Introduction: Consumer Protection in the Turkish Fintech Market

Financial technology has changed the relationship between consumers and financial service providers.

A customer can now open an electronic money account, use a digital wallet, initiate payments, connect several bank accounts through open banking, obtain digital financial services and trade crypto assets without entering a physical branch.

For fintech companies, this digital model provides significant commercial advantages.

However, digital distribution does not eliminate consumer protection obligations.

In many cases, it increases them.

A consumer using a mobile financial application may never speak with an employee of the institution. The entire commercial relationship may be created through:

• an onboarding screen;
• electronic terms and conditions;
• a privacy notice;
• a fee table;
• a mobile notification;
• an authentication process.

Accordingly, the legal design of the customer journey becomes extremely important.

A poorly drafted clause hidden inside twenty pages of terms may constitute an unfair contractual term.

A fee that was not adequately disclosed may become disputed.

An institution that fails to respond properly to an unauthorized payment claim may face liability.

A fintech advertisement promising “free transfers” while imposing undisclosed charges at the final stage may create consumer-law and advertising risk.

Consumer protection for fintech companies in Türkiye is governed through several overlapping regulatory frameworks.

The principal legislation includes Law No. 6502 on Consumer Protection, while payment institutions and electronic money institutions are also subject to Law No. 6493 and the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers.

Banks and some other financial institutions are subject to additional financial-consumer legislation, while crypto asset service providers are regulated by the Capital Markets Board of Türkiye.

The Ministry of Trade’s current consumer-law database confirms that the Turkish framework continues to include Law No. 6502, regulations on unfair contractual terms, financial distance contracts, consumer credit and other sector-specific consumer rules.

For this reason, consumer protection compliance for fintech companies in Turkey should be designed together with licensing, payment regulation, cybersecurity, AML/KYC and KVKK compliance.

1. Who Is a Consumer Under Turkish Law?

The starting point is determining whether the customer is legally a consumer.

Under Turkish consumer law, the concept broadly concerns a natural or legal person acting for purposes that are not commercial or professional.

This distinction matters.

A natural person using a payment application to transfer money to family members may be a consumer.

A company using the same payment institution to collect payments from thousands of commercial customers may generally be acting for commercial purposes.

Not every fintech customer is therefore necessarily a consumer.

This affects:

• jurisdiction;
• unfair-term protection;
• consumer arbitration board jurisdiction;
• mandatory mediation;
• consumer contract rules.

Fintech companies serving both individuals and businesses should therefore avoid using one universal contract without considering the legal differences between consumer and commercial customers.

2. Consumer Protection Law Applies to Regulated Financial Institutions

A common misconception is that financial-sector regulation replaces consumer law.

It does not.

The Regulation on Unfair Terms in Consumer Contracts expressly provides that its rules apply even to contracts prepared by persons or institutions conducting activities under licences or permissions issued by legislation or public authorities.

Accordingly, being licensed by:

• the CBRT;
• BRSA;
• CMB;
• another financial regulator

does not automatically protect a company from consumer-law scrutiny.

A fintech can simultaneously comply with its regulatory licence and breach consumer law through the wording of its customer contract or commercial practices.

3. Main Consumer Protection Laws Applicable to Fintech

Depending on the business model, the most relevant legislation may include:

Law No. 6502 on Consumer Protection

This is the general consumer protection statute.

Law No. 6493

This governs payment services and electronic money and contains important customer rights.

Payment Services Regulation

This contains detailed rules concerning:

• pre-contractual information;
• framework agreements;
• fees;
• unauthorized payments;
• refunds;
• complaint procedures.

The CBRT continues to identify Law No. 6493 and the Payment Services Regulation as the principal legal framework governing payment and electronic money services.

Regulation on Unfair Terms in Consumer Contracts

This protects consumers against non-negotiated terms creating an unfair imbalance.

Financial Services Distance Contracts Regulation

This regulates specified financial services concluded remotely, although its scope must now be considered carefully following amendments effective at the end of 2024.

Commercial Advertising and Unfair Commercial Practice Rules

These regulate misleading or deceptive marketing.

KVKK

Consumer protection and data protection frequently overlap in digital financial products.

4. Payment Institution Contracts

Payment institutions and electronic money institutions generally operate through a framework agreement with the customer.

Under the current Payment Services Regulation, continuous payment relationships must generally be governed through a written framework agreement prepared in at least 12-point type.

Where the agreement is concluded through a remote communication channel, the ordinary written-form requirement does not apply in the same way.

A copy of the framework agreement must be provided to the customer or made accessible on paper or through a permanent data storage medium following conclusion and upon request during the relationship.

For fintech companies, the concept of a permanent data storage medium is important.

It means that information should be made available in a form that allows the customer to:

• access it;
• preserve it;
• reproduce it without alteration.

