Why did SICPA hire Cuneyd Zapsu?

The record

Two SICPA companies received invoices totalling TRY 19.6 million from the consultancy of Cuneyd Zapsu, a founding member of Turkey’s AK Party, between 2015 and 2019. That is approximately US$4.6 million, excluding VAT. Financial records and a payment statement examined by The Ledgers show that the invoices and payments coincided with the timetable for two SICPA public-sector contracts in Turkey: tobacco and alcohol tax stamps, and museum ticketing. We have seen no document identifying the services for which these payments were made.

Some payments carry an unusual description: “DÖSİMM share fee” (“DÖSİMM payı bedeli”). DÖSİMM is the revolving-fund operation of Turkey’s Ministry of Culture and Tourism. In February 2018, SICPA Turkey won DÖSİMM’s ticketing tender for 54 museums and archaeological sites with a TRY 3.9 billion bid; around four months later, monthly payments to Zapsu’s company began under this description.

Until 2008, Zapsu was a member of the AK Party’s Central Decision and Executive Board and a special assistant to party leader Recep Tayyip Erdoğan. An English-language CV obtained by The Ledgers lists him as an adviser to SICPA from 2012 and to Philip Morris International from 2010. Neither company appears in his current official biography. That biography describes its client list as a “relatively small selection”; an omission does not establish concealment or the end of a relationship.

In April 2023, SICPA’s Swiss parent, SICPA SA, was ordered to pay CHF 81 million for failing to take measures to prevent bribery of foreign public officials. That case did not include Turkey. Paying consultancy fees is not a crime, and The Ledgers is not aware of any official finding concerning the payments examined here. This report asks one question: what did SICPA buy from Zapsu?

The money trail: US$4.6 million over five years

Between 2015 and 2019, Zapsu’s company invoiced two SICPA companies for TRY 19,618,764, excluding VAT. Converted at annual average exchange rates, that is approximately US$4.63 million.

Of the invoices, TRY 7.77 million, approximately US$2.29 million, was billed to Switzerland-based SICPA Security Solutions SA. That company was a member of the joint venture that signed a five-year, TRY 359.3 million tax-stamp contract with Turkey’s Revenue Administration in December 2014, according to a parliamentary motion by Akif Hamzaçebi. The invoices were issued in the first two years of that contract and again in 2019, when it ended.

The remaining TRY 11.85 million, approximately US$2.34 million, was billed to SICPA Turkey. This became the new name of SICPA Assan after Kibar Holding withdrew from the partnership in February 2016, according to Kibar Holding. SICPA Assan had been SICPA Security Solutions SA’s joint-venture partner in the 2014 tax-stamp contract.

The payment statement attributed to SICPA Turkey shows two categories underlying these invoices: nine quarterly “consultancy fee” (“danışmanlık bedeli”) payments between August 2017 and July 2019, and 16 “DÖSİMM share fee” payments between July 2018 and September 2019. The statement also records SICPA Turkey’s purchase of a fixed asset from Zapsu’s company in May 2016 for approximately TRY 47,298, including VAT.

The consultancy fee was fixed in US dollars: US$141,600 per quarter, comprising US$120,000 plus 18 per cent VAT. The nine payments totalled US$1,274,400 including VAT, or TRY 6,033,745.92. The total excluding VAT was US$1,080,000.

The statement also contains an entry for “contract stamp duty” (“sözleşme damga vergisi”) of TRY 16,002.84, dated 7 September 2017. If the entire tax related to this consultancy agreement and was borne by SICPA Turkey, a rate of 0.948 per cent would imply a contract value of approximately TRY 1.69 million. At the August 2017 exchange rate, that corresponds to US$480,000 a year, or four quarterly fees. This calculation is conditional; we have not seen the contract.

The payments in the records available to us end in September 2019. The 2020 records we examined also show no invoices issued to SICPA companies.

What did the “DÖSİMM share fee” pay for?

