Why should you read this guide?

When money laundering is mentioned, most executives think of banks, jewellers or major criminal organisations. Yet ordinary companies engaged in genuine business activities can also be used as vehicles in laundering schemes. A supplier invoice, money introduced by a shareholder as a “loan”, or an advance received from abroad can place your company, without your knowledge, in the middle of a risky transaction.

In such a case, managers, shareholders or employees who knowingly participate in the process may face personal criminal liability. The company’s banking relationships and commercial reputation may also be adversely affected.

Do not confuse these three concepts

1. What is money laundering?

Money laundering is the concealment of the origin of assets derived from crime and giving them the appearance of legitimate income. The process generally takes place in three stages:

Figure 1. The three stages of money laundering

Company transactions may also be used as instruments in the second and third stages: invoices that do not reflect genuine transactions, shareholder current accounts, capital increases and foreign trade are typical examples.

2. How can your company be used as a “vehicle”?

The situations below are examples frequently encountered in practice. None of them is a crime on its own, but each warrants further scrutiny.

3. Eight warning signs

Ensure that your sales, purchasing and finance teams inform management when they encounter the following situations:

Figure 2. Warning signs management should know — examples only; none constitutes a crime or suspicion on its own

4. Who may be liable, and why?

Criminal liability is personal (Turkish Penal Code Art. 20). Everyone is responsible only to the extent of their own act and intent; title or position alone does not create liability. The table below shows which conduct may give rise to liability for whom.

Which conduct may create liability for whom?

Other important criminal provisions

5. Is your sector an “obliged party”?

Some sectors are directly subject to obligations such as customer identification and suspicious transaction reporting. In these sectors, breaches may result in administrative monetary penalties of varying amounts depending on the type of breach and category of obliged party, and some breaches may also lead to criminal penalties. For example, for non-financial obliged parties, the 2026 penalty for each breach of the customer due diligence obligation is TRY 284,449.

This table is a summary; for scope and thresholds, the current text of Article 4 of the Regulation on Measures should be taken as the basis.

6. What changed in October 2026?

With the amendment published in the Official Gazette dated 07.10.2026, the thresholds at which banks and other obliged parties must carry out identification procedures were doubled:

Figure 3. Identification thresholds

• For general transactions, the threshold increased from TRY 185,000 to TRY 370,000.
• For wire transfers / EFT and crypto-asset transfers, the threshold increased from TRY 15,000 to TRY 30,000.
• When banks authenticate internet and mobile transactions using one-time SMS codes, they may, subject to certain conditions, dispense with obtaining a signature specimen.

In 2026, companies transporting cash and valuables were also added to the list of obliged parties (February). MASAK also began publishing UN sanctions lists on its website (September).

7. Sanctions lists and crypto assets

Sanctions lists

Under UN Security Council resolutions and Türkiye’s decisions concerning the financing of terrorism and weapons of mass destruction, the assets of certain persons and entities may be frozen. Failure to comply with an asset-freezing decision and knowingly providing funds to listed persons are criminal offences (Law No. 6415 Art. 15; Law No. 7262 Art. 5). The scope of prohibited transactions depends on the relevant decision. For companies engaged in foreign trade, checking new customers and suppliers against sanctions lists is an important good practice.

Figure 4. Sanctions-list screening for a new business partner (good practice)

Crypto assets

• If the company intends to acquire crypto assets for investment purposes using company funds, the service provider’s authorisation should be verified through the official announcements of the Capital Markets Board of Türkiye (CMB). Inclusion in the CMB list of operating entities does not, by itself, mean that the entity is authorised.
• Such transactions should be subject to a board resolution and all records should be retained (good practice).
• Crypto-funded capital or shareholder loans coming from a “shareholder’s wallet” should not be accepted unless the source is documented (good practice).

8. Why is your bank asking questions?

Banks are required to know their customers, monitor transactions and report transactions they consider suspicious to MASAK. A question such as “What is the purpose of this payment?” is an ordinary part of that obligation and does not, by itself, mean that a suspicion exists. Banks’ internal policies may also go beyond the statutory minimum requirements.

Possible situations and how to prepare

9. Management’s 10-step checklist

For companies that are not obliged parties, this list does not constitute a statutory requirement; it consists of risk-reducing good-practice recommendations. You can review it at your next management meeting; every “No” answer points to an area for improvement.

Principal Legal and Regulatory References