Corporate Governance
and Compliance

The company type, ownership structure, group relationships, public listing, regulated sector, countries of operation and management model are reviewed. The duties and reporting lines among the general assembly, board of directors, managers, senior management, committees and control functions are determined.

The existing articles of association, internal directives, organization chart, representation structure and actual decision-making practice are compared. Differences between authority on paper and day-to-day practice are reported in terms of liability, invalid transactions, conflicts of interest and oversight risk.

The articles of association, the internal directive of the general assembly, the working rules of the board of directors, the structure of the board of managers, signature and representation directives, committee charters and governance policies are prepared or updated.

The documents should not make statutory duties and powers impossible to apply in practice; they should be consistent with the company type and registration practice. The effect of a contractual allocation of authority toward third parties and the company’s bodies is assessed separately.

Authority and approval levels are determined for financial, commercial, human resources, procurement, contract, litigation, data, technology and public relations decisions. Processes in which one person holds the authority to initiate, approve, pay and record are separated on a risk basis.

Delegation of authority does not remove the management body’s non-delegable duties under the law or its oversight responsibility. Powers of attorney, signature circulars, internal directives, bank instructions and system permissions are kept consistent with the same authority architecture.

Delegation of management under Turkish Commercial Code (TTK) Art. 367 is not the same as the power of representation. In a joint-stock company the non-delegable duties under Art. 375, and in a limited liability company those under Art. 625, are protected separately. The effect of internal authority limits on third parties requires a separate legal review.

The management body’s duties of care, loyalty, regard for the company’s interest, oversight, financial control, risk management, loss of capital, over-indebtedness, books and reporting are assessed for the specific transaction.

A decision protocol is established so that decisions rest on sufficient information, the agenda and attachments are provided on time, dissenting views and reservations are entered in the minutes, and implementation is followed up. A board decision may not by itself remove liability where there is no actual oversight and follow-up.

The audit committee, corporate governance committee, committee for the early detection of risk, and the remuneration and nomination functions are structured according to the company’s public listing, size and the legislation it is subject to.

Committee membership, independence, charter, meeting calendar, access to information, reporting and escalation to the board of directors are put in writing. Establishing a committee does not by itself transfer the board’s ultimate oversight responsibility.

Strategic, financial, operational, legal, regulatory, technology, data, people and reputational risks are defined using a common method. In addition to likelihood and impact, the speed at which the risk may arise, existing controls, the responsible person, tolerance and the escalation threshold are determined.

Risk records are not kept merely as an annual presentation. Critical indicators, incident reports, audit findings and corrective actions are reported to the management body in a measured and regular manner.

TTK Art. 378 provides a special committee obligation for companies whose shares are traded on a stock exchange. For other companies, the case in which the auditor considers it necessary and notifies the board of directors in writing is assessed separately; the same establishment requirement is not assumed for all companies.

Instructions, information, financing, services, data, brand and manager relationships among the parent company, subsidiaries, affiliates, joint ventures and branches are reviewed. How group policies affect the statutory responsibility and decision-making authority of the local company’s bodies is determined.

An approval and contract structure is established for intra-group service and cost sharing, data transfers, joint procurement, security, cash management and reporting. A foreign parent company’s policy is adapted to local law before it is applied directly in Türkiye.

A structure of disclosure, recusal, independent assessment, approval and recordkeeping is established for actual or potential conflicts of interest among managers, shareholders, employees, suppliers, advisers and closely related persons.

In related-party transactions, price, terms, the company’s interest, decision quorum, public disclosure, valuation and reporting obligations are reviewed according to the company’s status. Disclosing a conflict of interest does not automatically make the transaction lawful.

The rights to obtain information and inspect, to attend the general assembly, to vote, to receive dividends, special audit, minority rights and the principle of equal treatment are built into the governance structure. Information asymmetry among shareholders and the application of privileges are assessed together with the articles of association and the law.

The general assembly agenda, the call, representation, electronic participation, resolution and registration processes are prepared. While trade secrets and personal data are protected, unnecessary restriction of shareholders’ statutory information rights is prevented.

