A person sells USDT through a peer-to-peer marketplace. The Turkish lira reaches the seller’s bank account, the name appears plausible, and the cryptocurrency is released. Days later the bank account is restricted. A prosecutor’s file reveals that the payment came from someone who believed they were paying an investment adviser, an online merchant or a romantic partner. The fiat payment, the P2P order and the crypto transfer are all real—but they do not tell the same story.

This is the recurring difficulty in crypto P2P investigations in Turkey. The bank sees an incoming transfer from a complainant. The P2P platform sees a completed trade. The blockchain records a transfer or withdrawal, but not the conversation that caused it. Investigators must decide whether the account holder was the fraudster, a knowing facilitator, an unlicensed professional intermediary, a careless trader, or an ordinary seller caught in a triangular fraud.

That decision cannot safely be made from an IBAN, a wallet address or a risk score alone. It requires a reconstruction of three different ledgers, a legally accurate account of the trader’s role, and evidence of knowledge and intention. The same discipline is needed whether the file concerns a Turkish individual, a company managing crypto liquidity, a platform, a bank, or a foreign resident converting legitimate income into Turkish lira.

For legal advice on this matter, you may contact Av. Ahmet Karaca:

WhatsApp Email

Why P2P investigations are unusually easy to misread

A P2P trade compresses several relationships into one event. There may be a platform contract between buyer and seller, a bank transfer between different legal persons, an internal platform balance movement and a later on-chain withdrawal to a self-hosted wallet. In a clean trade these layers align. In a disputed trade, one identity may appear on the P2P order, another on the bank transfer and a third in the messages.

That mismatch is important, but it is not a verdict. A third-party payment can indicate fraud, money-mule activity, informal remittance, use of a company treasury, a family payment, or a breach of platform rules without criminal intent. Conversely, a perfect name match does not prove innocence if the account was opened or controlled by another person. The investigation must explain who controlled each account, who issued each instruction, what each participant knew at the relevant time, and where the economic benefit ended.

The practical starting point is the event record. “Merchant”, “victim”, “seller” and “wallet owner” describe possible roles; the records must establish which role each participant actually performed.

The three-ledger method: bank, platform and blockchain

A defensible P2P analysis reconciles three evidence systems. Each answers a different question and each has blind spots.

Evidence layer	What it can establish	What it cannot establish by itself
Bank and payment records	Sender and recipient accounts, amount, local timestamp, reference, channel, reversals and restrictions	Why the transfer was made; who controlled an account at the moment; whether crypto was delivered
P2P platform records	Order ID, verified user profiles, advertisement, quoted rate, payment window, dispute history, release event and internal balance movement	Whether the bank sender was deceived elsewhere; what happened outside the platform; later ownership of an external wallet
Blockchain records	Transaction hash, asset, network, block time, addresses, token contract, value and subsequent on-chain movement	The natural person behind an address; off-chain platform transfers; the legal purpose of a payment

The central working document should be a transaction-level reconciliation table. For every disputed payment it should place the bank value date and time, P2P order opening and release times, platform users, payer name, exchange rate, crypto amount, network, transaction hash and subsequent destination on one line. Time zones must be normalised—usually to UTC—with the original local timestamps preserved. A five-minute apparent contradiction often disappears when one export uses UTC, another uses Turkey time and a mobile screenshot shows the device’s travel-zone setting.

Internal platform movements require special care. If cryptocurrency was released from escrow into the buyer’s platform balance, there may be no public transaction hash at that stage. The relevant proof is the platform’s internal ledger. Blockchain analysis begins only when assets are deposited to or withdrawn from on-chain addresses. A report that invents a transaction hash for an off-chain event, or treats an exchange hot wallet as the suspect’s personal wallet, is not merely imprecise; it can reverse the meaning of the evidence. The underlying attribution discipline is examined in greater depth in our blockchain forensics and fund-tracing analysis.

Is crypto P2P trading legal in Turkey?