A mobile screen that disappears immediately after acceptance may therefore create evidential problems.

5. Pre-Contractual Information for Payment Services

The payment service provider must provide information before establishing the framework agreement.

Under Article 42 of the Payment Services Regulation, the provider must inform the customer regarding the contractual matters listed in Article 43 before the relationship is established.

Providing the draft agreement or making it available through the institution’s website can satisfy the relevant pre-contractual information requirement in specified circumstances.

This means the consumer should understand the product before clicking the final acceptance button.

Information architecture should therefore be designed so that material terms are not revealed only after account activation.

6. What Should Fintech Customer Agreements Explain?

A fintech customer agreement should generally make important issues clear, including:

• identity and contact information of the provider;
• description of the service;
• operation of payment orders;
• authentication methods;
• applicable limits;
• fees and commissions;
• foreign exchange methodology where applicable;
• complaint procedures;
• termination rules;
• liability rules;
• unauthorized transaction procedures.

Terms should be drafted in comprehensible language.

A fintech company should avoid using complex banking terminology where the same concept can be explained in ordinary language.

The objective is not merely to create a legally sophisticated contract.

The customer should actually be able to understand the financial consequences of accepting it.

7. Remote Fintech Contracts

Most fintech contracts are concluded remotely.

The Payment Services Regulation permits remote framework agreements but requires the payment service provider to implement technological and operational measures so that remote contracting is comparably secure and reliable.

The provider must also verify the information and documents obtained from the customer before beginning to provide services.

The Regulation additionally requires customer demand and approval before a framework contract is concluded remotely and imposes specific employee-training requirements concerning fraud risks such as phishing, social engineering and coercion.

Remote onboarding is therefore not merely an interface design issue.

It is part of consumer protection and transaction security.

8. Financial Services Distance Contracts: Important Scope Distinction

Law No. 6502 contains a specific framework for distance contracts relating to financial services.

Article 49 broadly addresses financial services such as banking, credit, insurance, private pensions, investment and payment-related services.

For qualifying contracts, the consumer must receive clear pre-contractual information before becoming bound, and the legislation generally recognises a 14-day withdrawal right for covered financial services.

However, fintech companies must be careful.

Following the amendment effective 31 December 2024, the Financial Services Distance Contracts Regulation contains exclusions concerning certain payment services outside banking, credit, insurance, private pension and investment services.

Accordingly, a standalone payment or e-money company should not automatically tell every customer:

“You have a 14-day statutory withdrawal right under the Financial Services Distance Contracts Regulation.”

The precise product must first be classified.

For pure payment and electronic money services, Law No. 6493, the Payment Services Regulation and the general principles of Law No. 6502 may be more directly relevant.

9. Unfair Terms in Fintech Contracts

Fintech companies frequently use standard-form contracts.

Customers normally cannot negotiate each provision individually.

This makes unfair contractual terms particularly important.

The Ministry of Trade explains that contractual terms cannot be changed against the consumer during the contractual period and that consumers cannot be charged extra amounts for services they reasonably expect or for costs that are part of the provider’s own statutory obligations or business interests unless the legal conditions for charging are satisfied.

Examples of problematic fintech clauses may include provisions stating that:

• the institution is never responsible for any system error;
• the institution may impose any fee at any time without notice;
• the customer waives every legal remedy;
• the institution may terminate immediately without objective reason while imposing penalties on the consumer;
• all unauthorized transactions are automatically the customer’s responsibility;
• the provider may unilaterally alter essential contractual terms without justification.

Whether a term is legally unfair depends on the exact wording and circumstances, but broad clauses attempting to eliminate statutory customer rights create substantial risk.

10. A Licence Does Not Validate an Unfair Contract Clause

This point deserves emphasis.

The Unfair Terms Regulation expressly applies to contracts prepared by licensed businesses.

Therefore, a payment institution cannot defend a potentially unfair consumer clause simply by saying:

“Our company is regulated by the CBRT.”

Likewise, a digital bank does not receive an exemption from consumer contract principles merely because banking supervision applies.

Regulatory supervision and consumer contract control operate simultaneously.

11. Fees and Commissions for Payment Services

Pricing transparency is one of the most important consumer protection requirements.

Under Article 49 of the Payment Services Regulation, payment service providers cannot charge customers for information that the provider is legally required to supply under the Regulation.

Where the customer requests additional information, more frequent information or a different delivery method beyond the agreed framework, a fee may be charged only within the regulatory conditions and generally not above the cost of the service.

Article 50 further authorises the CBRT to regulate the nature and maximum amount or rate of specified fees, costs, commissions and benefits associated with payment and electronic money transactions.

Fee structures should therefore be designed together by product, finance and legal teams.

