MASAK (Mali Suçları Araştırma Kurulu, “Financial Crimes Investigation Board”) is Turkey’s central authority for combating money laundering, terrorism financing, and the financing of weapons of mass destruction proliferation. Operating under the Ministry of Treasury and Finance, MASAK doesn’t license financial institutions itself — instead, it sets and enforces anti-money-laundering (AML) and know-your-customer (KYC) obligations that cut across every other regulator’s jurisdiction, applying to banks, payment and e-money institutions, and crypto asset service providers alike, regardless of which agency issued their operating license.
Origins and Legal Basis
MASAK was established in 1996 under Law No. 4208, Turkey’s original anti-money-laundering law. Its scope expanded over time to include counter-terrorism financing, and its modern legal foundation is Law No. 5549 on the Prevention of Laundering Proceeds of Crime, which took effect in 2006. This law remains the primary statute governing MASAK’s authority today, covering not just money laundering but also the financing of terrorism and, more recently, the financing of weapons of mass destruction proliferation.
What MASAK Actually Does
MASAK’s core function is best described as an intelligence pipeline: it collects large volumes of data from obligated institutions and public bodies, processes that data into actionable intelligence, and channels the results to the judicial and administrative authorities responsible for prosecution or enforcement. MASAK itself does not typically prosecute cases — it identifies and escalates them.
Key functions include:
- Collecting suspicious transaction reports (STRs) from obligated institutions
- Analyzing financial data for patterns consistent with money laundering, terrorism financing, or proliferation financing
- Conducting administrative investigations and sectoral risk assessments
- Referring cases to judicial authorities (courts) or administrative bodies for enforcement action
- Coordinating national AML/CFT policy through the Coordination Board for Combating Financial Crimes (Mali Suçlarla Mücadele Koordinasyon Kurulu), which evaluates draft AML legislation and aligns implementation strategy across agencies
Who Is Obligated to Report to MASAK
Turkish law casts a wide net over who must comply with MASAK’s requirements. “Obligated parties” (yükümlüler) include both financial institutions and certain non-financial businesses:
- Banks
- Payment institutions and electronic money institutions
- Crypto Asset Service Providers
- Other financial intermediaries (brokerages, insurance companies, etc.)
- Certain non-financial businesses and professions, including dealers in precious metals, stones, and jewelry
Being an obligated party carries a specific practical consequence: it creates a legal duty to make reasonable inquiries into a customer’s identity and the source of their funds — a duty that applies regardless of the size of the business or its transaction volume, though the requirement to formalize a compliance program and appoint a dedicated compliance officer generally scales with an institution’s size, per sector-specific guidance.
Core Obligations for Regulated Fintechs
For a fintech company classified as an obligated party, MASAK compliance generally involves:
- Suspicious Transaction Reports (Şüpheli İşlem Bildirimi, ŞİB): a mandatory, confidential legal report filed with MASAK whenever there is suspicion — or reasonable grounds to suspect — that funds involved in a transaction originate from illegal activity.
- Threshold-based reporting: obligated parties must report transactions exceeding an amount set periodically by the Ministry of Treasury and Finance, regardless of whether suspicion is involved.
- Record retention: institutions must retain documentation related to STRs, internal escalations to compliance officers, and the written justification for any decision not to file a report on a reviewed transaction.
- Group-level information sharing: under Article 5/2 of Law No. 5549, companies within the same financial group are permitted to share customer identification, account, and transaction information with each other for compliance purposes — the legal basis that allows a banking or fintech group to operate a shared risk database or blacklist across its subsidiaries.
MASAK’s Role Across Turkey’s Fintech Regulatory Landscape
MASAK’s authority is deliberately cross-cutting rather than sector-specific, which is what makes it distinct from Turkey’s other main regulators:
- Banks, licensed by BDDK, are directly obligated to MASAK.
- Payment and electronic money institutions, licensed and supervised by TCMB under Law No. 6493 (following the transfer of relevant licensing authority from BDDK to the Central Bank), are equally obligated to MASAK’s AML framework.
- Crypto Asset Service Providers, licensed by SPK under Law No. 7518, are treated as obligated parties as well — including compliance with the international Travel Rule for cross-border crypto transfers, in force since 2025.
In practice, this means MASAK compliance isn’t something a fintech can satisfy once and move on from at licensing — it’s a continuous, parallel obligation that runs alongside whatever primary license (BDDK, TCMB, or SPK) governs the company’s core activity, as covered in our guide to Turkey’s fintech regulatory framework.
Frequently Asked Questions
What does MASAK stand for? Mali Suçları Araştırma Kurulu, translated as the Financial Crimes Investigation Board.
When was MASAK established? In 1996, under Law No. 4208. Its current legal foundation is Law No. 5549, which took effect in 2006.
Does MASAK license financial institutions? No. MASAK does not issue operating licenses. Licensing is handled by BDDK (banks), TCMB (payment and e-money institutions), and SPK (crypto asset service providers and capital markets). MASAK’s authority is AML/CFT compliance, which applies across all of them.
What is a Suspicious Transaction Report (ŞİB)? A confidential legal report that obligated institutions must file with MASAK when there is suspicion, or reasonable grounds to suspect, that a transaction involves funds from illegal activity.
Does MASAK’s authority only apply to banks? No. MASAK’s authority extends to payment and e-money institutions, crypto asset service providers, other financial intermediaries, and even certain non-financial businesses such as precious metals and jewelry dealers.
This article is part of Fintech in Türkiye’s ongoing coverage of Turkey’s fintech regulatory landscape. For more on how Turkey’s regulators work together, explore our Regtech & Compliance section.
