AML Compliance and Financial Investigations

Determining Obliged-Entity Status and the Scope of Activities

The articles of association, activity permits, products, customer types, fund and data flows, intermediary role, and office and representation structure are reviewed to determine whether the company is an obliged entity under Law No. 5549 and the Regulation on Measures. Where an organization offers several services, each activity is classified separately. Where obliged-entity status applies, the provisions on customer identification, reporting, retention, training, monitoring, the compliance program or the compliance officer that will apply are turned into a written matrix. Status is reviewed again after a change of activity, a merger, a new product or an expansion of a license. The output is a reasoned legal note suitable for management decisions and supervision.

MASAK Compliance Gap Analysis and Corrective Action Plan

The existing policy, customer acceptance, identification, beneficial ownership, risk rating, transaction monitoring, internal reporting, suspicious transaction reporting, training, internal audit, retention and information request processes are reviewed against the law and against actual practice. Not only whether a text exists is tested, but also who owns each control, its data source and frequency, how an alert moves to a decision, and how management reporting works. Findings are classified by legal significance, likelihood of recurrence and remediation priority. For each finding, the responsible unit, target date, necessary system or document change and method of verification are set. Once a correction is complete, a follow-up test is performed.

Establishing and Updating the Compliance Program

For obliged entities under the Compliance Program Regulation, institutional policy and procedures, risk management, monitoring and control, the compliance officer and compliance unit, training and internal audit are structured together. The size of the organization, transaction volume, and product, channel, customer and country risk form the basis. The duties of legal, operations, information technology, human resources, internal audit and the board of directors are matched. The program is reviewed at least once every two years; where there is a significant change in legislation, products or risk, this schedule does not have to be waited for. The current version, its effective date and management approval are kept.

Preparing Institutional Policy and Procedures

The institutional policy ties risk management, customer identification, suspicious transaction reporting, retention and production of records, the provision of information and documents, the duties of the compliance officer, training and internal audit principles to how the institution actually operates. Detailed procedures explain, for each user role, the steps for customer acceptance, identity verification, beneficial ownership, politically exposed persons, sanctions lists, alert review, reporting and recordkeeping. No conflict is left between the policy and the system screen, contract, workflow or staff authorization. Exception authority, escalation, versioning, approval and distribution records are defined.

Board Responsibility and Compliance Governance

The board’s duties of oversight, providing resources, approving policy, risk appetite, the independence of the compliance officer and regular reporting are tied to a decision calendar. Organization and access rights are set up so that the compliance officer can receive information from all relevant units on time and make reporting decisions with independent judgment. Senior management or a high-revenue business line may not intervene without reason to close an alert or to decide on customer acceptance. Management reports show not only the number of reports but also delayed alerts, data quality, high-risk customers, training coverage, internal audit findings and corrective actions.

Compliance Officer Licensing, Registration and Appointment

Under the amendment to the Regulation of 25 December 2024 and MASAK General Communiqué No. 30 of 9 September 2025, licensing, the authorization examination, registration, refresher training and appointment conditions are reviewed according to the type of obligation of the organization. Holding a license and being eligible to be appointed as compliance officer in a particular organization are separate matters. Term of office, deputy appointment, exclusivity, notification, delegation, departure and the schedule for new appointments are managed. The candidate’s qualifications, along with their independence within the institution, access to information, and adequate team and budget, are secured in writing.

The appointment review uses the current text of the Regulation, including the amendments of 22 August 2025, together with Communiqué No. 30 (opens in a new tab). A license does not replace experience in the organization to which the appointment is made, independence, or the other conditions of appointment.

Compliance Unit, Segregation of Duties and Resource Planning

The place of the compliance unit in the organization, its staff numbers, job description, access level, need for shift or service hours, and backup arrangements are set according to the risk profile. The boundaries are drawn between customer acquisition, sales, operations, fraud, cybersecurity, legal, internal control and internal audit functions. The same person is prevented from combining, without controls, the generation of alerts, their closure, reporting decisions, sampling and internal audit tasks. Even where external services are used, the organization’s statutory responsibility continues and is reflected in the contract and the supervision plan.

