## Introduction
For any crypto exchange operating in Turkey, understanding the **MASAK investigation process** is not optional — it is a core compliance competency. MASAK (Mali Suçları Araştırma Kurulu), Turkey's Financial Crimes Investigation Board, has the authority to investigate any transaction on any licensed platform. An investigation can be triggered by an exchange's own Suspicious Transaction Report (STR), by intelligence received from a domestic or foreign financial intelligence unit (FIU), or by a referral from law enforcement.
This guide provides a step-by-step breakdown of how MASAK crypto investigations unfold and what exchanges are required to do at each stage.
## Legal Foundation: Law No. 5549
**Law No. 5549** — the Law on Prevention of Laundering Proceeds of Crime — is the primary legislative instrument governing MASAK's authority and the obligations of reporting entities, which explicitly include crypto asset service providers.
Key provisions relevant to exchanges:
- **Article 4:** Obligation to establish AML/CFT programs
- **Article 5:** Customer identification and verification requirements
- **Article 6:** Record retention (minimum 8 years)
- **Article 7:** Transaction monitoring obligations
- **Article 8:** Suspicious transaction reporting obligations
- **Article 13:** MASAK's investigative powers
- **Article 15-17:** Administrative penalties for non-compliance
## Stage 1: Internal Detection and the STR Decision
The investigation process almost always begins inside the exchange. A compliant exchange must have a transaction monitoring system capable of detecting the patterns that MASAK recognizes as indicative of money laundering or terrorist financing.
### Common Red Flags Triggering Internal Review
- Transactions exceeding the **15,000 TRY reporting threshold** without clear legitimate purpose
- **Structuring:** Multiple transactions just below the threshold in a short window
- Transactions to or from wallet addresses associated with **sanctions lists** (OFAC, UN, EU, MASAK)
- Use of **mixers or privacy protocols** (Tornado Cash, Monero, etc.)
- Rapid deposit-withdrawal cycles with no apparent economic purpose
- Customer account activity inconsistent with stated source of funds
- **Gambling platform wallet** interactions (see Law No. 7258 exposure)
- Cross-border transactions to **FATF high-risk jurisdictions**
- Sudden high-volume activity on previously dormant accounts
### The Compliance Officer's Role
Once an alert is generated by the transaction monitoring system, it must be reviewed by the exchange's **designated Compliance Officer** (Uyum Gorevlisi). The Compliance Officer determines:
1. Is there a reasonable basis for suspicion?
2. Is additional customer information needed before a decision?
3. Should an STR be filed or the alert dismissed with documented rationale?
**Critical rule:** The Compliance Officer must never inform the customer that their transaction is under review or that an STR is being considered. **Tipping off** is a criminal offense under Law No. 5549.
## Stage 2: Filing the Suspicious Transaction Report
### Filing Deadline
Once the decision to file is made, the STR must be submitted to MASAK **within 10 business days** of the date the suspicious activity was identified. Failure to meet this deadline is a standalone violation, regardless of whether the underlying activity turns out to be criminal.
### Content of the STR
MASAK's prescribed STR format requires the following:
**Section 1 — Reporting Entity:**
- Exchange name, license number, address
- Compliance Officer name and contact details
**Section 2 — Subject of the Report:**
- Full identification data for the account holder (name, TC ID or passport, date of birth, address)
- Any linked accounts or beneficial owners
- Customer risk classification
**Section 3 — Transaction Details:**
- Date, time, and type of transaction
- Amounts in both cryptocurrency and TRY equivalent (at TCMB rate)
- Source and destination wallet addresses
- Blockchain network and transaction hash
- Any cross-exchange or cross-chain activity
**Section 4 — Suspicious Indicators:**
- Specific behaviors or patterns that triggered the report
- Reference to applicable MASAK typologies
- Comparison with customer's historical behavior
**Section 5 — Exchange Action Taken:**
- Whether the transaction was allowed to proceed, blocked, or reversed
- Any account restrictions applied
- Supporting documents attached (transaction records, identity documents, communication logs)
### Submission Channel
STRs are submitted electronically through the **MASAK Electronic Reporting System**. Exchanges must maintain secure access credentials and ensure their system is capable of submitting reports in the required XML format.
## Stage 3: MASAK Review and Intelligence Analysis
Upon receiving an STR, MASAK conducts an initial triage:
1. **Completeness check:** Is the report properly formatted with all required fields?
2. **Priority classification:** Does the report relate to a known investigation, a high-risk typology, or a politically exposed person?
