Corporate & Commercial
AML & MASAK Compliance in Turkey 2026: Foreign Investor Guide
What are MASAK AML obligations for foreign companies in Turkey? Complete 2026 guide on suspicious transaction reporting, TCK 282 penalties & compliance — by Istanbul lawyers.
Money laundering in Turkey carries severe criminal penalties under Article 282 of the Turkish Penal Code (TCK), with imprisonment ranging from three to seven years and judicial fines reaching 20,000 days for convicted individuals. For foreign investors, multinational corporations, and high-net-worth individuals deploying capital into the Turkish market, understanding MASAK (Mali Suçları Araştırma Kurulu — Turkey's Financial Intelligence Unit) compliance obligations is not merely a regulatory formality — it is a strategic imperative that determines whether your investment structure survives regulatory scrutiny or triggers a criminal investigation.
The Turkish framework has been redrawn repeatedly over the last five years, and not always in the direction people assume. Customer identification thresholds have gone up with inflation — from TRY 20,000 to 75,000 in February 2021, to 85,000 in June 2022 and to TRY 185,000 in January 2023 — while a separate, far lower threshold of TRY 15,000 now governs electronic transfers and, since the Presidential Decision of 25 December 2024, crypto asset service providers and crypto transfers. The categories of obliged party have widened rather than the sums narrowed. Foreign-owned enterprises, joint ventures and holding structures with a Turkish nexus carry exactly the same obligations as domestic ones where they fall inside those categories — and none at all where they do not, which is the distinction this guide starts from. The exposure, where it exists, is both administrative and criminal, and some of it attaches to individuals rather than to the company. Our criminal defense lawyer in Istanbul page sets out how we act where an investigation has already started.
Key Takeaways: Money Laundering and MASAK Compliance in Turkey
Article 282 of the Turkish Penal Code punishes laundering the proceeds of an offence carrying a minimum penalty of six months or more with three to seven years' imprisonment and a judicial fine of up to 20,000 days; knowingly acquiring, receiving, holding or using such property carries two to five years. Terrorist financing under Article 4 of Law No. 6415 carries five to ten years.
There is no monetary threshold for a suspicious transaction report. Article 27(2) of the Measures Regulation requires obliged parties to report regardless of amount, within ten business days of the date the suspicion arose (Article 28(2)).
Customer identification is triggered at TRY 185,000 for a single or linked transactions (TRY 15,000 for crypto asset service providers), at TRY 15,000 for electronic and crypto transfers, and regardless of amount when a permanent business relationship is established or a report is required.
Administrative fines under Article 13 of Law No. 5549 start at statutory base figures — TRY 30,000 for customer-identification and continuous-reporting breaches, TRY 50,000 for failing to report a suspicious transaction, TRY 500,000 for an unremedied compliance-programme breach — which Article 28 increases each year by the revaluation rate. For financial institutions the fine is doubled and cannot be less than 5% of the transaction.
An ordinary foreign-owned trading or holding company does not have to appoint a MASAK compliance officer. A full compliance programme with a compliance officer is required of the financial-sector obliged parties listed in Article 4 of the Compliance Programme Regulation — banks, brokerages, insurers, payment and e-money institutions and, since 25 December 2024, crypto asset service providers. Article 29 of the same Regulation requires a further, listed group — including cargo companies and, since 25 December 2024, medium, large and very large e-commerce intermediary service providers — to appoint a compliance officer without a full programme.
Turkey's Anti-Money Laundering Legal Framework
Turkey's AML regime is anchored in three primary legislative instruments: the Turkish Penal Code (TCK), Law No. 5549 on the Prevention of Laundering Proceeds of Crime, and the regulations issued by MASAK through binding circulars and communiqués. The detail sits in the Measures Regulation made under Law No. 5549 and in the Compliance Programme Regulation. The architecture has been reshaped repeatedly in recent years: Law No. 7262 of 27 December 2020 rewrote the penalty regime and added a fine for carrying out a suspended transaction (the suspension power itself was introduced by Law No. 6704 in 2016); Presidential Decision No. 3580 of February 2021 moved the identification thresholds; Presidential Decision No. 3941 of 1 May 2021 made crypto asset service providers obliged parties, and Presidential Decision No. 9305 of 25 December 2024 gave them their own lower identification threshold and brought them into the compliance-programme duty; and Law No. 7521 of 18 July 2024 redrew the position of lawyers and confirmed that fines are open to challenge in the administrative courts.