There is no blanket rule making every purchase or sale of crypto assets between individuals a criminal offence in Turkey. The decisive issue is what the person is actually doing. A holder converting their own assets is not automatically operating a platform or providing a regulated service. But the legal character changes when the activity is carried on regularly, commercially or professionally for the account of others.

Law No. 7518 brought crypto-asset service providers within the framework of the Capital Markets Law No. 6362. The Capital Markets Board of Turkey (CMB, or SPK in Turkish) then issued Communiqués III-35/B.1 and III-35/B.2, effective from 13 March 2025, covering establishment, authorisation, governance, records, custody, transfers, permitted services and capital adequacy. The CMB’s official announcement is the useful starting point for the current regulatory architecture.

The CMB’s September 2024 principle decision included a P2P-specific point on regular transactions in one’s own name for another’s account. Point 6 was subsequently repealed, as recorded in the CMB’s 2025/15 bulletin. It should not be presented as a current standalone rule. The relevant classification now requires the statute and Communiqué III-35/B.2, particularly Articles 5–6, applied to the actual service. Repeal does not create a blanket P2P exemption. Article 109/A of Law No. 6362 addresses unauthorised crypto service-provider activity.

There is no safe numerical formula such as “ten trades per month is personal” or “below this turnover no licence is needed”. The substance of the activity matters:

Are the assets and funds economically the trader’s own?
Does the person accept instructions or money from customers?
Are advertisements continuously available at a systematic spread?
Is the person matching third parties, holding their value or arranging settlement?
Are multiple bank accounts, employees, agents or an organised desk used?
Is income derived from proprietary trading risk, or from fees for transmitting value?
How does the person present the activity to counterparties and the public?

Payment-services law can create a separate perimeter. If an arrangement is in substance the receipt and transmission of funds for others, Law No. 6493 and the Central Bank of the Republic of Turkey’s authority over payment services may become relevant. The CBRT’s official payment-services materials explain that regulated payment services are governed by Law No. 6493 and secondary legislation. Calling a service “OTC”, “settlement support” or “P2P liquidity” does not decide its legal nature.

Platform status must also be checked precisely. The CMB expressly warns that inclusion in its “Operating Entities List” does not itself mean that the entity has been authorised under the applicable legislation. A platform’s current authorisation position and the evidential value of its records are separate questions.

The result is a role-based inquiry. Personal trading, proprietary corporate treasury activity, market making, operating a P2P venue, crypto brokerage and money transmission are not interchangeable. A criminal defence that discusses only fraud while ignoring the regulatory perimeter may leave a second, independent issue unanswered.

Why did a Turkish bank freeze an account after a USDT sale?

“The bank froze my account” is a description, not a legal basis. Several measures that feel identical to the customer have different authorities, durations and remedies.

Possible restriction	Typical source	Key point
Contractual or compliance restriction	Bank’s customer due-diligence, fraud or risk controls	The bank may request source-of-funds and transaction-purpose evidence; the precise contractual and factual basis should be identified
Postponement of transaction	Article 19/A of Law No. 5549 and its implementing framework	A suspicious attempted or ongoing transaction may be postponed for up to seven business days under the statutory process
Temporary suspension for specified cyber-enabled offences	Article 128/A of the Criminal Procedure Code	A bank, payment provider or crypto-asset service provider may suspend an account for up to 48 hours where the statutory conditions are met, with prompt prosecutorial notification
Judicial seizure	Criminal Procedure Code, including Articles 128 and 128/A	The measure is connected to a criminal file and must be examined against the order, suspected proceeds and proportionality
Attachment or another public-law measure	Enforcement, tax, administrative or sanctions framework	Not every inaccessible balance is a MASAK or prosecutor’s freeze

Article 19/A is commonly reduced online to a “seven-day freeze”. The official MASAK explanation is more precise: the period and starting point depend on the applicable postponement route, and the statutory measure concerns an attempted or ongoing transaction. A restriction that continues afterwards may rest on another legal basis. The customer therefore needs the institution, reference number, date, affected amount and scope of the measure—not a generic answer from a call centre.

