Introduction: Digital Banking Law in Turkey

Digitalisation has fundamentally changed the Turkish banking and financial technology market. Customers increasingly expect to open accounts, transfer money, obtain financing, make investments and manage their financial affairs entirely through mobile applications without visiting physical bank branches.

Türkiye has responded to this transformation by creating a specific regulatory framework for branchless digital banks and Banking as a Service (“BaaS”).

The principal legislation is not a standalone statute called the “Digital Banking Law.” Instead, Digital Banking Law in Turkey is principally based on Banking Law No. 5411 and the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model, published in the Official Gazette on 29 December 2021.

The Banking Regulation and Supervision Agency (“BRSA” or “BDDK”) continues to list this Regulation as part of the current banking legislation in 2026.

The Regulation defines a digital bank as a credit institution that provides banking services through electronic banking distribution channels instead of physical branches. Unless a specific restriction applies, digital banks may perform the activities available to credit institutions according to whether they operate as deposit banks or participation banks.

This distinction is critical for international fintech investors.

A Turkish digital bank is not simply a fintech application connected to a conventional banking licence. It is itself a regulated bank subject to the general banking framework, capital adequacy requirements, corporate governance rules, BRSA supervision, information systems requirements and additional rules specifically designed for digital banking.

Establishing a digital bank in Türkiye therefore requires substantially more regulatory preparation and financial resources than establishing an ordinary fintech, payment institution or electronic money company.

This guide explains the principal rules governing digital bank licensing in Turkey, including minimum capital, establishment permission, operating permission, customer restrictions, branchless operations, management qualifications, information systems, remote onboarding, BaaS, AML/KYC and foreign investment.

1. What Is a Digital Bank Under Turkish Law?

The Regulation defines a digital bank as a credit institution providing banking services through electronic banking service distribution channels instead of physical branches.

This definition distinguishes a digital bank from a conventional bank that merely offers strong mobile banking functionality.

Almost every major Turkish bank today provides internet and mobile banking. That does not make each of them a “digital bank” for purposes of the specific regulatory regime.

A digital bank is designed from the beginning as a branchless banking institution.

Its principal customer interaction takes place through channels such as:

• mobile banking;
• internet banking;
• electronic banking platforms;
• remote onboarding systems;
• other permitted digital distribution channels.

The legal significance of this model is that the bank receives a full banking licence but becomes subject to special operating restrictions during the digital-bank phase.

2. Main Legislation Governing Digital Banks in Turkey

The principal legislation applicable to digital banks includes:

Banking Law No. 5411;

Regulation on the Operating Principles of Digital Banks and Banking as a Service Model;

Regulation on Transactions of Banks Subject to Permission and Indirect Shareholding;

Regulation on Information Systems and Electronic Banking Services of Banks;

Regulation on Remote Identification Methods to be Used by Banks and Establishment of Contractual Relationship in Electronic Environment;

and other regulations governing internal systems, capital adequacy, risk management, outsourcing and banking secrecy.

The BRSA’s current legislation database continues to list both the Digital Banks Regulation and remote-identification and information-systems regulations as part of the Turkish banking regulatory framework.

Consequently, compliance with the Digital Banks Regulation alone is not sufficient.

Article 4 of the Digital Banks Regulation expressly provides that digital banks must comply with the legislation applicable to credit institutions in addition to the specific digital-bank requirements.

3. Which Authority Licenses Digital Banks in Turkey?

The competent regulatory authority is the Banking Regulation and Supervision Board, operating through the Banking Regulation and Supervision Agency.

Under Banking Law No. 5411, establishing a bank in Türkiye requires a Board decision supported by the affirmative votes of at least five Board members, provided that the statutory establishment requirements are satisfied.

The Banking Law also provides that the establishment decision should generally be notified within three months following the application or completion of missing application documents. If missing documents are not completed within six months, the application becomes invalid.

However, investors should distinguish two different regulatory stages:

Establishment permission, and

Operating permission.

Obtaining permission to establish a digital bank does not by itself authorise the institution to begin accepting deposits, participation funds or conducting banking activities.

A separate operating licence is required.

4. Is a Digital Bank a Real Bank?

Yes.

A digital bank is not merely a payment institution, electronic money institution or fintech intermediary.

It is legally a credit institution.