TCK Article 282: Criminal Penalties for Money Laundering
Under Article 282 of the Turkish Penal Code, a person who takes abroad property derived from an offence whose minimum penalty is six months' imprisonment or more, or who subjects it to various transactions in order to conceal its illegitimate source or to create the impression that it was legitimately acquired, is punished with three to seven years' imprisonment and a judicial fine of up to 20,000 days. A separate and lesser offence in Article 282(2) catches the person who, without taking part in the first, buys, accepts, holds or uses such property knowing what it is: two to five years. The sentence is increased by half where the offence is committed by a public official, or by a member of a profession in the exercise of that profession, and doubled where it is committed within the activity of a criminal organisation (Article 282(3) and (4)). Security measures apply to legal persons (Article 282(5)), and a person who, before prosecution begins, secures the recovery of the property or reveals where it is, is not sentenced at all (Article 282(6)).
Two points matter for a foreign investor, and they pull in opposite directions. The offence does not require the defendant to have committed the predicate offence — laundering someone else's proceeds is enough. But it is not a negligence offence and there is no strict liability: Article 282(1) requires the purpose of concealing the source or of creating an appearance of legitimacy, and Article 282(2) requires knowledge of what the property is. "Should have known" is not the statutory test. What careless structuring does expose a director to is different and more practical — an investigation in which the prosecutor invites the court to infer knowledge from the circumstances, and the documentary record is the only answer to it. That is the real reason to keep due diligence files, and it is a separate question from the administrative duties discussed below. On the wider point, our guide to white-collar crime and executive liability in Turkey sets out how personal exposure attaches to those acting for a company.
Law No. 5549 and MASAK's Regulatory Authority
Law No. 5549 establishes MASAK as Türkiye's financial intelligence unit and sets the duties that follow: customer identification (Article 3), suspicious transaction reporting (Article 4), the training, internal audit, control and risk-management measures the Ministry may require (Article 5), continuous reporting above amounts the Ministry sets (Article 6), the duty to hand over information and documents on request (Article 7), and retention of records for eight years (Article 8). Article 2(d) draws the list of "obliged parties" widely: banking, insurance, private pension, capital markets, lending and other financial services; post and transport; games of chance and betting; dealers and intermediaries in foreign exchange, immovables, precious stones and metals, jewellery, vehicles, construction machinery, historical artefacts, works of art and antiques; notaries; sports clubs; free-practising lawyers within defined transactional limits; and other fields designated by presidential decision — the route by which crypto asset service providers were brought in.
For a foreign investor structuring a Turkish subsidiary or joint venture, the first question is therefore not "what does our AML programme have to look like" but "are we an obliged party at all". A holding company, a manufacturer or a services business is not one merely because it is foreign-owned or because the sums are large. A company that deals in or brokers immovables, vehicles, precious metals or art, or that provides a financial service, is. Getting that answer wrong in either direction is expensive: one way you build a compliance function you never needed, the other way you accrue fines per breach with an eight-year window in which they can still be imposed (Article 13(6)).
MASAK Compliance Obligations for Foreign Investors in 2026
Customer Due Diligence (CDD) and Beneficial Ownership
Article 5 of the Measures Regulation sets out when identity must be established, and the thresholds are not the ones usually quoted online. Identification is required regardless of amount when a permanent business relationship is set up, when a suspicious transaction report is called for, and whenever there is doubt about the adequacy or accuracy of identity information already held. It is required by amount when a transaction, or linked transactions taken together, reach TRY 185,000 — TRY 15,000 for crypto asset service providers — and when an electronic transfer or a crypto asset transfer reaches TRY 15,000. Identification has to be completed before the relationship is established or the transaction carried out, not afterwards.
