Turkish payment institutions, e-money institutions, crypto platforms and banks are putting AI into their back offices: models that score customer risk, rank AML alerts, support credit decisions and draft compliance case notes. As of October 2026, none of the main Turkish rules is written specifically for AI, yet they already answer the key question of who is responsible when the model is wrong. Two EU dates matter for a Turkish fintech with EU customers or EU clients: the AI Act’s high-risk rules for credit scoring of individuals apply from 2 December 2027 (moved from 2 August 2026 by the Digital Omnibus on AI), and the EU Anti-Money Laundering Regulation applies from 10 July 2027.
What “AI-driven operations” means
The trend is a set of tools placed inside regulated processes: onboarding risk scores and face-to-ID matching, transaction monitoring that ranks alerts by likelihood of money laundering, credit models, and “agents” that collect documents, reconcile records or draft a suspicious transaction report for a human to review. Most are bought from vendors. Two questions follow in every jurisdiction: can the task be given to a machine (or to the vendor running it), and who answers to the regulator and the customer when it fails? This piece belongs to the operations strand of our fintech law hub.
MASAK: the model can flag, the compliance officer decides
Payment and e-money institutions are obliged parties under the Regulation on Measures (Art. 4(1)(e)). They must report suspicious transactions under Law No. 5549 Art. 4, monitor continuously whether transactions fit the customer’s profile (Measures Regulation Art. 19), pay special attention to the misuse of new technologies (Art. 20(1)) and report within ten business days of the suspicion arising (Art. 28(2)). An AI engine is a sensible way to meet these duties, but the Compliance Programme Regulation keeps the decisions with named people:
- The board is ultimately responsible for the programme, and delegating to board members does not remove that responsibility (Art. 6(1), (3)).
- The compliance officer is appointed as in-house staff (Art. 16(2)) and reports the transactions the officer decides are suspicious (Art. 19(1)(e)). Compliance unit staff may help evaluate alerts but cannot decide to report (Art. 18(2)). A model is in no better position.
- Risk rating methods must be tested retrospectively for consistency and effectiveness (Art. 12(1)(ç)), which in practice means model validation.
Vendors do not absorb the responsibility. The reliance rule in Measures Regulation Art. 21 leaves final responsibility with the relying institution, and Art. 21(4) excludes from that rule persons performing services that extend or complement the institution’s own units, so, in our reading, their work counts as the institution’s own. Penalties also reach individuals: for breaches of Law No. 5549 Art. 5(1) not cured after the written warnings and deadlines in Art. 13(2), the responsible board member, or failing one the senior manager, receives one quarter of the fine imposed on the institution (Art. 13(3)). Our MASAK obligations guide covers the underlying duties.
Outsourcing an AI tool: TCMB and BDDK
Under Art. 21 of TCMB’s payment services Regulation (Official Gazette 1.12.2021, No. 31676), payment services and e-money issuance cannot be outsourced, but information systems can be under a written contract that does not transfer management powers. The institution is responsible for the provider’s acts (Art. 21(4)), and a provider abroad must face no legal obstacle to TCMB obtaining information or auditing it (Art. 21(7)). The Information Systems Communiqué adds that decision-making power and responsibility over the systems stay with the institution (Art. 16(1)), that contracts must give TCMB and the auditors information and inspection rights (Art. 16(9)), and that personal data may go to the cloud only on a domestic private or, with providers TCMB considers suitable, community cloud model (Art. 16(7)). In our reading, a public-cloud model API hosted abroad does not fit easily into that rule once customer personal data is sent to it. Art. 13 requires a time-stamped audit trail kept for at least ten years, covering API queries to other institutions and their purpose.
Banks face a sharper line. BDDK’s Support Services Regulation (Official Gazette 5.11.2011, No. 28106) bars obtaining credit assessment, credit proposals and the credit decision from a support service provider (Art. 4(1)(b)), and credit risk monitoring too (Art. 4(1)(d)). A vendor model can support the credit team; it cannot be the credit decision. See our AI credit scoring guide for the credit side.
KVKK: automated decisions and the AML exception
Law No. 6698 Art. 11(1)(g) lets a person object to an outcome against them produced by analysis exclusively through automated systems, which covers a model-made credit refusal with no real human review (see our KVKK Article 11 piece). AML monitoring can fall under an exception: Art. 28(2)(a) disapplies Arts. 10, 11 (except compensation) and 16 where processing is necessary to prevent crime, provided it is proportionate. The tipping-off ban in Law No. 5549 Art. 4(2) also bars disclosing a report. KVKK’s AI Recommendations (April 2025 edition) say the role of human intervention in decision-making should be established.
EU: the AI Act after the Digital Omnibus
The AI Act reaches a Turkish provider placing systems on the EU market, and a Turkish provider or deployer whose AI output is used in the Union (Art. 2(1)(a), (c)). Creditworthiness assessment and credit scoring of natural persons is high-risk, except systems used to detect financial fraud (Annex III, 5(b)). Biometric verification whose sole purpose is to confirm a person’s claimed identity is excluded from the remote biometric identification category (Annex III, 1(a)). An Annex III system that profiles natural persons is always high-risk (Art. 6(3)).
Deployers of high-risk systems must follow the instructions for use, give human oversight to competent and trained people with authority, monitor operation, keep logs for at least six months and tell people that such a system is used in decisions about them (Art. 26(1), (2), (5), (6), (11)). Credit scoring deployers must also run a fundamental rights impact assessment (Art. 27). Regulation (EU) 2026/1744 (OJ L 24.7.2026, in force since 27 July 2026) amended Art. 113 so that Chapter III, Sections 1 to 3, which include Arts. 26 and 27, applies to Annex III systems from 2 December 2027.
