Updated 3 November 2026 · Written by Melis Alparslan, Regional Sales Manager · Reviewed by Ufuk Gürdaş, Compliance Specialist
What is the legal framework for AML in Türkiye?
MASAK does not license anyone. It is Türkiye's financial intelligence unit and its AML supervisor: it receives suspicious transaction reports (STRs), has obliged parties audited under article 11 of Law 5549 and fines them under article 13. Licenses come from the sector regulators in the next section.
The core of anti money laundering (AML) law in Türkiye is Law No. 5549 on Prevention of Laundering Proceeds of Crime, adopted on 11 October 2006 and amended by Law No. 7262 in 2020 and Law No. 7521 in 2024. It names the obliged parties and sets the identification, reporting, compliance program, record and information duties, with the fines behind them.
The laundering offense sits in article 282 of the Turkish Penal Code. Terrorist financing and asset freezing sit in Law No. 6415 of 2013.
Law 5549 is short, so you will spend most of your time in the Measures Regulation of 2008. It is a regulation in the legal sense, a binding rule made under powers the law gives and amended by Presidential decision, and it sets customer due diligence (CDD), the thresholds, transfer data and the STR deadline.
The Compliance Program Regulation of 16 September 2008 adds the officer and program rules for financial institutions. MASAK's numbered general communiqués carry the forms, limits and sector rules.
Which regulatory bodies oversee AML in Türkiye?
| Body | Role | Firms it licenses or oversees |
|---|---|---|
| MASAK (Mali Suçları Araştırma Kurulu, the Financial Crimes Investigation Board), Ministry of Treasury and Finance | Financial intelligence unit and AML supervisor: STR intake, audits, administrative fines, communiqués | Every obliged party, financial and non financial |
| BDDK (Banking Regulation and Supervision Agency) | Licenses and supervises under the Turkish banking laws | Banks; financing, factoring and leasing companies |
| SPK (Capital Markets Board, CMB) | Licenses capital market firms; crypto asset service providers since Law No. 7518 (2 July 2024) | Brokers, portfolio managers, crypto platforms |
| TCMB (Central Bank of the Republic of Türkiye) | Licenses payment and electronic money institutions under Law No. 6493 (27 June 2013) | Payment and electronic money institutions |
| SEDDK (Insurance and Private Pension Regulation and Supervision Agency) | Licenses and supervises insurers | Insurers, reinsurers, pension companies |
| KGK (Public Oversight, Accounting and Auditing Standards Authority) | Public oversight of accounting and auditing standards and of independent audit | Independent auditors and audit firms |
Foreign groups get this split wrong most often. Picture an illustrative payment institution in Istanbul: TCMB decides whether it may operate and how much capital it holds, while MASAK checks how it identifies, monitors and reports on customers. The two meet only at the end. Under article 13(2) of Law 5549, a compliance program breach still unfixed after MASAK's warnings and two fines is reported to the licensing body, which can suspend, restrict or cancel the license.
Which sectors are governed by AML regulations in Türkiye?
Article 2(d) of Law 5549 names the sectors, and article 4 of the Measures Regulation lists the obliged parties. By group:
- Banks and financial institutions. Banks, financing, factoring and leasing companies, payment and electronic money institutions, capital market intermediaries, insurers, pension and savings finance companies. Their fines run at twice the base rate.
- Crypto asset service providers (VASPs). Obliged parties since 1 May 2021, licensed by the CMB, and the only group identified from 30,000 TL on any transaction.
- Designated non financial businesses and professions (DNFBPs). Real estate, precious metal, jewelry, vehicle and art dealers, notaries, independent accountants, sports clubs, betting operators. Most need no compliance officer.
- Lawyers. Only for property, company, foundation and association work and for managing accounts and the assets in them.
- Marketplaces. Medium and larger ecommerce intermediaries, for transactions with their sellers, since 25 December 2024.
- Post, cargo and cash transport. PTT and cargo companies; cash and valuables transport firms since 13 February 2026.
- Foreign groups. A Türkiye branch, agency or representative of a foreign obliged party is an obliged party itself (art. 4(2)). In the other direction, a Turkish party's units abroad apply the Regulation as far as local law allows and tell MASAK where it does not (art. 4(3)).
Lenders show how the duty lands. Quick Finans, a financing company in Türkiye, must know every customer it lends to, so it screens each credit applicant inside the lending decision.
What are the AML requirements in Türkiye, and how do you conduct due diligence?
