Türkiye changed its customer identification thresholds again on 7 October 2026. Presidential Decision No. 11845, published in the Official Gazette that day and in force on publication, amends the Regulation on Measures for the Prevention of Laundering Proceeds of Crime and Financing of Terrorism (the “Measures Regulation”). The general one-off threshold rises from TL 185,000 to TL 370,000. The threshold for crypto-asset service providers (CASPs) and for wire and crypto transfers rises from TL 15,000 to TL 30,000, and the Travel Rule data threshold moves with it. For payment institutions, e-money institutions and CASPs, this is a good moment to check the whole AML/CFT framework they answer to under MASAK, the Financial Crimes Investigation Board.
What changed on 7 October 2026
The Decision amends five articles of the Measures Regulation. Update these figures in onboarding, monitoring and transfer messaging:
| Rule (Measures Regulation) | Until 6 October 2026 | From 7 October 2026 |
|---|---|---|
| Identification for one-off or linked transactions (Art. 5(1)(b)) | TL 185,000 (CASPs: TL 15,000) | TL 370,000 (CASPs: TL 30,000) |
| Identification for wire transfers and CASP crypto transfers (Art. 5(1)(c)) | TL 15,000 | TL 30,000 |
| Full, verified originator data in wire transfer messages (Art. 24) | TL 15,000 and above | TL 30,000 and above |
| Full, verified originator data in crypto transfer messages, the Travel Rule (Art. 24/A) | TL 15,000 and above | TL 30,000 and above |
Article 16(1) covers later face-to-face transactions by customers already identified within a permanent business relationship and normally requires a signature specimen. The Decision lets financial institutions skip the signature specimen where verification is done through internet or mobile service channels, or by a one-time SMS code (SMS OTP) sent to the mobile number registered with the institution and previously verified. The verification must suit the nature and risk level of the transaction, give sufficient assurance that the person is the previously identified customer and include adequate safeguards against unauthorised transactions. The fifth change (Art. 38) concerns MASAK audit reports for obliged parties other than financial institutions; payment institutions, e-money institutions and CASPs are financial institutions under Art. 3(1)(f), so it does not change their position. All of these changes took effect on publication, 7 October 2026 (Article 6 of the amending Regulation). Note that MASAK’s CASP guide, published earlier, still shows TL 15,000.
Which fintechs are obliged parties
Article 4 of the Measures Regulation lists the “obliged parties” under Law No. 5549. Point (e) covers payment institutions and electronic money institutions, in wording introduced by a 2016 amendment. Point (ü), added by Presidential Decision No. 3941 published on 1 May 2021, covers crypto-asset service providers. Turkish branches, agents and representatives of an obliged party headquartered abroad are also obliged parties (Art. 4(2)).
The AML regime sits on top of licensing. Payment and e-money institutions need permission from the Central Bank of the Republic of Türkiye (CBRT) under Law No. 6493 (Arts. 14 and 18); see our payment and e-money licence page. CASPs need Capital Markets Board permission under Article 35/B of Law No. 6362, added by Law No. 7518 (in force 2 July 2024), and Article 35/C requires them to identify customers under Law No. 5549.
Law No. 5549 sets the core duties:
- Know your customer (Art. 3): identify customers and those acting for them before the transaction.
- Suspicious transaction reporting (Art. 4): report to MASAK regardless of amount within ten business days of the suspicion (Measures Regulation Arts. 27-28), and tell no one that a report was made, including the parties to the transaction (MASAK examiners and courts excepted).
- Compliance systems (Art. 5): risk-based training, internal audit, control and risk management.
- Continuous reporting (Art. 6): report transactions above Ministry-set amounts.
- Information (Art. 7): give MASAK and its examiners whatever they request.
- Record keeping (Art. 8): keep records for eight years.
Law No. 7262 of 2020 on proliferation financing rewrote parts of Law No. 5549, including the penalty article.
