A corporate compliance lawyer in Turkey builds and defends a foreign-owned company’s compliance programme under KVKK, MASAK, bribery and 2026 competition rules.
Most foreign groups arrive in Turkey with a compliance manual already written. It has a code of conduct, an anti-bribery policy, a data protection notice and a whistleblowing hotline, usually drafted in Frankfurt, London or New York and translated with care. The manual travels well. The obligations it is meant to satisfy do not travel at all, because Turkish regulators enforce Turkish mechanics: registrations, notifications, board resolutions, statutory books and procedural deadlines that no group template anticipates.
Oznur & Partners is an Istanbul-based international law firm, founded in 2015 by Attorney Fatih Oznur and building upon his family’s legal practice tradition rooted in the 1990s. The firm is a Legal 500 EMEA 2025 Exclusive Contributor for Corporate & Immigration (the only such firm in Turkey) and Turkey’s exclusive representative firm in Chambers and Partners 2026 for Corporate Immigration. Our corporate compliance work sits next to our M&A, banking and dispute resolution practices, which is where most compliance failures eventually surface.
Group compliance officers who manage a Turkish subsidiary from abroad often put the question to us directly: “What does a corporate compliance lawyer in Turkey do that our own compliance team cannot?” The answer is translation in the legal sense, not the linguistic one. A Turkish compliance lawyer converts a group policy into the specific filings, contracts, board decisions and regulator procedures that make the policy enforceable in Turkey, and then defends that structure when the Personal Data Protection Authority, the Competition Authority or the Financial Crimes Investigation Board asks for evidence.
Timing is the second question, and it is usually asked too late: “When does a Turkish subsidiary need its own compliance review?” A Turkish entity needs its own review at four moments: at formation or acquisition, before its first cross-border transfer of personal data, when it receives its first letter from a Turkish regulator, and when its workforce reaches the size at which Turkish job security rules begin to apply. Waiting for the fourth moment is common. Waiting for the third is expensive.
Foreign parent companies also ask a sharper question once they understand how Turkish liability works: “Which compliance risk do foreign parents most often underestimate in Turkey?” In Turkey, a company cannot commit a crime, yet it can still pay for one. Turkish criminal law does not impose criminal penalties on legal persons, but Article 43/A of the Misdemeanours Law allows an administrative fine against the company when an employee, representative or organ commits bribery, money laundering, fraud or certain other offences for the company’s benefit, and the fine no longer waits for the criminal case against the individual to finish.
The last question tends to come from boards that believe the work is already done: “How compliant is a Turkish subsidiary that has adopted every group policy?” Often it holds a well-documented gap. The policies exist, they are signed and filed, and none of them has been connected to the Turkish obligation it was supposed to meet (the standard contract that was never notified, the board resolution that was never registered, the employee monitoring clause that predates the 2026 KVKK principle decision). That gap is invisible until someone outside the company looks for it.
⚖️ What Does a Corporate Compliance Lawyer in Turkey Actually Do?
A corporate compliance lawyer in Turkey does three things that a policy cannot do by itself: maps which Turkish rules apply to a specific entity, builds the documents and filings those rules require, and represents the company when a regulator, an employee or a counterparty tests whether the system works. Each of the three is separate work. Mapping without building produces a risk memo nobody implements. Building without defence produces a programme that collapses the first time it is challenged.
The mapping stage is where foreign groups are most often surprised. Turkish compliance is not one regime but several, each with its own regulator, its own procedural language and its own sanction logic. Personal data sits with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu). Competition sits with the Turkish Competition Authority (Rekabet Kurumu). Anti-money laundering sits with the Financial Crimes Investigation Board (Mali Suçları Araştırma Kurulu, MASAK). Corporate housekeeping sits with the trade registry under the Ministry of Trade. Bribery sits with public prosecutors. A Turkish subsidiary of fifty people can answer to all five in the same year.
The building stage is less glamorous and far more decisive. It produces privacy notices that match the actual data flows, standard contracts for cross-border transfers and their notification to the Authority, distribution agreements reviewed for competition exposure, gifts and hospitality rules adapted to Turkish public procurement practice, board resolutions that give compliance officers real authority, and employment documents that let an internal investigation proceed without creating a second violation. None of it is exotic. All of it has to be done in a Turkish legal form that a Turkish regulator will recognise.
The defence stage is where the earlier work is either vindicated or exposed. A dawn raid by the Competition Authority, a data breach that must be reported within a fixed window, a complaint from a dismissed employee, an information request from MASAK: in each case the company’s position depends on what it can show, not on what its policy says. Our role at that point is to present the record, protect privilege where Turkish procedure allows it, and keep the response consistent across regulators who do not coordinate with one another.
