Filing a suspicious transaction report (ŞİB) with MASAK
A working reference for uyum görevlileri and analysts at Turkish obliged parties, written with SPK-licensed intermediaries in mind: who must report, what counts as suspicious, how long you have, what the form asks for and what you may not tell anyone. Each point links to the law, regulation or MASAK guidance it comes from.
Reviewed · Educational material, not legal advice.
Who must report
Law No. 5549 on the Prevention of Laundering Proceeds of Crime puts the reporting duty on obliged parties (yükümlüler). Article 2(d) defines them by sector: banking, insurance, private pensions, capital markets, lending and other financial services, postal and transport services, lotteries and betting, and also dealers in foreign exchange, real estate and precious stones, notaries, sports clubs and, in defined cases, lawyers.
The Tedbirler Yönetmeliği, the regulation on measures against laundering and terrorist financing, names the obliged parties one by one in article 4. Capital-markets intermediaries (sermaye piyasası aracı kurumları) and portfolio management companies are on the list, so an SPK-licensed firm offering leveraged FX and CFD trading reports to MASAK in the same way a bank does.
MASAK (Mali Suçları Araştırma Kurulu Başkanlığı) is Türkiye's financial intelligence unit, part of the Ministry of Treasury and Finance. Every ŞİB goes to MASAK, whichever authority licenses the firm.
What triggers a report
Under article 4(1) of Law 5549, a report is required where there is any information, suspicion or reasonable ground to suspect that the assets in a transaction carried out or attempted with or through the obliged party were obtained illegally or are used for illegal purposes.
Article 27 of the Regulation extends the definition to terrorism: the suspicion may be that the assets are used for terrorist acts or by terrorist organisations, terrorists or those who finance terrorism, or are connected with them. The same article sets four working rules:
- There is no threshold. Suspicious transactions are reported regardless of amount.
- Attempted transactions count. A deposit the firm refused, or a withdrawal the client dropped after a question, can still be reportable.
- Transactions are assessed together where needed. Several transactions that are unremarkable one by one can form a suspicion together, and MASAK's guidance says one form is filed for transactions assessed together.
- Continuous reporting does not replace an ŞİB. A transaction already reported under the continuous reporting regime (devamlı bilgi verme) must still be reported if it is suspicious.
Before filing, the firm looks into the transaction as far as its powers and means allow and bases the report on what it found (Regulation, article 28; General Communiqué No. 13, article 4). That is the analyst's review and the uyum görevlisi's decision, and both belong in the case file.
How long you have
The limit is set in article 28 of the Regulation and restated in article 5 of MASAK's General Communiqué No. 13:
| Situation | Limit |
|---|---|
| Standard | At the latest within 10 business days from the date the suspicion about the transaction was formed. |
| Delay would be harmful | Immediately (derhal). General Communiqué No. 13, article 5; the same rule appears in MASAK's reporting guide for crypto-asset service providers, section 2. |
| New information after filing | A new ŞİB form, marked as a supplement to the earlier report, sent without delay (Regulation, article 28). |
The clock starts when the suspicion is formed, not when the transaction took place or when an alert fired. Record that date, and who formed the suspicion, in the case file on the day. For electronic reports, MASAK's guide takes the filing date as the date the report entered MASAK's records. The STR deadline calculator counts the 10 business days with Turkish public holidays.
Where the firm thinks a transaction should not go ahead, article 19/A of Law 5549 provides for deferral. A report can carry a deferral request (erteleme talepli ŞİB), and a deferral cannot exceed seven business days from the date of the report (summary of the deferral rules).
Ten business days is a ceiling. Whether a case falls under 'delay would be harmful' is a judgement the uyum görevlisi should record with reasons. Check the current MASAK guidance for your sector on how it applies to suspected terrorist financing.
How to submit
General Communiqué No. 13 sets the channels. Electronic reports go through MASAK's online system, which the Communiqué calls MASAK.ONLINE (article 13); MASAK decides which obliged parties must file electronically and from when. Parties not required to file electronically may deliver the paper form by hand, by registered post or by fax (article 12).
