Introduction: AML and KYC Compliance for Fintech Companies in Turkey

Anti-money laundering (“AML”) and Know Your Customer (“KYC”) compliance have become central components of financial technology regulation in Türkiye.

A fintech company may have an innovative product, sophisticated payment architecture and the appropriate regulatory licence, but this does not remove its obligations to identify its customers, understand who ultimately controls corporate customers, monitor transactions and report suspicious activity.

Indeed, regulatory developments between 2024 and 2026 have strengthened the importance of AML compliance for payment institutions, electronic money institutions, digital financial businesses and particularly crypto asset service providers.

The principal authority responsible for administering Türkiye’s anti-money laundering framework is the Financial Crimes Investigation Board (“MASAK”), operating under the Ministry of Treasury and Finance.

The central statute is Law No. 5549 on Prevention of Laundering Proceeds of Crime.

Article 3 of Law No. 5549 requires obligated parties to identify persons conducting transactions and persons on whose behalf or account transactions are conducted before the relevant transaction, within the framework of customer due diligence rules. Article 4 separately requires suspicious transactions to be reported to MASAK.

However, there is an important point for fintech founders:

Not every company calling itself a “fintech company” is automatically subject to exactly the same MASAK obligations.

The legal position depends on the regulated activity.

A technology company providing software to a bank may be treated differently from:

• a payment institution;
• an electronic money institution;
• a bank;
• a financing company;
• a crypto asset service provider;
• another entity classified as an obligated party under Turkish AML legislation.

The first step in any AML compliance programme for a fintech company in Turkey is therefore determining the precise regulatory status of the business.

1. What Is AML Compliance?

AML refers to legal and operational measures designed to prevent the financial system from being used to disguise, transfer or legitimise proceeds generated through criminal activity.

Modern AML regulation also interacts closely with rules designed to combat:

• terrorist financing;
• proliferation financing;
• organised crime;
• fraud;
• corruption;
• sanctions evasion;
• illicit financial networks.

AML compliance is therefore broader than checking a customer’s identity document when an account is opened.

A functioning AML framework generally involves:

• customer identification;
• customer due diligence;
• beneficial ownership analysis;
• customer risk classification;
• transaction monitoring;
• enhanced due diligence;
• suspicious transaction reporting;
• record retention;
• sanctions controls;
• internal policies;
• compliance officers;
• employee training;
• internal audit.

MASAK describes customer due diligence as a collection of measures through which obligated entities obtain sufficient information regarding customers and their activities. These measures include identity verification but extend substantially beyond it.

2. What Is KYC?

Know Your Customer (“KYC”) is one of the fundamental components of the broader AML framework.

KYC seeks to answer several basic questions:

Who is the customer?

Is the customer acting on their own behalf?

Who is the ultimate beneficial owner?

Why does the customer want to use the relevant financial service?

Does the customer’s activity correspond with the expected purpose of the business relationship?

Is the customer’s transaction behaviour consistent with the known risk profile?

KYC is therefore not simply an identity-document collection exercise.

A compliant fintech should generally be capable of understanding both:

the customer’s identity, and

the nature and purpose of the customer relationship.

This becomes particularly important in digital financial services where the institution may never physically meet the customer.

3. Main AML Legislation Applicable to Turkish Fintech Companies

The principal legal instruments include:

Law No. 5549 on Prevention of Laundering Proceeds of Crime;

the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism;

the Regulation on Compliance Programmes Regarding Obligations on Prevention of Laundering Proceeds of Crime and Financing of Terrorism;

MASAK General Communiqués;

sector-specific Suspicious Transaction Reporting Guides;

and specialised regulations concerning remote identification, crypto transfers and enhanced measures.

MASAK maintains the applicable AML regulations and sector guidance within its official regulatory database.

Fintech companies should therefore avoid treating Law No. 5549 as the only source of their AML obligations.

Most operational requirements are detailed in secondary regulations and MASAK guidance.

4. Which Fintech Companies Are Subject to MASAK Obligations?

The answer depends on the type of financial service.

Important regulated fintech-sector entities include:

• banks;
• electronic money institutions;
• payment institutions;
• crypto asset service providers;
• certain capital markets institutions;
• financing and other financial institutions.

Payment institutions and electronic money institutions are among the categories subject to Turkish AML rules.

The Compliance Programme Regulation specifically requires electronic money institutions and most payment institutions to establish a formal compliance programme. Certain payment institutions exclusively providing specified limited activities, including particular account information, payment initiation or bill-payment services, may fall within exceptions to that specific compliance-programme obligation, although other AML obligations may continue to apply.

Crypto asset service providers were expressly added to the compliance-programme framework through amendments published on 25 December 2024.