The Corporate Governance Communiqué (Kurumsal Yönetim Tebliği), mandatory and voluntary principles, board independence, committees, investor relations, related-party transactions, common and continuing transactions, and corporate governance reporting are reviewed.

Compliance reports are kept consistent with the company’s actual practice. Explanations under “comply or explain” are not left in general or repetitive wording; the reason, risk, alternative practice and future plan are written accurately.

The scope and exceptions of the Capital Markets Board (SPK) Communiqué No. II-17.1, the company’s group and current Board decisions are checked together. Mandatory principles are distinguished from principles subject to disclosure.

Family, ownership and management roles are separated; structures are prepared for the family council, the family constitution, the board of directors, professional management, share transfers, succession, dividend distribution, employment and dispute resolution.

It is clearly distinguished which provisions of a family constitution are moral commitments and which gain legal effect through the articles of association, a shareholders’ agreement or a corporate resolution. Generational transition, inheritance and the continuity of the company are planned together.

The company’s products, customers, suppliers, public relations, payment channels, countries, workforce structure, data, licenses and past incidents are reviewed. Risks are identified not by legislative heading but through actual business processes and points of contact.

The program is built from the components of management oversight, responsible persons, policy, controls, training, reporting channels, investigation, monitoring, reporting and corrective practice. The same control is not used for every risk; more intensive controls and records are applied to high-risk processes.

The code of ethics creates a common framework of conduct on integrity, conflicts of interest, gifts and hospitality, relations with public officials, confidentiality, data, discrimination, competition, company assets, accuracy of records and reporting.

Policies are not written merely as lists of prohibitions. The approving authority, monetary or qualitative limit, exceptions, records, advisory channel, consequences of a breach and the person responsible for updates are specified. Provisions of global policies that conflict with local legislation are adapted.

Relations with the public and private sectors, intermediaries, advisers, commissions, facilitation payments, gifts, hospitality, travel, donations, sponsorships, political contributions, and tender and license processes are reviewed on a risk basis.

Controls are established for third-party onboarding, contracts, payment verification, proof of services, management approval and periodic renewal. Where foreign anti-bribery legislation may apply, coordination is ensured with qualified legal professionals in the relevant country.

Whether the company is an obligated party under Law No. 5549 and the related regulations; and its obligations regarding customer due diligence, beneficial owner, risk management, monitoring, suspicious transaction reporting, continuous information, retention and training are reviewed.

Compliance program and compliance officer requirements are structured according to the obligated group. The confidentiality of a suspicious transaction report and the rules against disclosing that a report has been made are treated separately from ordinary reporting channels and management reporting. The details are covered on the page AML Compliance and Financial Investigations (a page currently available in Turkish only).

Under Law No. 5549 Art. 4/2, the fact that a suspicious transaction report has been made may not be disclosed to anyone, including parties to the transaction, other than the examiners assigned to supervise compliance with obligations and the courts during judicial proceedings. Reporting to the general assembly or in management reports does not lift this special confidentiality rule.

Connections involving parties, countries, products, services, payments, banks, transport and end use are assessed. In addition to the regulations in Türkiye, foreign sanctions and export control rules that may apply because of a contract or cross-border transaction are reviewed with local legal professionals.

A screening result such as a name similarity is not treated as an automatic violation. Identity verification, the sanctions program, scope, license, exceptions, and any blocking or notification obligation are determined in the specific case.

Contact with competitors, pricing, distribution, exclusivity, online sales, information exchange, tenders, trade associations, employee mobility and dominant position risks are reviewed according to the company’s processes.

A management message, a protocol for contact with competitors, a plan for on-site inspections, contract review, training, reporting channels and an internal review structure are established. The details of competition violations, Competition Authority investigations and merger control are covered on the page Competition Law (a page currently available in Turkish only).

Oversight of data responsibility by the management body is established through a data inventory, access, retention, suppliers, cross-border transfer, breaches, data subject requests and reporting on technical and administrative measures.

A compliance monitoring or internal investigation purpose does not permit unlimited processing of the data of employees and third parties. Processing conditions, the privacy notice, purpose limitation, proportionality, access and destruction obligations are handled in coordination with the page Data Protection and Privacy (a page currently available in Turkish only).