There is a quieter fourth function. Compliance in Turkey is a moving target, and the rules that governed a subsidiary at formation are rarely the rules that govern it five years later. Merger control thresholds changed in February 2026. The competition fining framework was rewritten at the end of 2024. Cross-border data transfer rules were overhauled in 2024, and a new principle decision on employee communications followed in October 2026. A compliance lawyer who only builds and never revisits leaves the client with a structure that slowly drifts out of alignment, not through any single failure but through the steady accumulation of unaddressed change.
⚖️ Why Is a Global Compliance Policy Not Enough in Turkey?
A global compliance policy is not enough in Turkey because Turkish regulators assess compliance through Turkish procedural acts, and a group policy rarely produces those acts on its own. The policy says the company protects personal data; the Personal Data Protection Authority asks whether the standard contract for a transfer to the parent was notified within five business days. The policy says the company does not tolerate bribery; the prosecutor asks who approved the payment and whether the company benefited.
Consider two subsidiaries we have seen in practice, both owned by the same kind of European group, both carrying identical policies. In the first, the group data protection notice had been translated and posted, the intercompany data processing agreement had been signed, and nobody had noticed that the 2024 amendments required a different instrument for transfers abroad and a filing in Turkey. In the second, the local general manager had asked for a Turkish review before the first payroll export to the parent. The policies were the same. The exposure was not.
The pattern repeats across every regime. Global anti-bribery policies are written around the US Foreign Corrupt Practices Act and the UK Bribery Act, which is sensible for the group, but Turkish exposure runs through Article 252 of the Turkish Penal Code and Article 43/A of the Misdemeanours Law, which work differently. Global competition policies focus on cartels and dominance; Turkish enforcement also reaches resale price maintenance in ordinary distribution networks. Global whistleblowing policies assume a statutory protection regime that Turkey does not have.
None of this means the group policy should be discarded. The group policy is the right starting point, and Turkish regulators do look favourably on a company that can show a serious, documented programme. The point is narrower: the policy has to be anchored to Turkish law, clause by clause, by someone who knows which Turkish act each clause is supposed to trigger. That anchoring is what we do, and it is usually a matter of weeks of focused work rather than a rebuild.
Foreign investors increasingly ask us a version of the same question from the other direction: “If our policy is already aligned with GDPR, is our Turkish data protection position safe?” Alignment with GDPR helps, because the 2024 KVKK amendments moved Turkish rules closer to the European model, but it does not settle the Turkish position. Turkey has its own transfer instruments, its own notification duty, its own breach reporting practice and its own registry, and a GDPR-compliant group can still be non-compliant in Istanbul on the day the Authority opens a file.
⚖️ How Oznur & Partners Builds Compliance for Foreign-Owned Companies
We build compliance for foreign-owned companies the way a regulator will later read it: entity by entity, obligation by obligation, with a document trail for each. Our starting assumption is that the client already has policies. Our job is to find out which Turkish obligations those policies actually satisfy, which they only appear to satisfy, and which they do not touch at all.
The work begins with a structured review of the Turkish entity (its articles of association, board and general assembly records, data flows, intercompany agreements, distribution and agency contracts, employment documents, and any correspondence with Turkish authorities). We do not send a questionnaire and wait. We read the documents, because what a company believes it has filed and what the trade registry shows are often different things.
From that review we produce a gap map ranked by exposure, not by volume. A missing standard contract notification sits above an outdated privacy notice; an unregistered board resolution on signatory authority sits above a cosmetic inconsistency in the employee handbook. The client sees, on one page, what needs to happen this month, this quarter and this year, and who in the organisation owns each item.
Remediation follows in Turkish legal form. We draft and file what needs filing, rewrite what needs rewriting, and leave the rest alone. Where group policy and Turkish law conflict, we say so plainly and propose a local addendum rather than a silent deviation, because a regulator who finds an undocumented local practice will treat it as a breach of the group policy as well as of Turkish law.
Finally, we stay. Most of our compliance clients keep us on a retainer that covers regulatory change monitoring, board-level reporting and first response when an authority makes contact. The retainer exists because Turkish compliance is maintenance work. A structure that was correct at the time of review and then left untouched for three years is, in our experience, the most common source of the problems we are later asked to solve.
Not sure which Turkish obligations your group policies actually cover?
Send us your Turkish entity’s documents and we will tell you where the policy and the filing record part ways.
⚖️ Can a Company Be Fined for an Employee’s Bribe in Turkey?
