Foreign Company Wants to Report an Employee to Turkish Prosecutors: What Evidence Should Be Collected First? (2026 Updated Guide)

A foreign company suspects an employee of fraud, theft, embezzlement, data misuse or another crime in Turkey. Learn what evidence should be preserved before filing a criminal complaint.

A foreign-owned or international company operating in Turkey may discover suspected employee misconduct involving company money, confidential information, customer accounts, inventory, procurement, invoices, digital systems or corporate property. Management may immediately consider filing a criminal complaint with Turkish prosecutors. However, one of the most important decisions is often made before the complaint is filed: identifying, preserving and organizing the evidence without violating employee rights or damaging the integrity of potential digital evidence. A poorly conducted internal investigation can weaken an otherwise serious criminal complaint. Lawyer Fırat Fesih Kaya advises that companies should distinguish suspicion from provable facts, preserve original records and establish a clear chronology before making definitive criminal allegations.

When Can Employee Misconduct Become a Criminal Matter in Turkey?

Not every workplace dispute constitutes a crime. Poor performance, breach of internal procedure, failure to meet targets or an ordinary employment disagreement should not automatically be converted into a criminal allegation.

Criminal concerns may arise where the facts potentially indicate conduct such as theft, fraud, breach of trust, forgery, unauthorized access to information systems, misuse of company property or other offenses depending on the circumstances.

The legal characterization should follow the evidence rather than precede it.

Do Not File a Criminal Complaint Based Only on Suspicion

A company does not necessarily need to prove the entire criminal case before approaching prosecutors. Criminal investigation is ultimately conducted by the competent authorities.

Nevertheless, the complaint should clearly explain what happened, when it happened, who appears to have been involved and which evidence supports the allegation.

Statements such as “we believe the employee stole money” are considerably less useful than a documented transaction history showing where company funds moved and why the transaction appears unauthorized.

First Preserve the Existing Evidence

Before interviewing numerous employees or confronting the suspected person, identify evidence that could disappear or change.

This can include company emails, accounting records, invoices, access logs, payment instructions, bank records, inventory records, internal messaging, CCTV footage, contracts and corporate-system logs.

Preservation should be lawful and proportionate.

Create an Evidence Preservation Notice

Where appropriate, relevant personnel should be instructed not to delete, overwrite or alter records connected with the incident.

Automatic deletion schedules for emails, CCTV footage or system logs may also need to be identified quickly.

The purpose is to preserve evidence—not to manufacture a new record after the dispute has begun.

Preserve Original Digital Evidence

Screenshots can be useful, but they should not automatically replace the underlying digital record.

Where an important email, message or system entry exists, preserve the original source, relevant metadata and surrounding context where technically possible.

Do Not Edit Screenshots

Cropping, highlighting or adding annotations to the only retained copy can create later questions about authenticity.

Keep an untouched original and create a separate working copy if explanations or annotations are necessary.

Company Email Records Can Be Important

If the suspected misconduct was conducted through a corporate email account, relevant communications may provide significant evidence.

However, access to employee communications should be evaluated in light of privacy, personal-data, employment and criminal-procedure considerations. The fact that an account belongs to the company does not justify unlimited investigation of every private communication.

Separate Business Communications From Private Communications

Where possible, the internal investigation should focus on information genuinely connected with the alleged misconduct.

Unnecessary collection of unrelated personal material can create additional legal problems without strengthening the criminal complaint.

Preserve Accounting Records

Financial misconduct investigations frequently depend on accounting evidence.

Relevant records may include ledgers, invoices, expense claims, payment vouchers, purchase orders, customer accounts, bank reconciliation records and internal approvals.

Bank Transactions Should Be Mapped

If company money is missing, prepare a transaction-by-transaction analysis.

Identify the originating account, recipient, date, amount, payment explanation and person who authorized or initiated the transaction.

This is far more useful than presenting prosecutors with hundreds of pages of unexplained bank statements.

Follow the Money

Where suspected fraud involves transfers to employees, relatives, suppliers or third parties, map the financial flow as far as company records permit.

Do not make unsupported allegations against recipients merely because their accounts received money. Explain the evidence connecting each transaction with the suspected scheme.