Article 128/A, introduced into the Criminal Procedure Code in late 2025, creates a different mechanism for proceeds connected with specified offences committed through information systems, including relevant forms of theft, aggravated fraud and misuse of bank or credit cards. The financial institution may suspend the account for up to 48 hours and must notify the public prosecutor. During that period the suspected proceeds may be seized by judicial decision or, in urgent cases, by a prosecutor’s written order subject to judicial review. The provision also requires requested records from banks, payment-service providers and crypto-asset service providers to be sent within ten days. The official legislative text should be read for the exact conditions.

A useful application does not merely demand that “the block be removed”. It identifies the measure, distinguishes disputed proceeds from the account’s unrelated balance, supplies the reconciliation evidence, and asks the competent authority for a reasoned and proportionate review. Our broader Turkish-language guide to MASAK, prosecutor and bank-account restrictions compares the principal legal routes beyond the P2P context.

How a P2P seller becomes connected to a fraud complaint

The most common mechanism is triangular fraud. The fraudster manipulates a victim into sending money but gives the victim the P2P seller’s IBAN. At the same time, the fraudster opens a P2P buy order. When the victim’s transfer arrives, the seller believes the order has been paid and releases USDT. The victim loses fiat currency; the seller loses cryptocurrency; the fraudster obtains the crypto without exposing a bank account in their own name.

The offender recruits or deceives a victim through a fake investment, marketplace sale, task scheme, impersonation or social-engineering story.
The offender opens a P2P order to buy crypto from an unrelated seller.
The victim is instructed to send the demanded amount directly to the seller’s bank account.
The seller sees the correct amount and may see the order number in the transfer note, but the payer name does not match the platform buyer.
The seller releases the crypto to the platform buyer; the offender withdraws or rapidly disperses it.
The victim complains. The first visible domestic endpoint is the seller’s IBAN, so the seller’s account is restricted and the seller enters the investigation.

The mismatch between payer and P2P buyer is the scheme’s hinge. It is also why platform warnings against third-party payments matter. Yet breach of a warning is not automatically proof of participation in fraud. It may support an inference of recklessness or undermine a trader’s account, but criminal liability still requires the elements of a specific offence and an individual assessment of conduct and mental state.

Can selling USDT make the account holder a criminal suspect?

It can make the seller a suspect because the bank account provides an immediate evidential link. Suspect status, however, is not guilt. Turkish criminal law is based on personal criminal responsibility. The investigation must move beyond “the money arrived here” and examine what the person did and knew.

Depending on the facts, prosecutors may consider aggravated fraud under Article 158 of the Turkish Penal Code, theft by use of information systems under Article 142(2)(e), misuse of bank or credit cards under Article 245, laundering criminal proceeds under Article 282, and the rules on perpetration and assistance under Articles 37 to 40. These provisions have different physical and mental elements. They should not be treated as interchangeable labels for any suspicious transfer.

For a fraud theory, the file should connect the account holder to the deceit or to knowing assistance. For a laundering theory, the origin of the property, the alleged act of transferring abroad or subjecting it to transactions to conceal its illicit source or create an appearance of legitimacy, and the required knowledge must be analysed. For assistance, the concrete contribution and the person’s intent matter. Repeated use of accounts, unusual commissions, instructions to divide payments, false explanations, shared credentials or immediate forwarding may be probative. So may evidence pointing the other way: a genuine P2P order, market-consistent pricing, delivery of the seller’s own crypto, prior ordinary trades, a contemporaneous objection to a name mismatch, and absence of contact with the victim.

Neither side should overclaim. A transaction hash proves that a blockchain transaction occurred; it does not prove the legal purpose. A platform KYC profile identifies the registered user; it does not automatically establish who held the device. A bank account identifies its customer; it does not by itself identify the author of every instruction. Attribution grows from corroboration.

2026 update: the defined account-access participation provision

Law No. 7589, Article 13 added TCK Article 158(4). It provides a one-half sentence reduction where participation in the specified fraud offences is limited to supplying the listed payment instruments or means of account access for an unjust benefit, subject to its conditions. It is neither an immunity for renting an account nor an automatic reduction for every P2P trader. The underlying participation, intent, actual role, procedural stage and transitional rules must be examined separately. Older decisions should not be used without this temporal check.

The difference between a bad trade, negligence and knowing participation

P2P files often fail because every factual concern is converted into a conclusion about intent. A stronger analysis separates three questions.

First, what rule was broken? The seller may have ignored a platform rule requiring same-name payment. That is relevant, but it initially proves non-compliance with a trading safeguard.

Second, what risk was objectively visible? A single payment from a spouse with an explained relationship is different from twenty unrelated payers, scripted descriptions and a premium far above the market. The frequency, value, account age, communication and economic logic alter the inference.

Third, what did this person actually know and intend? Knowledge cannot be assumed from the technology used or the nationality of a counterparty. It may be inferred from facts, but the inference must remain tied to the record. The analyst should test an innocent-trader hypothesis and a knowing-facilitator hypothesis against the same timeline.

This is not an exercise in finding a favourable narrative. It is a method for exposing which narrative leaves unexplained evidence. A credible technical-legal report records facts that help and hurt its subject, distinguishes observation from inference, and states where platform data is still missing.

Russian and Ukrainian users: legitimate payment needs without a nationality shortcut

Many Russian and Ukrainian citizens living in Turkey use P2P markets for ordinary reasons: converting savings, receiving freelance income, paying rent and living costs, supporting family members, or moving value between banking systems that do not interoperate smoothly. War, relocation, capital controls, loss of access to a domestic account, correspondent-banking decisions and institution-specific restrictions can make conventional transfers slow, expensive or unavailable.

The proposition that “Russian citizens are banned from payment services” is too broad. Sanctions attach to particular jurisdictions, persons, entities, services and transactions, and their reach depends on the relevant legal system. The European Union has progressively restricted named banks, financial institutions and crypto providers and, in 2026, expanded restrictions concerning Russian-established crypto services. The Council of the European Union’s official sanctions overview shows why a service may be unavailable without turning nationality itself into proof of wrongdoing. The United States takes a similarly transaction- and person-specific approach: OFAC FAQ 1021 confirms that virtual-currency transactions involving blocked interests remain subject to sanctions rules.

For a Turkish investigation, this distinction matters in both directions. Nationality, residence or use of USDT cannot replace evidence of an offence. At the same time, a legitimate need for an alternative payment route does not neutralise a transaction with a designated person or a deliberate sanctions-evasion structure. Screening should use the relevant list as it stood on the transaction date, including aliases and ownership/control rules where applicable, and should record the result rather than merely state that a “sanctions check” was done.

A foreign resident’s evidential package often needs more than a Turkish bank statement. Useful records may include residence documents, foreign employment contracts, invoices, tax filings, salary statements, bank exports, exchange purchase history, wallet provenance, proof of travel, rental payments and a coherent explanation of why the chosen route was used. Critical foreign-language material should be translated accurately. Under the Criminal Procedure Code, a person who cannot adequately express themselves in Turkish has rights concerning interpretation; speed should not be purchased at the cost of a statement the person does not fully understand. A separate case-focused study on foreign residents, crypto P2P transactions and criminal liability develops these evidential issues in Turkish.

Red flags are questions, not convictions

The Financial Action Task Force identifies risk indicators relevant to virtual assets: irregular transaction patterns, unexplained volume, use of anonymity-enhancing methods, source-of-funds concerns, unlicensed P2P activity on behalf of others and bank accounts used to facilitate such activity. FATF also states an essential limitation: the presence of an indicator does not automatically mean that activity is illicit; the indicator must be assessed with the customer context and any logical business explanation. That principle appears in the official FATF virtual-asset red-flag guidance.