A company can be fined in Turkey for a bribe paid by its employee, representative or organ if the bribe was paid for the company’s benefit. Turkish criminal law does not impose criminal penalties on legal persons, so the company itself is not prosecuted, but Article 43/A of the Misdemeanours Law No. 5326 (Kabahatler Kanunu) imposes an administrative fine on the legal person in addition to the criminal case against the individual.
Article 43/A of the Misdemeanours Law, as currently worded, sets the administrative fine against the legal person between TRY 10,000 and TRY 50 million. The provision applies where the offence is committed by an organ or representative of the company, or by a person who performs a function within the company’s activities, and where the offence is committed for the company’s benefit. The fine applies only where no heavier administrative fine is provided for the same conduct.
Article 43/A covers more than bribery. The listed offences include bribery under Article 252 of the Turkish Penal Code, laundering of proceeds of crime, fraud, bid rigging, smuggling and the financing of terrorism, among others. A compliance programme that addresses only bribery leaves the company exposed to the same administrative fine for the other listed offences, several of which arise in ordinary procurement, customs and payment operations.
Article 43/A no longer requires the authorities to wait for the outcome of the criminal case against the individual. A fine under Article 43/A can be imposed without waiting for the investigation or prosecution of the person who committed the act to be completed. If the investigation or prosecution later establishes that the offence was not committed for the company’s benefit, the fine is lifted and, if already collected, refunded.
The timing rule in Article 43/A changes how a Turkish subsidiary should respond to a bribery allegation. Under the earlier logic, a company could treat the criminal case against the employee as the main event and wait for its result. Under the current wording, the administrative case against the company can move first, which means the company needs its own evidence of controls, approvals and benefit analysis ready at the start, not at the end.
Article 60 of the Turkish Penal Code adds a second layer of exposure. Where a legal person operating under a licence granted by a public authority benefits from an intentional crime committed through the abuse of that licence, the court may order security measures against the legal person, including cancellation of the licence and confiscation. For companies in regulated sectors such as energy, finance, aviation or pharmaceuticals, the licence is often worth more than any fine.
Individual exposure under Article 252 of the Turkish Penal Code is significant. A person who provides a benefit to a public official, directly or through intermediaries, to have the official do or not do something related to the official’s duties faces imprisonment of four to twelve years. Article 252 also extends to bribery of foreign public officials, officials of international organisations and certain other persons performing public functions for a foreign state.
An anti-bribery programme for a Turkish subsidiary therefore has to do three things that a global policy rarely does on its own. It has to identify where the subsidiary meets public officials (customs, permits, tax inspections, public tenders, state-owned customers). It has to document the approval chain for any benefit given in those settings. It has to make the company’s own position on benefit defensible early, because Article 43/A proceedings can begin before anyone has been charged.
Third-party risk deserves separate attention. Turkish bribery liability reaches benefits provided “through intermediaries”, and agents, customs brokers, consultants and distributors are the most common route. Due diligence on intermediaries, written anti-bribery undertakings, audit rights and termination clauses for breach are standard tools. For transactions, we coordinate anti-bribery diligence with our due diligence work on Turkish targets, because historic payments by a target become the buyer’s problem at closing.
Criminal defence is outside the scope of a compliance programme but sits close to it. When an allegation becomes an investigation, the company and the individual employee usually need separate counsel, and the interests of the two can diverge quickly. Our criminal defence team handles the individual side where appropriate; the compliance team keeps the company’s administrative and regulatory position consistent.
⚖️ Personal Data Protection (KVKK) for Foreign-Owned Companies
Every foreign-owned company that processes personal data in Turkey must comply with the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK), regardless of where its parent is incorporated. The KVKK applies to employee, customer and supplier data alike, and it is enforced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) through the Personal Data Protection Authority.
The KVKK rules on cross-border data transfers were rewritten by Law No. 7499, published in the Official Gazette on 12 March 2024. Transfers abroad now rest on an adequacy decision, on one of the appropriate safeguards set out in the law (standard contracts, binding corporate rules, undertakings, or agreements between public bodies), or, for incidental transfers only, on one of the listed exceptions. The implementing regulation on cross-border transfers was published on 10 July 2024.
The Personal Data Protection Board has published four types of standard contract for cross-border transfers: controller to controller, controller to processor, processor to processor and processor to controller. Each transfer must use the type that matches the actual relationship. Only the optional clauses may be adjusted; the core text of the chosen standard contract cannot be negotiated away.
A signed standard contract must be notified to the Personal Data Protection Authority within five business days of signature. The notification duty arises from Article 9 of the KVKK as amended, and since October 2024 notifications can be filed through the Authority’s online Standard Contract Notification Module. A standard contract that is signed but never notified leaves the transfer without a valid basis under Turkish law, even though the document itself is in the file.