Beneficial ownership is dealt with separately in Article 17/A, and the test is more than twenty-five per cent, not twenty-five or more. On a permanent business relationship with a company registered in the trade registry, the obliged party identifies the natural person shareholders holding more than 25%. If there is no such shareholder, or there is reason to doubt that the shareholder is the real beneficiary, the search moves to whoever ultimately controls the company; and if even that cannot be established, the most senior executive on the trade registry record is treated as the beneficial owner. Identity information obtained on foreign corporate shareholders may be confirmed through the open records of the chamber-of-commerce equivalent or other official registers in the relevant country. For offshore holding structures, layered SPVs and nominee arrangements, this is where the file usually stalls — and it is worth mapping the chain before the bank asks, not after.
Suspicious Transaction Reports (STRs) and Transfer Thresholds
The single most common misconception about the Turkish regime is that suspicious transaction reporting has a monetary floor. It does not. Article 4 of Law No. 5549 requires a report wherever there is any information, suspicion or ground for suspicion that the property involved in a transaction — carried out or merely attempted — has been obtained unlawfully or is being used for unlawful purposes, and Article 27(2) of the Measures Regulation states in terms that suspicious transactions are reported regardless of amount. The report goes in within ten business days of the date the suspicion arose (Article 28(2)); where fresh information emerges later, a supplementary form follows without delay (Article 28(3)).
Two consequences follow that foreign investors tend not to expect. First, the reporting is secret and stays secret: Article 4(2) of the Law and Article 29 of the Regulation forbid the obliged party from telling anyone — including the customer and including its own head office abroad — that a report has been or will be made. If your Turkish bank stops explaining, that may be why, and pressing it puts the individual banker at risk of the criminal penalty in Article 14. Second, the person who does report is protected: Article 10 of the Law and Article 29(4) of the Regulation exclude civil and criminal liability for those who comply with the duty.
What does turn on amount is the information that must travel with a transfer. Under Article 24 of the Measures Regulation, domestic and cross-border electronic transfer messages of TRY 15,000 or more must carry the sender's name or title, account or reference number, and at least one identifying detail such as address, date of birth, customer, national, passport or tax number — and that information must be verified. Below TRY 15,000 the name and account number still travel, but need not be verified. A receiving institution that gets an incomplete message must return the transfer or have the gaps filled, and persistent offenders can be cut off. Article 24/A imposes the matching rules on crypto asset transfers, including transfers to and from unhosted wallets, with effect from the amendments of 25 December 2024 — the genuinely recent development in this area.
Compliance Officer Appointment and Internal Controls
Not every obliged party has to build a compliance programme, and this is where a good deal of bad advice is sold to foreign companies. Article 4 of the Compliance Programme Regulation lists who must: banks other than the central bank and development and investment banks; capital markets brokerages; insurance and pension companies; the PTT for its banking activity; group A authorised foreign exchange institutions; financing, factoring and leasing companies; portfolio management companies; precious metals intermediaries; electronic money institutions; payment institutions (with narrow carve-outs); and, added on 25 December 2024, crypto asset service providers. A financial group forms a programme at group level, and that does not relieve each member of forming its own. The compliance officer is appointed within thirty days of obtaining the operating licence (Article 16(1)). Separately, Article 29 requires a second list of obliged parties to appoint a compliance officer within thirty days of obtaining their licence without building a full programme: among them card issuers other than banks, group B authorised foreign exchange institutions, reinsurers, asset management companies, cargo companies, clearing and custody institutions and, since 25 December 2024, medium, large and very large e-commerce intermediary service providers and savings finance companies.
Where the duty does apply, Article 5 defines what the programme must contain — institutional policy and procedures, risk management, monitoring and control, appointment of a compliance officer and formation of a compliance unit, training, and internal audit — and Article 6 places ultimate responsibility on the board of directors, which may delegate to one or more board members resident in Türkiye without shedding its own responsibility. The measures are reviewed at least every two years.
The sanction for getting this wrong is not immediate, and the sequence matters. Under Article 13(2) of Law No. 5549 the Presidency first issues a written warning with a period of not less than thirty days. Only if the deficiencies are still not made good does a fine of TRY 500,000 follow — the statutory base figure, increased annually under Article 28. With that fine comes a second warning and a further period of not less than sixty days; failure again brings a fine of twice the first; and if thirty days after that notice the deficiencies remain, the matter is referred to the supervising authority for suspension, restriction or withdrawal of the operating licence. The responsible board member, or failing that the senior executive, is personally liable for a quarter of the fine imposed on the institution (Article 13(3)).