Corporate Risk Assessment and Risk-Based Approach

Customer, product, service, channel, country, transaction, technology and distribution system risks are identified; inherent risk, control effectiveness and residual risk are assessed separately. The data source, weighting, score ranges, high-risk threshold, manual change authority and validation period of the model are written down. Risk rating does not rest only on a customer’s nationality or sector; the purpose of the transaction, source of funds, ownership, behavior and activity profile are considered together. A risk-based approach does not mean that all obligations are removed for low risk. The model is tested for discriminatory outcomes, data quality and the risk of false negatives.

2025 National Risk Assessment and Alignment with the 2026–2030 Strategy

The sectors, crimes, technologies, cross-border flows and confiscation priorities in the National Risk Assessment updated by MASAK in 2025 and in the 2026–2030 National Strategy Document are carried into the organization’s risk assessment. The existence of a national risk does not automatically make every customer high-risk; the organization’s actual exposure and controls are examined separately. For a new typology, product or country change, an event-based assessment is made. An adaptation note explaining the effect of national priorities on the organization is submitted to the board; the policy, scenarios, training and internal audit scope are renewed where necessary.

The national strategy and risk assessment are a framework for the organization to understand its own exposure. Each strategic objective does not by itself create a new statutory obligation for a private person; the legal basis of any measure to be applied is determined separately.

Customer Acceptance Policy and Prohibited Business Relationships

Customer and transaction types that cannot be accepted are defined according to law, licenses, sanctions decisions and the institution’s reasoned risk appetite. For accounts in anonymous or fictitious names, customers whose identity cannot be verified, structures whose beneficial owner cannot be disclosed, relationships with no established business purpose, and links to prohibited persons, a process for refusing the transaction or ending the relationship is prepared. Commercial pressure, sales targets or senior management requests do not remove the mandatory check. Refusal and termination communications are arranged so that they do not disclose that a report has been made, and so that they do not needlessly violate consumer, contract, anti-discrimination and data rights.

Identity Determination and Verification of Natural Persons

Where a continuing business relationship, certain transaction types or thresholds under the legislation apply, the identity information of a natural person is obtained before the transaction and verified against a valid source. Scenarios involving Turkish citizens, foreigners, minors, persons under guardianship, agents and representatives are tied to separate procedures. The type and validity date of the document, the match between the photograph and identity details and the person, and address and contact confirmation are recorded under the applicable rules. Taking a copy of an identity document and verifying the identity are not the same act, and unnecessary data fields are not collected. Current monetary thresholds are not written into a fixed web text; they are verified on the transaction date.

Legal Persons, Authority to Represent and Legal Arrangements

For companies, associations, foundations, co-ownership arrangements, foreign legal persons and unincorporated arrangements, the registry, title, activity, address, tax information, representatives and authorizing documents are verified. Reliance on the trade registry gazette alone is not enough; the current record, signing authority, purpose of activity and the nature of the business relationship are reviewed together. For a foreign document, the issuing authority, apostille or certification, translation and currency requirements are assessed. A legitimate commercial reason for a complex ownership structure is made clear. The identity of the representative and their authority to bind the legal person are checked before the transaction.

Identification and Verification of the Beneficial Owner

The beneficial owner is not only a shareholder shown in the registry or a name in a declaration form; the natural person who holds ultimate ownership or control of a legal person or legal arrangement is sought. Direct and indirect shareholding, voting rights, privileges, contractual control, the power to appoint managers and other means of control are reviewed. In layered, foreign or nominee structures, source documents are requested. A discrepancy between the declaration and the registry, the MERSIS system, the share ledger, financial records or a reliable external source is not closed without a reasoned explanation. The method of identification and the level of verification are documented according to customer risk.

Acting on Behalf of Another Person and Control of Authorized Persons

The situations in which a person who carries out a transaction in their own name but for the account of another must disclose this in writing are built into the customer interface and operating process. Transactions by agents, intermediaries, escrow accounts, bulk payments, marketplaces, collections, company employees and family members are reviewed for their real purpose and the actual beneficiary. The statement “the account is mine, but the money belongs to someone else” is not accepted as sufficient on its own. The authority document, source of funds, economic purpose, transaction instruction and final recipient are verified. The legal consequences of not declaring a transaction made for another person’s account are explained to the customer clearly and proportionately.