For a Turkish subsidiary of a foreign group, the standard contract notification is the single most commonly missed KVKK obligation we see. Group data processing agreements signed before 2024, or signed under the European Union’s standard contractual clauses, do not replace the Turkish standard contract. Payroll exports, shared HR systems, group CRM platforms and cloud services hosted abroad usually all involve transfers that need a Turkish instrument.
Data breach reporting in Turkey runs on a 72-hour clock. Under Personal Data Protection Board Decision No. 2019/10, a data controller must notify the Board without delay and at the latest within 72 hours of becoming aware of a breach. If notification within 72 hours is not possible for a justified reason, the reasons for the delay must be explained to the Board together with the late notification. Affected individuals must be notified within the shortest reasonable time.
The Personal Data Protection Board publishes breach notifications on its website. Under Board Decision No. 2025/2451 of 25 December 2025, publication is limited to 60 days, and the announcement can be removed earlier if the data controller documents that affected individuals have already been notified. For a foreign-owned company, the published breach notice is often the first thing a journalist, competitor or counterparty finds.
Employee monitoring became a separate compliance item in October 2026. Principle Decision No. 2026/2035 of the Personal Data Protection Board, dated 16 September 2026 and published in the Official Gazette on 8 October 2026, sets the procedures and principles for employers monitoring corporate email accounts and other communication channels used for work. Monitoring must rest on a valid processing condition, observe the general principles of the KVKK, include notice to employees and be protected by data security measures.
Principle Decision No. 2026/2035 matters most during internal investigations. The instinct to search an employee’s mailbox after an allegation is exactly the act the decision regulates, and a company that investigates one breach by committing a second one weakens its position before both the Board and any labour court. Monitoring clauses in employment contracts and IT policies written before October 2026 should be reviewed against the decision.
KVKK compliance overlaps with technology work. Companies deploying AI tools, analytics platforms or automated decision systems in Turkey face KVKK questions at the design stage, and our information technology law team and artificial intelligence lawyers handle those projects alongside the compliance programme. Administrative fines under Article 18 of the KVKK are revalued annually, and we confirm the applicable amounts at the time of each assessment rather than quoting them in advance.
⚖️ Competition Law Compliance and Merger Control Thresholds in 2026
The Turkish Competition Board (Rekabet Kurulu) may impose administrative fines of up to 10 percent of an undertaking’s annual gross revenue for anti-competitive agreements, concerted practices, decisions of associations and abuse of dominance under the Law No. 4054 on the Protection of Competition. The ceiling applies to subsidiaries of foreign groups in the same way as to Turkish companies.
The method for calculating competition fines in Turkey changed at the end of 2024. The new Regulation on Fines for Restrictive Agreements, Concerted Practices, Decisions and Abuse of Dominance was published in the Official Gazette on 27 December 2024 (No. 32765). The new Regulation removed the earlier distinction between cartels and other infringements and the lower and upper limits of the base fine rates tied to that distinction. Aggravating and mitigating factors were redefined in line with Board practice.
The Turkish Competition Authority’s guidelines on the 2024 fining regulation, adopted by the Board on 13 February 2025, state that the listed mitigating factors are not exhaustive. The Board may take other circumstances into account when setting the final fine. A documented compliance programme is therefore relevant to the conversation about the fine, although we do not treat the guidelines as a promise of any specific reduction.
Merger control thresholds in Turkey increased in February 2026. Under Communiqué No. 2026/2, published in the Official Gazette on 11 February 2026 (No. 33165) and amending Communiqué No. 2010/4, a transaction requires Competition Board approval if the combined Turkish turnover of the parties exceeds TRY 3 billion and at least two parties each have Turkish turnover above TRY 1 billion.
A second threshold under Communiqué No. 2010/4, as amended in 2026, captures acquisitions where the target’s Turkish turnover exceeds TRY 1 billion and at least one other party has worldwide turnover above TRY 9 billion. For mergers, the same test applies where at least one party has Turkish turnover above TRY 1 billion. The earlier thresholds of TRY 750 million, TRY 250 million and TRY 3 billion no longer apply to transactions after 11 February 2026.
Transactions involving technology undertakings follow a separate rule. Under the 2026 amendment, where at least one technology undertaking established in Turkey is a party, a TRY 250 million turnover threshold applies on the side of the acquired party instead of the general TRY 1 billion threshold. Foreign buyers acquiring Turkish software, platform or digital businesses should test this lower threshold first, because it catches deals that look small by group standards.
Distribution networks are the most common source of competition exposure for foreign-owned subsidiaries. Resale price maintenance, territorial restrictions, non-compete obligations in dealer agreements and information exchange through trade associations all draw the Competition Authority’s attention. A review of distribution, agency and supply agreements against the block exemption rules is usually the first deliverable in a competition compliance project.