MASAK's ŞİB guide of April 2025 describes the online flow on onlineislemler.masak.gov.tr: open a new report (Yeni Şüpheli İşlem Bildirimi), complete the sections in order and send it for approval (Onaya Gönder). Check the current MASAK guidance for your sector on the login method and on who in the firm may hold access.
Where the firm has an uyum görevlisi, reports go to MASAK through that person. Staff can report internally to the uyum görevlisi by any procedure the firm sets, but an oral report is not an acceptable procedure (Communiqué No. 13, article 9).
What goes in the report
The 2025 guide describes these parts of the form:
| Part | What it holds |
|---|---|
| Report type | New (Yeni), or a supplement (Ek) to an earlier report. |
| Suspicion category | At least one and at most three categories from MASAK's list. Communiqué No. 13, article 7, makes the report category mandatory and asks for the matching suspicion category or categories. |
| Persons | The natural or legal persons involved, with their identification details. |
| Transactions | Status (completed or attempted), type, amount and currency of each transaction. |
| Explanation (açıklama) | Free text of at least 300 and at most 50,000 characters. |
| Attachments | xls, xlsx, doc, docx, pdf, png, jpeg or tif; up to 50 MB per file and 250 MB in total. |
MASAK asks for a detailed account of the act or acts under suspicion in the explanation, and for structured data to go into the matching form fields rather than only into the free text (reporting guide, section 4.2.8).
For an intermediary, that means
A report on suspected loss transfer between two leveraged accounts should name both account holders and what links them (a shared device, IP address, bank account or introducing agent), list the matched positions with times, instruments and volumes, state the profit and loss that moved between the accounts and the deposits and withdrawals on each side, and say what the firm has done, for example holding a pending withdrawal or asking for a deferral.
Confidentiality and the disclosure ban
Article 4(2) of Law 5549: obliged parties may not disclose to anyone, including the parties to the transaction, that an ŞİB has been filed. The only exceptions are the inspectors assigned to check compliance and the courts during proceedings. A breach is a crime under article 14: one to three years' imprisonment and a judicial fine of up to 5,000 days.
Article 29 of the Regulation extends the ban to a report that is going to be filed, and to everyone in the firm who knows of it: the staff who carried out or managed the transaction, legal representatives and any other employee. Internal reports to the uyum görevlisi are confidential too. The uyum görevlisi may not give anyone the cards, passwords or other means of access to the online system. The firm may not tell its head office, branches or agents abroad that it has reported a customer.
Reporting is protected. Those who fulfil their obligations under the Law cannot be held legally or criminally liable for it (Law 5549, article 10); article 29 of the Regulation names uyum görevlileri, legal representatives, managers and staff.
In practice: messages to a client about a held withdrawal or a restricted account are neutral and agreed with compliance in advance, and the dealing desk and client support see that an account is restricted, not why.
Record keeping and penalties
Article 8 of Law 5549: obliged parties keep documents for eight years from the date they were drawn up, and books and records for eight years from the last entry, and produce them on request. Breaching this, or the duty under article 7 to give MASAK and the inspectors the information and documents they ask for, is also a crime under article 14.
Failing to report a suspicious transaction is sanctioned with an administrative fine under article 13 of the Law. The amounts have been amended several times; check the current consolidated text before relying on a figure.
Keep the file for alerts closed without a report as well: which facts were checked, why they explained the activity, and who decided. An inspector may ask about the alerts you did not report as readily as about the ones you did.
The uyum görevlisi
The Regulation defines the uyum görevlisi as the officer appointed to ensure compliance with the obligations under the Law and the rules made under it (Tedbirler Yönetmeliği, article 3).
Firms within the scope of the Compliance Programme Regulation, which include capital-markets intermediaries, must appoint one. The uyum görevlisi reports to the board or to the board members it designates (article 16), must meet the conditions in article 17, and is supported by a compliance unit with enough staff and resources (article 18). The duties in article 19 include running the suspicious transaction reporting process and keeping it confidential.