Payments described as “DÖSİMM share fee” began around four months after SICPA Turkey won the Ministry of Culture and Tourism’s museum-ticketing tender. Over 15 months, they totalled TRY 7,964,874.90, including VAT.

DÖSİMM is the Turkish abbreviation for the Ministry of Culture and Tourism’s Central Directorate of Revolving Fund Operations; it has no connection with tax stamps. The ministry advertised the tender for the right to operate museum and archaeological-site ticket offices in the Official Gazette on 20 September 2017, according to TRT Haber.

SICPA Turkey won the tender held on 27 February 2018 with a bid of TRY 3,907,000,000. Its competitor, Etkin Eğitim, offered TRY 3.86 billion, according to Türkiye Turizm. According to the ministry’s official announcement, the contract was signed on 19 March 2018, took effect on 1 May 2018 and runs through 31 December 2026. It covered 54 museums and archaeological sites, including Topkapı Palace, Hagia Sophia, Ephesus and Pamukkale. As of June 2025, SICPA Turkey operated at 113 locations, including 77 museums and archaeological sites, and employed 513 people at museums, according to Ekonomist.

The 16 “DÖSİMM share fee” payments behave differently from the fixed consultancy fee. Their amounts change each month, falling to TRY 204,608 in March 2019 and rising to TRY 920,437 in September 2019. This pattern, declining in winter and peaking in late summer, resembles the tourism season. That is an inference, however: we have seen no document setting out the payment formula. The description could indicate a share of revenue or an accounting label allocating an expense to the DÖSİMM project.

On 17 April 2017, Kerim Ülker of Dünya published an article headlined “Cuneyd Zapsu’s assistant is becoming a partner in Swiss SICPA.” According to that report, Cavidan Gülşen Karanis Ekşioğlu—described as Zapsu’s “right-hand woman,” with management roles in Zapsu-family companies, including Cuneyd Zapsu Danışmanlık A.Ş.—had entered talks to acquire 30 per cent of SICPA Turkey. SICPA SA had also applied to the Competition Authority for the sale, the report said.

We could not confirm whether the sale took place. Nor have we seen a document establishing any connection between it and the “DÖSİMM share” payments. Ekşioğlu was appointed ambassador to Hungary in June 2022, according to Serbestiyet.

The payments in the statement end in September 2019, while the museum contract continues. The ministry’s official announcement gives the end of the operating period as 31 December 2026.

Who is Cuneyd Zapsu, and whom has he advised?

A founding member of the AK Party, Zapsu established his consultancy after leaving active politics in 2008. Its clients spanned energy, nuclear power, finance and food.

Zapsu held executive positions in his family’s hazelnut-exporting companies and chaired the Istanbul Hazelnut and Hazelnut Products Exporters’ Association from 1987 to 2001 and the International Nut and Dried Fruit Council, or INC, from 2002 to 2007.

He was among the AK Party’s founders in 2001. Until 2008, he served on its Central Decision and Executive Board and alongside party leader Recep Tayyip Erdoğan as “special assistant and data coordinator,” according to his DEİK biography. In 2008, he resigned from his active political roles and founded Cuneyd Zapsu Danışmanlık A.Ş. His DEİK CV states that, as of December 2015, the company provided senior advisory services to eight international companies and project-based consultancy to 22 domestic and foreign companies.

A rare record of what such services might involve emerged from the International Consortium of Investigative Journalists’ Uber Files. According to Medyascope’s account of Deutsche Welle’s reporting, in December 2014 Zapsu’s company sent Uber a draft agreement seeking US$50,000 a month for three months of lobbying. His company reportedly supplied Uber with a contact list of about 30 people, ranging from governors and mayors to ministers. It is not known whether Uber signed the draft.

The following list brings together advisory roles Zapsu declared at different times. SICPA, Philip Morris, Harbin Electric and Axel Springer, which appear in the CV obtained by The Ledgers, do not appear in his current official biography. “Present” below means the point at which that historical CV was prepared; it does not establish that a role continues today.

His official biography describes its client list as a “relatively small selection.” A company’s absence from that list does not establish concealment or the end of a relationship.