Observation	Possible risk interpretation	Evidence that tests the interpretation
Payments from names different from the P2P buyer	Triangular fraud, mule activity or informal remittance	Order chats, payer relationship, platform warning, dispute history and destination account
High number of trades	Professional service or unexplained business activity	Source of crypto, pricing model, accounting records, customer instructions and beneficial ownership
Rapid crypto withdrawal after release	Layering or dissipation	Historical trading routine, destination attribution, wallet control and subsequent use
Multiple bank accounts	Evasion of controls or distribution of proceeds	Account ownership, limits, business operations, consolidation pattern and device access
Russian-linked service or address	Sanctions or geographic exposure	Transaction-date screening, exact provider, counterparties, applicable jurisdiction and source of funds
Premium above market	Compensation for illicit risk	Contemporaneous local liquidity, payment method, size, volatility and repeated spread

In March 2026, FATF’s targeted report on stablecoins and unhosted-wallet P2P transactions again described both sides of the problem: stablecoins have legitimate uses arising from their stability, liquidity and interoperability, while direct wallet-to-wallet transactions can create heightened illicit-finance risk when regulated intermediaries and identifying information are absent. Proportionate analysis requires holding both facts at once.

How a serious P2P investigation should be conducted

1. Identify the legal measure and the exact disputed amount

Obtain the prosecutor’s office and file number, the date and issuer of any order, the bank’s restriction notice, and the amount actually associated with the complaint. Do not assume that the whole account balance is alleged proceeds. If the institution will not disclose information directly, the request should be directed through the competent procedural route.

2. Preserve volatile evidence before explaining the case

Export P2P orders, chats, account history, deposit and withdrawal records, bank statements and device data. Preserve original files and metadata. Screenshots are useful for orientation but weak as the sole record because they omit context and can be edited. Record where each item came from, when it was acquired, by whom and how integrity was checked. NIST’s digital-evidence preservation guidance emphasises documentation, integrity and chain of custody—principles equally valuable in a private technical examination.

3. Build a normalised chronology

Start before the disputed payment. Record advertisement creation, order opening, messages, the victim’s contact with the offender, bank transfer, payment confirmation, crypto release, withdrawal request, on-chain confirmation, account restriction and complaint. Preserve both original and converted time zones. If two events have only minute-level precision, do not claim second-level causation.

4. Reconcile each fiat payment with an actual order

Match by amount, time, payer, recipient, reference and order window. Identify one-to-many and many-to-one relationships. A round amount appearing in several orders cannot be matched by value alone. If the bank payment predates the order, or several users claim the same transfer, that inconsistency deserves explicit treatment.

5. Trace crypto without confusing custody

Validate the network and token contract; USDT on Ethereum, Tron and other networks are different ledger objects. Confirm decimals, transaction status and block time from an authoritative node or reliable explorer. Mark whether the transfer is a platform-internal ledger entry, a deposit, a withdrawal or a self-hosted-wallet transaction. Attribute a service wallet only when the evidential basis is documented.

6. Seek platform-native records

The strongest material often resides with the P2P venue: KYC files, order and advertisement logs, internal balance records, release confirmation, dispute tickets, login IPs, device identifiers, security changes, API keys, withdrawal addresses and Travel Rule data. A user’s export may preserve some of this, but official production can authenticate and complete it. Requests should specify identifiers and a time range; “send everything about this user” is slower and more likely to miss the exact issue.

7. Attribute control, not just registration

Registration evidence should be tested against device and behaviour evidence. Who controlled the phone and SIM? Which IP addresses and devices logged in? Was remote-access software present? Were credentials shared? Did the user create the advertisement, negotiate the trade and approve release? Did another device immediately withdraw the asset? Account ownership and operational control are separate propositions.

8. Test competing hypotheses

For each significant fact, ask how it behaves under at least two explanations. Third-party payment may support triangular fraud, but does the seller’s immediate message asking why the name differs support lack of knowledge? Repetition may suggest professional activity, but do accounting and treasury records show proprietary corporate trading? A high fee may indicate risk compensation, or reflect local liquidity at that hour. The report should show why one inference fits the complete record better than another.

9. Translate the technical result into legal propositions

A graph is not a legal analysis. The report should separate: verified fact; technical inference; attribution confidence; unresolved gap; and legal significance. “Address A sent 12,000 USDT to an exchange deposit address” is a fact-based technical proposition. “The suspect laundered criminal proceeds” is a legal conclusion requiring much more.

Evidence that should be preserved immediately

Complete bank account statements in machine-readable and official PDF form, including transaction references and value dates;
P2P order IDs, advertisement details, counterpart usernames, KYC name displayed at the time, rate, quantity and status;
Full in-platform chat exports and appeal or dispute records, not cropped selections;
Exchange account statements showing deposits, trades, internal transfers, fees, releases and withdrawals;
Blockchain transaction hashes, network names, token contract addresses and wallet addresses copied as text;
Emails and security alerts concerning logins, password resets, new devices or withdrawal addresses;
Messaging-app exports with attachment files and available metadata;
Source-of-funds records: salary, invoices, tax returns, sale agreements, prior crypto purchases and wallet history;
Contemporaneous market prices and the method used to calculate any spread or commission;
For companies, accounting entries, beneficial-ownership information, mandates, policies and employee access logs.

Do not delete the trading application, reset the phone, edit messages, ask counterparties to align their accounts, or circulate seed phrases and private keys as “evidence”. A public address and transaction hash are normally sufficient for blockchain review. Private signing material is not.

Technical tools—and the limits that matter in court

Investigators may use full nodes or RPC providers, block explorers, transaction decoders, graph-analysis platforms, sanctions-screening datasets, exchange records, mobile and computer forensic tools, timeline systems and spreadsheet or database reconciliation. The tool name is less important than a reproducible method.

Blockchain analytics commonly relies on clustering heuristics and service attribution. Some conclusions are strong—for example, a deposit address confirmed by the receiving exchange. Others are probabilistic, such as common-input ownership on certain UTXO networks or behavioural attribution across bridges. Smart-contract routers, omnibus wallets, account-abstraction systems, cross-chain bridges and exchange hot wallets can weaken naïve ownership assumptions.

A technically sound report therefore states:

the data source and retrieval time;
the network and chain identifier;
the token contract and decimal treatment;
the software or service used and relevant version where material;
the rule behind each cluster or label;
whether attribution is public, provider-supplied or independently confirmed;
the confidence level and plausible alternatives;
the difference between an address, a platform account and a natural person.

On-chain transparency is powerful, but it does not replace off-chain evidence. The decisive link is frequently the exchange’s internal ledger or device history, not another hop on the graph.

Four case patterns that require different answers

A Russian resident converts savings for living expenses

A Russian citizen lawfully residing in Turkey sells USDT acquired from documented salary savings. Most trades are paid from same-name counterparties. One payment comes from a third party who later reports an investment scam. The seller releases USDT to the platform buyer and has no contact with the complainant.

The analysis should verify the source and continuity of the USDT, identify the exact order, compare names, preserve chat warnings, establish where the released asset went and screen the relevant services and counterparties against transaction-date sanctions data. The seller’s nationality and use of P2P are not substitutes for proof of knowledge. The third-party payment remains a serious fact that must be explained, not hidden.

A Ukrainian professional moves earnings between countries

A Ukrainian software professional receives foreign freelance income, buys stablecoins abroad and periodically converts them to Turkish lira. A bank flags the volume as inconsistent with the profile recorded when the account was opened.

This may begin as a customer-due-diligence problem rather than a fraud case. Contracts, invoices, tax treatment, foreign bank flows, acquisition records and P2P orders should form one source-of-funds chain. An explanation supported only by wallet screenshots is incomplete because it does not show how the assets were earned.

A company runs high-volume “treasury” P2P activity

A Turkish company claims to trade only its own assets but continuously quotes prices, accepts transfers from hundreds of individuals and follows instructions from third parties. Staff operate several accounts and the company earns a fixed margin without material market exposure.