Preserve Original Invoices

If invoices are suspected to be fictitious, altered or duplicated, retain the original electronic and paper records.

Compare invoice numbers, dates, suppliers, quantities, bank payments, delivery documents and accounting entries.

Verify Whether Goods or Services Were Actually Delivered

A suspicious invoice does not necessarily prove fraud.

Check purchase orders, warehouse records, delivery notes, project records, correspondence and confirmation from relevant business units.

The central question may be whether the company actually received what it paid for.

Procurement Records Can Reveal the Scheme

For procurement-related allegations, preserve quotations, tender documents, supplier-selection records, approvals and communications between the employee and supplier.

Repeated awards to connected entities or unexplained price differences may warrant further investigation.

Check Conflicts of Interest

Determine whether the employee has a financial or personal connection with a supplier, customer or intermediary involved in the suspicious transactions.

Corporate records and lawfully obtained business documentation may help establish the relationship.

Inventory Records Should Be Preserved

Where goods are missing, compare physical inventory with warehouse-management systems, dispatch records, delivery notes, access records and CCTV footage.

Document the date and method of the inventory count.

CCTV Footage Can Be Valuable but Must Be Preserved Quickly

Security systems frequently overwrite footage automatically.

If relevant footage exists, preserve the original recording promptly and document when, where and by whom the copy was obtained.

Avoid unnecessary editing.

Access-Control Records Can Help

Badge entries, building access logs and secure-area records may help establish whether a person entered a particular location at a relevant time.

They should normally be used together with other evidence rather than treated as conclusive by themselves.

Computer Logs Can Be Critical

Where the suspected offense involves company systems, preserve login records, access logs, transaction histories and relevant audit trails.

A digital-forensics specialist may be appropriate where deletion, manipulation or unauthorized access is suspected.

Do Not Conduct Amateur Digital Forensics

Repeatedly opening, copying or modifying devices can affect digital evidence.

For serious cases involving laptops, servers or mobile devices, consider a documented forensic-preservation process.

Can the Company Search an Employee’s Laptop?

The answer depends heavily on the circumstances, including ownership of the device, company policies, legitimate expectations of privacy and the nature and scope of the investigation.

Corporate ownership should not be treated as an unlimited authorization to examine every piece of personal information.

Personal Phones Require Particular Caution

A company should not simply seize and search an employee’s private telephone because it suspects wrongdoing.

If important evidence is believed to exist on a personal device, legal options should be evaluated rather than using coercive internal measures that may create separate privacy or evidentiary problems.

WhatsApp Messages May Become Relevant

Messages can potentially become evidence, but authenticity, completeness and lawful acquisition matter.

A screenshot showing one isolated message may not reveal the complete conversation. Preserve context where legally available.

Secret Recordings Require Legal Analysis

Management should not automatically instruct employees to make covert recordings.

The legality and evidentiary value of a secret recording can depend heavily on how and why it was created. The specific circumstances should be assessed before relying on such material.

Preserve Contracts and Job Descriptions

A prosecutor investigating alleged misuse of authority may need to understand what the employee was actually authorized to do.

Employment contracts, job descriptions, powers of attorney, signature circulars, internal delegation documents and approval limits can therefore become important.

Authority Limits Can Be Crucial

If an employee transferred money or signed a contract, determine whether the act was authorized.

A transaction that management later regrets is not automatically criminal. Evidence showing that the employee deliberately exceeded or abused authority can be critical.

Preserve Internal Policies

Expense policies, procurement rules, cybersecurity policies, confidentiality obligations and authorization procedures may help explain why particular conduct was prohibited.

The company should also establish whether the employee actually received or knew about the relevant policy.

Interview Relevant Employees Carefully

Internal interviews can help reconstruct events, but they should be planned.

Identify what each witness personally saw or heard and distinguish firsthand knowledge from workplace rumors.

Prepare Interview Records

Where appropriate, document the date, participants and substance of an internal interview.

Avoid rewriting a witness’s account into stronger language than the witness actually used.

Do Not Pressure Witnesses

Witness statements obtained through intimidation or improper pressure can create credibility and employment-law problems.