SICPA is the only company in this list that builds tax-control infrastructure on behalf of the state.

The two sides of tax stamps: SICPA and Philip Morris

Two entries in Zapsu’s CV place him on both sides of the tax-stamp business: SICPA, which builds the system, and Philip Morris, one of the tobacco companies that pays for stamps on cigarette packs.

The CV lists Zapsu as an adviser to Philip Morris International, or PMI, from 2010 and to SICPA Security Solutions SA from April 2012. Both entries end with “present.” This means the two advisory roles overlapped when the CV was prepared, in late 2012–2013. We do not know what happened afterward.

SICPA is headquartered in Prilly, near Lausanne; PMI’s operations centre is also in Lausanne. The two companies competed in tracking technology. According to Swissinfo, SICPA first offered its SICPATRACE tracking system to Philip Morris in 2002. PMI considered the system too slow for its production lines and developed its rival technology, Codentify. In 2010, PMI licensed Codentify free of charge to BAT, JTI and Imperial. The four companies formed an association in 2011 to promote it as an alternative to tax stamps, according to Tobacco Tactics.

The competition also played out in individual markets. When SICPA’s proposed PHP 18 billion tax-stamp project was being discussed in the Philippines in 2009, Philip Morris executive Chris Nelson said the stamps would cost the company between PHP 564 million and PHP 1.1 billion a year, calling that a “major blow,” according to Philstar. SICPA did not win the project; PMI and its local partner proposed their own marking solution, according to Swissinfo.

International tobacco-control rules also separate these two spheres. The Protocol to Eliminate Illicit Trade in Tobacco Products, adopted under the World Health Organization Framework Convention on Tobacco Control and in force since 2018, prohibits delegating tracking-and-tracing obligations to the tobacco industry. It also limits the authorities’ interaction with the industry to what is “strictly necessary,” as described by Tobacco Tactics. The protocol binds its state parties; it does not directly impose obligations on consultants, and it entered into force after the overlap recorded in the CV. See the WHO protocol and Article 8 guidance.

The same adviser serving both sides raises a question about conflicts of interest. Did SICPA and PMI know about Zapsu’s other client? Did the Revenue Administration, which administered the tax-stamp contract, know? Our information about the scope and duration of the PMI consultancy comes only from the CV; we could not independently verify it.

Timing: payments and public tenders

The years in which invoices and payments were concentrated coincide with years in which SICPA won public tenders in Turkey or its tax-stamp contract expired. We have no invoice data from before 2015.

According to Hürriyet, SICPA established Turkey’s tobacco and alcohol tax-stamp system after winning the Revenue Administration’s 2006 tender through a joint venture with Assan. The next five-year tender went to the Gate Elektronik–Prooftag partnership with a TRY 217 million bid; SICPA-Assan had bid TRY 324 million. Following a lawsuit brought by SICPA-Assan, Ankara’s 7th Administrative Court annulled the tender on 28 September 2012. The Council of State upheld that decision by three votes to two, according to Milliyet.

Zapsu’s CV dates the start of his SICPA consultancy to April 2012. We have seen no information or document connecting him to that lawsuit.

The sequence in the records is as follows:

• April 2012: Zapsu’s consultancy for SICPA begins, according to his CV.

• 28 September 2012: Ankara’s 7th Administrative Court annuls the tender won by Gate Elektronik–Prooftag.

• 9 September 2014: SICPA wins a new tax-stamp tender for TRY 359.3 million.

• 9 December 2014: the tax-stamp contract is signed.

• 2015: SICPA Security Solutions SA receives the highest annual invoice total recorded for that company in the documents available to us: approximately US$1.33 million.

• 9 August 2017: the first quarterly consultancy payment is made.

• 20 September 2017: the museum-ticketing tender is advertised.

• 27 February 2018: SICPA Turkey wins the museum-ticketing tender.

• 19 March 2018: the museum contract is signed.

• 1 May 2018: the museum contract takes effect, for an operating period ending on 31 December 2026.