3. **Intelligence enrichment:** MASAK cross-references the STR against its existing databases, including prior STRs from other reporting entities, law enforcement records, and data from the Egmont Group network of international FIUs
If MASAK determines that the STR warrants further investigation, it may:
- Request **additional information** from the reporting exchange under Article 13
- Issue a formal **information request** to other financial institutions
- Share intelligence with **Turkish law enforcement** (Emniyet Genel Mudurlugu, Jandarma)
- Transmit intelligence to **foreign FIUs** through the Egmont Group channel
## Stage 4: MASAK Information Request to the Exchange
This is the stage at which exchanges most often find their compliance infrastructure under stress. MASAK may issue a formal information request requiring the exchange to produce:
- **Complete transaction history** for the subject account (typically all-time, not limited to the suspicious transactions)
- **Identity verification documents** and verification process logs
- **Source of funds documentation** provided by the customer
- **Communication records** with the customer
- **IP addresses and device fingerprints** associated with account access
- **Linked account information** (other accounts funded from the same source)
- **Cold wallet / withdrawal address** history
### Response Deadline
MASAK information requests typically specify a response deadline of **5 to 15 business days**. Missing this deadline is a serious violation and can result in significant administrative penalties.
### Data Retention Requirement
This is why the 8-year record retention requirement under Law No. 5549 is critical. Exchanges that cannot produce records because they were deleted or not systematically retained will face both penalties for the retention failure and potential adverse inference in the underlying investigation.
## Stage 5: Account Restriction and Asset Freeze
Depending on the severity of the suspected activity, MASAK may request — or Turkish courts may order — a **freeze on assets** held in the subject account. Exchanges are required to:
1. Immediately **restrict all account activity** upon receipt of a freeze order
2. **Preserve all assets** in the account at current balances (no withdrawals, no trades)
3. **Confirm compliance** with the freeze order to MASAK in writing
4. **Not inform the customer** of the freeze until legally permitted to do so
Frozen assets remain in custody until the investigation is resolved by MASAK's dismissal of the matter, a prosecutorial decision not to charge, or a court judgment.
## Stage 6: Referral to Public Prosecutor
If MASAK's investigation produces evidence of criminal activity — money laundering, terrorist financing, or related offenses — the matter is referred to the **Public Prosecutor's Office (Cumhuriyet Savciligi)**.
At this stage:
- A formal criminal investigation is opened
- The exchange may receive court orders for additional evidence production
- Exchange staff who had knowledge of the activity (including Compliance Officers who failed to report) may be interviewed as witnesses
- In serious cases, exchange management may face personal criminal liability if they are found to have facilitated the activity
## Stage 7: Post-Investigation Obligations
Even after a MASAK investigation concludes — whether in a prosecution, a regulatory sanction, or a dismissal — the exchange has ongoing obligations:
- **Retain all investigation-related records** for the remainder of the 8-year period
- **Review internal controls** to identify any gaps that the investigation exposed
- **Update risk typologies** in the transaction monitoring system based on the patterns involved
- **Report any related activity** that comes to light after the initial STR
## Penalties for Non-Compliance Under Law No. 5549
| Violation | Penalty Range |
|---|---|
| Failure to file an STR | 100,000 – 1,000,000 TRY |
| Late STR filing | 50,000 – 500,000 TRY |
| Tipping off the customer | Criminal liability (up to 3 years imprisonment) |
| Failure to respond to MASAK information request | 200,000 – 2,000,000 TRY |
| Inadequate record retention | 100,000 – 500,000 TRY per deficiency |
| Systematic non-compliance | License revocation |
| Facilitating money laundering | Criminal prosecution of responsible individuals |
Penalties are applied per violation and can be cumulative. MASAK has demonstrated willingness to levy maximum penalties against exchanges that show patterns of non-compliance rather than isolated technical failures.
## Building an Investigation-Ready Compliance Program
The exchanges that navigate MASAK investigations most successfully share several characteristics:
### Comprehensive Transaction Monitoring
An automated system that generates alerts based on current MASAK typologies, updated regularly as new patterns emerge. Integrating blockchain analytics (such as **Defy Live AML**) that scores transactions against known high-risk addresses significantly improves detection quality.
### Clear STR Decision Process
A documented internal process for escalating, reviewing, and deciding on STR filings — with defined timelines, responsible parties, and approval chains. The 10-business-day deadline is tight; a process that requires multiple layers of approval must account for that constraint.
### Complete and Accessible Records
All transaction records, identity documents, and customer communications stored in a system that allows rapid retrieval by account, date, or transaction hash. When MASAK issues an information request, the ability to respond within 5 days requires infrastructure that supports it.
### Trained Compliance Personnel
Compliance Officers who understand both the technical aspects of blockchain transactions and the specific requirements of Law No. 5549. MASAK requires ongoing training, and exchanges should treat this as a substantive requirement rather than a box-checking exercise.
### Legal Counsel Relationships
Establishing a relationship with Turkish lawyers experienced in financial crime matters before an investigation begins — not after the first MASAK request arrives.
## Conclusion
The MASAK crypto investigation process is procedurally detailed, legally consequential, and operationally demanding. Exchanges that invest in robust compliance infrastructure — including automated AML monitoring, complete record-keeping, and trained compliance personnel — are far better positioned to meet MASAK obligations without triggering secondary penalties for compliance failures.
For exchanges that have not yet implemented formal transaction monitoring systems, the time to do so is before the first STR obligation arises — not after.