12. Customers Must Understand the Total Cost

The Payment Services Regulation requires payment service providers to provide customers with a statement containing the overall cost and usage of services.

The statement must include breakdowns such as:

• monthly and annual fees;
• discounts;
• deductions;
• transaction fees;
• account fees;
• commissions;
• loyalty benefits.

It must be provided free of charge, either in physical form or through a permanent data storage medium depending on the customer’s preference.

This requirement supports a fundamental consumer-law principle:

financial pricing should be transparent, not discoverable only after the customer has incurred the cost.

13. Additional Charges Must Be Disclosed Before the Transaction

Where an additional fee or commission is charged because a particular payment instrument is used, the customer must be informed before the payment transaction begins.

The Payment Services Regulation states that the payer is liable for such charges only where the customer was fully informed before initiation of the transaction.

For mobile fintech interfaces, this means that a fee disclosed only on the receipt screen after the transfer has already been confirmed may be legally problematic.

The correct stage for disclosure is before final authorization.

14. Bank Financial Consumer Fee Rules Should Not Be Confused With Payment Institution Rules

Türkiye also has the Communiqué on Fees Charged to Financial Consumers (No. 2020/7).

However, its scope is specifically directed toward:

• banks;
• financial institutions granting consumer credit;
• card issuers.

The CBRT’s January 2026 implementation instruction confirms this scope.

Therefore, an electronic money institution should not automatically apply every bank fee rule as though the Communiqué directly governed all of its services.

Payment/e-money institution fees must principally be analysed under Law No. 6493 and the Payment Services Regulation.

Digital banks, by contrast, may fall within the banking financial-consumer fee framework where the relevant conditions are satisfied.

15. Unauthorized Payments: One of the Most Important Consumer Rights

Unauthorized payment transactions are among the most common consumer disputes involving fintech applications.

A customer may claim:

• “I did not make this transfer.”
• “My account was taken over.”
• “My wallet was accessed without permission.”
• “Someone used my payment instrument.”

Under the Payment Services Regulation, a payment transaction not authorised through the agreed procedure is considered unauthorized.

The legal framework then determines:

• notification obligations;
• burden of proof;
• reimbursement;
• customer liability.

16. The Customer Has Up to 13 Months to Request Correction

A customer who becomes aware of an unauthorized or incorrectly executed payment must notify the provider without delay.

In any event, the correction request must generally be made within 13 months following the payment transaction.

However, where the payment service provider failed to provide all information required by the Regulation concerning the transaction, the customer may not be bound by that 13-month period.

For fintech companies, this makes long-term transaction records essential.

A dispute may arise many months after the transaction.

17. The Burden of Proof Can Fall on the Payment Service Provider

Where the customer claims that a payment was unauthorized or incorrectly executed, the payment service provider bears the burden of proving matters including that the payment:

• was authorised by the customer;
• was properly recorded;
• was entered into the relevant accounts;
• was not affected by a technical failure within the provider’s services.

Where a payment initiation service provider is involved, the burden may be allocated within that provider’s area of control.

This is extremely important in digital fraud litigation.

The existence of a login or SMS record alone should not automatically be assumed to prove full customer authorisation.

The institution should preserve reliable authentication and transaction evidence.

18. Refund of Unauthorized Payments

Where it is established that the payment was made without customer authorization or was incorrectly executed, the payer’s payment service provider must refund the relevant amount immediately or restore the payment account to the position it would have been in had the unauthorized transaction not occurred.

The provider may conduct a reasonable investigation before correction where strong suspicion exists regarding intentional conduct or gross negligence falling within the regulatory framework, but this should not become a mechanism for indefinitely delaying every consumer complaint.

Fraud investigation should therefore operate under clear internal deadlines.

19. Consumer Liability for Lost or Stolen Payment Instruments

The current Payment Services Regulation provides an important consumer limitation.

Where unauthorized use results from a lost or stolen payment instrument or failure to properly safeguard customer security information, the payer may generally be responsible for up to:

TRY 250

of losses arising from unauthorized transactions occurring within the 24 hours before the customer makes the required notification.

After the notification, the customer generally cannot be held responsible for subsequent unauthorized transactions.

Different consequences apply where the customer acted fraudulently or intentionally or with gross negligence breached the applicable security obligations.

This is one of the most practically important statutory consumer rights in Turkish payment law.

20. Fintech Contracts Cannot Simply Transfer Every Fraud Loss to the Consumer

A clause stating:

“Any transaction completed using your password is entirely your responsibility under all circumstances”

may conflict with mandatory payment legislation.

The Payment Services Regulation establishes specific rules concerning responsibility for unauthorized payment transactions.

A fintech company should therefore avoid contractual provisions that attempt to eliminate statutory allocation of liability.