• 10 July 2018: “DÖSİMM share fee” payments begin.

• 2019: in the year the tax-stamp contract expires, SICPA Security Solutions SA is again invoiced, this time for TRY 2.66 million.

• September 2019: the payments recorded in the statement end.

• 6 December 2019: a new tax-stamp tender is cancelled.

• 22 January 2020: the protocol transferring the work to the Turkish State Mint is signed, according to Hamzaçebi’s parliamentary motion.

The timeline does not establish causation. We have seen no document showing that Zapsu met anyone on SICPA’s behalf in connection with these tenders. The pattern of payments nevertheless warrants asking whether the relationship was tied to SICPA’s public contracts in Turkey.

SICPA’s record: overseas bribery cases and intermediaries

On 27 April 2023, SICPA SA was found criminally liable in Switzerland for failing to take organisational measures to prevent bribery in Brazil, Colombia and Venezuela, and was ordered to pay CHF 81 million. According to the Office of the Attorney General of Switzerland’s summary penalty order, this comprised a CHF 1 million fine and a CHF 80 million compensatory claim.

A former sales manager received a suspended 170-day prison sentence for bribing senior officials in the Colombian and Venezuelan markets between 2009 and 2011. Proceedings against the CEO and main shareholder were discontinued, according to the Swiss government and the prosecutor’s statement.

In a side letter issued to SICPA, the prosecutor stated that the company had failed to take measures to prevent its “employees and consultants” from breaking the law. The letter said the penalty order did not constitute an admission of guilt and that the underlying allegations had not been adjudicated by a trial court; that qualification is separate from the company’s conviction by penalty order for organisational failings. The letter also recorded that SICPA had fully and voluntarily remedied the shortcomings and cooperated fully with the investigation. SICPA disagrees with the grounds but says it did not oppose the order in order to end the uncertainty. It emphasises that it has held ISO 37001 anti-bribery certification since 2021.

In Brazil, SICPA’s local companies signed a settlement agreement with the state for approximately BRL 762 million in June 2021. According to Money Times, the agreement followed an internal investigation that confirmed improper payments to a public official between 2009 and 2015. The individuals tried in the same case were acquitted in June 2022, according to SICPA.

The Swiss investigation initially covered 14 countries. According to a September 2020 prosecution document reported by Swissinfo, SICPA hired a nephew of the then Philippine president’s spouse as a “representative” for US$5,000 a month and a US$200,000 success fee. The document said it was “clear” that part of the commission would go to the president’s spouse. It is not clear whether the success fee was paid, and this allegation did not form part of the final decision.

Swissinfo reported in 2022 that investigators had found SICPA and banknote-printing machinery manufacturer KBA-NotaSys used the same consultants in several countries to negotiate bribes with local officials. The 2023 summary penalty order, however, covers only Brazil, Colombia and Venezuela. SICPA denies being involved in, or aware of, illegal conduct by its external consultants.

Neither Turkey nor Zapsu is mentioned in the Swiss decision. The Ledgers has previously reported on SICPA’s consultancy payments during the period of Turkey’s 2014 tax-stamp tender and a success fee contingent on winning that tender, in “Payments, a rival and a success fee” and “From Draft to Invoice.” Those reports did not name Zapsu.

Questions awaiting answers

Only the parties can explain what the payments were for. The Ledgers identifies the following questions as requiring answers.

For SICPA: SICPA SA, SICPA Security Solutions SA and SICPA Turkey

1. On what dates, and for what scope of work, did you sign contracts with Cuneyd Zapsu and his company? What specific services did you receive under those contracts?

2. Were the approximately TRY 3.6 million in invoices issued to SICPA Security Solutions SA in 2015 a success fee linked to the tax-stamp contract signed in December 2014?

3. What did the payments described as “DÖSİMM share fee” cover? Were the amounts calculated as a percentage of museum-ticketing revenue or of the share paid to DÖSİMM?

4. Did the proposed 30 per cent stake for Zapsu’s close associate Gülşen Karanis Ekşioğlu, discussed in 2017, materialise? What was the outcome of the Competition Authority application?