Employees should not be instructed to support a predetermined version of events.

Preserve Evidence Favorable to the Suspected Employee Too

A credible investigation should not selectively preserve only incriminating material.

If company records contain information contradicting the allegation, that information should not be destroyed or concealed.

Build a Chronology

One of the most useful documents for prosecutors is a clear timeline.

For example: employee receives authority, supplier is selected, invoice is issued, payment is approved, funds are transferred, internal discrepancy is discovered and relevant records are preserved.

Each important event should be connected with supporting evidence.

Identify the Company’s Financial Loss

Calculate the alleged loss carefully.

Separate confirmed losses from estimates, expected profits and amounts that may later be recovered.

An exaggerated damage figure can weaken the credibility of the complaint.

Obtain an Internal Financial Review

For complicated accounting allegations, an internal or independent financial review can help identify questionable transactions.

The reviewer should distinguish accounting irregularities from evidence actually indicating intentional misconduct.

Consider an Independent Forensic Audit

Where the suspected loss is substantial or the scheme spans multiple years, a forensic audit may help identify transaction patterns, related parties and control failures.

The resulting analysis should remain traceable to original records.

Preserve Chain of Custody

For important physical and digital evidence, document who collected it, when it was collected, where it was stored and whether copies were made.

This is particularly important where authenticity may later be disputed.

Do Not Destroy the Employee’s Access Records After Termination

Companies often deactivate accounts immediately when employment ends, which may be necessary for security.

However, relevant logs and historical data should be preserved before deletion or account recycling.

Secure the Business Without Destroying Evidence

Passwords may need to be changed, access revoked and financial authority suspended to prevent further loss.

These security steps should be documented so that the company can distinguish post-discovery changes from historical evidence.

Should the Employee Be Confronted Before the Complaint?

Not necessarily.

Premature confrontation can result in deletion of records, coordination between participants or movement of assets. On the other hand, an internal explanation may sometimes resolve an apparent irregularity.

The decision should depend on the evidence and risk profile.

Employment Termination and Criminal Complaint Are Separate Issues

The company should separately analyze whether it has grounds for disciplinary action or termination under employment law.

A criminal complaint does not automatically establish lawful termination, and termination does not automatically prove a crime.

Avoid Defamatory Internal Announcements

Management should limit accusations to personnel who genuinely need to know.

Announcing that an employee is a “fraudster” before any finding can create unnecessary legal exposure.

What Should the Criminal Complaint Contain?

A useful complaint should identify the company, relevant individuals, chronology, suspected acts, financial or property impact and supporting evidence.

The legal characterization can be explained, but factual clarity is essential.

Organize Evidence Instead of Submitting a Document Dump

Prosecutors should be able to understand the case.

Create an evidence index identifying each attachment and what fact it supports.

Thousands of pages submitted without explanation can obscure the strongest evidence.

Can the Company Ask Prosecutors to Obtain Evidence It Cannot Access?

Yes, the criminal-investigation process may allow competent authorities to obtain evidence that the company cannot lawfully collect itself.

The complaint should identify the evidence believed to exist and explain why it is relevant rather than attempting unauthorized private access.

Bank Records of the Employee Should Not Be Obtained Illegally

A company may have evidence showing payments from its own accounts, but it should not attempt to acquire confidential personal banking information through improper means.

Relevant financial information can be sought through lawful investigative procedures where legal requirements are met.

Can Assets Be Secured?

Where the suspected offense and legal conditions justify protective measures, asset-related measures may become relevant during the criminal investigation.

These measures are judicial or prosecutorial matters subject to applicable legal requirements; the company cannot simply freeze the employee’s private assets itself.

What If the Employee Has Left Turkey?

The company can still preserve evidence and submit a complaint. The employee’s foreign nationality or departure does not itself determine whether a Turkish criminal investigation can proceed.

Jurisdiction and procedural measures depend on the particular offense and circumstances.

What If the Employee Is a Foreign National?

Foreign nationality does not eliminate criminal-procedure rights or potential criminal responsibility in Turkey.

Interpreter, notification and other procedural issues may become relevant depending on the person’s language ability and status.