Depending upon its licence, it may be established as:

• a digital deposit bank; or
• a digital participation bank.

Subject to the specific restrictions in the Digital Banks Regulation, digital banks can undertake the banking activities permitted to the relevant type of credit institution.

Banking Law No. 5411 identifies banking activities including accepting deposits or participation funds, granting loans, carrying out payment and fund transfer transactions, issuing payment instruments, conducting foreign exchange transactions and various other financial activities subject to the particular bank category and applicable legislation.

Therefore, the regulatory status of a digital bank is substantially broader than that of an electronic money institution.

5. Corporate Form Required for a Digital Bank

A bank established in Türkiye must be incorporated as a joint-stock company, or anonim şirket (A.Ş.).

Article 7 of Banking Law No. 5411 requires:

• incorporation as a joint-stock company;
• shares to be issued against cash and in registered form;
• founders to satisfy statutory qualifications;
• board members to possess the necessary professional qualifications;
• transparent ownership and organisational structures;
• planned activities to correspond with the financial and organisational structure;
• appropriate internal control, risk management and internal audit planning.

For a fintech entrepreneur planning to establish a digital bank, this means ordinary startup incorporation documents are insufficient.

The proposed company’s articles of association, ownership structure, management and business plan must be designed as those of a regulated bank from the outset.

6. Minimum Capital for a Digital Bank in Turkey

One of the most important requirements for obtaining a digital bank licence in Turkey concerns capital.

Article 9 of the Digital Banks Regulation provides that the minimum paid-up capital required to obtain an operating licence is:

TRY 1,000,000,000

The capital must be paid in cash and free from fictitious transactions.

The BRSA Board is expressly authorised to increase this amount.

The TRY 1 billion threshold therefore represents the specific regulatory minimum under the Digital Banks Regulation.

It should not necessarily be interpreted as the total investment required to establish a commercially sustainable digital bank.

A digital bank must additionally finance matters such as:

• technology infrastructure;
• cybersecurity;
• personnel;
• management;
• risk systems;
• regulatory compliance;
• audit;
• capital adequacy;
• customer acquisition;
• fraud prevention;
• business continuity;
• operational expenses.

In practice, establishment capital may be substantially higher than the regulatory minimum. For example, the BRSA authorised the establishment of Adil Katılım Bankası A.Ş. as a digital participation bank with TRY 3 billion in establishment capital in a 2024 decision.

7. Can the Operating Restrictions of a Digital Bank Be Removed?

Yes, potentially.

This is one of the most commercially significant provisions of the Turkish digital banking framework.

Article 5 of the Digital Banks Regulation provides that where a digital bank increases the relevant minimum paid-up capital to:

TRY 2.5 billion

the bank may apply to the BRSA Board for removal of the special digital-bank operating restrictions.

The Board may remove those restrictions gradually or completely under a transition plan if it considers the bank capable of managing the resulting risks.

Once the restrictions are completely removed, the institution may perform banking activities available to other credit institutions without being subject to the special digital-bank restrictions in Article 5.

This creates an important strategic possibility.

An institution can initially enter the market under the digital-bank framework and, subject to regulatory approval and increased capitalisation, later seek broader operating freedom.

However, reaching TRY 2.5 billion in capital does not automatically remove the restrictions.

BRSA approval remains necessary.

8. Who Can Be Customers of a Digital Bank?

The Turkish framework places specific restrictions on the credit customers of digital banks.

Under Article 5 of the Digital Banks Regulation, credit customers may generally consist only of:

• financial consumers, and
• small and medium-sized enterprises (“SMEs”).

The Regulation contains limited exceptions for matters such as transactions in interbank or money and capital markets, loans to other banks and certain foreign-currency loans to businesses exceeding SME size.

The definition of SME is therefore commercially significant for digital banks.

In November 2025, the BRSA determined the turnover threshold for domestic-resident SMEs at TRY 1 billion for purposes of the relevant capital adequacy framework.

Accordingly, the target customer strategy of a digital-bank applicant should be designed carefully.

The institution cannot simply present a business plan targeting every corporate customer in Türkiye while remaining subject to the digital-bank customer restrictions.

9. Credit Restrictions Applicable to Digital Banks

The Digital Banks Regulation also contains specific rules concerning unsecured consumer credit.

Article 5 limits the total amount of certain unsecured cash consumer loans based upon the customer’s declared and verified average monthly net income.