The conditions for cross-border transfer under KVKK Art. 9 are also reviewed for remote access by a foreign parent company and for cloud systems. In a breach notification where personal data have been obtained unlawfully, under Personal Data Protection Board decision No. 2019/10 the basic rule is notification to the Board without delay from the time of learning and within 72 hours at the latest, and notification to the affected persons in the shortest reasonable time. The same notification regime does not apply to every cyber incident.

The duties of the management body and of the information technology, information security, legal, compliance, communications and business continuity teams are determined within a matrix of cyber risk, incident escalation, decision and reporting.

Cybersecurity Law No. 7545, personal data, electronic communications and sector-specific security obligations are reviewed according to the company’s scope. A law firm does not perform technical penetration testing; it manages the consequences of technical findings for notification, liability, contracts and disputes. The details are found on the page Cybersecurity Law (a page currently available in Turkish only).

Hiring, working conditions, pay, performance, overtime, leave, remote work, equal treatment, occupational health and safety, discipline, termination and personnel file processes are reviewed in terms of legislation and actual practice.

Employer policies are aligned with the limits of the employer’s right to direct work, employee privacy notices, the disciplinary procedure, and defense and decision-making authority. Collective bargaining agreements, workplace practice and contractual entitlements are also taken into account.

The six business days and one year in Art. 26 of Law No. 4857 relate to the power to terminate on the basis of conduct contrary to the rules of morality and good faith. The one-year limit does not apply where the employee obtained a financial benefit. When the knowledge arose with respect to the competent authority, and the effect of the investigation, are examined in the specific case; opening a process is not an automatic suspension of the time limit.

A structure of prevention, reporting, review and remediation is established for discrimination, harassment, sexual harassment, psychological harassment, retaliation, forced labor, child labor and human rights risks in the supply chain.

Equal treatment and inclusion policies are not left as abstract commitments. Measurable controls are placed at decision points such as hiring, promotion, pay, assignment, performance, termination of the employment relationship and workplace accessibility.

Risk classification is carried out when accepting intermediaries, distributors, representatives, advisers, subcontractors, suppliers and business counterparties. Ownership and management structure, beneficial owner, public connections, reputation, sanctions, conflicts of interest, qualifications, scope of services and payment terms are reviewed.

The intensity of the review is determined in proportion to the risk. Contract provisions are supported by mechanisms for verification, records, audit, subcontractors, training, notification, suspension and termination. Periodic monitoring and event-based renewal are applied after onboarding.

In compliance review before mergers and acquisitions, past violations, open regulatory proceedings, intermediaries and control gaps are also assessed. The findings are matched with the transaction documents, closing conditions and the post-acquisition remediation plan.

Accessible and secure channels are designed through which employees and, where necessary, third parties can raise concerns. The scope of the channel, responsibility for operating it, options for anonymous or identity-protected reports, acknowledgment of receipt, feedback, escalation and retention rules are put in writing.

No promise of absolute confidentiality or of anonymity in every case is given. Access to information is limited to persons who need to know by virtue of their duties; the prohibition of retaliation is announced and monitored. The reporting channel is kept separate from the general inquiry form and from marketing infrastructure.

Risk-based rules are established for gifts, meals, travel, accommodation, events, donations, sponsorships, social investment and political contributions, based on amount, frequency, purpose, party, timing and public connection.

Prohibition, pre-approval, after-the-fact notification and recording categories are distinguished. Fragmented transactions and repeated benefits to the same person are aggregated; the true purpose and beneficiary of transfers made under the label of marketing or corporate social responsibility are examined.

A structure is established for management oversight, authority, data ownership, risk and opportunity assessment, report approval and assurance readiness on sustainability matters. Whether the company falls within the mandatory scope of the Türkiye Sustainability Reporting Standards is examined according to the year, thresholds and the nature of the company.

It is ensured that statements on climate, human rights, workforce, supply chain and governance rest on verifiable records. Voluntary reporting, advertising and financing statements are also examined for the risk of misleading disclosure and contractual liability.