Updating Customer Information and Ongoing Review

The customer’s identity, address, activity, representation, ownership, beneficial owner, risk and transaction purpose information is not collected only at the start of the relationship. Periodic updates are made according to the risk level and trigger events. A share transfer, a change of manager, a change of activity or country, an unusual transaction, the expiry of a document and a sanctions match may initiate an update. The customer’s transactions are monitored together with the known activity, income, source of funds and expected behavior. Where an update cannot be made, restricting or ending the relationship and the assessment for a report are carried out separately and with reasons.

Politically Exposed Persons and Close Associates

The identification of politically exposed persons (PEPs), their spouses, first-degree relatives and close associates within the scope of the Communiqué is tied to customer acceptance, beneficial ownership and ongoing monitoring processes. For relationships with a PEP elected or appointed by a foreign state, senior management approval, the identification of wealth and source of funds, and enhanced monitoring measures apply. For PEPs in Türkiye or in international organizations, the condition that the business relationship or transaction is high-risk is taken into account when applying these additional measures. Being a PEP alone is not a crime and is not grounds for refusing a customer.

When the position or status ends, the measures specified continue for at least one year; if the transactions or the business relationship still carry risk, extending the period is assessed. The calendar, the risk and the reasons for the decision are recorded together. Serial No. 21, Article 4 (opens in a new tab).

High-Risk Countries, Targeted Financial Sanctions and List Screening

The FATF statements on high-risk jurisdictions and jurisdictions under increased monitoring, the United Nations lists, asset freezing decisions published in Türkiye, the laws numbered 6415 and 7262, and contractual foreign sanctions clauses are kept distinct from one another. Customers, beneficial owners, representatives, senders, recipients and transaction counterparties are screened at an appropriate frequency. A name similarity is not treated as a definite match without confirmation by identity details. The match, possible match, false match, holding of the transaction, reporting, asset freezing and objection steps are tied to a written flow. A foreign list does not automatically produce the same result under Turkish law.

With respect to notices of listing under the UN Security Council regime, the notification and transaction postponement process under Communiqué No. 34 of 23 September 2026 (opens in a new tab) is set up separately. A name similarity is distinguished from a true match; an ordinary alert is not presumed to freeze all assets on its own.

Designing and Applying Enhanced Measures

For a high-risk customer, product, channel, country or transaction, measures proportionate to the risk apply, such as additional information on the customer and the beneficial owner, the purpose of the business relationship, source of wealth and funds, senior management approval, the frequency of transactions and enhanced monitoring. The technological risks, risky countries, crypto-asset service providers, payment and electronic money institutions and terminal services addressed in MASAK’s current guidance of 30 September 2025 are adapted to the relevant sector. The same list of documents is not requested for every high-risk customer; the reason, scope and outcome of the measure and the date of reassessment are recorded.

Simplified Measures and the Limits of Their Application

A simplified measure is applied only to customer and transaction types for which the legislation permits it, on the basis of a low-risk assessment and within the limits set. It may not be used as a general exemption that removes identification, sanctions screening or the report of suspicious transactions altogether. If the customer’s nature or transaction behavior changes, the simplified approach is reviewed. The conditions for entering and leaving the low-risk category should be traceable in the system. Where suspicion arises, the simplified measure is not continued; customer identification and the reporting process are reconsidered on current facts.

Because of the amendments numbered 31, dated 7 January 2026, and 33, dated 23 September 2026, previous policy and product limits are checked again. Simplified measures are not applied to suspicious or high-risk transactions, or where the customer is a foreign PEP. Raising certain amounts does not create a general exemption across all products or a reporting threshold.

Remote Identification and Digital Customer Onboarding

Under MASAK General Communiqué No. 19, sector-specific regulations and the 2025–2026 amendments, it is determined for which obliged entities and customer groups remote identification may be used. Document verification, liveness, biometric or video processes, device and session security, the match between the person and the document, transaction records and the establishment of the contract are reviewed together. Separate conditions of the current communiqué apply to remote identification of non-Turkish natural persons using a passport. Failed attempts, forged documents, identity theft and accessibility scenarios are documented in writing. Remote methods do not remove the customer risk review.