Fraud liability should be determined according to:

• customer authorisation;
• authentication;
• customer conduct;
• provider security;
• timing of notification;
• gross negligence or fraud.

This is both a contractual and operational issue.

21. Strong Authentication and Consumer Protection

Digital consumer protection is closely connected to cybersecurity.

The Payment Services Regulation imposes authentication and security requirements, including rules governing strong customer authentication and customer security credentials.

Where the payment service provider fails to require authentication mandated by the regulatory framework, the consumer may receive additional protection concerning losses from unauthorized use.

Therefore:

cybersecurity compliance directly affects financial liability.

Weak authentication is not merely an information systems problem.

It can become a consumer reimbursement issue.

22. Refund Rights in Certain Merchant-Initiated Transactions

Consumer rights are not limited to obviously fraudulent payments.

Article 56 of the Payment Services Regulation also creates a refund mechanism for specified transactions initiated by or through the payee where:

• the exact transaction amount was not specified when authorisation was given; and
• the resulting amount exceeded what could reasonably have been expected considering spending history, contract terms and other relevant circumstances.

The request must generally be made within two months after the payment transaction.

The provider must accept and make the refund or reject the request with reasons and explain available legal remedies within ten business days of receiving the request.

This should be considered when designing recurring or merchant-initiated payment products.

23. Complaint Handling: 20-Day Rule

Turkish payment law contains a specific complaint deadline.

Payment service providers must respond to customer complaints and objections concerning payment services within:

20 days

from the application date.

The response must be:

• demonstrable;
• reasoned;
• delivered using the customer’s application method.

Institutions must also take measures ensuring complaints can easily reach the relevant internal unit.

For fintech companies, this requires a genuine complaint-management system.

A chatbot repeatedly telling the customer “your request is being reviewed” does not substitute for a reasoned response.

24. TÖDEB Individual Customer Arbitration

Individual customers of payment and electronic money institutions may also have access to the arbitration mechanism established within the Türkiye Payment and Electronic Money Institutions Association (“TÖDEB”).

The Payment Services Regulation requires institutions to inform customers about the right to apply to the relevant Association arbitration committees through:

• the framework contract;
• website;
• branches or representative locations;
• similar communication channels.

The CBRT further states that where the institution’s answer is inadequate or no response is provided within the prescribed period, an application may be submitted to the TÖDEB Individual Customer Arbitration Committee within the relevant 60-day period.

This alternative dispute mechanism exists alongside the consumer’s statutory rights under Law No. 6502 and other laws.

25. Consumer Arbitration Boards in 2026

Law No. 6502 provides another important dispute mechanism: Consumer Arbitration Committees (Tüketici Hakem Heyetleri).

For 2026, disputes with a value below:

TRY 186,000

fall within the monetary jurisdiction of consumer arbitration committees.

The Ministry of Trade confirms that this threshold applies from 1 January 2026.

A consumer fintech dispute may therefore potentially proceed before a consumer arbitration committee where:

• the applicant qualifies as a consumer;
• the dispute constitutes a consumer transaction;
• the monetary value falls below the threshold.

This can include disputes involving financial services depending on the exact relationship.

26. Consumer Court and Mandatory Mediation

For consumer disputes of TRY 186,000 or more in 2026, consumer arbitration committees cannot determine the case.

The Ministry of Trade states that such disputes should generally proceed first through mandatory mediation under Article 73/A of Law No. 6502 and then, where unresolved, before the consumer court or the civil court acting as consumer court where no specialised consumer court exists.

The Ministry of Justice likewise confirms that mediation is generally a condition precedent for actions to be brought before consumer courts, subject to statutory exceptions.

A fintech company’s litigation strategy should therefore distinguish between:

• internal complaint;
• TÖDEB arbitration where relevant;
• Consumer Arbitration Committee;
• mandatory mediation;
• consumer court.

27. Digital Wallet Consumer Protection

Digital wallets can create several consumer-law issues.

Customers should clearly understand:

• who issues the wallet;
• whether stored value constitutes electronic money;
• which institution holds the funds;
• where the wallet can be used;
• transaction limits;
• fees;
• withdrawal or redemption rules;
• complaint channels.

A digital wallet should not be designed in a manner that makes the legal service provider invisible.

Brand partnerships and white-label arrangements should clearly identify the institution legally responsible for the financial service.

28. Electronic Money Redemption Rights

Electronic money is issued against funds received by the issuing institution.

The customer must generally be able to request redemption within the framework established by Law No. 6493 and the Payment Services Regulation.

The conditions governing redemption should be explained clearly in the customer agreement.

A fintech should avoid creating unnecessary barriers such as:

• hidden withdrawal procedures;
• unexplained delays;
• disproportionately difficult identity requirements introduced only at withdrawal stage;
• undisclosed redemption charges.