Where the personal exposure actually sits
Foreign investors read the AML chapter as a corporate compliance topic. Three provisions of Law No. 5549 make it a personal one, and none of them depends on being an obliged party.
Not saying whose money it is. Article 15 makes it an offence, punishable by six months to one year's imprisonment or a judicial fine of up to 5,000 days, to carry out a transaction requiring identification in your own name but on someone else's account without first telling the obliged party, in writing, whose account you are acting on. Nominee arrangements that are perfectly ordinary in other jurisdictions run straight into this. If a Turkish account, share purchase or property transfer is being made for a third party, the declaration has to be made in writing and before the transaction.
Refusing information, destroying records, tipping off. Article 14 attaches one to three years' imprisonment and a judicial fine of up to 5,000 days to breaches of the tipping-off prohibition in Article 4(2), of the duty to give information and documents in Article 7, and of the eight-year retention duty in Article 8. Special statutory confidentiality is no answer: Article 7(2) removes it, subject to the rights of the defence.
Cash at the border. Article 16 requires travellers carrying Turkish currency, foreign currency or instruments of payment in or out of the country to give a full and accurate explanation if customs asks. If no explanation is given, or a false or misleading one is, the values are taken into custody and a fine of one tenth of the amount carried — or of the difference between the amount carried and the amount declared — is imposed, and the matter goes to MASAK as suspicious. This is the provision that catches ordinary travellers with no criminal purpose whatever, and what follows at the gate — the finding protocol, the MASAK check and the fifteen-day objection — is set out in our guide to money held at Istanbul Airport customs.
As to MASAK's own powers, the distinction between suspending a transaction and seizing an asset matters. Under Article 19/A the Minister — on the Presidency's assessment, and with the power delegable to a deputy minister — may suspend a transaction, or refuse to let it go through, for seven business days, to confirm the suspicion, analyse the transaction or pass the analysis to the competent authorities. It is a pause on a transaction, not an open-ended freeze of an account, and an obliged party that carries out a suspended transaction anyway is fined the amount of the transaction, with a floor of TRY 50,000. Taking the assets themselves requires the criminal route: Article 17 allows seizure under Article 128 of the Code of Criminal Procedure where there is strong suspicion of laundering or terrorist financing, and a prosecutor's seizure in urgent cases must go to a judge within twenty-four hours, with the judge deciding within a further twenty-four.
| Duty | Who it binds | Trigger | Consequence of breach |
|---|---|---|---|
| Customer identification (Law Art. 3; Regulation Art. 5) | All obliged parties | Permanent business relationship, or TRY 185,000 in single or linked transactions, or TRY 15,000 for electronic and crypto transfers | Administrative fine from a TRY 30,000 base, doubled and at least 5% of the transaction for financial institutions (Art. 13(1)) |
| Suspicious transaction report (Law Art. 4; Regulation Arts. 27–28) | All obliged parties | Any suspicion, regardless of amount; report within 10 business days | Administrative fine from a TRY 50,000 base; tipping off is a criminal offence under Art. 14 |
| Compliance programme and compliance officer | Programme and officer: the financial-sector parties listed in Art. 4 of the Compliance Programme Regulation; officer only: the parties listed in Art. 29 | Compliance officer within 30 days of obtaining the operating licence (Regulation Arts. 16(1) and 29(1)) | Written warning of at least 30 days first; then TRY 500,000, then double, then licence measures (Art. 13(2)); responsible director pays one quarter (Art. 13(3)) |
| Record retention (Law Art. 8) | All obliged parties | 8 years from the document date, last entry, or last transaction | 1 to 3 years' imprisonment and a judicial fine of up to 5,000 days (Art. 14) |
| Declaring that you act for another (Law Art. 15) | Any person, including foreign individuals | Any transaction requiring identification made on another's account | 6 months to 1 year's imprisonment or a judicial fine of up to 5,000 days |
| Explanation to customs (Law Art. 16) | Any traveller | On request when carrying currency or payment instruments across the border | Values taken into custody; fine of one tenth of the amount or of the undeclared difference |
All the fixed figures above are statutory base amounts. Article 28 of Law No. 5549 increases them at the start of each year by the revaluation rate determined under the Tax Procedure Law, so the figure that applies to a breach is the one published for the year in which the breach occurred. Fines cannot be imposed once eight years have passed since the breach (Article 13(6)), and since the amendment of 18 July 2024 they may be challenged before the administrative courts (Article 13(7)).