In the process for foreign natural persons under Serial No. 19, Article 4/C, and in accordance with the amendment No. 32, a suitable chip passport, a video interview and a match between the chip and visual information are required; if no match is achieved, no account is opened. Address confirmation is completed within three months at the latest; before confirmation, no money transfer or cash withdrawal may be made. These customers are monitored as high-risk; remote identification is not applied to citizens of risky countries. The authority and other conditions under the organization’s own regulatory framework are also checked.

Reliance on Third Parties and Correspondent Relationships

Where a financial institution may rely on another financial institution’s customer identification measures, the counterparty’s regulation, timely access to information and documents, where responsibility lies, and the conditions for sharing within the group are reviewed. Reliance on a third party is distinguished from outsourcing. In a cross-border correspondent relationship, the counterparty’s activity, supervision, compliance controls, reputation, sanctions history and the risk of payable-through accounts are assessed. Shell bank relationships are not established. Management approval, a contract, periodic review and criteria for terminating the relationship are set.

Electronic Transfers, Message Information and the Travel Rule

For electronic transfers, the carrying of sender and recipient information with the message, incomplete or inconsistent information, intermediary institutions, cross-border transfers, bulk transactions and return scenarios are regulated. For payment and electronic money institutions and crypto-asset service providers, the sector-specific travel rule, time limits, thresholds and measures for unhosted wallets are applied in line with current legislation. Rejecting a transfer with incomplete information, holding it, requesting additional information and the assessment for a report are separated on a risk basis. Regular reconciliation is carried out between message data and accounting and customer records.

Transaction Monitoring Scenarios and Alert Governance

The transaction monitoring system uses indicators such as customer profile, amount, frequency, speed, country, channel, counterparty, device, terminal, crypto address, ownership and behavioral change, according to sector risk. The data source, threshold, score, look-back period, products covered and the authority of the alert owner are documented. Fixed amount rules are not considered sufficient on their own. False positives, delayed alerts, data gaps, manual closure and model changes are monitored. Closing an alert is not a finding that no crime occurred; it is the reasoned record of the outcome of the review. Important scenarios are tested by an independent party.

Internal Suspicious Transaction Report and Escalation

An internal reporting form, an urgent option, minimum required information and confidentiality rules are prepared so that an employee or operations unit can raise a suspicion with the compliance officer through a secure channel. An employee is not expected to name the legal character of an offense; the transaction, the parties, the date, the indicator and the basis are enough. A report is not made subject to the approval of a sales manager. The compliance officer may request additional information, review other transactions, and reasons the decision to report or not to report. Access to the identity of the reporter and of customer data is restricted. The record of the internal report is included in the retention and production arrangements.

Suspicious Transaction Report Decision and Report Quality

Under Law No. 5549, Article 4, and Communiqué No. 13, information, suspicion or a matter requiring suspicion is assessed. No definitive proof of crime or minimum transaction amount is required for a report. The customer profile, the transaction flow, the source of funds or assets, the beneficial owner, related accounts, connected persons and indicators of suspicion are recorded in an intelligible chronology. The form, category, code and description controls of the sector guidance updated in 2025 are used. A copied description or an alert code alone is not sufficient. The time limit is tracked from the date suspicion arose; where there is a risk of delay, a separate urgent process applies.

MASAK Online 2.0 Registration and Reporting Processes

The MASAK Online registration, authorized user, multi-factor access, roles, institution details, reports, attachments, drafts, submission confirmation and technical outage processes are managed. Sector guidance updated in 2025, as well as XML or bulk reporting requirements, are adapted to the organization’s systems. Form fields are not filled automatically without validation against source systems. Before submission, a legal and operational quality check is performed, followed by confirmation and safekeeping of the registration number. Access is updated immediately upon a change of user or departure. A technical failure does not remove the deadline tracking; an alternative means of communication and recording is set in advance.

