMK m.134) Hakkında Bir Değerlendirme”), Istanbul Medipol University Law Faculty Journal (İstanbul Medipol Üniversitesi Hukuk Fakültesi Dergisi), vol. 12, no. 1, 2025, pp. 283–318; in particular pp. 293–294 and 298–299. DOI: 10.46547/imuhfd.2025.12.1.8. Journal record · Full text.
- Karen Kent, Suzanne Chevalier, Tim Grance and Hung Dang, NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, August 2006. In particular sec. 3.1.2–3.2: verification of the data copy and examination context. Used for technical explanation; not a source of procedural rules in Turkish law. NIST publication record · Full text.
- Scientific Working Group on Digital Evidence, SWGDE Best Practices for Mobile Device Evidence Collection & Preservation, Handling, and Acquisition, 18-F-003, version 1.2, September 17, 2020. In particular sec. 3 and 6.3.1; changing data on active devices and the effect of separate data extraction procedures on hash comparison. Publication record · Full text.