MASAK, Türkiye’s Financial Crimes Investigation Board, has issued two new suspicious transaction reporting (STR) guides in as many months. The Guide on Detecting and Reporting Hawala and Similar Alternative Value Transfer Systems came out in September 2026, followed in October 2026 by the Guide on Combating Rented Accounts (kiralık hesap, known internationally as money mule accounts). Read together, the message is clear. MASAK wants obliged parties to look at the network an account sits in rather than at single transactions, and it does not want an STR to be the end of the response: the account must also stop being usable. This article summarises both guides for payment institutions, e-money institutions and crypto-asset service providers (CASPs).
Why read the two guides together
Both guides rest on the same legal basis: Article 231(1)(c) of Presidential Decree No. 1 and Article 30(2) of the Measures Regulation, which allow MASAK to share what it learns from STRs with obliged parties through guidance. The guides do not create new obligations. They show how existing customer due diligence, monitoring and reporting duties apply to these two risks. In practice they will become the reference point in an audit when the question is why an indicator spelled out in the guide was missed.
The two topics overlap. The rented-account guide lists hawala as one of the uses of mule accounts, and the hawala guide describes third-party accounts and family and company networks as the carriers of hawala structures. Both reach the same conclusion: indicators that mean little on their own become meaningful when they converge on the same group of accounts.
The hawala guide: what counts is the service actually provided
The guide defines hawala as a structure in which value handed over in one place is made available to another person or in another place without the same funds being transferred directly. There are three stages: acceptance of value, delivery of the equivalent, and settlement between intermediaries. Settlement does not have to follow each transaction. In the guide’s example, if an intermediary in Türkiye delivers USD 10 million worth of value to its foreign partner’s customers and the foreign intermediary pays out USD 8 million in Türkiye, the balance to settle may be only USD 2 million. That balance can be cleared in cash, bank transfers, payment or e-money accounts, foreign currency, gold, crypto-assets or trade transactions.
For fintechs, the key point is that labels do not matter. Whether the activity is called “hawala”, “safekeeping”, “current account” or “netting”, what counts is the service actually provided. The guide treats structures that, without a licence, continuously accept funds on behalf of others, move them to other persons or countries and earn a commission, FX margin or other benefit as an indicator of unlicensed payment services under Law No. 6493, and points to the criminal provisions in Article 28 of that Law.
“Digital hawala” is not a separate legal system. It is traditional hawala supported by crypto-assets, payment accounts and e-money. The guide highlights stablecoins as a settlement tool between intermediaries, notes that crypto-assets need not move between two CASPs at all, and warns that economic control can change hands through the transfer of a private key or recovery phrase while the asset stays at the same address.
The guide also maps the legislation: Law No. 6493 for unlicensed value transfer; Article 282 of the Turkish Criminal Code for moving or converting criminal proceeds; Article 5(1)(c) of Law No. 7258 for collections and transfers linked to illegal betting (three to five years’ imprisonment and a judicial fine of up to 5,000 days for intermediating money transport); Law No. 6415 for terrorist financing; and Law No. 7262 for proliferation financing. It states clearly that obliged parties are not expected to make the final criminal law characterisation. They are expected to detect unusual value transfers and apply the required measures and reports.
Reporting category: STRs under the guide must at minimum select suspicion category SK-29 Engaging in Unlicensed Payment and E-Money Services. We recommend updating STR templates and internal escalation forms accordingly.
Hawala indicators for payment and e-money institutions
The 2025 National Risk Assessment rated this sector medium-high, and the guide focuses on outbound cross-border transfers. Key indicators include:
- Cross-border transfers whose frequency or size does not fit the customer’s income, occupation or business, where the customer cannot reasonably explain the purpose or the relationship with the recipient.
- Funds from many apparently unrelated senders moved quickly to one or a few recipients abroad.
- Unconnected customers regularly sending funds to the same group of foreign recipients.
- Domestic and foreign transactions systematically offsetting each other in amount and timing, giving the impression of netting.
- Systematic use of recipients in third countries when a more direct route exists.