AML/KYC obligations may legitimately require additional checks, but these should not be used as a pretext for systematically preventing access to customer funds.

29. Safeguarding Customer Funds

Consumer protection in payment and electronic money companies also includes protection of customer funds.

Law No. 6493 contains safeguards requiring relevant customer funds to be protected through regulated mechanisms.

The CBRT publicly reiterated this principle in May 2025, stating that payment service users’ funds held by payment and electronic money institutions are protected through safeguarding accounts at banks under Article 22 of Law No. 6493.

This is an important distinction from ordinary fintech startup money.

Customer funds should not be treated as working capital belonging to the institution.

30. Open Banking Consumer Protection

Open banking introduces new consumer protection risks because multiple institutions may participate in one customer journey.

For example:

• Bank A holds the payment account;
• Fintech B provides account information;
• Fintech C initiates the payment.

The customer may not immediately understand which institution is responsible for a failure.

The Payment Services Regulation therefore contains specific allocation rules.

Where a payment is initiated through a PISP, the account servicing provider remains subject to the statutory customer correction and refund framework, while the PISP may be liable internally for losses resulting from failures within its responsibility.

Open banking interfaces should clearly identify the relevant provider and avoid confusing customers about legal responsibility.

31. Consumer Consent in Open Banking

Open banking depends on customer authorization.

However, consumer consent should be:

• specific;
• informed;
• linked to the requested service;
• technically secure.

A customer agreeing to connect a bank account for account aggregation should not automatically be considered to have authorised unrelated commercial uses of financial transaction data.

Consumer protection, payment regulation and KVKK therefore intersect directly in open banking.

The product team should distinguish:

permission to access an account for payment services

from

legal authority to process data for unrelated purposes.

32. Digital Banks and Consumer Protection

Digital banks remain banks.

Their branchless nature does not reduce consumer rights.

In addition to Banking Law and BRSA regulations, digital banks serving financial consumers may become subject to:

• Law No. 6502;
• financial consumer fee regulation;
• consumer credit rules;
• distance financial service rules;
• advertising requirements.

The CBRT’s 2026 implementation instruction for Financial Consumer Fees confirms that the 2020/7 framework applies to banks, consumer-credit financial institutions and card issuers.

Digital banks should therefore analyse consumer pricing within the banking regulatory framework rather than only under fintech/payment rules.

33. Banking as a Service and Customer Transparency

Banking as a Service may create a white-label customer experience.

The customer may primarily interact with a fintech interface while banking products are actually supplied by a licensed service bank.

Consumer transparency therefore requires the relationship to be structured so that the customer understands:

• which company operates the interface;
• which institution provides the regulated banking service;
• which party handles complaints;
• which contract governs the banking relationship.

A BaaS provider should not create the false impression that the interface provider itself is the licensed bank where this is not the case.

This is both a banking-regulatory issue and a broader consumer transparency issue.

34. Crypto Assets and Consumer Protection

Crypto markets require special treatment.

Türkiye’s crypto framework changed fundamentally following Law No. 7518 in July 2024 and the CMB’s two major communiqués published on 13 March 2025.

The CMB framework now regulates:

• crypto trading;
• transfer;
• custody;
• customer assets;
• platform operations;
• token listings;
• capital adequacy.

The CMB’s 2025 report confirms that the regulatory framework also requires separation between customer and platform assets, customer-level monitoring, price surveillance and mechanisms for detecting market-disruptive activity.

These are important investor/customer protection mechanisms.

35. Crypto Investment Risk Should Not Be Misrepresented

A crypto platform should not market high-volatility assets as though returns are certain.

Potentially problematic statements may include:

• “guaranteed profit”;
• “risk-free crypto income”;
• “this token cannot lose value”;
• “CMB supervision guarantees your investment.”

Regulation of the platform does not mean the regulator guarantees the commercial value of individual crypto assets.

Marketing teams should therefore distinguish between:

the regulatory status of the service provider

and

the investment risk of the crypto asset.

36. Commercial Advertising Rules Apply to Fintech

Fintech advertising is subject to consumer advertising law.

The Ministry of Trade’s Advertising Board supervises advertisements and unfair commercial practices under Law No. 6502 and may investigate advertising:

• upon complaint;
• upon applications from competitors;
• ex officio.

It can impose measures including cessation, correction and administrative sanctions.

For fintech companies, risky advertising may include:

• hiding mandatory charges;
• exaggerating investment returns;
• describing conditional services as “free”;
• falsely implying government guarantee;
• failing to disclose important product risks.

37. Advertising Enforcement Can Be Financially Significant

Türkiye continues to actively enforce advertising rules.

For 2026, administrative fines applicable to misleading advertisements and unfair commercial practices can range, depending on factors such as medium and nationwide impact, from approximately TRY 99,339 to TRY 39,916,524 under the updated consumer-law penalty schedule.