This distinction is important.

A fintech company should ask two separate questions:

1. Is the company an obligated party under AML legislation?
2. Is it also required to establish the full institutional compliance programme specified by the Compliance Programme Regulation?

The answers may not always be identical.

5. Customer Identification Requirement

Article 3 of Law No. 5549 contains the fundamental customer-identification obligation.

An obligated entity must identify persons conducting transactions and persons for whom or on whose account transactions are being conducted before the transaction, where the relevant customer due diligence requirements apply.

The Measures Regulation then provides detailed requirements concerning:

• natural persons;
• Turkish legal entities;
• foreign legal entities;
• associations;
• foundations;
• representatives;
• persons acting on behalf of others;
• beneficial owners.

Accordingly, a fintech onboarding flow should not merely ask the customer’s name and email address.

The amount and type of information required depend on the nature of the customer and relationship.

6. When Is Customer Identification Required?

Customer identification is particularly important when establishing a continuous business relationship.

Opening a payment account, electronic money account or ongoing crypto account will generally create a much stronger KYC requirement than an isolated low-risk interaction.

Turkish legislation also contains monetary thresholds for certain occasional transactions.

MASAK’s official announcement states that the general identity-verification threshold was increased in 2023 to TRY 185,000 for individual transactions or connected transactions, while the relevant threshold for certain electronic transfers was increased to TRY 15,000.

However, fintech businesses should not interpret these thresholds as permission to operate anonymous customer accounts below those values.

Where a continuous business relationship exists, where suspicion arises, where earlier identity information is doubtful, or where another regulatory requirement applies, identity verification can be necessary regardless of the ordinary transaction threshold.

Furthermore, monetary thresholds can be amended over time and should always be checked against the legislation applicable on the transaction date.

7. Connected Transactions and Structuring

Customers may attempt to remain below identification or monitoring thresholds by dividing a larger transaction into smaller transactions.

Turkish AML rules therefore consider connected transactions.

MASAK explains that connected transactions should generally be assessed by considering transactions relating to the same customer and having the same or related nature, although the determination ultimately depends on the relevant product, service and risk structure.

Fintech monitoring systems should therefore be capable of detecting transaction fragmentation.

For example, a customer completing ten smaller transactions instead of one large transaction should not automatically escape compliance controls merely because each transaction individually falls below a monetary threshold.

8. Natural Person KYC

For natural-person customers, Turkish AML requirements involve obtaining and verifying specified identification information.

Depending upon the customer and applicable procedure, relevant information may include:

• name and surname;
• date and place of birth;
• nationality;
• identity document information;
• address;
• Turkish identification number where applicable;
• contact information;
• occupation;
• signature or equivalent verification elements.

In a continuous business relationship, address information may also need to be verified through legally recognised methods.

MASAK guidance confirms that address verification can involve official residence documents, recent utility bills and other qualifying public documentation.

Digital fintech systems should be designed to collect this information in a structured and auditable format.

9. Corporate Customer KYC

Corporate customers require a more complex analysis.

A fintech onboarding a company should generally understand:

• the company’s legal name;
• registration information;
• registered office;
• tax identification information;
• authorised representatives;
• ownership structure;
• business activities;
• persons controlling the company;
• ultimate beneficial owners.

This is particularly relevant for:

• merchant acquiring;
• business wallets;
• corporate payment accounts;
• crypto institutional accounts;
• fintech B2B platforms.

Simply verifying the identity of the employee opening the account is generally insufficient.

The institution must understand the legal entity behind the customer relationship.

10. Beneficial Ownership Requirements

Identifying the ultimate beneficial owner is a central component of Turkish KYC.

A company appearing on the customer contract may merely be an intermediate legal entity.

The real question is:

Which natural person ultimately owns or controls the customer?

MASAK guidance explains that beneficial ownership analysis of legal entities involves three principal concepts:

• ownership;
• ultimate control;
• senior management where no natural person can otherwise be identified as the beneficial owner.

MASAK’s current guidance states that, for legal entities, natural persons holding more than 25% of the shares should be identified within the beneficial-ownership analysis. If ownership does not reveal the ultimate beneficial owner, control mechanisms must also be considered.

Accordingly, a fintech should not stop its KYC process merely because the immediate shareholder is another company.

The ownership chain may need to be followed through several corporate levels until the relevant natural persons are identified.

11. Beneficial Ownership Documents

There is no single document that must always be used to establish beneficial ownership.

MASAK indicates that evidence can include sources such as:

• share ledgers;
• Trade Registry Gazette records;
• trade registry documentation;
• shareholder meeting attendance lists;
• Central Securities Depository documentation;
• other reliable documents demonstrating the relevant ownership position.