- Transfers described as payment for goods or services where the invoicing party and the recipient differ.
- Companies whose business does not fit the activity using virtual POS, payment accounts or e-wallets to turn physical value into what looks like commercial revenue.
Hawala indicators for CASPs
The CASP sector was rated high risk in the 2025 National Risk Assessment. The core risk is value collected through other channels being converted into crypto and withdrawn to external wallets, or the reverse. The guide says self-hosted wallets are not a red flag on their own but must be assessed against wallet history, shared addresses and geographic risk. Indicators include an account used as a pass-through between fiat, crypto and external wallets rather than for investment; unrelated customers sending to the same external wallets; systematic purchases of USDT, USDC or similar stablecoins quickly moved to external wallets; persons linked to authorised FX houses or jewellers generating volumes that do not fit their profile; and attempts to hide links to sanctioned wallets through intermediate wallets and asset swaps.
The rented-account guide: the account holder may not be the one running the account
According to the guide, a rented or mule account ranges from handing over access credentials, to the holder transacting on someone else’s instructions, to giving up actual control entirely. It is not limited to individuals: lending out existing company accounts, setting up or acquiring companies for this purpose and using shell or “zombie” companies are all covered. The guide singles out fraud and illegal betting and gambling as the main areas of use and refers to the national action plan against illegal online betting issued by Presidential Circular 2025/18.
The forms of control it describes bear directly on onboarding and transaction monitoring design:
- Full handover: mobile or internet banking credentials, the SIM, authentication tools or the device are handed over.
- Instructed use: the holder keeps the credentials but carries out transactions whose timing, amount and counterparty are set by someone else.
- Partial control: the holder keeps using the account day to day, while transfers above certain amounts or to certain counterparties are directed by others.
- Central management: many accounts are accessed from the same device, phone number or IP address, and a single hub decides which account collects and which distributes.
- Rotation: an account that attracts scrutiny or becomes too busy is dropped and a “spare” account takes its place.
The section on open banking and API integrations stands out. In more sophisticated set-ups, the choice of which user pays into which account, which account replaces one that has become risky and keeping balances at zero can all be managed centrally and automatically, and different websites can share the same back-end payment infrastructure. The guide also gives examples of layered flows: from an individual’s account to a company account to a payment or e-money institution; from a mule account to a CASP, into crypto and out to an external wallet; or from a mule account to a jeweller and into precious metals or cash.
Detection: the unit of analysis is the network, not the account
Perhaps the guide’s most important statement is that the basic unit of analysis should be the network the account belongs to, not only the account or customer. Accounts that never transact with each other can still converge on the same counterparties, the same financial institutions, shared devices or IP addresses, POS links or wallets. The guide expects:
- network and relational analytics alongside single-transaction scenarios, including identifying each account’s role (collection hub, distribution point, or bridge between clusters);
- for payment and e-money institutions, joint review of internal transfers, FAST, POS and virtual POS, and technical access data; for CASPs, joint review of bank and payment accounts, customer accounts and external wallet links;
- scenarios run frequently and at varying, unpredictable times rather than on a fixed schedule, with near real-time monitoring where feasible;
- re-review of connected accounts, including ones previously rated low risk, whenever a new mule account is identified.
The guide says analysis at this scale cannot realistically be done by people alone, and that supporting compliance teams with network analytics, anomaly detection and AI-assisted tools has become a “de facto necessity”. It adds that local models running on the institution’s own infrastructure may be considered to protect sensitive data, but that these systems must support experts rather than make final decisions. Its finding that compliance teams without adequate software and analytics are “quite unlikely” to detect these networks in time signals that technical capacity will also be examined in MASAK audits.
Filing an STR is not enough: what to do before you report
This is the part of the rented-account guide that will create the most work for fintechs. The guide says an STR is not the only measure to take once a mule account is identified. The real aim is to stop the account being used for illegal activity. It grounds this in Articles 18 (transactions requiring special attention), 19 (monitoring the customer and transactions), 20 (technological risks), 22 (refusing transactions and terminating the relationship), 25 (high-risk countries) and 26/A (enhanced measures) of the Measures Regulation, and in the risk management and monitoring provisions of the Compliance Programme Regulation (Articles 11 to 15).