Common questions about this topic
Can a foreign investor be charged with money laundering in Turkey?
Yes — Article 282 of the Penal Code applies to anyone within Turkish jurisdiction, whatever their nationality, and the defendant need not have committed the predicate offence. But it is not a negligence offence. Article 282(1) requires the purpose of concealing the unlawful source or of creating the impression of lawful acquisition, and Article 282(2) requires knowledge that the property is what it is. Prosecutions therefore turn on what the investor knew and what the file shows, which is why contemporaneous due diligence records matter more than any policy document.
What is MASAK and what authority does it have over foreign companies?
MASAK (Mali Suçları Araştırma Kurulu) is Türkiye's financial intelligence unit, under the Ministry of Treasury and Finance. Compliance is audited through the inspectors listed in Article 2(e) of Law No. 5549, who may demand any information, document or statutory book and question those concerned (Article 11). On the Presidency's assessment the Minister may suspend a transaction for seven business days under Article 19/A. Information may be shared with foreign counterpart units, and Article 22(3) provides that doing so is not a disclosure of secrets. A foreign-owned entity is subject to all of this if, and only if, it is an obliged party under Article 2(d).
What are the STR filing obligations for businesses in Turkey?
There is no threshold. Article 27(2) of the Measures Regulation requires suspicious transactions to be reported regardless of amount, and Article 4 of Law No. 5549 sets the test as any information, suspicion or ground for suspicion that the property was unlawfully obtained or is being unlawfully used — including for transactions that were only attempted. The report goes in within ten business days of the date the suspicion arose (Article 28(2)). Failure to report attracts an administrative fine from a base of TRY 50,000, which Article 28 increases annually, doubled and subject to a 5% floor for financial institutions.
Does Turkey cooperate with international AML investigations?
Yes. Law No. 5549 provides for it directly: Article 22(3) states that giving information to counterpart institutions in other countries is not a disclosure of secrets, and Article 19/A(2) allows the suspension power to be used on the reasoned request of a foreign counterpart, on a reciprocal basis, where the Presidency also sees a link to laundering or terrorist financing. Article 18 requires prosecutors and courts to send MASAK a copy of every non-prosecution decision, indictment, judgment and seizure order in laundering and terrorist financing matters.
What happens if a company fails to appoint a compliance officer?
First, check whether the duty applies at all: the duty falls on the financial-sector parties listed in Article 4 of the Compliance Programme Regulation and on the further parties listed in Article 29 (among them cargo companies and medium, large and very large e-commerce intermediary service providers), and an ordinary foreign-owned trading or holding company is not among them. Where it does apply, the sanction is staged rather than immediate. Article 13(2) of Law No. 5549 requires a written warning with a period of at least thirty days; if the deficiency is not then cured, a fine of TRY 500,000 (base figure, increased annually) follows with a further warning of at least sixty days; failure again brings double that fine; and thirty days after that the supervising authority is asked to suspend, restrict or withdraw the licence. The responsible board member or senior executive is personally liable for a quarter of the fine.
Can MASAK freeze a foreign investor's bank accounts in Turkey?
Not in the way the question assumes. What Law No. 5549 gives the administration is narrower: under Article 19/A the Minister may suspend a specific transaction, or refuse to allow it to go through, for seven business days — a pause on a transaction rather than a freeze of an account, and not extendable by that route. Taking or blocking the assets themselves requires the criminal process: Article 17 allows seizure under Article 128 of the Code of Criminal Procedure where there is strong suspicion, and where a prosecutor orders it in an urgent case the order must go to a judge within twenty-four hours and the judge must decide within a further twenty-four; if the judge does not approve it, the prosecutor's order lapses. Asset freezing in terrorist financing matters is governed separately by Law No. 6415.
This guide is general information on Turkish law, not legal advice on your own matter. Rules and practice change; check the position before you act.