Confidentiality of Reports and the Prohibition on Tipping Off

Except for the exceptions stated in the law, an obliged entity may not disclose to anyone, including the parties to the transaction, that a report has been made to MASAK. Access to information for the compliance officer, management, operations, legal, audit and external service providers is limited according to their duties. The explanation given to a customer about a delay in a transaction or a request for additional documents should not reveal the report; nor may it contain a false statement. Screenshots of a report, email subject lines and meeting minutes are not kept where they can be widely accessed. The criminal consequences of breaching confidentiality and the internal disciplinary process are explained clearly in training.

Information that a report has been made or will be made, and internal reports made to the compliance officer, are subject to specific confidentiality rules. Appointing an attorney, a confidentiality agreement or an encrypted transfer channel does not by itself lift the statutory prohibition on disclosure. The authority to share is reviewed for each document and recipient separately.

Postponement, Refusal and Termination of the Business Relationship

A suspicious transaction report, refusal because identity cannot be established, termination of the business relationship, postponement of a transaction under Article 19/A of Law No. 5549, and freezing of assets are treated under separate legal bases. An ordinary report does not stop a transaction by itself. In a report requesting postponement, the requirement of documents or serious indication under the legislation and the process of authorized decision are assessed; the transaction is not carried out until the decision is notified. The period in this route may not exceed seven business days from the date of the report. Where the assets are identified by the Presidency and the postponement decision is notified, the start date is the date of notification. Where a separate freezing or judicial measure exists, the expiry of the period does not lift it. The decision, scope, notification and time record are monitored.

Retention, Production and Eight-Year Record Management

Under Law No. 5549, Article 8, documents prepared and books and records are kept for eight years from the last record, and identification records for eight years from the last transaction; for accounts, the start date is the date the account was closed. Suspicious transaction reports, internal reports, attachments and the reasons for not reporting are also covered. For each data class, the start date, period, storage medium, access, integrity, backup and disposal rules are written. Longer sector-specific periods apply where they exist. The purpose limitation and deletion arrangements under the Personal Data Protection Law (KVKK) are managed together with the statutory retention obligation. Records should remain readable and capable of being produced on time.

Responding to MASAK Information and Document Requests

The competent authority, scope, deadline, data fields, period, format and delivery method of the request are reviewed. Legal, compliance, information technology and data-owning units prepare a single verified response set. Incomplete, contradictory or unreadable records are not sent; a table whose source is unknown is not turned into an official answer until verified. The provisions on the right of defense and the statutory limits of attorney professional secrecy are assessed against the concrete request. Requested information is not concealed or altered. The delivery list, approval, delivery confirmation and any later clarification are recorded. If a deadline cannot be met, a properly documented request for additional time or an explanation is considered.

Continuing Information Duties and Electronic Notification Management

Among the transactions in which the organization is a party or acts as an intermediary, the scope of continuing information duties prescribed by legislation is reviewed for transaction type, threshold, period, data format and exceptions. Monetary amounts are not fixed on a web page; they are verified against the regulation in force on the transaction date. The MASAK electronic notification account and reporting channel are checked daily by authorized staff. The moment of notification, the response period, attachments, delivery and access information are recorded. User changes, contact details and authority updates are made without delay. Electronic notification, the channel for suspicious transaction reports and internal email are not confused with one another.

A MASAK electronic notification under Law No. 5549, Article 9/A, is deemed served on the date it reaches the recipient’s electronic address. The five-day rule under the general UETS regime does not apply to this special regime automatically. The notification account, the designated backup officer and the time record are arranged accordingly.

MASAK Training and Role-Based Awareness Program

Training covers the concepts of laundering proceeds of crime, financing of terrorism and proliferation, risk areas, institutional policy, customer identification, suspicious transaction reporting, confidentiality, retention, information duties and sanctions. Role-based scenarios are prepared for the board of directors, compliance, customer acquisition, retail offices, sales, operations, call center, information technology, internal audit and external service teams. Participation, duration, method, content and assessment outcome are recorded; the reporting calendar set by legislation is followed. Merely having opened an online presentation is not considered sufficient. Tendencies toward wrong decisions and real institutional findings are reflected in training through examples that contain no personal data.