1. Understand the suspicion first. Compare the customer’s occupation, income and activity with the transaction volume; look into the source of funds, the purpose of the transactions and the customer’s relationship with frequent counterparties; and where needed contact the customer directly to find out who is really using the account.
2. Do not reduce the STR to a transaction dump. The report should clearly set out the customer’s explanations, the documents that support or contradict them, the reviews carried out and any inconsistencies. The guide lists cases where STRs were filed but the source of funds was not investigated and the customer was never contacted among the “significant deficiencies identified previously”.
3. Restrict use of the account. The priority measure is to close or restrict the mobile and internet channels that let third parties operate the account remotely. Depending on the case, suspending card, POS and virtual POS services, lowering limits and not issuing new products may also be appropriate.
4. Use graduated measures in digital-only businesses. The guide accepts that for branchless banks, payment and e-money institutions and CASPs, shutting off remote access entirely would in effect end the relationship. It lists graduated options: limiting outflows, blocking new payees, lowering transfer limits, suspending external wallet transfers or specific products, step-up authentication, manual review of transactions, or a restricted access mode that only allows customer assets to be returned.
5. Terminate or postpone where needed. If the risk cannot be managed with these measures, or the account is clearly operated by third parties, the institution should consider refusing the transaction and ending the relationship, and, where the conditions are met, postponing the transaction under Article 19/A of Law No. 5549.
The guide is also direct on liability. Keeping an account open without any restrictive measure once it is understood to be a mule account “may become impossible to justify merely by having filed an STR”, and may be assessed separately under risk management and monitoring duties. Compliance failures can lead beyond administrative sanctions to judicial proceedings depending on the facts. The guide says that knowingly and wilfully continuing to process transactions through mule networks known to carry criminal proceeds may be examined by the judicial authorities as participation in money laundering under Article 282 of the Criminal Code. It is equally explicit that a breach of administrative duties or the presence of objective risk indicators does not, on its own, create criminal liability.
For the baseline obligations, including thresholds, the compliance officer and the Travel Rule, see MASAK Thresholds Doubled from 7 October 2026.
Rented-account indicators by sector
Payment and e-money institutions
The guide sees this sector as the most critical after banking. It stresses that these institutions are not closed systems: where an institution participates in FAST, money landing in an e-money account can reach the banking system within moments. It treats POS and virtual POS as a separate risk area, citing merchants with no financial history quickly reaching high volumes, heavy cancellation, refund and chargeback rates, and POS terminals still processing after the business has stopped trading. Indicators include volume that the profile cannot explain; an account receiving funds from many people soon after opening and passing them on quickly; funds pooled in certain accounts and then distributed through fast channels including FAST; the same device, IP, phone number or email across unrelated accounts; sequential or similar contact details; customers unaware of their own transactions; and new accounts with the same pattern replacing ones that have become risky.
The guide also points to institutions’ own accounts at banks: a transfer shown in the bank’s records in the institution’s name may in fact be a customer’s transaction. Being able to trace, per customer, the source of funds, the destination account and the final exit channel is therefore essential.
Crypto-asset service providers
The guide recalls the enhanced measures that MASAK General Communiqué No. 29 imposed on CASPs: crypto withdrawals generally take place at least 48 hours after a purchase, swap or deposit, and at least 72 hours after it for a first withdrawal, and stablecoin withdrawals are capped at the equivalent of USD 3,000 a day and USD 50,000 a month. The new emphasis is on behaviour aimed at getting around these rules, not just on whether they are applied: systematic withdrawals the moment a waiting period ends, splitting activity across customer accounts, and using other crypto-assets briefly as a “bridge asset” to escape the stablecoin cap before converting back to stablecoins on another platform. Other indicators include funding of one CASP account from many different bank accounts, unrelated customers sharing the same cluster of external wallets, several accounts run from one device or IP, and funds from betting or fraud mule networks converging in shared wallets.