The Regulation also gives the BRSA authority to amend the applicable ratios and monetary limits.

Digital banks should therefore design automated credit-scoring systems in a manner that complies with:

• banking credit legislation;
• income verification rules;
• risk-management principles;
• consumer legislation;
• regulatory lending limits.

The use of artificial intelligence or proprietary credit-scoring models does not eliminate the bank’s regulatory responsibility.

Indeed, where a digital bank uses its own income-estimation model, the Regulation requires the underlying documents and records to remain audit-ready and the model to produce reasonable and consistent results.

10. Can a Digital Bank Open Physical Branches?

As a rule, no.

The defining characteristic of a digital bank is that it operates without conventional physical branches.

The Regulation prohibits digital banks from establishing organisations such as:

• branches;
• correspondent offices;
• agencies;
• representative offices,

apart from the head office and permitted service units affiliated with the head office.

Digital banks are also restricted from providing conventional physical safe-deposit and custody services, except where the relevant service can be provided digitally.

However, branchlessness does not mean that a digital bank can have no physical presence whatsoever.

11. Physical Customer Complaint Office

A digital bank is required to establish at least one physical office for handling customer complaints.

This office cannot be used as an ordinary bank branch.

Digital banks may also provide services through their own ATM networks or other ATM networks.

The Regulation additionally permits certain cash withdrawal or prepaid-balance loading services through businesses accepting eligible payment instruments, subject to the applicable conditions.

This framework demonstrates the regulatory philosophy behind digital banking:

The institution should remain fundamentally branchless while maintaining sufficient physical accessibility for complaints and certain operational needs.

12. Service Continuity Requirement

Because digital banks depend almost entirely upon electronic channels, system availability is a central regulatory concern.

The Regulation requires digital banks to announce committed continuity levels for each electronic banking distribution channel.

For internet banking and mobile banking, the committed continuity percentage cannot be below:

99.8%

Digital banks must also report relevant service availability and interruption metrics to the BRSA in accordance with regulatory procedures.

For investors, this requirement highlights a crucial point:

A digital-bank licence is not simply a financial licence.

It is also a technology-resilience project.

Infrastructure, redundancy, disaster recovery and incident management are therefore core components of the business model.

13. Management Requirements for a Digital Bank

The Digital Banks Regulation imposes additional management requirements because of the technological nature of the business.

When assessing the management team, the BRSA considers whether managers have sufficient knowledge and experience to understand risks specific to the digital banking model.

Most importantly:

the highest-ranking executive responsible for information systems must be appointed at least at the level of assistant general manager, and

at least one board member must have at least ten years of professional experience in information systems management.

This is a highly significant requirement for fintech founders.

A traditional board consisting exclusively of bankers, lawyers, accountants and investors may therefore be insufficient.

Technology governance must be represented at board level.

14. Founder Qualifications

Founders of Turkish banks are subject to stringent fit-and-proper requirements under Article 8 of Banking Law No. 5411.

These rules address matters including:

• bankruptcy and insolvency history;
• ownership or control in failed financial institutions;
• certain criminal convictions;
• financial strength and reputation;
• honesty and competence;
• transparent ownership structures.

Where founders are legal entities, their ownership and risk-group structure is also examined.

For international investors, the BRSA may therefore look beyond the immediate Turkish shareholder and examine the ultimate control structure.

Opaque ownership arrangements can create significant licensing difficulties.

15. Technology, E-Commerce and Telecom Groups Establishing Digital Banks

The Turkish framework expressly anticipates the possibility that digital banks may be established by technology, e-commerce or telecommunications groups.

Where the applicant’s controlling shareholders are legal entities providing technology, electronic commerce or telecommunications services, the Digital Banks Regulation contains special regulatory considerations.

The BRSA may require the relevant controlling entities or their controllers to be resident in Türkiye and may require information-sharing arrangements with the Risk Center concerning data relevant to the indebtedness and financial capacity of persons residing in Türkiye.

This is particularly important for major technology platforms seeking to transition into financial services.

A large customer base and sophisticated digital infrastructure may be commercially advantageous, but they do not substitute for banking-law compliance.

16. Business Plan Requirements for a Digital Bank Licence

The business plan for a digital-bank licence is significantly more detailed than a conventional corporate plan.