Fintech companies should therefore design a flexible corporate onboarding process.

International corporate customers may require additional documents depending upon their jurisdiction and ownership structure.

12. Customer Risk Classification

Modern AML regulation is based on a risk-based approach.

Not every customer requires exactly the same level of scrutiny.

A fintech should therefore create customer risk categories.

Relevant risk factors may include:

• customer type;
• business activity;
• country of residence;
• transaction volume;
• expected transaction frequency;
• delivery channel;
• use of remote onboarding;
• crypto exposure;
• ownership complexity;
• source of funds;
• politically exposed person status;
• connection to high-risk jurisdictions.

A low-risk salaried customer using a limited domestic payment service may not require the same level of scrutiny as an opaque foreign corporate structure moving large volumes of crypto assets.

MASAK’s enhanced-measures guidance emphasises risk-based controls for high-risk customers, technological risks, risky countries and relationships involving crypto asset service providers.

13. Enhanced Due Diligence

Where higher risks are identified, ordinary KYC may be insufficient.

The institution may need to implement enhanced due diligence (“EDD”).

Enhanced measures may include:

• obtaining additional information;
• verifying source of funds;
• investigating source of wealth;
• obtaining senior-management approval;
• increasing monitoring frequency;
• restricting transaction volume;
• restricting transaction types;
• requiring the initial financial movement from another regulated institution.

The Compliance Programme Regulation expressly contemplates enhanced measures of this nature.

The essential principle is proportionality.

The higher the money laundering or terrorist-financing risk, the stronger the compliance measures should be.

14. Politically Exposed Persons

A Politically Exposed Person (“PEP”) can create heightened financial crime risk because of the person’s public position and potential exposure to corruption-related risks.

Fintech companies should therefore establish procedures for identifying relevant PEP relationships.

A compliant approach may involve:

• screening customers during onboarding;
• screening beneficial owners;
• identifying relevant connected persons where required;
• senior-management approval;
• determining source of funds;
• enhanced ongoing monitoring.

MASAK’s September 2025 crypto guidance expressly addresses measures required for relationships involving politically exposed persons.

PEP status does not automatically mean that a person is engaged in unlawful activity.

It means the relationship may require additional risk management.

15. Remote KYC for Fintech Companies

One of the most important developments in modern Turkish AML regulation is remote customer identification.

MASAK’s current regulatory framework expressly recognises remote identification methods for various financial institutions.

The official MASAK remote identification page lists the applicable legislation for:

• banks;
• payment institutions;
• electronic money institutions;
• other regulated financial institutions.

MASAK General Communiqué No. 19 provides the general framework for remote identification.

Remote KYC does not mean that regulatory standards are reduced.

The process must still provide reliable identity verification and adequate protection against:

• impersonation;
• stolen identity documents;
• synthetic identities;
• account takeover;
• technological manipulation.

16. Remote Identification for Payment and Electronic Money Institutions

Payment institutions and electronic money institutions are among the financial institutions for which remote customer identification can be implemented within the applicable regulatory framework.

MASAK’s guidance confirms that the remote-identification methods used by payment and electronic money institutions operate together with the general principles contained in MASAK General Communiqué No. 19 and relevant sector-specific regulations.

A compliant fintech onboarding system should therefore coordinate:

• identity-document verification;
• customer authentication;
• technical security;
• sector rules;
• MASAK requirements.

Remote onboarding should be designed jointly by the legal, compliance, information-security and product teams.

17. Remote Identification for Crypto Asset Service Providers

Türkiye introduced a dedicated remote-identification framework for crypto asset service providers in 2025.

On 12 June 2025, MASAK published an amendment to General Communiqué No. 19 regulating remote customer verification for crypto asset service providers.

MASAK’s September 2025 CASP Guide subsequently incorporated remote identification into the broader crypto compliance framework.

This development is particularly important for crypto exchanges because their commercial model depends heavily on entirely digital customer acquisition.

A crypto platform should therefore ensure that its user onboarding architecture reflects the current MASAK standards rather than using an ordinary consumer-app registration process.

18. Monitoring the Customer Relationship

KYC is not completed when the customer account is opened.

Financial institutions must continue to monitor the relationship.

This means reviewing whether transactions remain consistent with:

• information obtained about the customer;
• the customer’s business;
• expected transaction behaviour;
• stated purpose of the relationship;
• customer risk classification.

Customer information should also be updated where necessary.

MASAK guidance notes that financial institutions are required to keep customer information, documentation and records current.

This principle is often referred to as ongoing customer due diligence.

