Bank account closed for AML: what can be corrected

• The bank's closure or refusal letter, emails and the dates.
• Account statements around the closure date and details of the refused transfers.
• Source-of-funds documents: payslips, tax returns, sale contracts, company accounts.
• For an old case: the court decision showing acquittal, dismissal or non-prosecution (beraat, düşme, kovuşturmaya yer olmadığı kararı), with a certified translation.
• Identity documents that separate you from someone with a similar name: passport, Turkish ID card, date and place of birth.
• For a company: Trade Registry Gazette (Ticaret Sicil Gazetesi), signature circular and an ownership chart.
• Copies of every request you send and proof of the date it was received.

• Asking the bank to show you its suspicious-activity report: it may not, in the U.S. or in Turkey.
• Disputing accurate information: agencies and controllers correct errors; erasure rights do not reach data a bank must keep by law (GDPR Art. 17(3)(b)).
• Missing the KVKK complaint window: 30 days after the reply, 60 days after the request.
• Requests without proper identification: U.S. agencies release files only after proper identification (15 U.S.C. 1681h(a)(1)).
• Treating a sanctions block as a data problem: if the bank cites OFAC, the route is an OFAC license or a delisting petition.

• Funds blocked or rejected under U.S. sanctions: see OFAC and sanctions.
• An INTERPOL notice or an extradition request: see extradition.
• A Turkish court order, asset freeze or criminal investigation: that is Turkish criminal law; see Turkish-law matters.
• Removing news articles or search results: that is a separate request to the publisher or search engine.

Who this is for

• People whose U.S. bank closed their account and who want to know which records it may have relied on.
• Turkish citizens whose account at a bank in Turkey was closed with little or no notice.
• Companies whose bank or payment-service accounts were closed after a compliance review.
• People with an old, dropped or acquitted case, or a name match, that keeps coming up in screening.

Key requirements

• Suspicious-activity reports are secret. A U.S. bank may not disclose a SAR, or any information that would reveal one, and must refuse even a subpoena (31 CFR 1020.320(e)). In Turkey a bank may not tell anyone, including the parties, that it reported a transaction to MASAK (Law No. 5549, Art. 4(2)).
• Turkish onboarding rules: a bank that cannot verify a customer's identity, or cannot get enough information on the purpose of the relationship, must not open it, and must end an existing one if re-verification fails (AML Measures Regulation, Art. 22).
• Notice in Turkey: under the Central Bank's payment-services rules, a provider may end an open-ended contract with at least one month's notice if the contract allows it. That notice rule does not apply when other law, such as AML rules, requires the provider to end the contract (Payment Services Regulation, Art. 45(3)).
• U.S. consumer reports: agencies that keep check-writing histories are “nationwide specialty consumer reporting agencies” (15 U.S.C. 1681a(x)). Each must give you your file once every 12 months on request without charge (15 U.S.C. 1681j(a)) and reinvestigate a dispute within 30 days, or up to 15 more days if you send new information (15 U.S.C. 1681i(a)(1)). You can also dispute directly with the bank that supplied the data (12 CFR 1022.43).
• EU data: you can ask a controller covered by the GDPR what it holds about you and where it got it, and have wrong data corrected (GDPR Arts. 15 and 16). It must answer within one month, extendable by two further months (Art. 12(3)). Erasure does not apply where the controller must keep the data by law (Art. 17(3)(b)).
• Turkish data: you can ask a data controller in Turkey whether and why it processes your data, to whom it passed it, and to correct or delete it (KVKK Art. 11). It must reply within 30 days (Art. 13). After a refusal you can complain to the Personal Data Protection Board within 30 days of the reply and no later than 60 days after your request (Art. 14). These rights do not apply where the processing is needed to prevent crime (Art. 28(2)(a)).

What to check with an attorney

• Whether the closure cites sanctions (then see the OFAC page), a court or government order, or only the bank's own review.
• Which records exist: consumer reports, data held by an EU or Turkish controller, public court records or news.
• Whether each record is wrong, outdated or accurate; a correction request needs a record that is wrong or outdated.
• Which law applies to each record holder: the FCRA in the U.S., the GDPR in the EU, KVKK in Turkey.
• Complaint deadlines, such as KVKK's 30-day and 60-day limits.

Fees and rules reviewed 16 Oct 2026. Sources below.

Official sources:

1. 31 CFR 1020.320: Bank suspicious activity reports and confidentiality
2. Law No. 5549 on the Prevention of Laundering Proceeds of Crime (mevzuat.gov.tr)
3. Turkish AML Measures Regulation (Tedbirler Yönetmeliği), Art. 22
4. Central Bank Payment Services Regulation (RG 1 December 2021), Art. 45
5. 15 U.S.C. 1681a: FCRA definitions
6. 15 U.S.C. 1681i: Disputes and reinvestigation
7. 15 U.S.C. 1681j: Annual file disclosure
8. 12 CFR 1022.43: Direct disputes with the bank that supplied the data
9. 12 CFR 1022.137: Annual files from specialty reporting agencies
10. EU General Data Protection Regulation (EUR-Lex)
11. Law No. 6698 on the Protection of Personal Data (KVKK)
12. 15 U.S.C. 1681h: Conditions of disclosure (identification)

What changed: rewritten to say plainly what can and cannot be corrected, with U.S., EU and Turkish deadlines, the SAR confidentiality rules and the Turkish notice rule.