Internal Audit, Sampling and Management Reporting

Internal audit reviews the whole compliance program and the conformity of transactions with the law and institutional policy through risk-based sampling. Customer files, beneficial owners, PEPs, high-risk approvals, alerts, reports, retention, training, outsourced services and data quality are tested. The unit examined, the period, sampling method, finding, root cause, risk, responsible person and date of correction are reported. Appearances in which the compliance officer audits their own decisions are avoided. The board receives critical findings without delay. An internal audit report is grounded not merely in formal legal wording but in re-performable tests and records.

Financial Group Compliance Program and Sharing of Information Within the Group

For financial institutions in Türkiye that are subsidiaries of a parent based in Türkiye or abroad, the definition of a financial group, the group compliance officer, policy, risk, monitoring, training and internal audit structure are assessed. The secure sharing at group level, for compliance purposes, of customer identification and account and transaction information is structured together with Law No. 5549, the Compliance Program Regulation, the KVKK and the restrictions of foreign countries. The purpose of access, data fields, recipients, retention and security are documented in writing. Sharing with the group center does not mean unrestricted transfer of all data. Local reporting authority and confidentiality are preserved.

Sharing of information within a group for customer identification or compliance purposes does not permit disclosure that a report has been made. This information may not be shared among entities within the group either; for parent institutions and affiliated units abroad, a separate confidentiality prohibition is observed.

Compliance in Certain Non-Financial Businesses and Professions

For certain non-financial businesses and professions, such as the trade and intermediation in immovable property and in precious metals or jewelry, notaries, certain independent attorney activities, independent accounting and sworn financial advisory services, and independent audit, the scope of the obligation is determined by activity. Customer identification, beneficial owner, high-risk countries, technological risk, enhanced measures, reporting, confidentiality, retention, training, risk assessment, monitoring and control processes are established at the scale of the institution. The sector-specific reporting guidance updated in 2025 and the 2025 National Risk Assessment are adapted to the workflow.

The scope of the obligation for e-commerce intermediary service providers, and the compliance officer regime for those of medium, large and very large scale, are assessed separately. Scale, actual activity and the relevant definitions are documented; not every website is treated as belonging to the same group.

Scope Limits for Attorneys, Sworn Financial Advisers and Auditors

For independent attorneys, the financial transaction work that Law No. 5549, Article 2/d, enumerates in a limited way is reviewed according to actual role: the purchase and sale of immovable property, the establishment or management of limited real rights, companies, foundations and associations, transfers and liquidation, and the management of banking, securities and accounts. Under the current provision, matters falling within the first and third paragraphs of Article 35 of the Attorneys Act No. 1136 and information obtained through alternative dispute resolution are treated as exceptions. The rights of defense, the right to be heard and the professional secrecy of attorneys under Article 36 are preserved. Not every lawsuit or legal advisory matter automatically falls within the scope of suspicious transaction reporting.

For sworn financial advisers and independent auditors, their own definition of activity, scope of duties, sources of information and secrecy arrangements are determined separately. Exceptions between professional groups are not transferred as they stand. The basis for an information request and the authority to access a document are reviewed according to the file.

Compliance in Banks, Capital Markets, Insurance and Financing Institutions

For banks, brokerage firms, portfolio management companies, insurance and pension companies, financing, factoring and financial leasing institutions, the sector law, the supervisory order and the obligations under the MASAK framework are assessed together. Risks of customer and beneficial owner, correspondent relations, electronic transfer, high risk, investment transactions, credit, compensation, source of funds, intermediary and distribution channels are kept distinct. The data sources for records sent to the BDDK, SPK, SEDDK and MASAK are kept consistent. A sector audit of an institution does not remove its responsibility under Law No. 5549. Findings from regulators are tracked in a joint correction calendar.

Savings finance companies are also checked separately against the relevant definition of obliged entity and the provisions on the compliance officer. The same obligation table as for banking, insurance or capital markets activity is not assumed.