A fintech should therefore avoid a system in which KYC documentation is obtained once and then ignored indefinitely.

19. Transaction Monitoring

Transaction monitoring is one of the most important operational AML requirements for fintech companies.

Monitoring systems should identify activities that deviate materially from expected customer behaviour.

Examples may include:

• sudden transaction-volume increases;
• multiple transfers to unrelated parties;
• rapid in-and-out movements of funds;
• unusual international transfers;
• repeated transactions just below internal limits;
• transactions inconsistent with customer income;
• rapid crypto deposits and withdrawals;
• use of multiple accounts or devices;
• suspicious merchant activity.

The appropriate monitoring rules will vary according to the fintech product.

A crypto exchange requires different risk scenarios from an account information provider.

A merchant acquiring company requires different monitoring from a consumer wallet.

MASAK’s sector-specific Suspicious Transaction Reporting Guides are intended to help regulated businesses design these controls according to the risks of their particular industry.

20. Suspicious Transaction Reporting

Where a fintech identifies circumstances creating knowledge, suspicion or reasonable grounds for suspicion that assets may have been obtained illegally or are connected with unlawful purposes, a Suspicious Transaction Report (“STR”) may be required.

Article 4 of Law No. 5549 establishes the statutory suspicious transaction reporting obligation.

Importantly, there is no minimum monetary threshold for suspicion.

A relatively small transaction may still require reporting if its characteristics create legitimate suspicion.

The reporting obligation can also apply to attempted transactions.

This means a fintech may need to report conduct even where the suspicious customer did not successfully complete the proposed transaction.

21. Deadline for Suspicious Transaction Reporting

Under MASAK General Communiqué No. 13, suspicious transactions must generally be reported:

within ten business days from the date on which suspicion arises.

Where delay could be harmful, the report must be made immediately.

This is a critical operational requirement.

A company whose compliance team reviews suspicious cases only once each month may therefore fail to satisfy the reporting timeline.

The institution should establish internal escalation procedures capable of rapidly moving an alert from:

operational staff → compliance review → compliance officer → MASAK reporting.

22. Suspicious Transaction Reporting Through MASAK Online

MASAK increasingly requires suspicious transaction reports to be submitted electronically.

Its current sectoral reporting framework uses the MASAK Online system.

MASAK states that sector-specific reporting guides explain the risks, typologies and suspicious transaction indicators relevant to each obligated sector, and reporting is completed electronically through the MASAK Online infrastructure.

The payment and electronic money sector has a dedicated Suspicious Transaction Reporting Guide.

MASAK updated that sector’s reporting guidance and electronic reporting infrastructure in June 2024 to better address modern financial technologies and evolving financial crime typologies.

A fintech should therefore ensure that the compliance officer has reliable access to the current reporting infrastructure.

23. Tipping-Off Is Prohibited

A customer must not be informed that a suspicious transaction report has been made.

Article 4 of Law No. 5549 prohibits obligated entities from disclosing the fact of an STR to the transaction parties or other persons, except within the legally permitted supervisory and judicial framework.

This is known internationally as the tipping-off prohibition.

Employees should therefore never tell a customer:

“Your account has been frozen because we reported you to MASAK.”

Customer communications must be carefully managed.

For this reason, internal STR information should normally be accessible only to personnel who genuinely need it for compliance purposes.

24. Transaction Postponement

Some suspicious situations require more than an STR.

Where there are serious indications that the assets involved in a transaction are connected with money laundering or terrorist financing, the regulatory framework may permit an STR to be submitted together with a request that the transaction be postponed.

MASAK General Communiqué No. 13 provides that, in qualifying cases, the obligated party may refrain from performing the transaction until the relevant decision is communicated, subject to the statutory framework. The postponement period cannot exceed seven business days from submission of the relevant report.

This is a particularly sensitive compliance area and should be handled under established internal legal procedures.

25. Compliance Programme Requirements

Certain financial institutions must establish a formal AML Compliance Programme.

The Compliance Programme Regulation specifically includes:

• electronic money institutions;
• most payment institutions;
• crypto asset service providers;
• various other financial institutions.

A formal compliance programme generally involves several interconnected functions rather than a single compliance manual.

Its structure includes areas such as:

• institutional policies and procedures;
• risk management;
• monitoring and control;
• compliance officer arrangements;
• training;
• internal audit.

A startup should therefore budget for compliance personnel and systems as part of the business model rather than treating them merely as post-licensing expenses.

26. Appointment of a Compliance Officer

For institutions falling within the full compliance-programme framework, the compliance officer plays a central role.

The compliance officer is responsible for evaluating suspicious activity and ensuring that reporting obligations are properly performed.