Obligations by fintech type
| Topic | Payment institution | E-money institution | CASP |
|---|---|---|---|
| Identification trigger | Any permanent business relationship (account opening counts); one-off TL 370,000; transfers TL 30,000 | Same as payment institutions | Any permanent business relationship; one-off TL 30,000; crypto transfers TL 30,000 |
| Remote onboarding | Methods in the communiqué on payment and e-money institutions’ information systems (Official Gazette 1.12.2021), per MASAK Communiqué No. 19, Art. 5/C | Same as payment institutions | Methods in CMB Communiqué III-42.1, plus a population register check (Communiqué No. 19, Art. 5/A) |
| Transfer data | Wire transfer rule (Art. 24) | Wire transfer rule (Art. 24) | Travel Rule (Art. 24/A) |
| Compliance programme | Yes, unless the firm provides only bill payment, payment initiation or account information services | Yes | Yes, since 25 December 2024 |
| Compliance officer | Officer and at least one deputy; bill-payment, PIS-only and AIS-only firms appoint an administrative-level officer instead (Art. 29) | Officer and at least one deputy | Officer and at least one deputy |
| Specific enhanced measures | Merchants using terminals (POS) supplied under payment services (Compliance Regulation Art. 13(3)) | Risk-based (Compliance Regulation Art. 13(1)) | Source of funds, purpose, tighter monitoring and amount and count limits (Art. 13(2)); Communiqué No. 29 |
For account-based products the first trigger matters most: a permanent business relationship includes opening an account (Measures Regulation Art. 3), so identification is required regardless of amount.
Compliance programme and compliance officer
The Regulation on the Compliance Programme lists who must build a full programme (Art. 4): e-money institutions, payment institutions (except those providing only bill payment, payment initiation or account information services) and, since 25 December 2024, CASPs. It covers policy and procedures, risk management, monitoring and controls, a compliance officer and unit, training and internal audit (Art. 5), must be reviewed at least every two years, and the board is ultimately responsible (Art. 6). Since 25 February 2025 the institutional policy must also address the risk of breaching, not implementing or evading asset-freezing decisions under Law No. 6415 and Law No. 7262.
The compliance officer and at least one deputy must be appointed within 30 days of the operating licence, as in-house staff reporting to the board, and the signed commitment form goes to MASAK within ten days (Art. 16). The officer must be a Turkish citizen with a four-year degree and at least five years of experience in the roles listed in Article 17. Since 25 December 2025 the officer must also hold MASAK authorisation and be on its compliance officer register; MASAK General Communiqué No. 30 (Official Gazette, 9 September 2025) governs the exam and licence.
Remote onboarding
Article 6/A of the Measures Regulation allows remote identification where the firm’s sector rules allow contracts without meeting the customer. The detail is in MASAK General Communiqué No. 19: the process must be online, uninterrupted, video-based, real-time and fully recorded (Art. 4(7)), and outsourced providers must hold ISO/IEC 27001 certification (Art. 4(8)). AI-based face matching is allowed under conditions (Art. 4(9)). A June 2026 amendment added remote identification of foreign nationals with NFC passports, treated as high risk (Art. 4/C).
For CASPs, two extra rules apply: those intermediating privacy-based crypto-assets cannot onboard remotely at all, and deposits and withdrawals must go through a bank or card account matching the customer’s identity (Art. 6(5)).
Crypto transfers and the Travel Rule
The Travel Rule sits in Article 24/A of the Measures Regulation, in force since 25 February 2025, backed by Article 35/C(5) of Law No. 6362. From TL 30,000, the message must carry the originator’s name, wallet address (or reference number) and one further identifier such as address, place and date of birth or tax number, verified by the CASP, plus the beneficiary’s name and wallet address. Below TL 30,000, both parties’ names and wallet addresses are required without verification. Data must travel securely and simultaneously with the transfer, via distributed ledger technology, a messaging platform or an API.
A receiving CASP must request missing data and, failing that, return the transfer. For unhosted wallets, or foreign providers with no data-sharing obligation, the CASP must obtain a declaration about the counterparty from its own customer. For those two situations MASAK General Communiqué No. 29 (Official Gazette, 28 June 2025) requires crypto-asset trading platforms to wait at least 48 hours between purchase, swap or deposit and withdrawal (72 hours for a first withdrawal). It also caps platforms’ stablecoin withdrawals at USD 3,000 a day and USD 50,000 a month (which may be doubled where full Travel Rule data applies) and requires platforms to obtain a description of at least 20 characters for every crypto transfer. For the licence side, see our CASP compliance page.