The exact sanction depends on the legal provision and circumstances.

For heavily marketed fintech products, advertising review should therefore take place before campaigns go live.

38. Social Media Influencers and Fintech Marketing

Fintech companies increasingly use influencers to promote:

• investment applications;
• crypto platforms;
• digital wallets;
• payment products.

The Ministry of Trade maintains specific guidance on commercial advertising by social media influencers within its current consumer-law guidance framework.

A fintech cannot necessarily avoid responsibility for misleading marketing merely because the claim was spoken by an influencer rather than appearing on the company’s official website.

Marketing agreements should therefore require compliance with Turkish advertising rules.

39. Dark Patterns and Fintech Interfaces

Modern consumer-law risk is not limited to written contract terms.

The structure of the user interface can influence consumer decisions.

Examples of potentially problematic digital design include:

• hiding the “cancel account” button;
• making acceptance prominent while refusal is difficult;
• pre-selecting paid add-ons;
• displaying important fees only after confirmation;
• repeatedly pressuring users to purchase investment products;
• making withdrawal substantially harder than deposit.

Such practices should be assessed under consumer protection, unfair commercial practice and data protection principles.

The fact that a customer technically clicked a button does not necessarily make every interface design legally fair.

40. Account Closure Should Not Be Made Unreasonably Difficult

Fintech businesses often focus heavily on making account opening easy while making account closure difficult.

The Payment Services Regulation requires complaint channels to be accessible, while Law No. 6502 also protects consumers against unfair termination practices.

For qualifying distance financial service contracts, the Consumer Protection Law expressly states that the consumer should not be forced to use a more burdensome method to terminate the contract than the method used to establish it.

Even where that specific distance-contract provision does not apply to a particular payment product, excessively obstructive termination procedures may create broader consumer-law and fairness risk.

41. Customer Funds Frozen for AML Reasons

One difficult area is account restriction for AML, sanctions or fraud concerns.

A fintech may be legally required to restrict activity in certain circumstances.

Consumer protection does not mean that the company must ignore:

• MASAK obligations;
• sanctions;
• court orders;
• fraud risk;
• identity verification deficiencies.

However, operational procedures should distinguish a legally justified restriction from arbitrary account blocking.

Where legally possible, the institution should provide customers with appropriate information and an accessible complaint mechanism without violating AML confidentiality or tipping-off rules.

42. KVKK and Consumer Protection

Fintech customer protection increasingly overlaps with personal data protection.

Consumers should understand:

• what data is processed;
• why it is processed;
• who receives it;
• whether automated profiling is used;
• whether data leaves Türkiye.

The Personal Data Protection Authority’s July 2026 Payment and Electronic Money Sector Good Practices Guide now specifically addresses controller/processor status, legal bases, transfers, security and other data protection obligations relevant to these institutions.

For fintech businesses, data transparency should therefore form part of the broader customer protection framework.

43. Complaints Should Be Used as a Compliance Indicator

A fintech company should not treat customer complaints only as a customer-service problem.

Complaint patterns can reveal:

• contract ambiguity;
• cybersecurity failures;
• incorrect fees;
• defective onboarding;
• unauthorized transaction problems;
• poor merchant practices;
• misleading marketing.

Management should therefore analyse complaint data systematically.

For example, if thousands of customers complain about the same fee, the company should not simply improve the FAQ.

It should consider whether the underlying fee structure or disclosure process is legally defective.

44. Consumer Protection Due Diligence in Fintech M&A

An investor acquiring a Turkish fintech should examine consumer protection history.

Important areas include:

Customer Agreements

Are the terms enforceable and fair?

Fee Structure

Were all fees adequately disclosed?

Unauthorized Payments

How many fraud/refund complaints exist?

Complaints

Does the institution meet the 20-day response requirement?

TÖDEB Cases

Has the company faced significant arbitration claims?

Consumer Arbitration Committees

Are there repeated adverse decisions?

Advertising

Has the Advertising Board investigated campaigns?

Data Protection

Are privacy disclosures and consumer interfaces compliant?

Account Closure

Are there systematic complaints concerning frozen or inaccessible funds?

Consumer complaints can expose liabilities not immediately visible in financial statements.

45. Practical Consumer Protection Checklist for Fintech Companies

Before launching a consumer-facing fintech product in Türkiye, the company should review the following.

Customer Classification

Determine whether the customer is acting as a consumer or commercial user.

Regulatory Provider

Clearly identify the legal entity providing the financial service.

Contract

Use clear and understandable terms.

Pre-Contract Information

Provide material information before customer acceptance.

Fees

Disclose all relevant charges before transactions.

Annual/Monthly Cost Information

Provide required cost statements where applicable.