EU: AMLR, AMLA and the EBA guidelines
Regulation (EU) 2024/1624 (AMLR) applies from 10 July 2027 (Art. 90). Art. 76(5) permits decisions from automated processes or AI systems only if the data is limited to customer due diligence data, decisions to onboard, refuse, exit or change due diligence are subject to meaningful human intervention, and the customer can obtain an explanation and challenge the decision, except for a suspicious transaction report. Art. 18 allows outsourcing after notice to the supervisor, but the obliged entity remains fully liable and must understand the rationale behind the provider’s activities. Customer risk profiling decisions, FIU reporting (except to a group obliged entity in the same Member State) and approval of detection criteria can never be outsourced (Art. 18(3)). Every suspicion assessment must be recorded, whether or not it leads to a report (Art. 77(1)(b)). The AMLA Regulation (EU) 2024/1620 lets the Authority demand information from third parties to which selected obliged entities outsource (Art. 17(1)). For EU payment and e-money institutions, the EBA outsourcing Guidelines (EBA/GL/2019/02) bar delegating the management body’s responsibilities (para. 35) and require audit rights for critical functions (para. 87). The EBA’s final report of 18 September 2026 on non-ICT third-party risk (EBA/GL/2026/09) will repeal them from a date still to be set, and leaves ICT services to DORA.
| Question | Türkiye | EU |
|---|---|---|
| Who decides to report? | Compliance officer (Compliance Programme Reg. Arts. 18(2), 19(1)(e)) | FIU reporting cannot be outsourced outside the group (AMLR Art. 18(3)(e)) |
| Credit decisions | Banks cannot outsource assessment or decision (BDDK Reg. Art. 4(1)(b)); KVKK Art. 11(1)(g) | High-risk (Annex III 5(b)); deployer duties from 2.12.2027 |
| Records | Audit trail 10 years (IS Communiqué Art. 13); AML records 8 years (Law No. 5549 Art. 8) | Logs at least 6 months (AI Act Art. 26(6)); every suspicion assessment (AMLR Art. 77(1)(b)) |
| Vendor liability | Institution responsible (TCMB Reg. Art. 21(4)) | Obliged entity fully liable (AMLR Art. 18(2)) |
What is still unclear
We have not found a binding MASAK, TCMB or BDDK instrument written for AI, so supervisors may read technology-neutral rules differently for models whose reasoning is hard to reconstruct. Turkish law does not say how far a compliance officer may rely on a model’s ranking without reviewing the underlying transactions. The cloud rule in Art. 16(7) predates large language model APIs. In the EU, amended AI Act Art. 111(2) catches systems already in service before the application date only if their design changes significantly, and the meaning of that for regularly retrained models awaits guidance.
Where to start
- Model inventory: every model and agent in KYC, monitoring, credit and back office, with owner, vendor, data, hosting location and AI Act class.
- Human review: name the decisions a person takes (reports, refusals, exits, credit) and what they must check before signing.
- Explainable suspicion decisions: for each alert closed or reported, record the model output, facts checked and the officer’s reasoning, within tipping-off limits.
- Validation: back-test scores and thresholds against real cases and report to the board (Compliance Programme Reg. Art. 12(1)(ç), (e)).
- Vendor contracts: regulator and auditor access, subcontractor flow-down, data location, exit, and no training on your customer data.
- Audit trail: log agent actions, model versions and API queries to the IS Communiqué Art. 13 standard.
Can an AI system file a suspicious transaction report with MASAK on its own?
No. Where a compliance officer must be appointed, the officer makes the report and decides which transactions are suspicious (Measures Regulation Art. 27(2), Compliance Programme Regulation Art. 19(1)(e)). A model can generate and prioritise alerts, but the decision and its reasoning belong to the officer.
Is AML transaction monitoring high-risk under the EU AI Act?
Annex III does not list AML monitoring as such, and point 5(b) excludes fraud detection from the credit category. The more specific EU rules for AI in AML are in AMLR Art. 76(5), from 10 July 2027.
Has the AI Act’s high-risk deadline moved?
Yes. Regulation (EU) 2026/1744 moved the high-risk rules for Annex III systems, including credit scoring, to 2 December 2027, and for Annex I systems to 2 August 2028.
Sources. Law No. 5549 (Official Gazette 18.10.2006, No. 26323), Arts. 4, 5, 8, 13; Regulation on Measures (Official Gazette 9.1.2008, No. 26751), Arts. 4, 19, 20, 21, 27, 28; Regulation on the Compliance Programme (Official Gazette 16.9.2008, No. 26999), Arts. 6, 12, 16, 18, 19; TCMB Regulation on Payment Services and Electronic Money Issuance (Official Gazette 1.12.2021, No. 31676), Art. 21; TCMB Information Systems Communiqué (Official Gazette 1.12.2021, No. 31676), Arts. 13, 16; BDDK Regulation on Banks’ Procurement of Support Services (Official Gazette 5.11.2011, No. 28106), Art. 4; Law No. 6698 (Official Gazette 7.4.2016, No. 29677), Arts. 11, 28; KVKK Recommendations on the Protection of Personal Data in the Field of AI (April 2025); Regulation (EU) 2024/1689 (AI Act, OJ L 12.7.2024), Arts. 2, 6, 26, 27, 111, 113, Annex III; Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ L 24.7.2026); Regulation (EU) 2024/1624 (AMLR, OJ L 19.6.2024), Arts. 18, 76, 77, 90; Regulation (EU) 2024/1620 (AMLA, OJ L 19.6.2024), Art. 17; EBA/GL/2019/02; EBA/GL/2026/09 (final report 18.9.2026).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