To conduct due diligence in Türkiye, a firm works through the twelve duties below, each with its legal basis as amended to 7 October 2026. In the last column, complead, formerly Sanction Scanner, names the complead product that produces the record a MASAK auditor asks for; training gets no product.
| Obligation | Legal basis | What a program must do | How complead does it |
|---|---|---|---|
| Customer identification | Law 5549 art. 3; Measures Regulation arts. 5 to 16 | Identify and verify the customer and anyone acting for it before the relationship or transaction: every continuing relationship, transactions of 370,000 TL or more, wire and crypto transfers of 30,000 TL or more, any suspicion, any doubt about earlier data. | KYC and customer risk assessment share one engine with screening and monitoring, so one risk score follows the customer. |
| Beneficial owner | Measures Regulation art. 17/A | For a company in the trade registry, identify natural persons holding more than 25 percent; where there is none, or one is suspected not to be the real owner, the person in ultimate control; failing that, the most senior executive in the registry. | KYB and UBO verification traces each owner layer by layer to the natural persons at the top and reports any layer it cannot resolve. |
| Politically exposed persons | MASAK General Communiqué No. 21 (17 Nov 2022) | Find out whether a customer or beneficial owner is a domestic or foreign PEP, or a PEP's relative or close associate; get senior sign off, establish the source of wealth and monitor more closely. | Screening includes PEP lists, and their fuzzy matching threshold can differ from the one set for sanctions lists. |
| Risk based approach and ongoing monitoring | Law 5549 art. 5; Measures Regulation arts. 19 and 26/A | Monitor whether transactions fit the customer's occupation, business, finances, risk profile and source of funds; keep data current; apply enhanced measures in proportion to high risk. | API triggers switch ongoing monitoring on or off for each name, so a name that no longer matters stops being rescreened. |
| Sanctions and asset freezing | Law 6415 arts. 5 to 7; Law 5549 art. 19/A; Communiqué No. 34 (23 Sep 2026) | Apply freeze decisions published in the Official Gazette: UN listings under resolutions 1267, 1988, 1989 and 2253 by Presidential decision (art. 5), foreign requests decided by the President (art. 6), domestic freezes decided jointly by the Ministers of Treasury and Finance and of Interior and put to an Ankara court within 48 hours (art. 7). Screen against UN listings as MASAK announces them, report a matching transaction at once and defer it up to seven business days. | Fuzzy thresholds are set per list. Screening runs across 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. |
| Suspicious transaction report | Law 5549 art. 4; Measures Regulation arts. 27 and 28 | Report to MASAK at any amount, attempted transactions included, within ten business days of the suspicion forming; disclose the report to no one except obligation auditors and, during a trial, the courts (art. 4(2)). | For each case an agent assembles the evidence, a narrative and its work log, and case management supports the report itself; the compliance officer makes the filing decision. |
| Transfer information | Measures Regulation arts. 24 and 24/A | Wire and crypto transfers of 30,000 TL or more carry the sender's name, account or wallet and one identifier, verified; smaller ones carry names and account or wallet details; incomplete messages are completed or returned. | Payment screening screens both the sender and the receiver by API during transfer processing. |
| Continuous reporting | Law 5549 art. 6 | Report the transaction types and amounts MASAK designates, in the format and period it sets. | A rule scoped per product, segment or jurisdiction can flag the designated transaction types. |
| Compliance program and officer | Law 5549 art. 5; Compliance Program Regulation (2008) | Board approved policy, a compliance officer and deputy, risk management, monitoring and control, training and internal audit, for the institutions the Regulation names. | Rule versions are kept, each naming who changed it, when and why, with a one click rollback. |
| Record keeping | Law 5549 art. 8 | Keep documents for eight years from the date they were drawn up, books and records from the last entry, and identification documents from the last transaction; produce them on request. | The screening log keeps the user, the query, the time and the outcome of every search, no match outcomes included. |
| Information requests | Law 5549 arts. 7 and 9/A | Give MASAK and its auditors every document and record asked for; keep an electronic notification address. | An alert carries the rule that fired and the signals behind it, ready for an auditor's question. |
| Training | Compliance Program Regulation (2008) | Train staff on the law, typologies, the STR process and sanctions, with records MASAK can inspect. | Training stays with the firm. |
KYC in Turkey starts with the first three rows. Identity is verified before the relationship or the transaction (Measures Regulation art. 5(2)), for Turkish citizens with their identity number. For a registered company, the firm identifies any natural person above 25 percent; where none exists, or that person is suspected not to be the real owner, it looks for the person in ultimate control and, failing that, records the most senior executive. High risk brings enhanced due diligence (EDD) under article 26/A, from source of funds to senior approval.
Which thresholds apply since 7 October 2026?
The amendment in the Official Gazette of 7 October 2026 (No. 33393) doubled the money thresholds and left the deadlines alone.
- 370,000 TL. Identification for a single or linked transaction outside a continuing relationship (art. 5(1)(b); was 185,000 TL).
- 30,000 TL. Identification on wire and crypto transfers (art. 5(1)(c)) and verified sender data in the message (arts. 24 and 24/A, Türkiye's travel rule for wires and crypto; was 15,000 TL).
- Any amount. A continuing relationship, a suspicious case, or doubt about earlier identity data.
- Deadlines, unchanged. Ten business days to file an STR, eight years to keep records, up to seven business days to defer a transaction that matches a UN listing.
How does Türkiye apply the risk based approach?
Article 19 requires firms to monitor whether a customer's transactions fit its occupation, business, finances, risk profile and source of funds. Article 20 adds non face to face channels and new technology; article 25, customers from risky countries. Where risk is high, article 26/A sets enhanced measures in proportion. None of this is a fixed list of customer types.
Picture an illustrative Izmir jeweler whose new corporate customer pays 900,000 TL in three linked transfers. The firm asks where the money came from, and a senior manager signs off before the sale.
How is a suspicious transaction reported to MASAK?
| Stage | Input | Output | Who decides |
|---|---|---|---|
| Alert or staff report | Rule hit, screening match or an employee's report | Case opened, suspicion date recorded | Analyst |
| Analysis | Customer file, transactions, beneficial owner, PEP and sanctions results | Written reasoning | Analyst, then compliance officer |
| Decision | The case file | File or no file, dated and signed | Compliance officer |
| Filing | The STR form | Filed with MASAK within ten business days of the suspicion date | Compliance officer |
| UN listing match | A match to a listing MASAK announced | Immediate report; transaction deferred up to seven business days | Compliance officer, then MASAK |
A report is due when there is any information or suspicion that assets in a transaction, attempted or completed, were obtained illegally or serve an illegal purpose, terrorism included (art. 27). The clock starts on the day the suspicion forms, not the day of the transaction (art. 28). Telling the customer is a crime under article 14 of Law 5549. The general steps for filing a SAR or STR still apply; in Türkiye the form goes to MASAK.
What penalties apply for AML non-compliance, laundering and fraud in Türkiye?
| Breach | Fine (Law 5549 art. 13, 2020 base amount) | Financial institutions | Cap and extras |
|---|---|---|---|
| Identification (art. 3) or continuous reporting (art. 6) | 30,000 TL per breach | Twice the fine, and at least 5% of the transaction | 40 million TL per obligation a year for double rate firms, 4 million TL for others |
| STR duty (art. 4(1)) | 50,000 TL per breach | Twice the fine, and at least 5% of the transaction | Same caps; doubled the next year after a capped fine |
| Compliance program (art. 5(1)) | Written warning and at least 30 days; then 500,000 TL; a second warning and at least 60 days; then twice the first fine; then referral to the licensing body | Same sequence | Board member or senior manager: one quarter of the firm's fine |
| Electronic notification (art. 9/A) | 40,000 TL per finding | Same | 1 million TL a year |
| Offense | Article | Penalty |
|---|---|---|
| Laundering the proceeds of an offense with a minimum term of six months or more | Penal Code art. 282(1) | 3 to 7 years in prison and a judicial fine of up to 20,000 days |
| Knowingly acquiring, holding or using laundered assets | Penal Code art. 282(2) | 2 to 5 years |
| Laundering by a public official or a professional at work; within a criminal organization | Penal Code art. 282(3) and (4) | Increased by half; doubled |
| Tipping off, refusing information, breaching retention duties | Law 5549 art. 14 | 1 to 3 years and up to 5,000 days |
| Fraud | Penal Code art. 157 | 1 to 5 years and up to 5,000 days |
| Qualified fraud, including through banks, credit institutions or IT systems | Penal Code art. 158(1) | 3 to 10 years and up to 5,000 days; in cases (e), (f), (j), (k) and (l), among them banks, IT systems, credit and insurance, at least 4 years and a fine of at least twice the gain |
| Embezzlement by a public official | Penal Code art. 247 | 5 to 12 years; increased by half when concealed by fraudulent acts |
MASAK imposes the fines; the courts impose prison terms. The amounts are the base figures that Law No. 7262 wrote into article 13 in 2020, and article 28 of Law 5549 revalues them every January. MASAK's 2026 table puts a financial institution's fine at 568,898 TL per identification breach and 948,158 TL per STR breach, capped at 379,271,547 TL per obligation. No fine can be imposed eight years after the breach, and since Law No. 7521 a fine can be challenged in the administrative courts.