Company formation and transfers: lawyers and notaries are in scope too
The rented-account guide also covers shell and dormant companies. For lawyers, the indicators include economically or socially vulnerable persons becoming the nominal shareholder or director of several companies in a short time, shareholders who know little about the company’s business or capital, and dormant companies being acquired and then quickly activating bank accounts, payment accounts or virtual POS. The guide notes that lawyers’ obligations are limited to the activities listed in the legislation and that the assessment must respect that scope. For fintechs, the takeaway is that recently acquired companies with no trading history, and clusters of companies linked by a shared address, attorney or accountant, deserve separate treatment in corporate onboarding.
Checklist for fintechs and CASPs
- Add the indicators from both guides to your scenario library and document which rule catches which indicator.
- Write into your procedures that hawala-related STRs must at minimum select category SK-29.
- Build a network view that links devices, IPs, phone numbers, emails, IBANs, wallets and POS terminals across customer files.
- Vary scenario run times and move towards near real-time monitoring where possible.
- Make sure that identifying one mule account automatically triggers re-review of connected accounts.
- Set up a standard workflow for contacting the customer before an STR, requesting information and documents, and reflecting the results in the report.
- Prepare a graduated restriction matrix for digital channels (outflow limit, new-payee block, external wallet freeze, manual approval, return-only mode) and decide who approves each step.
- Set escalation criteria for terminating relationships and for postponement under Article 19/A.
- CASPs: add rules that detect circumvention of the 48/72-hour rules and the stablecoin caps (splitting, bridge assets).
- In corporate onboarding, add questions on dormant company acquisitions and shared control elements.
- If you use network analytics or AI tools, document that the tool does not decide and that an expert makes the final assessment.
For licensing and product design questions, see our fintech law hub; for crypto businesses, our CASP compliance page.
Do these guides create new obligations?
No. They show how existing duties under Law No. 5549, the Measures Regulation and the Compliance Programme Regulation apply to hawala and mule account risk. They also do not replace MASAK’s sector STR guides; they should be read as complementary typologies.
Must a suspected mule account be closed immediately?
The guide does not call for automatic closure. It expects a review and customer contact first, followed by graduated restrictions based on risk. If the risk cannot be managed that way, or it becomes clear that third parties are operating the account, ending the relationship comes into play.
Is a transfer to a self-hosted wallet suspicious in itself?
No. The hawala guide says expressly that self-hosted wallets are not an indicator of suspicion on their own. What matters is the combined picture: wallet history, shared addresses, the customer’s profile, connected persons and companies, and geographic and sanctions risk.
Sources. MASAK, Guide on Detecting and Reporting Hawala and Similar Alternative Value Transfer Systems (September 2026, in Turkish); MASAK, Guide on Combating Rented Accounts (October 2026, in Turkish); Law No. 5549, Art. 19/A; Measures Regulation, Arts. 18-20, 22, 25, 26/A and 30; Compliance Programme Regulation, Arts. 11-15; Law No. 6493, Arts. 12 and 28; MASAK General Communiqué No. 29; Law No. 7258, Art. 5(1)(c); Turkish Criminal Code No. 5237, Art. 282.
This article is for general information only and is not legal advice. Seek advice on your specific situation.
Author
More from Vircon Insights
MASAK Thresholds Doubled from 7 October 2026: AML Obligations for Payment, E-Money and Crypto Firms in Türkiye
October 8, 2026TCMB Writes Biometric Remote Identification into the Payment Services Regulation: What Payment and E-Money Institutions Must Change (RG 4.9.2026)
October 16, 2026PSD3 and the PSR: What the EU Payments Reform Means for Turkish Payment and E-Money Institutions
October 19, 2026MiCA for Turkish Crypto Firms: Serving EU Clients After the Transition Ended, Reverse Solicitation and the Two-Licence Reality
October 18, 2026Overnight Yield on Safeguarded Customer Funds: TCMB's March 2026 Amendment for Payment and E-Money Institutions (Art. 36/A)
October 17, 2026Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Related Practice Areas
ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →