Banking & Finance Law in Türkiye

Türkiye’s banking and finance sector has undergone significant regulatory change in recent years, driven by the growth of payments, fintech and alternative finance. We help banks, foreign investors, payment institutions and financial technology companies understand the framework, obtain the correct licenses, and stay compliant across the regulators that supervise this market. The recurring lesson we see is simple: in Türkiye, form follows licence. Before you decide how to build a product, you have to decide who regulates it — and that single question shapes your capital, your governance and your go-to-market timeline.

The regulatory framework

Financial activity in Türkiye is supervised by several specialised authorities, each with a defined mandate. Unlike jurisdictions with a single financial conduct authority, Türkiye distributes supervision across bodies that rarely overlap but often interlock:

• Banking Regulation and Supervision Agency (BDDK / BRSA) — licenses and supervises banks under Banking Law No. 5411, and factoring, financial leasing and financing companies under Law No. 6361.
• Central Bank of the Republic of Türkiye (CBRT) — authorises and oversees payment institutions, e-money institutions and payment system operators.
• Capital Markets Board (CMB) — regulates equity- and lending-based crowdfunding platforms, investment funds and traded debt instruments.
• Financial Crimes Investigation Board (MASAK) — enforces anti-money-laundering and counter-terrorist-financing rules.
• Insurance and Private Pension Regulation and Supervision Agency (SEDDK) — licenses and supervises insurance activity.

What this means for you: a product that feels like “one app” to a customer — say, a wallet that stores value, moves money and offers a buy-now-pay-later option — can straddle three regulators at once. Diagnosing that overlap early is the whole game.

Licensing requirements

Most financial activity in Türkiye is licence-gated. The authorisation you need depends on the exact service, not on how you brand it:

• Payment services, e-money and system operation — CBRT authorisation under Law No. 6493.
• Banking, factoring and financial leasing — BDDK licensing under Banking Law No. 5411 and the Law on Financial Leasing, Factoring and Financing Companies (Law No. 6361).
• Crowdfunding platforms — CMB authorisation under the Capital Markets Law.
• Insurance activity — Insurance and Private Pension Regulation and Supervision Agency (SEDDK) authorisation.

Activity	Regulator	Key legislation
Banking, factoring, financial leasing	BDDK	Banking Law No. 5411; Law No. 6361
Payment services & e-money	CBRT	Law No. 6493
Crowdfunding platforms & funds	CMB	Capital Markets Law
Insurance	SEDDK	Insurance legislation
AML/CFT compliance (all of the above)	MASAK	AML legislation

Each regime carries its own minimum capital, governance and fit-and-proper conditions for founders and controlling shareholders. The regulators vet who stands behind the institution, not only what it intends to sell, and later changes in qualifying shareholdings typically need prior approval.

Operating without the correct licence is not a paperwork slip — it exposes the business to administrative fines and, in serious cases, criminal liability. Treat the licensing question as the first design decision, not the last compliance box.

We map a proposed business model to the right regulator before launch, so the capital plan, corporate structure and product roadmap are all built on the correct legal footing from day one.

Lending and consumer credit

Consumer lending is governed by Banking Law No. 5411, the Law on Bank Cards and Credit Cards, and the regulations covering consumer loan agreements and housing finance. Direct lending is reserved for banks and financing institutions licensed by the BDDK. Payment and e-money institutions may not extend credit — a boundary that catches many fintechs by surprise when they try to bolt a lending feature onto a payments product.

Debt instruments can still be traded on the secondary market under the Capital Markets Law, and receivables can be mobilised through factoring — but the credit-origination function itself remains a licensed banking activity. In practice, this means a fintech that wants a lending economics without a banking licence usually has to partner with a licensed lender, or route the activity through a CMB-regulated platform, rather than originate credit on its own balance sheet.

Consumer-facing lending also carries a heavy consumer-protection overlay: mandatory pre-contractual disclosure, cooling-off rights, transparent cost presentation and strict rules on default interest. These are not formalities — defective disclosure can render terms unenforceable against the borrower.

Fintech, crowdfunding and alternative finance

Türkiye has built a distinct regime for alternative finance, and the CMB sits at its centre:

• Crowdfunding — both equity-based and lending-based platforms are licensed and supervised by the CMB. Authorised platforms run partnership or lending models while safeguarding investor interests through mandatory disclosures and investment limits.
• Peer-to-peer and marketplace lending — these are routed through lending-based crowdfunding platforms under the Capital Markets Law, rather than as standalone lenders.
• Investment funds and pooled products — must comply with CMB principles; alternative-finance products can fall within collective investment scheme rules.
• Invoice trading — governed by the Law on Financial Leasing, Factoring and Financing Companies, with factoring companies facilitating the transfer of receivables.

For a founder, the practical takeaway is that the “crowdfunding” label is not a light-touch shortcut. A CMB-authorised platform is a regulated financial intermediary with its own capital, systems and reporting obligations — but it is also the compliant home for models that could not exist as unlicensed lenders.

---

Payments and open banking

Payment services are regulated under Law No. 6493, with the CBRT authorising payment accounts, transaction processing, the issuance of payment instruments and money remittance. E-money issuance sits on the same track and is likewise a CBRT authorisation rather than a banking licence.

Open banking is addressed by the Regulation on Information Systems of Banks and Electronic Banking Services, which defines open banking and sets out how data is shared through application programming interfaces (APIs). Payment service providers must offer access on equivalent, non-discriminatory terms, allowing fintechs to build digital identity, onboarding and account-information services on top of bank infrastructure. This levels the field for newer entrants, but it also comes bundled with information-security, data-protection and operational-resilience obligations that scale with the sensitivity of the data being handled.

Anti-money-laundering and MASAK compliance

Whatever licence a financial business holds, it will also be an obliged party under Türkiye’s anti-money-laundering regime supervised by MASAK. That means a functioning compliance programme — customer due diligence and identity verification, risk profiling, transaction monitoring, record-keeping and suspicious-transaction reporting — has to be live before, not after, launch.

Regulators increasingly treat AML readiness as a condition of authorisation itself: an applicant that cannot demonstrate a credible compliance framework will struggle to obtain a licence in the first place. Building the AML function into the operating model from the outset is far cheaper than retrofitting it under supervisory pressure later.

How we help

Our banking and finance practice supports clients across the lifecycle of a regulated business:

• Licensing — structuring and filing applications with the BDDK, CBRT, CMB or SEDDK.
• Regulatory advice — compliance, product structuring, and ongoing supervision issues.
• Anti-money-laundering — MASAK compliance programmes, onboarding and reporting.
• Transactions — financing agreements, secured lending, factoring and leasing documentation.
• Foreign investment — market entry for banks, fintechs and financial sponsors entering Türkiye.

For foreign investors specifically, ownership of banks, payment institutions and financing companies is permitted, but the regulators vet founders and controlling shareholders closely, and later changes in qualifying shareholdings generally require prior approval. We prepare the shareholder file — beneficial ownership, source of funds, group structure — to the standard the regulator expects, which is where foreign applications most often stall.

The framework as a whole is built around consumer protection, fair lending and financial stability. Getting the licensing and compliance strategy right from the outset is the difference between a clean market entry and a stalled one. We help clients get there early, so the legal analysis shapes the business rather than the business colliding with the law.