ESG refers to environmental, social and governance matters. Sustainability reporting and assurance obligations are determined according to the current scope of the Capital Markets Board (SPK) and the Public Oversight, Accounting and Auditing Standards Authority (KGK) for the company concerned; the same reporting requirement is not assumed for every business. Technical measurement and independent assurance fall within the field of competent experts.

In finance, insurance, energy, tourism, health, pharmaceuticals, food, electronic communications, transport, defense, retail, e-commerce and other regulated fields, licensing, notification, advertising, pricing, consumer, data, record and audit obligations are mapped according to the company’s operating model.

Instead of a single general policy, checklists, approval flows and exception routes that business units can use at the moment of decision are established. Responsibility and an update calendar are set for decisions of regulatory authorities and changes to secondary legislation.

Licensing, customer, data, procurement and employee risks differ in tourism, health, finance, energy, retail, technology and manufacturing. A single compliance document does not replace all permits or sector-specific audits.

Training content is differentiated by risky duty and scenario rather than by title. Different modules are prepared for the board of directors, sales, procurement, public relations, human resources, finance, information technology and high-risk third parties.

Recording attendance is not by itself treated as an indicator of effectiveness. Scenario questions, knowledge checks, behavioral indicators, analysis of results and a repeat program are used. Management’s messages should be consistent with actual decisions and the incentive system.

The existence, design and actual operation of a control are examined separately. Sampling, data analysis, transaction testing, exception review, surveys and interviews are used according to the nature of the risk.

The management report shows not only the number of trainings but also reporting trends, review duration, recurring causes, overdue corrective actions, control gaps and residual risk. The reporting gives the decision-maker sufficient information without unnecessarily spreading personal data.

The job description, reporting line, budget, access to information, independence and direct access to the management body of the compliance officer or unit are determined. Appointments required by law are not confused with the company’s voluntary compliance structure.

The allocation of duties among the legal, internal audit, risk, human resources, information security and finance units is put in writing. An alternative reporting route is established for situations in which the compliance unit audits its own practice or has a conflict of interest with the subject of the review.

Implementation is not considered complete once a policy is published. The process owner, technology requirement, training, transition date, exceptions, audit and reporting steps are tied to an implementation plan.

After a violation or control gap, corrective action is tracked with a responsible person, target date, priority, dependency, evidence and closure approval. Interim measures and permanent solutions are shown separately; delay and risk acceptance are reported to the competent body.

An investigation is not closed with a decision on individual responsibility alone. Incentives, targets, management conduct, role ambiguity, control design, resources, training, technology and oversight gaps are examined with a root cause method.

The completion and effect of corrective actions are verified separately. Whether a similar risk exists in another unit, company or country is investigated; a closure and residual risk report is presented to the management body.

Before a report arrives, protocols are prepared for case intake, urgent escalation, authority, conflict-of-interest check, record preservation, data access, interviews, reporting, discipline, contact with regulatory authorities and corrective action.

It is determined which incidents will be referred to the board of directors, the audit committee, the data breach team, the occupational health and safety team or external legal counsel. The communication channels and decision records to be used in emergencies are defined in advance.

The allegation in the report, the parties, time, place, source, likely harm, continuing risk and existing records are reviewed at the first stage. A report may need to be referred to an investigation, a management resolution, an occupational health and safety process, a data breach response or another channel.

The initial assessment is not a definitive decision on the truth of the allegation. Its purpose is to stop urgent harm, prevent retaliation, preserve records and determine statutory time limits.

The authority commissioning the investigation, the team conducting it, the body that will decide and the persons who will receive the report are determined separately. If the allegation concerns senior management, the legal unit, the compliance officer or a member of the board of directors, an independent reporting line is established.

The prior role, personal relationships, decision responsibility and knowledge of the incident of the team members are disclosed. Independence is ensured not by title alone but by engagement, budget, access to information and freedom to report.

The allegations, the period to be examined, legal questions, data sources, persons to be interviewed, the need for experts, target timeline and reporting format are tied to a written plan. The scope may be expanded or narrowed, with reasons, as new findings emerge.