What If Senior Management May Also Be Involved?

The internal investigation should not be artificially limited to a junior employee if evidence points toward higher-level approval or participation.

Preserve board records, management approvals, signature authorities and relevant communications.

Do Not Conceal Corporate Compliance Failures

If weak internal controls contributed to the loss, hiding those weaknesses can create inconsistencies.

The criminal allegation should focus on provable conduct while the company separately addresses its compliance failures.

Consider Data Protection Before Transferring Evidence Abroad

Multinational groups may want to send employee emails, investigation files and personal data to foreign headquarters immediately.

Cross-border handling of personal data should be evaluated under the applicable data-protection framework before large datasets are transferred.

Coordinate the Turkish and Global Investigations

Where headquarters conducts a parallel internal investigation, ensure that Turkish evidence is preserved in a manner compatible with potential Turkish criminal proceedings.

Different legal systems may treat privacy, interviews and document collection differently.

When Should the Company Contact a Lawyer?

Ideally, before intrusive evidence collection begins.

Fırat Fesih Kaya Law Office can assist foreign companies in separating legitimate internal investigation steps from evidence-gathering methods that could create privacy, employment or criminal-procedure problems.

Immediate Evidence Checklist Before Reporting the Employee

Before approaching Turkish prosecutors, the company should ordinarily identify and preserve the incident chronology, accounting records, bank transactions involving company accounts, invoices, purchase orders, contracts, authorization documents, corporate emails, system logs, relevant messages, CCTV footage, access records, inventory information, witness identities, internal policies, financial-loss calculations and relevant corporate records.

The company should then separate verified facts from assumptions and identify evidence that prosecutors may need to obtain through formal investigative powers.

Frequently Asked Questions

Does the company need complete proof before filing a criminal complaint?

Not necessarily. Prosecutors investigate suspected crimes, but the complaint should contain concrete facts and available supporting evidence rather than speculation alone.

Can company emails be submitted as evidence?

Potentially, but the manner in which communications were accessed and preserved should be reviewed carefully, particularly where privacy issues arise.

Can the company search an employee’s private phone?

A private device should not be treated as freely searchable merely because the owner is an employee. Legal procedures should be considered where relevant evidence is believed to exist on the device.

Are screenshots enough?

They can be useful, but original digital records and surrounding context should be preserved where possible.

Can CCTV footage be used?

Potentially. Relevant footage should be preserved promptly because many systems overwrite recordings automatically.

Should the company secretly record the employee?

This should not be done automatically. The legality and evidentiary consequences of covert recording depend on the circumstances.

Can an employee be dismissed immediately after a criminal complaint?

Criminal procedure and employment termination are separate legal questions. The employment-law grounds and applicable deadlines should be evaluated independently.

Should the company provide prosecutors with thousands of documents?

Evidence should be organized. A chronology and indexed evidentiary file can make a complicated corporate case substantially easier to understand.

What if evidence exists in the employee’s bank account or personal phone?

The company should identify the evidence and explain its relevance to prosecutors rather than attempting to obtain protected information unlawfully.

What is the most important step before filing?

Preserve original evidence before confronting the suspected employee. A strong criminal complaint should be based on a documented chronology, traceable financial and digital records, clearly established authority limits and lawfully obtained evidence rather than conclusions or workplace suspicion.

Client-Focused Legal Support for Foreign Companies in Turkish Criminal Investigations

Employee fraud, theft, misuse of corporate funds, falsified invoices, unauthorized transfers and digital misconduct can create simultaneous criminal, employment, commercial, data-protection and asset-recovery issues for foreign companies operating in Turkey. Fırat Fesih Kaya Law Office assists international companies and foreign investors with evidence preservation, internal investigation strategy, preparation of criminal complaints, representation before Turkish prosecutors and coordination of related asset-recovery and corporate proceedings.

Lawyer Fırat Fesih Kaya can also coordinate with foreign headquarters and international legal teams where the suspected conduct involves multiple jurisdictions, foreign executives or cross-border financial transactions.

Phone: +90 312 434 22 22

Mobile: +90 532 769 22 22

Email: info@firatfesihkaya.av.tr

Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey