Türkiye KYC, KYB & AML compliance checklist
A practical, source-linked checklist for implementing KYC, KYB and AML requirements in Türkiye.
- Last reviewed
- Last reviewed:
- Version
- Version 1.0
Portable implementation guide
Get the PDF checklist
11 control areas · 38 implementation checks
Last reviewed: 8 October 2026 · Version 1.0
Download the checklistDirect answer
What does the Türkiye compliance checklist cover?
The Türkiye checklist translates primary KYC, KYB and AML rules into 11 control areas and 38 implementation checks. It identifies the relevant authorities, customer and beneficial-owner controls, reporting duties, recordkeeping expectations and evidence teams should retain.
Key regulatory facts
- Primary AML law
- Law No. 5549
- FIU
- Financial Crimes Investigation Board (MASAK)
- STR timing
- Within 10 business days from suspicion; immediately where delay is prejudicial
- Records
- 8 years from the applicable document, record or transaction trigger
- Beneficial ownership
- Identify the natural person who ultimately owns or controls; apply current Measures Regulation tests
- Sanctions
- Laws No. 6415 and 7262; Presidential and Official Gazette decisions
- Privacy law
- Personal Data Protection Law No. 6698, as amended
- FATF public lists
- Not listed at 19 June 2026
Implementation detail
Türkiye compliance requirements and actions
Open each control area to review the requirement, recommended implementation action, evidence to retain and the primary-source citation used by the research team.
01Scope, authorities, and licensingClassify the activity, Türkiye nexus and competent supervisor before launch.3 items+
Determine whether each activity is an obliged-party activity.
- Implementation action
- Map services and delivery models to the categories in Law 5549 and the current Measures Regulation, including financial institutions, designated businesses and professions and crypto-asset service providers.
- Evidence to retain
- Perimeter memo, service map and authority confirmation.
- Primary citation
- Law 5549 article 2(d); Measures Regulation article 4
Obtain each activity-specific authorisation before operating.
- Implementation action
- Classify banking, payments, electronic money, money transfer, capital markets, insurance, exchange and crypto services under the live sector regime.
- Evidence to retain
- Licence matrix, approvals and conditions.
- Primary citation
- Applicable BRSA, CBRT, CMB and Treasury legislation
Use current Turkish legislation and MASAK publications.
- Implementation action
- Track Official Gazette amendments, MASAK communiqués, sector guides and supervisory decisions; treat English translations as aids only.
- Evidence to retain
- Source register, translations and change log.
- Primary citation
- Law 5549 and implementing legislation
02Governance and risk assessmentControls must be risk-based, documented and effective at entity and financial-group level.3 items+
Maintain an enterprise ML/TF/PF risk assessment.
- Implementation action
- Assess customers, countries, products, delivery channels, transactions, new technologies and group exposure using current national and sector risk information.
- Evidence to retain
- Methodology, assessment, approval and updates.
- Primary citation
- Law 5549 article 5; Compliance Programme Regulation
Operate the required compliance programme.
- Implementation action
- Where applicable, appoint an authorised compliance officer and maintain policies, risk management, monitoring, training, internal control and audit.
- Evidence to retain
- Appointment, programme, reports, testing and remediation.
- Primary citation
- Law 5549 article 5; Compliance Programme Regulation
Apply group-wide controls without weakening local duties.
- Implementation action
- Govern permitted intra-group CDD, account and transaction information sharing and apply stricter local restrictions where required.
- Evidence to retain
- Group standard, legal analysis and access controls.
- Primary citation
- Law 5549 article 5(2)
03Natural-person identificationIdentify and verify the customer, beneficiary and representative at every applicable trigger.4 items+
Complete CDD before the relevant transaction or relationship.
- Implementation action
- Identify and verify the person conducting the transaction and the person on whose behalf or for whose benefit it is conducted using reliable evidence.
- Evidence to retain
- Identity attributes, document provenance and verification result.
- Primary citation
- Law 5549 article 3; Measures Regulation
Apply the current trigger and monetary threshold rules.
- Implementation action
- Configure relationship, suspicious-transaction and occasional-transaction triggers from the current Measures Regulation and MASAK amendments; do not hard-code an undated lira amount.
- Evidence to retain
- Dated threshold register, configuration and change tests.
- Primary citation
- Law 5549 article 3(2); Measures Regulation articles 5-6
Verify representatives and authority.
- Implementation action
- Identify the representative and represented person and authenticate the mandate before accepting instructions.
- Evidence to retain
- Representative KYC, mandate and validation.