The issue is no longer limited to whether any incoming payment was fraudulent. The factual substance may raise unauthorised crypto-service and payment-service questions. Corporate books, client communications, ownership of funds, risk transfer, contractual model and public representations become central. A label chosen by the company cannot displace the actual flow of value.

A recruited account holder acts as a money mule

A person gives bank and exchange credentials to an organiser, receives a percentage, accepts payments from unrelated victims and sends assets onward immediately. Messages show instructions to keep amounts below thresholds and to describe them falsely.

Here, genuine blockchain transfers do not create an innocent trade. Control evidence, compensation, repeated victim-linked receipts, concealment instructions and false explanations may support knowing participation. The same three-ledger method applies, but the combined facts point in a different direction.

What banks, platforms and crypto businesses should retain

Good records solve P2P cases faster than broad risk labels. A bank should be able to identify the event that triggered review, the payments linked to a complaint and the legal basis of any continuing restriction. A platform should preserve the complete order object: both users, advertisement, payment method, messages, release authorisation, internal ledger movements, devices, security events and withdrawal destinations.

Turkey’s AML framework now imposes detailed duties on crypto-asset service providers. MASAK’s updated sector guide covers customer identification, remote identification, enhanced measures, the Travel Rule, politically exposed persons, suspicious-transaction reporting, records and compliance programmes. MASAK General Communiqué No. 29 also introduced enhanced controls including waiting periods for specified crypto withdrawals—at least 48 hours after purchase, swap or deposit and at least 72 hours for a first withdrawal—and limits for withdrawals of assets designed to maintain stable value, subject to the communiqué’s rules. The official text of Communiqué No. 29 is the controlling source.

These controls should not be confused with a judicial seizure or with proof that the customer committed a crime. They are preventive compliance measures. For institutions, the best operational design links alert, order, customer, bank transfer and wallet evidence under stable identifiers so the reason for a decision can later be reconstructed.

What to do when a P2P-related bank restriction or criminal investigation begins

Find the legal basis. Identify whether the issue is a bank review, a MASAK postponement, a 48-hour suspension under Article 128/A, a seizure order or another measure.
Preserve before communicating widely. Export records, retain originals and document devices. Do not improvise a story in multiple support channels.
Isolate the disputed transaction. Match the complaint amount to a P2P order and the associated crypto delivery.
Establish ownership and source of funds. Show when and how the sold crypto was obtained and whether it belonged economically to the seller.
Explain identity mismatches. If payer and buyer differ, identify what was visible, what the platform rules said and how the seller reacted.
Trace the benefit. Determine which platform account or wallet received the crypto and who controlled it.
Address the regulatory role. If trading was frequent or commercial, analyse whether it remained proprietary or became a service for others.
Present one coherent chronology. The written explanation, bank data, platform record and blockchain evidence should use the same identifiers and timestamps.
Request a proportionate decision. Distinguish alleged proceeds from unrelated assets and direct the application to the authority competent for the actual measure.

A technically impressive graph attached to an unstructured petition rarely solves the file. The decision-maker needs a clear proposition: which payment corresponds to which order, who received the crypto, what the account holder knew, and which records independently support that account.

Recovering assets and protecting the victim’s position

For the victim, speed matters because the first complaint may be the only opportunity to stop assets at a bank, payment provider or exchange. The report should preserve the fraudulent communication, bank receipt, platform or wallet identifiers and precise time. If the path reaches a custodial service, a narrowly framed preservation or information request is more useful than a generic assertion that “the crypto went to an exchange”. The immediate evidence-preservation sequence is set out separately in our guide on what crypto-fraud victims should do first.

Article 128/A expressly contemplates return of seized criminal proceeds to the injured owner when ownership is established. In practice, competing claims can arise: the complainant says the fiat is theirs, while the P2P seller shows that crypto of corresponding value was delivered. That is why the offender’s unjust enrichment and the two innocent parties’ respective positions must not be collapsed into a single bank transfer. Criminal seizure, restitution, civil claims and contractual rights may intersect but do not always answer the same question.