The Digital Banks Regulation requires the applicant to explain the target market and identify needs within customer segments.

Examples expressly referred to in the Regulation include:

• students;
• housewives;
• persons under eighteen;
• SMEs;
• groups that may benefit from improved financial inclusion.

The application should identify the products designed for these customers and the marketing strategy.

The business plan must also contain:

• market size analysis;
• market-gap analysis;
• five-year pricing policy;
• expected number of customers;
• financial projections;
• forecast financial statements;
• expected break-even point;
• assumptions supporting these projections.

This demonstrates that the BRSA does not view digital banking as merely a technology licence.

The regulator expects evidence of a sustainable banking business.

17. Information Systems Plan Required for Licensing

The activity programme must also provide extensive information concerning technology.

The Digital Banks Regulation requires information such as:

• general system and network architecture;
• identification of critical systems;
• information systems strategy;
• IT risk management;
• information security management;
• IT project management;
• IT operations;
• accessibility;
• business continuity;
• external service management;
• outsourced technology providers;
• risk assessments of external providers;
• customer complaint workflows;
• transaction security;
• customer authentication;
• remote identity technology.

The information systems infrastructure is therefore examined before the bank receives permission to operate.

18. BRSA Assessment of Information Systems

A digital bank cannot obtain an operating licence merely by promising that it will build compliant technology after launch.

Article 12 of the Digital Banks Regulation requires a competency assessment of the applicant’s information systems.

The BRSA’s on-site inspection unit evaluates the systems within the scope of the activity programme.

Where considered necessary, the applicant may also be required to obtain an information-systems and business-process audit from an audit firm authorised by the BRSA.

Accordingly, the technology platform should reach a substantial level of operational readiness before the final operating-permission process.

19. Remote Customer Onboarding

Remote customer acquisition is fundamental to digital banking.

Türkiye has a separate Regulation on Remote Identification Methods to be Used by Banks and Establishment of Contractual Relationship in Electronic Environment.

The remote identification framework initially entered into force in 2021 and was subsequently expanded. In 2023, the BRSA amended the framework to facilitate remote onboarding of legal entities in addition to individuals and sole traders.

For digital banks, remote onboarding systems must therefore address matters including:

• identity verification;
• identity-document security;
• authentication;
• transaction security;
• fraud prevention;
• contract formation;
• evidence and record retention.

The customer journey cannot be designed solely for convenience.

It must satisfy regulatory security requirements.

20. Electronic Contract Formation

Digital banks commonly establish their customer relationships without wet signatures or branch visits.

Banking legislation therefore regulates electronic establishment of contractual relationships.

The Digital Banks Regulation requires information concerning the technical controls that will ensure customers understand and approve the content of electronic contracts.

This is especially important in relation to:

• deposit agreements;
• participation account agreements;
• consumer credit;
• debit and credit cards;
• electronic banking services;
• other banking products.

A simple “I accept” button may be insufficient if the surrounding process does not satisfy authentication and evidential requirements.

21. AML and KYC Compliance

A digital bank remains subject to the Turkish anti-money laundering and counter-terrorist financing framework.

The relevant regime principally includes Law No. 5549 on Prevention of Laundering Proceeds of Crime, MASAK regulations and sector-specific obligations.

Digital customer acquisition creates particular AML challenges because customers may never be physically present before bank staff.

Compliance infrastructure should therefore be capable of addressing:

• customer identification;
• beneficial ownership;
• politically exposed persons;
• sanctions screening;
• customer risk classification;
• transaction monitoring;
• suspicious transaction reporting;
• enhanced due diligence;
• record keeping.

A digital bank should incorporate AML controls directly into the onboarding and transaction architecture.

The compliance function cannot operate as a separate manual process detached from the core technology platform.

22. Personal Data Protection and Banking Secrecy

Digital banks process extremely large volumes of personal and financial data.

The legal framework includes both:

Law No. 6698 on the Protection of Personal Data (“KVKK”),

and banking confidentiality requirements, including Banking Law provisions and the Regulation on the Sharing of Confidential Information.

The BRSA’s current legislation continues to include the Regulation on Disclosure/Sharing of Confidential Information among banking regulations.

Digital-bank data governance may involve:

• customer identity information;
• deposits;
• transaction histories;
• credit information;
• behavioural analytics;
• device information;
• biometric data;
• fraud indicators;
• financial profiles.