- Primary citation
- Measures Regulation customer-identification provisions
Do not establish or continue an inadequately identified relationship.
- Implementation action
- Apply the current prohibition and termination rules where CDD cannot be completed and assess whether an STR is required without tipping off.
- Evidence to retain
- Failure reason, restriction and STR assessment.
- Primary citation
- Measures Regulation article 22
04KYB and beneficial ownershipVerify legal existence, authority, ownership and ultimate control.4 items+
Verify the legal person and authorised persons.
- Implementation action
- Obtain current trade-registry, constitutional, tax, activity, director and signatory evidence and validate authority through the live registry process.
- Evidence to retain
- MERSIS or registry extract, documents and discrepancy log.
- Primary citation
- Measures Regulation; Turkish Commercial Code; Trade Registry Regulation
Identify the natural person who ultimately owns or controls.
- Implementation action
- Trace direct, indirect, layered, nominee and other control arrangements and apply the current ownership, control and senior-managing-official fallback sequence.
- Evidence to retain
- Ownership chart, calculations, control rationale and verified identities.
- Primary citation
- Measures Regulation article 17/A
Do not treat a percentage as a safe harbour.
- Implementation action
- Use the current regulatory ownership indicator while still testing control by other means and applying the prescribed fallback where no natural person is identified.
- Evidence to retain
- Criterion-by-criterion analysis and escalation.
- Primary citation
- Measures Regulation article 17/A
Reconcile AML CDD with registry and tax beneficial-owner duties.
- Implementation action
- Capture the applicable MERSIS, trade-registry and Revenue Administration declarations separately from the AML identification conclusion.
- Evidence to retain
- Registry evidence, declaration receipts and discrepancy decisions.
- Primary citation
- Tax Procedure Law General Communiqué 529; registry rules
05PEPs, EDD, and remote onboardingApply enhanced controls to PEPs and higher-risk relationships.3 items+
Identify domestic and foreign PEP exposure.
- Implementation action
- Screen customers, beneficial owners, family members and close associates and apply the approval, source-of-wealth, source-of-funds and monitoring measures required by current MASAK rules.
- Evidence to retain
- Screening, classification, approval and corroboration.
- Primary citation
- MASAK General Communiqué No. 21; Measures Regulation
Apply enhanced measures to higher risk.
- Implementation action
- Obtain additional identity, purpose, ownership, wealth and funds evidence; increase review and monitoring intensity and document the rationale.
- Evidence to retain
- Risk trigger, enhanced CDD and approval.
- Primary citation
- Measures Regulation enhanced-measures provisions
Control remote identification by sector.
- Implementation action
- Use only a method permitted by the competent supervisor and retain liveness, authentication, fraud, consent and exception evidence.
- Evidence to retain
- Method assessment, session evidence and exceptions.
- Primary citation
- Applicable BRSA, CBRT, CMB and insurance remote-identification rules
06Monitoring and suspicious reportingOngoing scrutiny supports timely reporting to MASAK.4 items+
Monitor and refresh on a risk basis.
- Implementation action
- Compare activity with purpose, expected behaviour, customer risk and source of funds; update CDD when events, material changes or doubts arise.
- Evidence to retain
- Scenarios, alerts, reviews and refresh history.
- Primary citation
- Measures Regulation ongoing-monitoring provisions
Escalate suspicion without waiting for proof.
- Implementation action
- Assess completed and attempted transactions promptly and record the information, suspicion or reasonable grounds and formation time.
- Evidence to retain
- Case chronology, facts and decision.
- Primary citation
- Law 5549 article 4
Report to MASAK within the statutory period.
- Implementation action
- Submit through the current MASAK Online route within 10 business days from formation of suspicion and immediately where delay is prejudicial.
- Evidence to retain
- Suspicion timestamp, submission and acknowledgement.
- Primary citation
- MASAK General Communiqué No. 13 article 5
Prevent tipping off and protect report information.
- Implementation action
- Restrict access, communications and disclosure to the statutory exceptions.
- Evidence to retain
- Access logs, scripts, training and incidents.
- Primary citation
- Law 5549 article 4(2)
07Payments, wires, thresholds, and crypto-assetsSeparate CDD triggers, periodic reporting and activity-specific licensing.4 items+
Carry and screen required transfer information.
- Implementation action
- Apply current originator and beneficiary fields, missing-data procedures, sanctions checks and sector travel-rule requirements.
- Evidence to retain
- Field matrix, samples and repair queue.
- Primary citation
- Measures Regulation wire-transfer provisions; MASAK crypto guidance
Apply current periodic-reporting rules only to covered activity.
- Implementation action
- Maintain a dated matrix of reportable transaction types, amounts, periods and exemptions issued by the Ministry; do not present a CDD threshold as a universal reporting threshold.
- Evidence to retain
- Rule register, reports, receipts and reconciliation.
- Primary citation
- Law 5549 article 6; current MASAK reporting rules
Obtain payment and electronic-money authorisation.
- Implementation action
- Map account, wallet, acquiring, transfer, agent and outsourcing features to Law 6493 and current CBRT secondary rules.
- Evidence to retain
- Product memo, authorisation and control tests.
- Primary citation
- Law 6493; CBRT payment-services regulations
Obtain crypto-asset authorisation and apply current AML rules.
- Implementation action
- Map trading, transfer, custody and key-management services to Capital Markets Law articles 35/B-35/C, CMB communiqués III-35/B.1 and III-35/B.2, and MASAK travel-rule and STR guidance.
- Evidence to retain
- CMB status, permissions, product map and AML tests.
- Primary citation
- Law 6362 as amended by Law 7518; CMB communiqués III-35/B.1 and III-35/B.2
08Targeted financial sanctionsUse current UN-derived and domestic freezing decisions.3 items+
Screen designations, ownership and control.
- Implementation action
- Screen relevant parties at onboarding, transactions and list updates against current UN and Türkiye decisions and resolve potential indirect control.
- Evidence to retain
- List versions, screening logs and match decisions.
- Primary citation
- Laws 6415 and 7262
Implement published freezes without delay.
- Implementation action
- Block prohibited disposal or availability when a Presidential asset-freezing decision is published and notify or coordinate through the prescribed MASAK route.
- Evidence to retain
- Decision, restriction timestamp and notification.
- Primary citation
- Law 7262 article 3; Law 6415 and implementing regulation
Use licences, exemptions, delisting or release only under written authority.
- Implementation action
- Apply the designation-specific procedure and preserve every condition and approval.
- Evidence to retain
- Legal analysis, permission and release record.
- Primary citation
- Law 6415; implementing regulations
09Records and regulator accessRetention triggers are record-specific.3 items+
Retain AML documents and records for eight years.
- Implementation action
- Run the period from the document date, last record date or last transaction date as applicable and preserve reconstructable evidence.
- Evidence to retain
- Schedule, trigger, samples and retrieval test.
- Primary citation
- Law 5549 article 8
Preserve STR, CDD, monitoring and compliance evidence.
- Implementation action
- Keep decisions, supporting material, acknowledgements, training, controls and audits subject to statutory and lawful-hold requirements.
- Evidence to retain
- Case files, schedule and legal holds.
- Primary citation
- Law 5549 articles 4, 5 and 8
Produce complete records to competent authorities.
- Implementation action
- Maintain controlled access and an auditable process for MASAK and supervisory information requests.
- Evidence to retain
- Access matrix, production log and integrity checks.
- Primary citation
- Law 5549 articles 7-8
10Privacy, biometrics, breaches, and transfersApply Law 6698 as amended and current Personal Data Protection Board instruments.4 items+
Map processing conditions, notices and data-subject rights.
- Implementation action
- Inventory personal and special-category data, identify an Article 5 or 6 condition, provide Article 10 information and support Article 11 rights.
- Evidence to retain
- Data map, legal-basis record, notices and rights log.
- Primary citation
- Law 6698 articles 4-6 and 10-11
Apply enhanced controls to biometric and special-category data.
- Implementation action
- Document necessity and proportionality, apply current Board adequate measures and implement security appropriate to the sensitivity and onboarding risk.
- Evidence to retain
- Assessment, controls, test results and approvals.
- Primary citation
- Law 6698 article 6; KVKK biometric-data guideline
Notify personal-data breaches without delay.
- Implementation action
- Escalate, contain, document and notify the Board and affected persons using the current Board decision and form; do not convert the Board's 72-hour interpretation into a statutory text claim.
- Evidence to retain
- Incident chronology, assessment and notifications.
- Primary citation
- Law 6698 article 12(5); Board Decision 2019/10
Use the amended cross-border transfer regime.
- Implementation action
- Apply adequacy, an Article 9 appropriate safeguard or a limited incidental-transfer exception and file standard-contract notifications within five business days where used.
- Evidence to retain
- Transfer map, mechanism, contract and notification receipt.
- Primary citation
- Law 6698 article 9; 2024 Cross-Border Transfer By-Law
11Practical evidence packsEvidence must reconstruct decisions end to end.3 items+
Maintain an onboarding pack.