Penalties
Under Article 13 of Law No. 5549, breaches of the identification (Art. 3) or continuous reporting (Art. 6) duties carry TL 30,000, and failure to report a suspicious transaction TL 50,000. For listed financial institutions, which expressly include payment and e-money institutions, the fine is doubled and may not be less than 5% of the transaction amount. Compliance programme failures follow a ladder: a written warning with at least 30 days to fix, then TL 500,000, then at least 60 more days, then a second fine of twice the first, then referral to the licensing authority for suspension, restriction or revocation. The responsible board member (or senior manager) faces one quarter of the fine. Annual caps per obligation are TL 40 million (doubled tier) and TL 4 million (others), and fines time-bar after eight years. Under Article 28 these fixed amounts are revalued every year, so the figures above are base amounts, not current ones.
Article 14 is criminal: breaching the tipping-off ban, the information duty or record keeping is punishable by one to three years’ imprisonment and a judicial fine of up to 5,000 days. The Minister of Treasury and Finance may suspend or block a transaction for seven business days on suspicion of laundering or terrorist financing; executing it in breach of that decision costs a MASAK fine equal to the transaction amount, at least TL 50,000 (Art. 19/A).
Where to start: build your AML programme
- Switch thresholds to TL 370,000 and TL 30,000 and log the change.
- Map your licence to the Compliance Regulation: full programme (Art. 4) or administrative-level officer only (Art. 29).
- Appoint a MASAK-licensed compliance officer and deputy within 30 days of the licence.
- Write a board-approved institutional policy covering risk, monitoring, training, internal audit and asset-freezing risks.
- Build sanctions screening against the freezing decisions under Laws No. 6415 and No. 7262.
- Align remote onboarding with Communiqué No. 19 and your sector rules; check vendor ISO 27001 certification.
- For CASPs: implement Article 24/A messaging, unhosted-wallet declarations and the Communiqué No. 29 limits.
- Run an STR workflow that meets the ten-business-day deadline, using MASAK’s sector STR guides.
More on licensing and product design is in our fintech law hub.
Does a payment institution have to appoint a compliance officer?
Yes. Most payment institutions must build a full compliance programme and appoint a compliance officer and at least one deputy within 30 days of the licence. Those providing only bill payment, payment initiation or account information services skip the full programme but must still appoint an administrative-level compliance officer within 30 days.
Since when have crypto-asset service providers been MASAK obliged parties?
Since 1 May 2021, when Presidential Decision No. 3941 added them to Article 4 of the Measures Regulation. The duty to build a full compliance programme followed on 25 December 2024, and the Travel Rule in Article 24/A has applied since 25 February 2025.
Are the fines in Law No. 5549 still TL 30,000 and TL 50,000?
Those are the amounts written in Article 13. Article 28 increases them at the start of each year by the revaluation rate under the Tax Procedure Law, so the amount applied in a given year is higher.
Sources. Law No. 5549 on the Prevention of Laundering Proceeds of Crime (Official Gazette 18.10.2006, No. 26323), Arts. 2-8, 13, 14, 19/A and 28; Measures Regulation (Official Gazette 9.1.2008, No. 26751), Arts. 3, 4, 5, 6/A, 16, 24, 24/A, 27, 28, 38 and 46; Presidential Decision No. 11845 (Official Gazette 7.10.2026, No. 33393); Presidential Decision No. 9305 (Official Gazette 25.12.2024, No. 32763); Regulation on the Compliance Programme (Official Gazette 16.9.2008, No. 26999), Arts. 4-6, 13, 16, 17 and 29; MASAK General Communiqué No. 19 (Official Gazette 30.4.2021, No. 31470); MASAK General Communiqué No. 29 (Official Gazette 28.6.2025, No. 32940); MASAK General Communiqué No. 30 (Official Gazette 9.9.2025, No. 33012); Law No. 7262 (Official Gazette 31.12.2020, No. 31351, 5th repeat); Law No. 6493, Arts. 14 and 18; Law No. 6362, Arts. 35/B and 35/C; MASAK guide for crypto-asset service providers (2025).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
TCC Article 376 for a Cash-Burning Startup: Capital Loss, Over-Indebtedness and the Board's Three Thresholds
October 1, 2026Non-Compete and Non-Solicit for Departing Employees in Türkiye: What to Write, What Gets Enforced
September 30, 2026Türkiye's Mandatory Contracted-Lawyer Rule: What a TRY 198,180 Fine Tells You
September 18, 2026Rule 701: Granting Options to Your Team in Türkiye from a Delaware Company
September 7, 2026Bridge Financing in Türkiye: Convertible Notes and KISS in Practice
September 5, 2026Closing a Venture Round: Step by Step from Signing to Money in the Bank
September 1, 2026Related Practice Areas
ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →