Banking, Payments and Fintech Regulation in Türkiye

Türkiye’s banking and finance sector has undergone significant regulatory change in recent years, driven by the growth of payments, fintech and alternative finance. We help banks, foreign investors, payment institutions and financial technology companies understand the framework, obtain the correct licenses, and stay compliant across the regulators that supervise this market. The recurring lesson we see is simple: in Türkiye, form follows licence. Before you decide how to build a product, you have to decide who regulates it, and that single question shapes your capital, your governance and your go-to-market timeline.

Financial activity in Türkiye is supervised by several specialised authorities, each with a defined mandate. Unlike jurisdictions with a single financial conduct authority, Türkiye distributes supervision across bodies that rarely overlap but often interlock:

• Banking Regulation and Supervision Agency (BDDK / BRSA): licenses and supervises banks under Banking Law No. 5411 and the wider Turkish banking laws, and factoring, financial leasing and financing companies under Law No. 6361 (the Law on Financial Leasing, Factoring, Financing and Savings Financing Companies).
• Central Bank of the Republic of Türkiye (CBRT): authorises and oversees payment institutions, e-money institutions and payment system operators under Law No. 6493.
• Capital Markets Board (CMB): regulates equity- and lending-based crowdfunding platforms, investment funds and traded debt instruments.
• Financial Crimes Investigation Board (MASAK): enforces anti-money-laundering and counter-terrorist-financing rules.
• Insurance and Private Pension Regulation and Supervision Agency (SEDDK): licenses and supervises insurance activity.

What this means for you: a product that feels like “one app” to a customer, say, a wallet that stores value, moves money and offers a buy-now-pay-later option, can straddle three regulators at once. Diagnosing that overlap early is the whole game.

• Payment services, e-money and system operation: CBRT authorisation under Law No. 6493.
• Banking, factoring and financial leasing: BDDK licensing under Banking Law No. 5411 and the Law on Financial Leasing, Factoring, Financing and Savings Financing Companies (Law No. 6361).
• Crowdfunding platforms: CMB authorisation under the Capital Markets Law.
• Brokerage and other investment services: CMB permission under Article 39 of Capital Markets Law No. 6362, which says investment services may be carried on as a regular business only with CMB permission and only by investment firms.
• Insurance activity: Insurance and Private Pension Regulation and Supervision Agency (SEDDK) authorisation.

Each regime carries its own minimum capital, governance and fit-and-proper conditions for founders and controlling shareholders. The regulators vet who stands behind the institution, not only what it intends to sell, and later changes in qualifying shareholdings typically need prior approval.

Operating without the correct licence is not a paperwork slip. Under Article 28 of Law No. 6493, acting as a payment or e-money institution without the required permit is punishable by one to three years’ imprisonment and a judicial fine of up to 5,000 days, and licensed providers that breach the rules face administrative fines under Article 27. Treat the licensing question as the first design decision, not the last compliance box.

We map a proposed business model to the right regulator before launch, so the capital plan, corporate structure, company formation route and tax positioning are all built on the correct legal footing from day one.

Debt instruments can still be traded on the secondary market under the Capital Markets Law, and receivables can be mobilised through factoring, but the credit-origination function itself remains a licensed banking activity. In practice, this means a fintech that wants a lending economics without a banking licence usually has to partner with a licensed lender, or route the activity through a CMB-regulated platform, rather than originate credit on its own balance sheet.

Consumer-facing lending also carries a heavy consumer-protection overlay under Consumer Protection Law No. 6502. The lender must hand over a pre-contract information form a reasonable time before the contract is concluded (Article 23), the consumer may withdraw from a consumer loan within fourteen days without giving reasons or paying a penalty (Article 24), information on every fee and charge must be given as an annex to the contract (Article 4(4)), and compound interest is barred in consumer transactions, including on default (Article 4(7)). A missing contract term does not by itself invalidate the agreement (Article 4(1)), but the lender bears the burden of proving that it informed the consumer of the withdrawal right and of the fees, which is why the loan documentation belongs in the same review as the wider consumer law compliance of the product.

• Crowdfunding: both equity-based and lending-based platforms are licensed and supervised by the CMB. Authorised platforms run partnership or lending models while safeguarding investor interests through mandatory disclosures and investment limits.
• Debt-based crowdfunding: raising money from the public through crowdfunding is carried out via CMB-authorised platforms (Capital Markets Law Article 4(1)), and Article 35/A(1) provides that banking legislation does not apply to debt-based crowdfunding activities.
• Investment funds and pooled products: must comply with CMB principles; alternative-finance products can fall within collective investment scheme rules.
• Invoice-based receivables finance: factoring companies licensed under Law No. 6361 (the Law on Financial Leasing, Factoring, Financing and Savings Financing Companies) may not take over or collect receivables from a sale of goods or services that cannot be documented by invoice, or future receivables tied to such a sale that cannot be documented under BDDK Board rules (Article 9(2)).

For a founder, the practical takeaway is that the “crowdfunding” label is not a light-touch shortcut. A CMB-authorised platform is a regulated financial intermediary with its own capital, systems and reporting obligations, but it is also the compliant home for models that could not exist as unlicensed lenders.

Open banking is addressed by the Regulation on Information Systems of Banks and Electronic Banking Services, which defines open banking services as an electronic channel through which customers, or parties acting for them, reach a bank’s financial services through application programming interfaces (APIs) and similar methods (Article 3), and sets authentication rules for that channel (Article 41). On the fintech side, payment initiation and account information services are payment services in their own right under Article 12(1)(f) and (g) of Law No. 6493, so a provider of those services needs CBRT authorisation. This opens bank infrastructure to newer entrants, but it also comes bundled with information-security, personal data protection and operational-resilience obligations that scale with the sensitivity of the data being handled.

For payment and e-money institutions the link is written into the statute: the CBRT’s regulations on how these institutions are established and operated are issued after obtaining MASAK’s opinion (Law No. 6493, Articles 14(6) and 18(6)). Building the AML function into the operating model from the outset is far cheaper than retrofitting it under supervisory pressure later.

For foreign investors specifically, ownership of banks, payment institutions and financing companies is permitted, but the regulators vet founders and controlling shareholders closely, and later changes in qualifying shareholdings generally require prior approval. We prepare the shareholder file, beneficial ownership, source of funds, group structure, to the standard the regulator expects, which is where foreign applications most often stall.

The framework as a whole is built around consumer protection, fair lending and financial stability. Getting the licensing and compliance strategy right from the outset is the difference between a clean market entry and a stalled one. We help clients get there early, so the legal analysis shapes the business rather than the business colliding with the law.

• Enforcing Bank Guarantee Letters in Türkiye: calls on letters of guarantee, injunctions against unfair encashment and the bank’s independent payment obligation.
• Customs Law & Trade Compliance: Customs valuation, tariff disputes, and duty exemptions under Law No. 4458.
• Tax Law & Cross-Border Structuring: Corporate tax planning, withholding exemptions, and double taxation treaty (DTT) relief.
• Free Zones & Customs Regimes: Inward Processing Regime (DİİB), bonded warehousing, and corporate tax exemptions.
• Legal Matters in Istanbul for Foreign Clients and Companies: Customs litigation before Istanbul and Bakırköy Tax Courts.