MASAK’s reporting rules provide that, in institutions required to appoint a compliance officer, suspicious transaction reporting is generally completed through that compliance officer.

Internal reporting procedures should therefore be documented.

Employees who encounter suspicious activity must know:

• where to report;
• what information to provide;
• how the report will be investigated;
• that the customer must not be alerted.

Oral reporting alone should not be the company’s only internal notification mechanism.

MASAK specifically requires written internal reporting procedures for institutions operating through compliance officers.

27. Employee AML Training

A compliance programme cannot function if employees do not understand it.

Training should be proportionate to the employee’s role.

Relevant subjects may include:

• customer identification;
• beneficial ownership;
• suspicious transaction indicators;
• sanctions;
• PEPs;
• internal escalation;
• tipping-off restrictions;
• fraud and money laundering typologies;
• remote onboarding risks.

Customer-support employees may notice different warning signs from engineering personnel.

For example, an engineer may identify suspicious use of multiple devices, while a customer-support employee may identify inconsistent explanations concerning source of funds.

A mature AML programme therefore uses information from across the organisation.

28. Record Retention

Turkish AML legislation imposes a substantial document-retention requirement.

Article 8 of Law No. 5549 requires obligated entities to retain relevant documents, books, records and customer-identification materials for eight years.

MASAK clarifies that:

• documents are retained from their date of preparation;
• books and records from the date of the last entry;
• customer identification documents from the date of the last transaction;
• for account relationships, the relevant period begins when the account is closed.

STR-related records and internal suspicious activity documentation are also within the retention framework.

This requirement should influence the fintech’s data architecture and document management systems.

29. AML and Data Protection Must Be Coordinated

Fintech companies must comply simultaneously with AML legislation and Law No. 6698 on the Protection of Personal Data (“KVKK”).

This sometimes creates a perceived conflict.

AML regulation requires collection and retention of substantial customer information.

KVKK requires personal data to be processed on a valid legal basis, proportionately and securely.

The correct approach is not to choose one legal regime over the other.

Instead, the company should document:

• which information is legally required under AML rules;
• the applicable data-processing legal basis;
• required retention periods;
• access restrictions;
• deletion rules after mandatory retention expires.

AML records should not automatically become general-purpose marketing databases merely because the institution lawfully collected them for compliance purposes.

30. Crypto Asset Service Providers Face Enhanced AML Requirements

Crypto asset service providers are among the fintech businesses facing the most detailed AML obligations in Türkiye.

MASAK’s September 2025 CASP Guide covers:

• customer due diligence;
• remote identification;
• enhanced measures;
• the Travel Rule;
• transfer restrictions;
• PEP relationships;
• suspicious transaction reporting;
• provision of information and documents;
• compliance programmes.

The regulation reflects the particular financial crime risks associated with:

• pseudonymous blockchain addresses;
• rapid international transfers;
• self-hosted wallets;
• privacy-enhancing technology;
• cross-border counterparties.

A crypto platform therefore requires more than conventional customer-document KYC.

Its transaction monitoring should also understand blockchain-based financial activity.

31. The Crypto Travel Rule

One of the most important modern AML requirements is the Travel Rule.

The Travel Rule generally requires specified information concerning the originator and beneficiary of a crypto transfer to accompany or be associated with the transaction.

MASAK’s current CASP Guide expressly addresses implementation of the Travel Rule.

For a crypto exchange, the compliance architecture may therefore need to determine:

• who is sending the crypto asset;
• who is receiving it;
• whether the destination belongs to another regulated CASP;
• which customer information must accompany the transfer;
• whether additional verification is required.

A system based only on copying a blockchain wallet address into a withdrawal field may therefore be insufficient for regulated operations.

32. Enhanced Measures for Crypto Businesses

Following the December 2024 regulatory amendments, crypto customer relationships are subject to heightened risk controls.

The Compliance Programme Regulation requires CASPs, in qualifying circumstances, to implement enhanced measures and appropriate transaction amount and transaction-count restrictions.

It also requires financial institutions entering business relationships with CASPs to apply enhanced measures and obtain senior-level approval for the relationship.

This provision shows the regulatory approach clearly:

Crypto activity is not prohibited, but it is treated as an area requiring stronger financial crime controls.

33. Payment and Electronic Money Institutions

Payment institutions and electronic money institutions should also build sector-specific AML systems.

MASAK’s dedicated sector guidance for payment and electronic money companies incorporates transaction and account types associated with modern fintech products and updated suspicious transaction typologies.

The sectoral reporting guide was revised specifically to better reflect developments in financial technology and evolving financial crime patterns.