The standard to be used in the assessment is determined at the outset. A company’s internal administrative review is not a criminal trial; nevertheless, instead of assumptions it should rely on consistent, verifiable and lawfully obtainable records.

Automatic deletion, document destruction or account closure is suspended, limited to the necessary scope and period. For email, messaging, business applications, access logs, camera footage, financial records and device review, ownership, processing condition, privacy notice, purpose, scope and access authority are assessed.

The collection is recorded with its source, date, method, responsible person and integrity check. Personal accounts and devices do not become an area of unlimited review merely because an investigation has been opened; narrower and more suitable methods are considered first.

• Scope: The person concerned, data source and date range.
• Authority and method: Legal basis, access, person responsible for collection and process record.
• Integrity: Source, time, copying and verification information.
• Retention: Review of the preservation and the criterion for lifting it.

The collected records are classified according to the investigation questions. Keyword, date range, person, transaction and subject filters are used in a way that reduces unnecessary data spread.

The incident chronology shows the source, time period, level of certainty and conflicting records. A missing record or silence is not automatically treated as evidence of a particular conclusion. Document review is used to determine the order of interviews and the need for additional data.

The purpose of the interview, the participants, the confidentiality limit, the prohibition of retaliation, the method of note-taking or recording and the follow-up process are explained at the start. Questions begin open-ended, and leading and accusatory language is avoided.

Before a decision is made on the allegation, the person concerned is given information sufficient to understand the accusation and to respond meaningfully. The scope of disclosure is balanced in the specific case in view of witness safety, personal data, trade secrets and the integrity of the investigation.

The employee is told the purpose of the review, the role of the interviewers and the confidentiality limits. The interview record is not treated as equal to the defense process that may be required before termination; the contract, internal policy and legal conditions are checked separately.

Recovery of deleted files, disk images, mobile devices, server logs, email archives, access analysis, accounting tests or other technical examinations are carried out by competent experts. The law firm does not claim to perform the technical examination; it coordinates the legal scope, the data boundary, the instruction and the use of the report.

The expert’s independence, method, competence, information security and subcontractors are reviewed. Technical findings and legal characterization are kept separate; uncertainties in the expert report are preserved in the conclusion text.

Where there is a risk to life or occupational safety, data loss, continuing harm, pressure, interference with witnesses or retaliation, interim measures are assessed. Measures such as restricting access, changing the reporting line, separating duties or leave are applied without a punitive purpose, proportionately and for a limited time.

For persons who file a report, provide information or take part in the investigation, decisions such as performance, shifts, promotion, pay, exclusion and termination of the employment relationship are monitored. Bad faith is not inferred merely from the fact that an allegation could not be verified.

Unpaid leave, a reduction in pay or a material change in working conditions should not be applied as an advance investigation measure. Within the framework of Labor Law Art. 22, the contract and the specific risk, the necessary procedure, employee consent and lighter alternatives are assessed.

The report shows the engagement, scope, method, sources reviewed, limitations, events, contradictions, legal framework and the conclusion for each allegation separately. Fact, interpretation and legal opinion are not mixed.

The decision belongs to the competent corporate body. Consistency in similar incidents, the seriousness of the violation, intent, management role, repetition, cooperation, harm, policy and employment law rules are assessed together. That an allegation could not be verified does not necessarily mean it is unfounded.

Where the incident falls within a personal data breach, workplace accident, crime, market violation, competition violation, money laundering risk or sector-specific regulation, the options of notification, application, voluntary disclosure or cooperation are examined separately.

Legal obligation, time limit, competent authority, scope of disclosure, personal data, trade secrets and the effect on any ongoing investigation are addressed together. Criminal, employment, commercial and administrative disputes, together with insurance and contractual notifications, are coordinated in a single incident plan.

Administrative sanctions, management liability, employment, commercial receivable and damages lawsuits; criminal complaints or criminal investigations; and, where the conditions are met, mediation, arbitration and legal remedies require different procedures. The option of cooperation with the authority, defense rights and special prohibitions on disclosure are assessed together.