Compliance in Payments, Electronic Money and Crypto-Asset Processes

For payment and electronic money institutions, remote customer onboarding, merchant, terminal, account, wallet, transfer, agent, fraud and fund flows are reviewed; for crypto-asset service providers, customer acceptance, wallets, transfers, on-chain risk, the travel rule, unhosted wallets and custody relationships are examined. MASAK’s crypto guidance of 30 September 2025 and its guidance on enhanced measures are applied together with the regulations of the Capital Markets Board (SPK) and the Central Bank of the Republic of Türkiye (TCMB). The result of chain analysis is not a definitive finding of crime; the risk indicator is assessed together with other customer and transaction data. Suspicious transaction reporting, transaction restriction and sector notification are kept separate.

Real Estate, Precious Metals, Authorized Institutions, Gaming and Sports Sectors

In real estate trading, the buyer, seller, representative, beneficial owner, sale price, payment chain and third-party accounts; in precious metals and jewelry, product, delivery, cash, country and supplier; in authorized foreign exchange institutions, currency transactions; in games of chance and betting, accounts, agents and winnings; and in sports clubs, donations, transfers and related-party flows are reviewed in line with the sector guidance. Commercial custom as a justification does not remove the identification or reporting obligation. Consistency is sought among land registry, invoice, bank, cash, stock and contract records. A risk indicator alone is not treated as an admission of crime.

Compliance Supervision, Administrative Fines and Objections

In an examination by MASAK or by an authorized supervisory officer, the scope, sample, minutes, information request, findings and defense timetable are monitored. The types of sanction for breaches of customer identification, reporting, ongoing information, the compliance program, information and document duties, retention and reporting confidentiality are kept separate. Monetary amounts may depend on revaluation and the value of the transaction, so they are calculated from an official source on the date of the event. The date of the breach, the time limit, repetition, the responsible natural person, the legal person, the transaction and corrective action are made specific. Administrative application and the conditions for an action for annulment are assessed from the date of notification; where a criminal investigation exists, the defenses are coordinated.

For administrative fines under Law No. 5549, Article 13, administrative judicial review is considered under the current Article 13/7. The date of the breach, transitional law, type of decision, notification and time limit for application are reviewed separately in the file. Because breaches of confidentiality, information or retention duties can have criminal consequences under Article 14, not all breaches are classified as administrative fines.

Article 282 of the TCK, Financial Investigation and Asset Measures

For Article 282 of the TCK, the elements are examined separately: the predicate offense, the origin of the asset value from crime, the offender’s knowledge, and the purpose of transferring the funds abroad, concealing their unlawful source or giving them an apparently legitimate appearance. Not every unusual movement of money is money laundering; the economic source, purpose of the transaction, flows between accounts, commercial documents and the person’s role are assessed. A MASAK analysis or assessment report, bank records, and tax, company, crypto and customs data are reviewed for procedure and content. Protective measures under Article 128 of the CMK, Article 17 of Law No. 5549, postponement of transactions, confiscation and the rights of third parties are dealt with under separate headings.

For the offense in Article 282/1 of the TCK, the value obtained from the predicate offense and the acts of transferring it abroad or of concealing its source or giving it an apparently legitimate character are examined separately. Acquiring, accepting, possessing or using the value while knowing that it is the product of a crime, without participating in the first paragraph, is separately regulated in Article 282/2. The amount of a transaction or its unusual character alone does not prove all of these elements.

Financing of Terrorism and Proliferation, International Coordination and Litigation

Law No. 6415 is reviewed separately for the financing of terrorism and the freezing of assets; Law No. 7262 is reviewed for the implementation of UN Security Council sanctions relating to the financing of the proliferation of weapons of mass destruction. For the financing of terrorism, it is not required that the funds be derived from crime or actually used in a terrorist act; the concrete act, information and purpose elements are assessed. The freezing decision, the match with a list, the scope of the decision, the rights of third parties and the applicable route of objection are identified. The notification and postponement process under Communiqué No. 34 is separated from the implementation of a freezing decision.

Foreign sanctions regimes are not treated as identical to decisions applied directly in Türkiye. In a cross-border file, the task of the local attorney, the financial expert and the technical review team, the authority to share documents, secure transfer, a common calendar, fees and the reporting limit are agreed in advance.