Turkey TR

OFAC removed seven Turkish companies and individuals, including Megasan and Hidropark Hidrolik Pnömatik, from the Russia-EO14024 SDN list on 29 June 2026. These entities had previously been designated for supplying Russia's military-industrial base with dual-use electronics and machine tools. This is the first instance of OFAC simultaneously delisting an entire third-country group under the Russia sanctions program, which reads architecturally as a case study in how third-country sanctions-evasion networks can be dismantled at the entity level even where the underlying trade-flow risk (Turkish dual-use exports transiting toward Russia) is not itself eliminated. The delisting closes one specific chapter of the sanctions-evasion architecture tied to these named entities, but it should not be read as a resolution of the broader dual-use export exposure that Turkish trade routes to Russia continue to represent. No underlying OFAC SDN List update page was directly retrieved this cycle; the delisting is sourced via T3 legal commentary, which caps confidence at Probable pending primary-source corroboration. The absence of a corresponding new designation action against replacement entities is itself notable: architecture-over-incident framing suggests watching whether the trade-flow function these seven entities performed has simply migrated to undesignated intermediaries, since removing an entity from a list interdicts a name, not necessarily the underlying commercial relationship. Sanctions-evasion architecture in enabler-adjacent jurisdictions typically persists at the functional level even after specific designations are resolved, and Turkey's position as a dual-use trade conduit to Russia predates and likely postdates this specific delisting event.

Outlook

Watch for whether the underlying OFAC SDN List entry is directly retrieved and corroborated in a future cycle, and whether any replacement designation targets successor entities performing the same dual-use trade function. The delisting itself does not resolve the structural question of continued Turkish-origin dual-use flows toward Russia's military-industrial base, which remains the analytically significant open question behind this specific entity-level action.

Turkey sits outside the EU AML Package's direct supervisory perimeter as a non-EEA jurisdiction, but this cycle's most significant enabler-jurisdiction signal is domestic to Turkey's own enforcement posture rather than a European structural development. Istanbul prosecutors indicted 57 suspects alleging that a Malta-registered payment institution, Paymix (Finance Incorporated Ltd), together with an affiliated crypto entity, Fincrypto UAB, moved approximately TRY210 billion in illegal-betting proceeds through Turkish payment institutions into crypto assets and onward to overseas wallets, with sentences of 6 to 39 years sought. The entity continues to appear in current MFSA consumer information, which is the clearest evidence this cycle of a licensing-versus-supervision gap in the enabler-jurisdiction architecture: an EMI licensed in Malta and therefore nominally passportable within the EEA payments space was allegedly used as the rail for a large-scale illegal-gambling laundering operation into Turkey, with MASAK's cooperation feeding the Turkish prosecution. No T1 court filing was retrieved for the indictment itself, so confidence is capped at Probable pending primary-source corroboration; the finding rests on T2 secondary reporting.

Separately, Turkish officials publicly identified Cyprus, Georgia, North Macedonia and Armenia as hosting operators that knowingly target Turkish consumers, escalating the enabler-jurisdiction framing from domestic blocking measures to explicit diplomatic and economic retaliation threats against those states. This is a notable escalation in how Turkey characterises enabler-jurisdiction responsibility: rather than treating offshore hosting as a purely private-sector compliance failure, Turkish officials are now framing it as a matter for state-to-state pressure. Globally, the EU AML Package sets the structural direction for enabler-jurisdiction supervision within the EEA; in Turkey, the directly relevant developments are this domestic prosecutorial action against a Malta-licensed EMI's Turkish-facing conduct and the diplomatic escalation toward four named non-EU host jurisdictions.

Outlook

Watch for any supervisory response from Malta's MFSA regarding Paymix's continued licensure given the scale of the allegations, and for whether the named diplomatic pressure on Cyprus, Georgia, North Macedonia and Armenia produces any bilateral regulatory-cooperation development. A T1 court filing for the Paymix indictment, if retrieved in a future cycle, would materially raise confidence on the laundering-rail mechanism finding.

Turkey's own crypto-asset regulatory perimeter is the lead story for this jurisdiction's D5 exposure this cycle, not global structural developments. Law No. 7518, amending Capital Markets Law No. 6362, requires all crypto-asset service providers to hold an operating licence from the Capital Markets Board of Türkiye (CMB/SPK). Existing platforms were required to apply by 30 June 2025 and must obtain full licences by 30 June 2026; of the hundreds of platforms that had previously been operating, only 58 companies remained in the licensing pipeline under CMB fit-and-proper and information-security audit. This licensing consolidation is entering its final transition window and represents the most material structural development in Turkey's digital-asset regulatory environment this cycle.

Running in parallel with, and not yet displaced by, that licensing consolidation is the Paymix/Fincrypto indictment: prosecutors allege that approximately TRY210 billion in illegal-betting proceeds was moved through Turkish payment institutions into crypto assets via a network involving a Malta-registered EMI and an affiliated crypto firm, Fincrypto UAB, before reaching overseas wallets. The coexistence of an active, audit-driven CASP licensing regime with a live large-scale illegal-betting-to-crypto laundering rail illustrates that formal licensing consolidation and the interdiction of illicit crypto-conversion flows are proceeding on separate tracks, at least as of this cycle: the CASP regime targets who may lawfully operate a crypto platform in Turkey, while the Paymix case concerns proceeds moved through payment institutions and crypto conversion outside that formal channel altogether. Both are Probable-confidence findings sourced from T3 practitioner commentary and T2 secondary reporting respectively; no primary CMB gazette text or T1 court filing was retrieved this cycle for either strand.

Outlook

Watch for the disposition of the 58 remaining CASP licence applicants as the 30 June 2026 deadline is reached, and for whether any enforcement action connects the formal CASP licensing track to the illegal-betting-to-crypto laundering rail exposed by the Paymix indictment.

FATF published Türkiye's fifth-round Mutual Evaluation on 23 September 2026, following a November 2025 onsite visit. The report rates Türkiye technically compliant or largely compliant on 38 of the 40 FATF Recommendations, while on the 11 Immediate Outcomes measuring effectiveness, only 3 are rated substantial and the remaining 8 are rated moderate. Turkish authorities, including MASAK and the Finance Ministry, have stated there is no near-term risk of Türkiye moving onto the FATF grey list (Increased monitoring) on the strength of this result. The technical-compliance improvement is a genuine architectural achievement, but the gap between strong technical-compliance scores and only moderate effectiveness outcomes is the more analytically significant reading: Türkiye has largely built the required legal framework, but supervision, beneficial-ownership transparency and other effectiveness dimensions have not yet caught up to the same standard.

That effectiveness gap has a concrete illustration this cycle in the beneficial-ownership space: Türkiye's beneficial-ownership disclosure regime operates via GİB Communiqué No. 529, a corporate-tax-return-based UBO disclosure mechanism, together with MASAK's greater-than-25%-shareholder identification test for obliged entities. No standalone public UBO register exists for non-listed companies, meaning legal ownership of such companies cannot be readily tracked by counterparties or supervisors outside the tax-filing channel. This structural gap is consistent with, and likely underlies, the moderate effectiveness rating on the relevant Immediate Outcome in the Mutual Evaluation.

Outlook

The Mutual Evaluation itself is the defining reference point for Türkiye's AML/CTF regime going forward; watch for any published follow-up action plan addressing the moderate-rated Immediate Outcomes, particularly around supervision and beneficial-ownership transparency, and for whether the beneficial-ownership disclosure architecture moves beyond the tax-declaration model toward a standalone public register.