A 2025 amendment (Official Gazette of 22 August 2025, No. 32994) bars appointing as uyum görevlisi someone who inspected the firm in the previous two years, requires the removal of an uyum görevlisi to be notified to MASAK within ten days with the reasons, and adds transitional rules on qualifications that apply from 25 December 2025. Check the current text for the qualification requirements.
How this differs from the UAE
| Point | Türkiye (MASAK) | UAE (CBUAE-licensed firms) |
|---|---|---|
| Channel | MASAK's online system | goAML |
| Clock starts | Date the suspicion was formed | Date the automated alert was generated |
| Maximum | 10 business days; immediately where delay would be harmful | 35 business days; initial report within 15 in a complex investigation (CBUAE guidance 4.6) |
| Disclosure | Crime, one to three years' imprisonment; no disclosure to head office or branches abroad | Federal crime; sharing within the group for AML purposes is allowed |
| Records | 8 years | At least 5 years |
The UAE side is covered in the goAML STR filing guide.
Where Marqib fits
Marqib prepares the case file this guide describes. Deterministic rules raise the alert; the case carries the MASAK 10-business-day clock from the date suspicion was formed, the evidence rows, a draft explanation in which every sentence cites one of them, and a draft in the MASAK ŞİB structure for the uyum görevlisi to check. Marqib does not file with MASAK: the uyum görevlisi submits through MASAK's own system. An analyst proposes, a different person approves with a reason code, and both are written to a hash-chained audit log.
Sources
- Law No. 5549 on the Prevention of Laundering Proceeds of Crime, consolidated text (Lexpera, Turkish)
- Tedbirler Yönetmeliği (Regulation on Measures against Laundering and Terrorist Financing), consolidated text (Lexpera, Turkish)
- Tedbirler Yönetmeliği, text as published on 9 January 2008, articles 27 to 30 (TSPB, PDF, Turkish)
- MASAK General Communiqué No. 13 on suspicious transaction reporting, Official Gazette 25 August 2014, No. 29099 (Lexpera, Turkish)
- MASAK, Şüpheli İşlem Bildirimi Kılavuzu, 28 April 2025 (PDF published by the Istanbul Chamber of Commerce, Turkish)
- MASAK, Şüpheli İşlem Bildirim Rehberi (crypto-asset service providers), 16 April 2022, sections 2 and 4 (PDF, Turkish)
- Compliance Programme Regulation (Uyum Programına İlişkin Yönetmelik), text as published on 16 September 2008 (TSPB, PDF, Turkish)
- Amendment to the Compliance Programme Regulation, Official Gazette 22 August 2025, No. 32994 (Alomaliye, Turkish)
- MG Hukuk, Suspicious transaction reports with a deferral request (Turkish)
- CBUAE Rulebook, STR guidance 4.6: Summary of review, investigation and reporting timelines
Questions
What is the deadline for filing an ŞİB with MASAK?
Ten business days at the latest from the date the suspicion was formed, and immediately where delay would be harmful (Tedbirler Yönetmeliği, article 28; MASAK General Communiqué No. 13, article 5).
Is there a minimum amount for a suspicious transaction report?
No. Article 27 of the Regulation requires suspicious transactions to be reported regardless of amount, and attempted transactions are covered.
Can we tell the client that a report has been filed?
No. Law 5549, article 4(2), bans disclosure to anyone, the client included, except inspectors and the courts; a breach carries one to three years' imprisonment under article 14. The Regulation also bars telling the firm's head office or branches abroad.
How long must ŞİB records be kept?
Eight years: documents from the date they were drawn up, books and records from the last entry (Law 5549, article 8).
Who submits the report inside the firm?
The uyum görevlisi, where the firm has one. Staff report internally to the uyum görevlisi by any procedure the firm sets, except orally (General Communiqué No. 13, article 9).