Cross-border preservation may require rapid cooperation with an overseas platform. Formal evidence and coercive measures remain matters for competent authorities. The Council of Europe’s 24/7 cybercrime contact network illustrates the importance of expedited international channels for electronic evidence; private requests do not replace them.

What a persuasive crypto P2P expert report looks like

A useful report is not a screenshot album and not a long recital of blockchain terminology. It gives the reader a reproducible path from source to conclusion. In a complex P2P file, the report should normally contain:

a precise mandate and the questions answered;
an inventory of materials received and material not obtained;
methods for acquisition, normalisation and integrity checking;
a participant and account map that avoids premature role labels;
a transaction reconciliation table joining fiat, platform and on-chain events;
a chronology with explicit time-zone handling;
address and service attribution with source and confidence;
analysis of device, login and control evidence where available;
both inculpatory and exculpatory observations;
alternative hypotheses and the evidence that discriminates between them;
a legal relevance section that does not usurp the court’s role;
annexes containing hashes, transaction IDs and legible primary records.

Visuals should clarify, not decorate. One flow chart showing the victim’s fiat, the seller’s USDT and the offender’s destination can be decisive. A “spaghetti graph” with hundreds of unexplained nodes usually is not. Where analytics produces a risk label, the report should identify the underlying exposure, number of hops, amount, date and limitations.

Questions that change the outcome of a P2P file

Did the bank sender and verified P2P buyer have the same identity? If not, what relationship or explanation existed at the time—not after the complaint?

Was cryptocurrency actually delivered? Establish the platform release and, if applicable, the on-chain withdrawal. A bank receipt alone cannot answer this.

Who controlled the receiving crypto account? KYC, devices, logins, withdrawals and communications should converge.

Whose assets were being traded? Personal holdings and proprietary treasury transactions differ from acting for customers.

Was the conduct occasional or organised? Regular advertisements, staff, multiple accounts, fixed commissions and customer instructions may alter the regulatory classification.

What was known before release? Later awareness of a complaint cannot be projected backwards. Contemporaneous warnings, messages and trading history carry more weight.

What exactly is frozen, by whom and under which provision? The available route depends on the answer.

Does a sanctions issue concern a listed person or service, or is it merely an assumption based on nationality? Only transaction-date, regime-specific screening can answer that question responsibly.

Continue from the P2P file to the wider evidence and defence framework

For the broader criminal-procedure framework, including participation, money laundering, CMK Article 128/A, digital-device evidence and foreign defendants, see Crypto Criminal Investigations in Turkey: MASAK, P2P and Defence. For the technical method used to test wallet labels, internal exchange ledgers, cross-chain transfers and control, see Blockchain Forensics in Turkey: Wallet Tracing and Digital Evidence. Victims looking for preservation, seizure and restitution strategy can continue with Crypto Fraud and Asset Recovery in Turkey.

A disciplined conclusion

Crypto P2P investigations in Turkey are not solved by deciding whether P2P is “legal” in the abstract. They are solved by identifying the person’s real role, separating preventive compliance action from criminal seizure, and making the three ledgers agree—or explaining precisely why they do not.

The hardest files often contain two innocent losses and one hidden beneficiary: a victim parts with fiat currency, a P2P seller parts with crypto, and the offender exploits the gap between banking identity and platform identity. Other files reveal something very different: organised third-party dealing, account rental, professional intermediation without authorisation or deliberate concealment of proceeds. The method must be capable of reaching either conclusion.

The decisive work is to preserve native records, reconcile every value transfer, attribute control carefully, test intent against contemporaneous evidence and connect the findings to the precise legal question. A conclusion should identify both the evidence that supports it and the missing records that could change it.

İlgili çalışma alanı: Kripto P2P Uyuşmazlıkları — Eşler arası (P2P) kripto alım satımı yapan bireyler; sahte dekont mağdurları ve işlem nedeniyle hesabı bloke edilenler.

Related English guides on Turkish P2P law

Use these guides for the transaction-specific questions:

Crypto P2P Investigations in Turkey: Bank Freezes, Criminal Liability and Defence