Relevant risks may include:

• wallet misuse;
• mule accounts;
• rapid peer-to-peer transfers;
• merchant fraud;
• fictitious merchants;
• payment account layering;
• unusual card or terminal activity.

For this reason, generic banking scenarios should not simply be copied into a payment-company monitoring system.

34. Merchant Acquiring and Terminal Risk

Payment terminal and merchant-acquiring activities have also attracted additional AML attention.

The Compliance Programme Regulation was amended in December 2024 to introduce strengthened measures for specified terminal services provided under Law No. 6493.

The regulation requires enhanced measures when establishing relevant merchant relationships and conducting specified identification-triggering transactions.

A payment institution onboarding merchants should therefore assess not only the legal existence of the merchant, but also:

• business activity;
• expected turnover;
• transaction structure;
• ownership;
• unusual refund patterns;
• suspicious card or terminal usage.

Merchant KYC can be as important as consumer KYC.

35. Technological Risk

Technology creates both financial innovation and financial crime risk.

MASAK specifically identifies technological risk as an area requiring enhanced risk management.

Relevant risks may include:

• non-face-to-face onboarding;
• identity fraud;
• device manipulation;
• bot activity;
• synthetic identities;
• account takeovers;
• anonymisation technologies;
• rapid automated transactions.

A fintech company’s AML programme should therefore involve its technology and cybersecurity departments.

Compliance cannot operate effectively if it has no access to device data, transaction patterns or relevant fraud information.

36. High-Risk Countries

Customer risk analysis should also consider geographic exposure.

Relationships involving countries with significant deficiencies in AML/CFT controls can justify stronger measures.

MASAK’s enhanced-measures guidance specifically identifies financial relationships involving risky countries as an area requiring additional controls.

A fintech’s geographic-risk model may therefore affect:

• onboarding;
• transaction limits;
• enhanced due diligence;
• source-of-funds requirements;
• monitoring frequency.

Country risk should not necessarily be based solely on nationality.

The company should consider the actual geographic connection to the financial activity.

37. Sanctions and Asset Freezing

A mature fintech compliance programme should not be limited to classic money-laundering detection.

Businesses may also need to screen customers and transactions against legally applicable:

• terrorist-financing measures;
• asset-freezing decisions;
• proliferation-financing restrictions.

MASAK’s compliance framework integrates these issues into the broader prevention architecture.

This means sanctions and asset-freezing checks may need to occur at:

• onboarding;
• periodic customer reviews;
• payment initiation;
• beneficiary screening;
• crypto transfers.

Automated sanctions screening should also include procedures for resolving false positives.

38. When Should a Fintech Reject a Customer?

There will be situations in which sufficient customer due diligence cannot be completed.

MASAK’s KYC framework includes rules concerning refusal of transactions and termination of business relationships where legally required customer due diligence cannot be adequately performed.

Examples may include:

• refusal to provide identification information;
• unexplained ownership structure;
• inability to determine the beneficial owner;
• obviously false documentation;
• inability to verify required information.

Commercial pressure should not override these requirements.

A fintech should be prepared to reject revenue where compliance cannot be satisfied.

39. AML Compliance for Foreign Fintech Companies Entering Turkey

Foreign fintech companies should not assume that global AML policies can simply be copied into their Turkish operations.

International compliance frameworks may be useful, but Turkish operations must satisfy local requirements concerning:

• customer identification;
• beneficial ownership;
• MASAK reporting;
• reporting timelines;
• local compliance officer structures;
• record retention;
• remote identification;
• sector-specific guidance.

A foreign parent company’s compliance system may therefore require a Turkish regulatory layer.

For multinational groups, the Compliance Programme Regulation also addresses group-level compliance programmes while confirming that individual regulated financial institutions within the group remain responsible for their own compliance obligations.

40. AML Due Diligence in Fintech M&A

AML compliance is an essential component of due diligence when acquiring a Turkish fintech.

The buyer should investigate:

Customer Identification:
Were customers properly verified?

Beneficial Ownership:
Are corporate customers appropriately documented?

Compliance Officer:
Has a qualified compliance structure been established where required?

STR History:
Does the institution have functioning reporting procedures?

MASAK Reviews:
Has the company been inspected or sanctioned?

Transaction Monitoring:
Are rules appropriate to the company’s actual product?

Remote Onboarding:
Does digital customer acquisition comply with current requirements?

Record Retention:
Can required eight-year records be produced?

Crypto Travel Rule:
Where relevant, does the institution have compliant transfer infrastructure?

A deficient AML history can create liabilities that survive a change of ownership.

41. Common AML and KYC Mistakes Made by Fintech Companies

Treating KYC as Identity Verification Only

Understanding beneficial ownership and customer activity is also required.