On-site inspections, commonly called dawn raids, test the programme in real time. The Competition Authority has treated obstruction of an inspection and deletion of data during an inspection as separate infringements with their own fines. Dawn raid protocols, reception training for front desk and IT staff, and a lawyer who can reach the premises quickly are practical elements of competition compliance, not formalities.
Merger control and competition compliance connect directly to our transactional work. Our M&A lawyers assess filing requirements at term sheet stage, and the competition team reviews the target’s commercial agreements for historic infringements that could transfer to the buyer. For joint ventures, the coordination analysis introduced by the 2026 amendment is part of the same review.
⚖️ Anti-Money Laundering Obligations: Who Is an Obliged Party in Turkey?
An ordinary commercial company in Turkey is not, by default, an obliged party under Turkish anti-money laundering rules. Obliged parties are listed in Article 4 of the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism, and the list covers banks, most financial institutions, payment and electronic money institutions, crypto asset service providers and specified non-financial businesses and professions.
The Turkish anti-money laundering framework rests on Law No. 5549 on the Prevention of Laundering Proceeds of Crime and is supervised by the Financial Crimes Investigation Board (MASAK). Obliged parties must identify customers, report suspicious transactions, keep records and, for certain categories, operate a full compliance programme with a designated compliance officer.
Record retention under Article 8 of Law No. 5549 is eight years. Obliged parties must keep documents relating to transactions and customer identification for eight years and produce them on request. Under Article 4(2) of Law No. 5549, the fact that a suspicious transaction report has been filed cannot be disclosed to anyone, including the parties to the transaction.
Customer identification thresholds were doubled in October 2026. An amendment to the Regulation on Measures published in the Official Gazette on 7 October 2026 (No. 33393) raised the identification threshold for single or linked transactions from TRY 185,000 to TRY 370,000, and the threshold for electronic transfers from TRY 15,000 to TRY 30,000. Suspicious transactions must still be reported regardless of amount.
Transaction postponement under Article 19/A of Law No. 5549 is a separate power. The Minister may decide to postpone a transaction for up to seven business days where there are serious indications of laundering or terrorism financing. The article contains no extension provision; after the postponement period, any further restriction requires a seizure order under the Code of Criminal Procedure.
Non-obliged companies still meet MASAK indirectly. Their banks apply customer due diligence to them, ask for beneficial ownership information, question unusual payment patterns and may decline transactions they cannot verify. A foreign-owned subsidiary that cannot explain its own ownership chain or the commercial purpose of an intercompany payment will experience MASAK rules as banking friction, even though no MASAK obligation applies to it directly.
The full MASAK framework, including the October 2026 amendments, the compliance officer licensing system and the rules on held transfers, is covered in our dedicated guide to MASAK compliance in Turkey. Corporate compliance work for obliged parties is coordinated with our banking and finance lawyers, who handle licensing and regulatory relationships with the banking and capital markets authorities.
⚖️ Corporate Governance and Statutory Housekeeping under the TCC
Corporate governance compliance in Turkey means keeping a company’s legal existence in order under the Turkish Commercial Code No. 6102 (Türk Ticaret Kanunu, TCC): board and general assembly resolutions, statutory books, share ledgers, signatory circulars, trade registry filings and, for audited companies, financial statements and websites. Most of the obligations are routine. The consequences of missing them are not.
Capital companies subject to independent audit must open a website within three months of their registration with the trade registry and dedicate a section of it to the announcements the company is legally required to make. The obligation arises from Article 1524 of the TCC and applies to joint stock and limited liability companies that fall within the independent audit thresholds set by Presidential decision.
For audited companies, the consequence of skipping the audit is severe. Under Article 397(2) of the TCC, financial statements and the annual report of a company subject to audit that have not been audited are deemed not to have been prepared. Every resolution that depends on those statements, including the general assembly’s approval of the accounts and the release of directors, is exposed as a result.
Signatory authority is the governance issue foreign groups most often underestimate. A Turkish company is bound by the persons whose authority is registered with the trade registry, not by the group’s internal delegation matrix. Where a general manager has been replaced at group level but the signatory circular has not been updated in Turkey, the former manager may still appear authorised to third parties.
Governance and compliance overlap at board level. The board is the organ that can make a compliance officer’s authority real, approve a code of ethics, receive compliance reporting and authorise an internal investigation. A compliance programme without a supporting board resolution exists only as a group document. The detailed governance framework, including board structures and director liability, is covered by our corporate governance lawyers.
