The Financial Crimes Investigation Board (“MASAK”) has published a new guide entitled “Combating Money Mules – Suspicious Transaction Reporting Guide”. The guide sets out in detail the measures that obliged parties should take and the risk indicators they should watch for in relation to money mule schemes used in various types of crime, particularly fraud and illegal betting.
Why Is the Guide Important?
MASAK defines money mule schemes as situations in which accounts belonging to natural or legal persons are used by persons other than their owners, or at the direction of such persons, and considers these schemes to be a significant area of financial risk in relation to crimes such as fraud, illegal betting, drug trafficking and terrorist financing.
The guide was also prepared in line with the 2026–2030 Strategy Document and FATF’s designation of combating fraud as a priority for the 2026–2028 period. It also complements the Action Plan under Presidential Circular No. 2025/18 on combating virtual betting and gambling.
Key Highlights
- Acquisition of money mule accounts: Individuals, particularly students, unemployed persons, low-income earners and those with limited digital literacy, are targeted through promises of commission, pressure from their social circles or seemingly simple requests. The concept of “money mule accounts” extends beyond sharing account details to include the transfer of passwords, SIM cards, verification codes or devices.
- Shell and “zombie” companies: Companies are established in the names of vulnerable individuals, existing active companies are made available for use, or long-inactive (“zombie”) companies are acquired and reactivated to collect funds under the guise of legitimate commercial activity.
- Forms of control and management: The legal owner of an account and the person who actually controls it may not always be the same. Key methods include full transfer, partial or shared control, centralised management and account rotation (the rapid replacement of an account once it becomes high-risk).
- Illegal payment infrastructure: The platform visible to the user (for instance, a betting website) is deliberately separated from the payment infrastructure through which funds are actually routed, allowing the true beneficiary to be concealed.
- Detection approach — network analysis: The guide emphasises that reviewing individual accounts in isolation is insufficient. It recommends relational network analytics based on shared devices/IP addresses, common counterparties and similar transaction patterns, as well as continuous monitoring supported by artificial intelligence where possible.
- Active preventive measures required before filing an STR: The guide stresses that filing a suspicious transaction report (“STR”) alone is insufficient. Obliged parties are expected to implement preventive measures such as contacting the customer, requesting information/documents, restricting channels and products, lowering transaction limits, limiting access to mobile/internet banking and, where necessary, terminating the business relationship.
- Criminal liability warning: The guide expressly states that knowingly and deliberately continuing transactions despite awareness of known money mule account networks may, depending on the circumstances of the case, be subject to judicial assessment under the provisions on participation in the money laundering offence set out in Article 282 of the Turkish Criminal Code No. 5237.
- Sector-specific risk indicators: Specific risk indicators are listed separately for banks, payment and electronic money institutions, crypto-asset service providers, authorised institutions, jewelers, brokerage firms, certified public accountants and sworn-in certified public accountants (SMMM/YMM), notaries and lawyers. Examples include powers of attorney concentrated in favour of the same proxy at notaries and broad financial authorisations granted following company incorporation or transfer in the case of lawyers.
The guide expects obliged parties to strengthen their customer due diligence, risk management, monitoring and control processes in light of money mule-account risks; invest in relational/network-based analytical capabilities alongside individual compliance checks; and document concrete preventive steps taken before filing an STR. It would be advisable to review sector-specific risk indicators and internal policies in light of the guide.