Unfair Terms

Remove provisions attempting to waive mandatory consumer rights.

Remote Contracting

Maintain reliable evidence of customer approval.

Authentication

Use regulatory security standards.

Unauthorized Payments

Establish a 13-month notification and investigation workflow where applicable.

Refunds

Ensure statutory refund obligations can be implemented rapidly.

Complaint Management

Respond to payment-service complaints within 20 days.

TÖDEB

Inform relevant individual customers about arbitration rights.

Consumer Arbitration Committees

Monitor the TRY 186,000 threshold applicable in 2026.

Advertising

Review financial claims before publication.

Influencers

Control third-party promotional claims.

Data Protection

Coordinate consumer notices with KVKK compliance.

AML Restrictions

Ensure customer communications do not breach tipping-off restrictions.

Frequently Asked Questions About Fintech Consumer Protection in Turkey

Does Turkish consumer law apply to fintech companies?

Yes, where the transaction falls within the scope of consumer law.

A regulated financial licence does not automatically exclude Law No. 6502 or unfair contractual term rules.

Are payment institutions subject to consumer protection rules?

Yes.

Payment institutions are subject to detailed customer protection provisions under Law No. 6493 and the Payment Services Regulation, as well as consumer law where the customer relationship qualifies as a consumer transaction.

Must payment institutions disclose fees before transactions?

Yes, where the applicable Payment Services Regulation rules require disclosure. Additional payment-instrument charges must be communicated before transaction initiation.

Can payment institutions charge customers for legally required information?

Generally no. The Payment Services Regulation prohibits charging for information the provider is required to supply under the Regulation, subject to limited exceptions for certain additional information requests or legally required processes.

How long does a customer have to dispute an unauthorized payment?

Generally, the customer must notify the provider without delay after discovery and no later than 13 months after the transaction, subject to the important exception where required transaction information was not properly supplied.

Who must prove that a payment was authorized?

The payment service provider bears significant evidential obligations and must prove authorization, correct recording and other regulatory elements when the customer disputes the transaction.

How much can the consumer be responsible for if a payment instrument is lost or stolen?

Under the current Payment Services Regulation, the customer may generally bear up to TRY 250 for unauthorized transactions occurring within the 24 hours preceding the required loss/security notification, subject to exceptions including fraud or intentional/grossly negligent breach.

How quickly must a payment institution answer a complaint?

Payment service providers must generally provide a demonstrable and reasoned answer within 20 days.

Can a customer apply to TÖDEB?

Individual customers may have access to TÖDEB’s arbitration mechanism, without prejudice to their statutory consumer and other legal remedies.

What is the Consumer Arbitration Committee threshold for 2026?

For 2026, consumer disputes below TRY 186,000 fall within the monetary jurisdiction of Consumer Arbitration Committees.

What happens for disputes of TRY 186,000 or more?

Such disputes generally proceed through mandatory consumer mediation and, where unresolved, consumer court proceedings, subject to statutory exceptions.

Does every remote fintech contract have a 14-day withdrawal right?

No.

Although Law No. 6502 and the Financial Services Distance Contracts Regulation recognise a 14-day withdrawal right for qualifying financial services, the Regulation’s current scope contains exclusions affecting certain payment services. The exact product must therefore be classified before asserting that the withdrawal right applies.

Can a fintech contract exclude all liability for cyber fraud?

Not necessarily.

Mandatory payment-service liability rules can override contractual wording, particularly for unauthorized transactions. Broad exclusions should be reviewed carefully.

Are crypto platforms subject to customer protection rules?

Crypto asset service providers are now subject to detailed CMB regulations concerning trading, custody, customer assets, token listing and other activities. The applicability of general consumer-law remedies to a particular crypto relationship should also be assessed according to the parties and nature of the transaction.

Conclusion: Building a Consumer-Compliant Fintech Business in Turkey

Consumer protection rules for fintech companies in Turkey operate through several overlapping layers of legislation.

The first layer is general consumer law under Law No. 6502.

The second is the sector-specific financial regulatory framework governing the relevant fintech activity.

For payment institutions and electronic money institutions, Law No. 6493 and the Payment Services Regulation contain detailed rules concerning contracts, pre-contractual information, fees, customer authentication, unauthorized payments, complaints and dispute resolution.

For banks and digital banks, additional banking and financial-consumer regulation applies.

For crypto asset service providers, CMB regulation increasingly establishes specialised customer and investor protection mechanisms concerning custody, asset segregation, market surveillance and platform operations.

The most important principle is that regulatory licensing does not replace consumer law.

Indeed, the Turkish Unfair Terms Regulation expressly applies even to contracts drafted by institutions operating under statutory licences and regulatory permissions.

Accordingly, a payment institution cannot simply state that the customer accepted its terms and therefore every clause is enforceable.