One-Time KYC

Customer relationships require ongoing monitoring.

Using the Same Risk Score for Every Customer

The framework is risk-based.

Ignoring Connected Transactions

Splitting transactions should not defeat monitoring.

Reporting Suspicious Transactions Too Late

The general reporting deadline is ten business days after suspicion arises, with immediate reporting where delay is dangerous.

Telling the Customer About the STR

Tipping-off is prohibited.

Treating Crypto Transfers Like Ordinary Database Transfers

Travel Rule and blockchain-specific controls may apply.

Using Foreign AML Procedures Without Turkish Review

MASAK requirements need local implementation.

Deleting KYC Records Too Early

Relevant records are generally subject to an eight-year retention period.

42. Practical AML and KYC Compliance Checklist for Turkish Fintechs

Before commencing operations, a Turkish fintech should determine:

Regulatory Status

Is the company an obligated entity under Law No. 5549?

Compliance Programme

Is a formal compliance programme mandatory?

Compliance Officer

Must a compliance officer be appointed?

Customer Identification

Are onboarding procedures legally sufficient?

Corporate KYC

Can legal-entity customers and representatives be verified?

Beneficial Ownership

Can natural persons ultimately owning or controlling corporate customers be identified?

Customer Risk Assessment

Is there a documented risk-scoring methodology?

PEP Screening

Are higher-risk public-office relationships identified?

Sanctions Controls

Are applicable asset-freezing and sanctions lists checked?

Transaction Monitoring

Does monitoring reflect the company’s actual products?

STR Procedures

Can suspicious transactions be escalated and reported within statutory deadlines?

Tipping-Off

Do staff understand confidentiality requirements?

Remote KYC

Does digital onboarding comply with sector-specific rules?

Travel Rule

For crypto businesses, can originator and beneficiary information be handled?

Record Retention

Can required records be maintained for eight years?

Employee Training

Do relevant employees understand AML procedures?

Internal Audit

Is the compliance programme independently reviewed?

Frequently Asked Questions About AML and KYC Requirements in Turkey

What is the main AML law in Turkey?

The principal legislation is Law No. 5549 on Prevention of Laundering Proceeds of Crime, supported by the Measures Regulation, Compliance Programme Regulation and MASAK communiqués and guidance.

What does MASAK do?

MASAK is Türkiye’s Financial Crimes Investigation Board and administers the country’s AML and counter-terrorist-financing compliance framework.

Are fintech companies subject to MASAK?

Many regulated fintech companies are, including payment institutions, electronic money institutions and crypto asset service providers. The exact requirements depend on the business model and regulatory classification.

Do payment institutions need an AML compliance programme?

Most payment institutions must establish one, although the Compliance Programme Regulation contains exceptions for institutions exclusively providing certain specified limited payment services.

Do electronic money institutions need a compliance programme?

Yes. Electronic money institutions are expressly included among the entities required to establish an AML compliance programme.

Are crypto exchanges subject to MASAK?

Yes. Crypto asset service providers are expressly included within the compliance-programme framework and MASAK has published dedicated CASP guidance.

How long must AML records be retained in Turkey?

Relevant AML documents and records must generally be retained for eight years, calculated according to the statutory rules applicable to the relevant document or relationship.

When must a suspicious transaction be reported?

The general deadline is within ten business days after suspicion arises. Where delay is considered dangerous, the report must be submitted immediately.

Is there a minimum amount for suspicious transaction reporting?

No. Suspicion rather than transaction value is the key criterion.

Can the customer be told that an STR was filed?

No. Disclosure of the suspicious transaction report to the customer or other unauthorised parties is prohibited.

Does Turkey require beneficial ownership identification?

Yes. Obligated entities must take measures to identify the ultimate beneficial owner. In legal-entity relationships, natural persons holding more than 25% ownership are an important starting point, with control and senior-management tests applying where necessary.

Is remote KYC permitted?

Yes, for qualifying regulated institutions under the applicable sector-specific rules and MASAK General Communiqué No. 19.

Is remote KYC permitted for crypto exchanges?

Yes. Specific remote identification rules for crypto asset service providers entered into force in June 2025.

Does Turkey apply the Crypto Travel Rule?

Yes. MASAK’s current CASP guidance specifically addresses the Travel Rule and associated crypto-transfer controls.

Conclusion: Building an Effective AML and KYC Programme for Fintech Companies in Turkey

AML and KYC requirements for fintech companies in Turkey are no longer peripheral compliance matters.

They are fundamental elements of operating a regulated financial technology business.

For payment institutions, electronic money institutions, crypto asset service providers and other regulated fintech businesses, compliance begins with understanding the customer.