- Implementation action
- Bundle identity, authority, KYB, beneficial ownership, PEP, sanctions, purpose, risk, privacy and approvals.
- Evidence to retain
- Complete sample and retrieval result.
- Primary citation
- Operational control supporting Law 5549
Maintain STR and sanctions case packs.
- Implementation action
- Link activity, suspicion time, report, receipt, confidentiality, restrictions and communications.
- Evidence to retain
- Case pack, timeline and access record.
- Primary citation
- Law 5549 article 4; Laws 6415 and 7262
Maintain a launch and legal-change pack.
- Implementation action
- Record perimeter, licences, reporting, sanctions, privacy, vendors, current thresholds and tests.
- Evidence to retain
- Signed pack, source register and approvals.
- Primary citation
- Official sources listed below
Primary-source register
18 sources used for this checklist
Use these links to verify the underlying legislation, regulator guidance, reporting procedures and international status statements.
- Law No. 5549 on Prevention of Laundering Proceeds of CrimeMASAK · Primary legislation - official English translation
- Measures Regulation and consolidated AML legislation registerMASAK · Official legislation register
- MASAK General Communiqué No. 13 - suspicious transaction reportingMASAK · Official binding communiqué
- Current sector suspicious transaction reporting guides and MASAK Online routeMASAK · Official filing guidance
- Law No. 6415 on Prevention of Financing of TerrorismMASAK · Primary legislation - official English translation
- Law No. 7262 on Prevention of Financing of ProliferationMASAK · Primary legislation - official English translation
- Current asset-freezing decisions and listsMASAK · Official sanctions register
- Company establishment and MERSIS guideMinistry of Trade · Official registry guidance
- Payment Services and Electronic Money Law No. 6493Central Bank of the Republic of Türkiye · Primary sector legislation and official framework
- Crypto-asset service-provider communiqués III-35/B.1 and III-35/B.2Capital Markets Board · Official supervisory announcement
- Capital Markets Board legislation systemCapital Markets Board · Official legislation register
- Personal Data Protection Law No. 6698Personal Data Protection Authority · Primary legislation - official English translation
- Cross-border transfer by-law and standard contractsPersonal Data Protection Authority · Official regulation and instruments
- Guideline on processing biometric dataPersonal Data Protection Authority · Official regulator guidance
- FATF Türkiye country assessment pageFATF · Authoritative assessment
- FATF Plenary outcomes - 19 June 2026FATF · Authoritative current assessment status
- FATF increased monitoring - 19 June 2026FATF · Authoritative current public-list status
- FATF call for action - 19 June 2026FATF · Authoritative current public-list status
Direct answers
Türkiye KYC, KYB and AML questions
Who receives suspicious transaction reports?+
MASAK receives reports through the current MASAK Online route and sector guide.
When must an STR be filed?+
Within ten business days from formation of suspicion, and immediately where delay is prejudicial.
How long are AML records retained?+
Eight years from the applicable document date, last record date or last transaction date under Law 5549 article 8.
What is Türkiye's beneficial-owner threshold?+
Apply the current Measures Regulation ownership indicator, control-by-other-means test and senior-managing-official fallback; a percentage is not a safe harbour.
Is there one universal transaction threshold?+
No. CDD triggers and periodic-reporting duties vary by transaction, obliged-party category and current MASAK rule; maintain a dated threshold register.
Can onboarding be electronic?+
Yes where the applicable sector supervisor permits the method and all identity, liveness, authentication, fraud and record controls are met.
Are crypto-asset services regulated?+
Yes. CMB licensing and operating rules and MASAK AML, reporting and travel-rule obligations apply according to the service.
How are cross-border data transfers handled?+
Use the amended Law 6698 article 9 hierarchy: adequacy, an appropriate safeguard, or a limited incidental-transfer exception; standard contracts require notification within five business days.
Is Türkiye on a FATF public list?+
No at 19 June 2026. FATF adopted a new mutual evaluation in June 2026, and absence from a list is not a low-risk conclusion.
Research and review method
VOVE ID Compliance Research maps the regulatory perimeter, translates obligations into operational controls, links each material claim to a source and records the date and version of every review.
General information, not legal advice. Reviewed 8 October 2026. Confirm controlling Turkish text, current monetary thresholds, sector rules, MASAK Online specifications, sanctions decisions, registry and beneficial-owner procedures, KVKK decisions and licensing conditions with the competent authority and qualified Türkiye counsel.