A digital fintech contract remains subject to mandatory law.

For payment and electronic money businesses, pricing transparency is particularly important.

The Payment Services Regulation restricts charges for legally required information and requires consumers to receive clear cost information. Additional charges linked to the use of payment instruments must be disclosed before the transaction is initiated.

Fintech companies should therefore design fees around the principle:

No customer should discover the real cost of a financial transaction only after confirming it.

Unauthorized payment transactions represent another major compliance area.

The current framework allows customers to request correction of unauthorized or incorrectly executed payments, generally within 13 months.

The payment service provider also bears the burden of proving key aspects of authorisation and correct execution.

Where unauthorized use results from a lost or stolen payment instrument, the Regulation generally limits the customer’s liability before notification to TRY 250 for qualifying transactions occurring within the preceding 24 hours, while the customer is not normally responsible for unauthorized transactions occurring after the required notification.

These rules should be built directly into fintech fraud operations.

A customer-service agent should not make legal liability decisions solely by saying:

“The payment was authenticated, therefore we cannot refund it.”

The company must consider the full statutory framework.

Complaint handling is equally important.

Payment service providers must respond to payment-related customer complaints and objections within 20 days, using the customer’s application method and providing a demonstrable and reasoned response.

Relevant individual customers should also be informed about the TÖDEB arbitration mechanism.

Consumer Arbitration Committees remain another major dispute channel.

For 2026, disputes below TRY 186,000 fall within their monetary jurisdiction.

For disputes of TRY 186,000 or more, consumers will generally need to proceed through mandatory mediation and subsequently consumer court litigation where settlement cannot be reached.

This creates substantial operational exposure for large consumer-facing fintech companies.

A contractual problem affecting 50,000 customers may result in thousands of relatively small individual disputes rather than one major lawsuit.

Fintech businesses should therefore monitor complaint patterns before they develop into systematic consumer litigation.

Advertising represents another increasing risk.

The Turkish Advertising Board actively supervises misleading advertisements and unfair commercial practices, and the administrative penalty regime was materially increased again for 2026.

Marketing teams should be especially cautious with expressions such as:

• “free”;
• “guaranteed”;
• “risk-free”;
• “government approved”;
• “no fees.”

Every such claim should be legally accurate in the actual customer journey.

This is particularly important for crypto and investment products.

The fact that a crypto platform is regulated does not mean that individual crypto assets are guaranteed by the government or regulator.

Consumer transparency also extends beyond written contracts.

The design of the application itself matters.

Fintech companies should avoid digital interfaces that make:

• accepting charges easy but understanding them difficult;
• depositing money simple but withdrawing unnecessarily complicated;
• opening an account immediate but terminating the relationship almost impossible.

In modern financial services, user experience can itself become a consumer-law issue.

For foreign fintech companies entering Türkiye, another important lesson is that international terms and conditions cannot simply be translated into Turkish and deployed.

Turkish financial services require localised analysis of:

• mandatory consumer rights;
• payment liability;
• fee disclosures;
• dispute mechanisms;
• KVKK;
• AML restrictions;
• sector-specific licensing obligations.

A contractual clause valid under English, American or another foreign law may be ineffective against a Turkish consumer where it conflicts with mandatory Turkish legislation.

The most effective compliance model is therefore to integrate consumer law into the fintech product from the first stage.

Before launch, a fintech should ask:

Is the customer clearly informed about who provides the service?

Can the customer understand the total cost?

Does the contract contain terms that improperly limit statutory rights?

Can unauthorized transaction complaints be investigated and refunded within the legal framework?

Can customer complaints be answered within 20 days?

Are advertising claims fully supported?

Can the consumer terminate or access funds without unnecessary obstacles?

When these questions are considered only after a dispute arises, the cost of remediation can be significant.

When they are incorporated into the original product design, consumer protection can become part of operational quality.

For companies planning to establish or operate a payment institution, electronic money institution, digital wallet, open banking platform, digital bank, Banking as a Service business, crypto platform or other consumer-facing fintech company in Turkey, consumer protection should therefore be treated as a core regulatory function.

The central principle is simple:

A legally compliant fintech product must not only work technically—it must also treat the customer fairly, transparently and securely.

As Türkiye’s digital financial market continues to grow, companies capable of combining technological innovation with strong consumer protection will be better positioned to maintain regulatory approval, reduce litigation and build long-term customer trust.

Legal Disclaimer: This publication provides general information concerning consumer protection requirements applicable to fintech companies in Türkiye as of July 2026. It does not constitute legal advice. The applicability of consumer legislation depends on the customer’s status, the financial product, contractual structure and regulated activity. Monetary thresholds, administrative penalties and regulatory practices may change. Each fintech product should be assessed individually under the legislation in force at the relevant time.