Fraud and embezzlement carry minimum terms of a year or more, so their proceeds pass the six month test in article 282(1) of the Turkish Penal Code. That is why the penalty for fraud in Turkey and the punishment for embezzlement sit in the table: legal actions against fraud can reach whoever moves the money, as a laundering charge on top of the predicate.
What are the major money laundering cases in Türkiye?
The Istanbul crypto exchange Thodex went offline in April 2021. Hürriyet Daily News reported that a court sentenced founder Faruk Fatih Özer to 11,196 years in prison on 7 September 2023, with the indictment putting losses at 356 million lira, and that officials confirmed his death in a prison cell on 1 November 2025.
MASAK's own enforcement hit the same sector. Anadolu Agency reported on 17 February 2022 that MASAK had fined four crypto exchanges 18.8 million TL in total for 2021 breaches of identification, reporting and record duties: Paribu 8 million TL, Bitci 4.25 million TL, Icrypex 4.1 million TL and BtcTurk 2.45 million TL. On 24 March 2023 the agency reported MASAK audits of 441 obliged parties and more than 105 million TL in fines.
Older summaries of Turkish cases, this guide's earlier version among them, also name Halkbank and SBK Holding. We give no facts on either here until a court or regulator record can be cited.
How do screening and monitoring support AML compliance in Türkiye?
A MASAK audit reads records: the list a name met, the rule that fired, who decided and when. complead, formerly Sanction Scanner, was founded in Istanbul in 2019 and runs an AI native platform for AML, KYC and fraud. Sanction Scanner, the screening product, is part of complead.
Its client screening and ongoing monitoring product logs every search, empty ones included, and takes fuzzy matching thresholds per list type and per list. Since Communiqué No. 34, MASAK announces UN Security Council listings itself, and a matching transaction is reported at once.
Transaction monitoring is built on a rules engine. A team can write the 30,000 TL transfer line without code, test it on the last 30, 60 or 90 days for the alert volume it would have raised, then ship it as a version naming who changed it and why. Agents work routine cases and attach the evidence, the narrative and a work log. The compliance officer makes the call.
Marketplaces now carry the duty. Hepsiburada selected complead Fusion for its merchants, and its announcement says each merchant will be screened for sanctions and PEP status at onboarding and rescreened daily, with one risk score per merchant and every action logged for internal audit.
Is Türkiye on the FATF grey list, and what changed in 2025 and 2026?
No. Türkiye was grey listed from 21 October 2021 to 28 June 2024. Its fifth round evaluation, published by the FATF on 23 September 2026, rated 15 of the 40 FATF Recommendations compliant, 23 largely compliant and two partially compliant (R.7 and R.8), found three of eleven Immediate Outcomes substantial and eight moderate, and placed Türkiye in enhanced follow up.
- 25 December 2024. Crypto asset service providers become financial institutions; article 24/A brings the travel rule; ecommerce intermediaries join.
- 28 June 2025. Communiqué No. 29: crypto withdrawals wait 48 hours after a purchase or deposit (72 for the first), and stablecoin withdrawals cap at 3,000 US dollars a day and 50,000 a month, twice that where the article 24/A(1) transfer data applies.
- 13 February 2026. Cash and valuables transport firms become obliged parties.
- 23 September 2026. Communiqué No. 33 raises the simplified measure limits; No. 34 sets the UN listing procedure, with the seven business day deferral of Law 5549 art. 19/A.
- 7 October 2026. Thresholds double to 370,000 TL and 30,000 TL; on repeat face to face transactions, financial institutions can skip the signature sample where an internet or mobile channel check or an SMS one time password to the verified phone number fits the transaction's nature and risk (art. 16).
Due next: the January 2027 revaluation of the article 13 amounts (Law 5549 art. 28) and follow up reports to the FATF.
A Turkish crypto platform holds a CMB license under Law No. 7518 and runs a MASAK program, and its open question is how the two calendars fit.
Download the Türkiye PDF: fourteen audit checks and two templates
The guide on this page is complete; the PDF exists for the audit file. Its 16 pages (2026 edition) add fourteen checks in the order a MASAK auditor raises them, a risk factor template for Turkish customers, and an STR decision record whose first field is the suspicion date.