Listed companies carry additional duties. The Capital Markets Board of Turkey (Sermaye Piyasası Kurulu, SPK) Communiqué on Corporate Governance requires listed companies to govern their activities by a code of ethics disclosed to the public on their websites. Our capital markets lawyers advise listed issuers and brokerage firms on disclosure and governance obligations under the Capital Markets Law No. 6362.
Day-to-day corporate housekeeping, including general assemblies, capital changes, registered address changes and branch openings, is handled by our corporate law team. For new entities, compliance architecture is easier to build at formation than to retrofit, and our company formation lawyers set up signatory structures, articles and initial registrations with the compliance programme in mind.
⚖️ Do We Need a Whistleblowing Hotline in Turkey?
Turkish law does not require private companies to establish a whistleblowing hotline, and Turkey has no standalone whistleblower protection statute. A Turkish subsidiary may still need a reporting channel, because group policies, international lenders, US and UK anti-bribery regimes and the expectations of Turkish regulators assessing a compliance programme all assume one exists.
Protection for employees who report misconduct in Turkey comes mainly from the job security rules of the Labour Law No. 4857 (İş Kanunu). Under Article 18 of the Labour Law, an employer that terminates the indefinite-term contract of an employee with at least six months of service, in a workplace employing thirty or more employees, must rely on a valid reason related to the employee’s capacity, conduct or the requirements of the business.
The Labour Law threshold creates two different positions inside the same group. A whistleblower in a Turkish workplace with thirty or more employees and at least six months of service can challenge a retaliatory dismissal and seek reinstatement. A whistleblower in a smaller workplace, or with less than six months of service, relies on general principles of good faith and equal treatment, which offer weaker practical protection.
Internal investigations in Turkey must be designed to survive two reviews: the Personal Data Protection Board’s review of how evidence was collected, and a labour court’s review of any disciplinary outcome. Principle Decision No. 2026/2035 on monitoring of work communications governs the first. Documented procedure, proportionate collection, the right to respond and a reasoned decision govern the second.
A Turkish reporting channel should therefore be written as a Turkish document, not only translated. It needs a lawful processing basis and notice for the data collected through reports, a defined retention period, rules on who may access reports, protection of the reporter’s identity within the limits of Turkish procedure, and a link to the disciplinary procedure in the employment contracts. Our employment lawyers align the reporting channel with the workplace rules that make it enforceable.
The scope of a reporting channel is limited. A hotline does not replace legal reporting duties where they exist, such as suspicious transaction reporting by MASAK obliged parties or notification of a data breach to the Personal Data Protection Board within 72 hours. A report received through the hotline may trigger those duties, and the procedure should say who decides when it does.
⚖️ Global Policy Compared with a Turkish-Ready Compliance Programme
A group policy and a Turkish-ready programme differ in what they produce, not in what they say. The table below compares the two on the eight obligations that most often decide a Turkish regulator’s view of a foreign-owned subsidiary, from data transfers to the corporate website.
| Area | Group policy alone | Turkish-ready programme |
|---|---|---|
| Cross-border data transfer | Intercompany DPA or EU standard contractual clauses | KVKK standard contract of the correct type, notified to the Authority within 5 business days |
| Data breach | Group incident response plan | Turkish breach response plan with a 72-hour Board notification path and named local owner |
| Anti-bribery | FCPA and UK Bribery Act policy | Controls mapped to TCK Article 252 and Misdemeanours Law Article 43/A, with evidence ready before any prosecution |
| Merger control | Group antitrust filing checklist | Test against the 2026 thresholds of TRY 3 billion, TRY 1 billion and TRY 9 billion, plus the TRY 250 million technology rule |
| Employee monitoring | Group acceptable use policy | Monitoring rules reviewed against Principle Decision No. 2026/2035 |
| Whistleblowing | Global hotline assuming statutory protection | Turkish reporting procedure linked to Labour Law Article 18 and KVKK notice |
| Signatory authority | Internal delegation matrix | Registered signatory circular updated at the trade registry |
| Corporate website | Group website | TCC Article 1524 website for audited companies, opened within 3 months of registration |
Each row in the comparison is a separate decision point. A Turkish subsidiary can be fully aligned in one row and exposed in the next, and regulators assess the rows independently. A compliance review should therefore produce a row-by-row answer, not a general rating.
⚖️ When Should a Foreign Company Bring In a Compliance Lawyer?
A foreign company should bring in a Turkish compliance lawyer before the first act that creates a Turkish obligation, not after the first regulator letter. In practice the decisive moments are formation or acquisition, the first cross-border transfer of personal data, the first distribution or agency agreement, the first contact with public procurement, and any event that raises the workforce above thirty employees.