However, customer identification is only the first stage.

A complete AML framework requires the institution to determine:

• who the customer really is;
• whether someone else acts behind the customer;
• who ultimately owns or controls corporate customers;
• why the customer is using the service;
• whether transactions correspond with the expected customer profile;
• whether suspicious behaviour needs to be reported.

Law No. 5549 provides the statutory foundation for this framework.

Article 3 requires customer identification and customer due diligence, while Article 4 creates the suspicious transaction reporting obligation and prohibits unauthorised disclosure of STRs.

The modern Turkish framework is explicitly risk based.

This means that a fintech should not treat every customer identically.

Customers, products, countries, technologies and transaction channels presenting higher risks require stronger controls.

MASAK’s September 2025 enhanced-measures guidance specifically emphasises risks connected with high-risk customers, technology, risky jurisdictions, crypto asset service providers and payment-sector terminal activity.

The same principle applies to beneficial ownership.

A company name in the trade registry is not necessarily the true customer from an AML perspective.

Fintech businesses dealing with legal entities should establish who ultimately owns or controls the company and should maintain sufficient evidence supporting that conclusion.

For regulated fintech companies operating entirely online, remote KYC is particularly important.

Türkiye allows remote customer identification for qualifying financial institutions, including payment and electronic money institutions, under MASAK General Communiqué No. 19 and associated sectoral legislation. Crypto asset service providers became subject to dedicated remote-identification rules in June 2025.

This provides fintech companies with significant commercial flexibility, but remote onboarding should not be confused with reduced compliance.

The technology must still verify the customer reliably and control impersonation and fraud risk.

Ongoing monitoring is equally important.

A fintech cannot simply identify the customer when the account is created and then disregard subsequent behaviour.

Transaction monitoring should compare actual customer activity with the information held by the institution and identify unusual or inconsistent behaviour.

Where suspicion arises, the institution must consider whether a Suspicious Transaction Report is required.

The general reporting deadline is ten business days from the date the suspicion arises, while urgent situations require immediate reporting.

Payment and electronic money institutions should also follow MASAK’s sector-specific suspicious transaction guidance, which has been updated to reflect modern financial technology products and new financial crime typologies.

Crypto companies face additional requirements.

Following the inclusion of crypto asset service providers within the full compliance-programme regime in December 2024 and subsequent MASAK developments, Turkish crypto businesses must address issues including:

• remote KYC;
• enhanced measures;
• Travel Rule compliance;
• crypto transfer controls;
• PEPs;
• suspicious transaction reporting;
• institutional compliance programmes.

Record retention represents another important operational issue.

Fintech institutions must generally preserve relevant AML documents and records for eight years. This includes customer identification documents and, within the applicable framework, records connected with suspicious transaction assessments.

The technology architecture must therefore support long-term regulatory record keeping.

For foreign fintech investors, compliance policies adopted at group level should also be localised.

A global KYC manual designed around UK, EU or US requirements may provide a useful foundation, but it does not automatically satisfy Turkish AML law.

Turkish operations should separately incorporate:

• MASAK customer identification rules;
• local beneficial ownership procedures;
• local STR reporting;
• compliance officer structures;
• eight-year retention;
• sector-specific remote KYC;
• Turkish enhanced-measures requirements.

Ultimately, the most effective approach is to build AML into the fintech product itself.

KYC, monitoring and compliance should not exist as a manual process outside the main platform.

The customer onboarding system should prevent non-compliant accounts from being opened.

Transaction-monitoring systems should identify unusual activity.

Compliance teams should receive structured alerts.

Relevant information should be retained securely.

Suspicious transaction escalation should operate within the statutory deadline.

For businesses planning to establish or operate a payment institution, electronic money company, digital wallet, crypto exchange, crypto custody business, embedded finance platform or other regulated fintech company in Turkey, AML and KYC architecture should therefore be designed at the same time as the commercial and technological architecture.

The key principle is straightforward:

A fintech company should know not only who its customer claims to be, but who the customer actually is, why the customer is using the service and whether the customer’s financial behaviour makes sense.

Companies capable of answering these questions through reliable technology, documented policies and effective human oversight will be far better positioned to satisfy Türkiye’s increasingly sophisticated financial crime compliance framework.

Legal Disclaimer: This publication provides general information concerning AML and KYC requirements applicable to fintech businesses in Türkiye as of July 2026. It does not constitute legal advice. MASAK thresholds, reporting requirements, sector classifications and customer-identification procedures may change. Each fintech company’s obligations should be assessed individually according to its regulated activities, customer profile, transaction structure and legislation in force at the relevant time.