5. Did you know that Zapsu was also advising Philip Morris International in 2012–2013? Was a conflict-of-interest review conducted?

6. Did the relationship continue after 2019? If it ended, why? Was the relationship with Zapsu examined in compliance reviews renewed after the 2023 Swiss decision?

For Cuneyd Zapsu

1. What services did you provide to SICPA? Did you meet public officials on SICPA’s behalf?

2. What did the invoices described as “DÖSİMM share fee” cover?

3. While advising SICPA and PMI simultaneously in 2012–2013, did you inform both companies?

4. Why do the SICPA and PMI advisory roles not appear in your current biography?

For Philip Morris International

1. When did your advisory relationship with Zapsu begin and end? Did it cover Turkey’s tax-stamp regulations?

2. Did you know that Zapsu was also advising SICPA?

For Gülşen Karanis Ekşioğlu, through the Ministry of Foreign Affairs

1. Were the 2017 talks concerning a 30 per cent stake in SICPA Turkey concluded? Do you have any connection with SICPA today?

Method, right of reply and what we do not know

This report is based on three documents. The payment statement and invoice records are consistent with one another:

• An English-language CV belonging to Zapsu.

• A 27-entry payment statement covering May 2016 to September 2019.

• Annual totals for invoices issued by Zapsu’s company to SICPA companies from 2015 to 2020.

The payment statement does not name the companies. We attribute it to SICPA Turkey because its amounts correspond to invoices issued to that company. The May 2016 fixed-asset entry—TRY 47,298.24, including VAT—matches the 2016 SICPA Turkey invoice total of TRY 40,083, excluding VAT, to the nearest lira after VAT is removed.

The 2016–2019 payments total TRY 11.90 million excluding VAT; the invoices for the same period total TRY 11.85 million. The difference of approximately 0.5 per cent could be explained by differences between invoice and payment dates. The lira equivalents of payments denominated in US dollars are consistent with market exchange rates on the payment dates: TRY 3.53 per dollar in August 2017 and TRY 6.09 in October 2018, following the August 2018 currency shock.

Annual average exchange rates were used for currency conversions, so the dollar amounts are approximate. Other positions listed in the CV correspond with the biographies published by DEİK and czapsu.com.

What we do not know:

• We have not seen the contracts.

• We do not know the formula used to calculate the payments labelled “DÖSİMM share.”

• We do not know what services the invoices to SICPA Security Solutions SA covered.

• We could not verify whether the proposed 30 per cent shareholding reported by Dünya in 2017 materialised.

• We have found no evidence that the payments were passed to public officials.

This report does not accuse anyone of a crime. Buying and selling consultancy services is legal, and SICPA’s Swiss conviction does not cover Turkey. The report seeks an explanation for payments whose timing overlaps with public contracts. The records do not establish that the payments in Turkey were corrupt.

Based on reporting from: The Ledgers · Archive records; TBMM · 12.01.2022; Patronlar Dünyası · Kibar Holding; TRT Haber · 02.10.2017; Türkiye Turizm · 01.03.2018; muze.gov.tr · Museum contract; Ekonomist · 2025; Dünya · Kerim Ülker · 17.04.2017; Serbestiyet · 2022; DEİK · Cuneyd Zapsu; Cuneyd Zapsu · Biography; Medyascope / DW · Uber · 11.07.2022; Habertürk · Serpil Yılmaz · 22.08.2017; Swissinfo · SICPA: The hidden cost of selling trust; Tobacco Tactics · Codentify; Philstar · 23.12.2009; WHO FCTC · Illicit Trade Protocol; Hürriyet · 2006; Milliyet · 2013; Swiss OAG · Decision · 27.04.2023; Swiss OAG · Side letter · 27.04.2023; SICPA · Response to the OAG decision; Casa da Moeda do Brasil · 2021 · p.43; Money Times · 2021; The Ledgers · Payments, a rival and a success fee; The Ledgers · From Draft to Invoice.