At formation, compliance architecture costs least. Articles of association, signatory structure, board composition and the first data flows can be designed correctly from the start. A Turkish company that is subject to independent audit has three months from trade registry registration to open its TCC Article 1524 website, and that deadline arrives before most groups have appointed a local finance team.
At acquisition, compliance is a valuation question. Historic bribery, competition infringements, unnotified data transfers and governance defects in the target pass to the buyer with the shares. Compliance diligence before signing, and representations, indemnities and closing conditions that reflect what diligence found, are the buyer’s main protection.
Before the first cross-border data transfer, the standard contract must be in place. Transfers that begin before the correct KVKK standard contract has been signed and notified within five business days start without a valid Turkish basis. Shared HR and payroll systems are the most common trigger, and they usually go live on a date set by the group IT calendar rather than by Turkish law.
After a regulator makes contact, the response window is short. A Personal Data Protection Board information request, a Competition Authority inspection or a MASAK request for documents each run on their own deadlines, and the first response often fixes the company’s position for the rest of the proceeding. A compliance lawyer engaged at this stage works with the record as it exists; one engaged earlier helps decide what the record contains.
⚖️ How to Choose a Corporate Compliance Lawyer in Turkey
Choose a corporate compliance lawyer in Turkey by testing what the lawyer can produce for a Turkish regulator, not by the length of the services list. Five criteria separate practical compliance counsel from general advisory: regulator-specific knowledge, document output, coordination with group counsel, transactional and litigation backup, and verifiable third-party recognition.
Regulator-specific knowledge is the first test. Ask the candidate how a standard contract is notified, what the 72-hour breach notification period runs from, which merger thresholds apply after February 2026 and how Article 43/A proceedings relate to a criminal case against an employee. Precise answers indicate current practice; general answers indicate a policy reviewer.
Document output is the second test. A useful compliance engagement produces filings, contracts, resolutions and procedures in Turkish legal form, ready to sign or submit. A report that lists risks without drafting the instruments that resolve them transfers the work back to the client.
Coordination with group counsel is the third test. Foreign-owned subsidiaries sit inside group compliance frameworks, and the Turkish lawyer has to work with in-house teams in other jurisdictions, in English, on the group’s reporting cycle. Local addenda should be explicit and documented, so that group and local positions never contradict each other silently.
Transactional and litigation backup is the fourth test. Compliance failures surface in transactions, disputes and investigations. A compliance lawyer whose firm also handles M&A, banking and dispute resolution can follow the issue through to its end without a handover, and without a new team relearning the client’s structure.
Third-party recognition is the fifth test, and it should be verifiable. Directory listings such as Legal 500 and Chambers and Partners can be checked independently on the directories’ own websites. Our guide on how to verify a lawyer in Turkey explains how to confirm bar registration and directory status before engagement.
⚖️ Why Foreign Companies Work with Oznur & Partners on Compliance
Oznur & Partners was founded in 2015 by Attorney Fatih Oznur, building upon his family’s legal practice tradition rooted in the 1990s. The firm’s 14 legal professionals work at the intersection of Turkish law and international business, and the firm’s practice is built around foreign investors and foreign-owned companies operating in Turkey.
Oznur & Partners is a Legal 500 EMEA 2025 Exclusive Contributor for Corporate & Immigration, the only such firm in Turkey, and Turkey’s exclusive representative firm in Chambers and Partners 2026 for Corporate Immigration. Both recognitions can be checked on the directories’ own platforms. Further details on the founder are available on the profile of Attorney Fatih Oznur.
Compliance at Oznur & Partners is not a stand-alone department. The same team advises on corporate structuring, M&A, banking and finance, capital markets, corporate immigration and dispute resolution. A KVKK question about a payroll transfer, a work permit question about a seconded compliance officer and a competition question about a new distributor can be answered in one engagement, under one fee arrangement, by people who already know the client’s structure.
Our client base includes major brokerage firms operating under Capital Markets Board supervision, which gives the team daily exposure to regulated-sector compliance: licensing, disclosure, customer due diligence and supervisory correspondence. The same discipline applies to unregulated subsidiaries, whose compliance obligations are fewer but whose regulators are no less exacting.
⚖️ How We Work with Group Compliance Teams Abroad
Oznur & Partners works with foreign compliance teams remotely as the default, not as an exception. Document review, gap mapping, drafting, board reporting and regulator correspondence are all handled without the client’s executives needing to travel to Turkey. Meetings run in English by video conference on the group’s schedule.
Where Turkish procedure requires a signature or a power of attorney, the document is executed in the client’s own country. A power of attorney signed before a notary abroad is legalised by apostille under the 1961 Hague Apostille Convention, translated into Turkish by a sworn translator and submitted in Turkey. For countries outside the Apostille Convention, legalisation through the Turkish consulate is the alternative. Our guide to power of attorney in Turkey sets out the steps.
Compliance officers seconded to Turkey need work permits and residence permits of their own. Our corporate immigration lawyers handle permits for foreign executives and specialists, which allows a group to place its own compliance staff in the Turkish entity without a separate adviser for the immigration side.
Reporting follows the client’s format. Some groups want a quarterly compliance dashboard for the board; others want short alerts only when Turkish law changes in a way that affects them. Either way, every report identifies the Turkish source of each change (Official Gazette date and number, Board decision number or communiqué number) so that group counsel can verify it independently.
⚖️ Who We Advise on Corporate Compliance
Oznur & Partners advises foreign-owned subsidiaries, branches and liaison offices in Turkey, foreign investors acquiring Turkish companies, and Turkish companies preparing for foreign investment or listing. Clients come from Russia, China, the United States, India, Argentina, Peru, Iran, Africa, the Middle East and Europe.
Sector experience shapes compliance priorities. Energy, pharmaceuticals, aviation and petrochemicals clients face licensing exposure under Article 60 of the Turkish Penal Code and heavy contact with public authorities. Finance and capital markets clients face MASAK and Capital Markets Board supervision. Technology clients face KVKK and the lower merger control threshold for technology targets. Real estate and export clients face customs, payment and beneficial ownership questions.
Country-specific guidance is available for several investor groups, covering the treaty, banking and structuring questions that sit alongside compliance: US investors expanding into Turkey, European investors, Chinese investors and Indian investors. Each guide covers the double tax treaty position, banking practice and the structures most often used by investors from that jurisdiction.
Further reading on the regulators referred to on this page is available from the Personal Data Protection Authority and the Turkish Competition Authority, both of which publish their decisions, guidelines and announcements online. Board decisions cited on this page, including Decision No. 2019/10 and Principle Decision No. 2026/2035, can be read in full on the regulators’ own sites.
⚖️ Related Legal Resources
🔹 Regulatory Compliance
MASAK Compliance in Turkey: obliged parties, the October 2026 identification thresholds of TRY 370,000 and TRY 30,000, and the eight-year record retention rule under Law No. 5549.
Banking and Finance Lawyer in Turkey: licensing, financing and regulatory relationships with the banking authority under the Banking Law No. 5411.
Capital Markets Lawyer in Turkey: disclosure and governance obligations under the Capital Markets Law No. 6362 and Capital Markets Board communiqués.
🔹 Corporate Structure and Transactions
Corporate Governance Lawyer in Turkey: board structures, director liability and general assembly procedure under the Turkish Commercial Code No. 6102.
Mergers and Acquisitions Lawyer in Turkey: deal structuring and Competition Board filings under the 2026 thresholds of TRY 3 billion and TRY 1 billion.
Due Diligence Lawyer in Turkey: legal review of Turkish targets, including historic compliance exposure that transfers to the buyer at closing.
Company Formation Lawyer: setting up joint stock and limited liability companies with signatory and governance structures built for compliance from day one.
🔹 People, Data and Technology
Employment Lawyer in Turkey: job security under Article 18 of the Labour Law No. 4857, disciplinary procedure and workplace policies.
Information Technology Law: KVKK, cross-border data transfers and technology contracts for companies operating in Turkey.
Corporate Immigration Lawyer in Turkey: work and residence permits for foreign executives, including compliance officers seconded to Turkey.
Schedule a Legal Consultation
Whether your Turkish subsidiary is preparing for its first data transfer, facing a regulator’s request or about to be acquired, our Corporate Compliance Lawyers in Istanbul can review the record and tell you where it stands.
⚖️ Conclusion: The Gap Is Found by Someone
Every foreign-owned company in Turkey has a compliance position, whether or not it has examined one. The policies arrived with the investment; the Turkish obligations arrived with the first employee, the first data transfer and the first contract. The only open question is who measures the distance between the two first.
When the company measures it, the result is a list of filings, contracts and resolutions, worked through on the company’s own timetable. When a regulator measures it, the same list arrives as a file number, a deadline and, under Article 43/A, possibly a fine that does not wait for anyone’s trial. The work is the same in both cases. The order in which it happens is what changes the outcome.
A Turkish subsidiary that has done the work does not look different from the outside. Its manual is the same manual. What differs is that every clause in it now points to something real in Turkey: a notified contract, a registered signatory, a reporting channel a labour court would recognise, a monitoring rule that respects the 2026 principle decision. That is the whole of corporate compliance in Turkey, and it is quieter than most groups expect.