A customer giving consent to the processing of data does not necessarily eliminate banking-secrecy restrictions or sector-specific requirements.

Financial data governance should therefore be assessed under both KVKK and banking legislation.

23. Outsourcing and Cloud Services

Digital banks are particularly dependent on external technology providers.

Potential outsourced functions include:

• cloud infrastructure;
• cybersecurity;
• identity verification;
• customer communication;
• analytics;
• fraud detection;
• software infrastructure;
• call centres.

However, outsourcing does not transfer the bank’s regulatory responsibility to the vendor.

The applicant’s licensing documentation must identify relevant information-systems external service providers and provide risk assessments concerning those providers.

Banks are also subject to the BRSA’s broader outsourcing and information-systems framework.

Accordingly, a cloud or technology provider should be selected only after considering Turkish banking regulation.

24. What Is Banking as a Service in Turkey?

Türkiye is one of the jurisdictions that has expressly regulated Banking as a Service (“BaaS”) within its banking legislation.

The Digital Banks Regulation defines the service model as one in which customers access the banking services of a service bank through the application or internet interface offered by an interface provider.

The customer effectively interacts with the fintech interface while the underlying regulated banking service is provided by the licensed bank.

This model is highly relevant to:

• e-commerce platforms;
• fintech applications;
• super-apps;
• accounting platforms;
• retail technology companies;
• embedded-finance providers.

However, the interface provider does not become a bank merely because banking services are available inside its application.

25. Who Can Provide Banking as a Service?

The Regulation provides that a service bank may provide BaaS only to interface providers resident in Türkiye, and only within the scope of the service bank’s own operating licence.

Banks themselves cannot act as interface providers under this regulatory model.

This domestic-residency condition is important for international fintech businesses.

A foreign fintech group may need to establish an appropriate Turkish corporate entity before operating as an interface provider in the Turkish BaaS market.

26. The Interface Provider Is Not the Bank

The regulatory allocation of responsibility in BaaS must be clearly understood.

The service bank makes the decision as to whether banking services will be provided to the customer.

This includes lending decisions.

The relevant banking services remain on the balance sheet of the service bank.

The interface provider should not create the false impression that it independently holds the banking licence.

Without the appropriate authorisation, the interface provider may not use names, statements or advertising that create the impression that it is a bank, payment institution or electronic money institution or that it independently collects deposits or other regulated funds.

Branding and marketing therefore become legal compliance issues in embedded-finance arrangements.

27. Who Is the Customer Contracting With in BaaS?

A direct contractual relationship must exist between the customer and the service bank.

Where that contractual relationship is established electronically, remote identification and electronic contract requirements apply.

The service bank remains responsible for customer identification under the applicable remote identification regulation.

The interface provider may facilitate the customer journey, but the legal banking relationship remains with the licensed bank.

This distinction should be clearly reflected in:

• terms and conditions;
• customer notices;
• mobile application screens;
• onboarding;
• privacy notices;
• advertising.

28. Cybersecurity Responsibility in Banking as a Service

The interface provider and service bank have significant joint responsibilities concerning the security of the customer-facing interface.

The Regulation states that they are jointly responsible for ensuring that the interface used to access banking services complies with relevant authentication and transaction-security obligations.

A service bank cannot continue providing BaaS through an interface provider whose systems do not satisfy those requirements.

This makes cybersecurity due diligence essential before a bank enters into a BaaS agreement.

29. Interface Providers as Outsourcing Institutions

An interface provider also qualifies as an outsourcing institution in relation to specified services it provides to the service bank.

For example, facilitating establishment of the customer relationship or enabling banking services to be provided through the interface can fall within the outsourcing framework.

The Digital Banks Regulation provides that acting as an interface provider to a service bank is subject to BRSA permission within the applicable framework.

Therefore, a BaaS project should never be treated as an ordinary API integration agreement.

It is a regulated banking outsourcing structure.

30. Digital Bank Establishment Permission Process

The licensing procedure can broadly be divided into several stages.

Step 1 – Determine the Banking Model

The founders should determine whether the proposed institution will be a digital deposit bank or digital participation bank.

Step 2 – Design the Ownership Structure

Founders and qualifying shareholders must satisfy Banking Law requirements.

Step 3 – Prepare Capital

The project should be capitalised consistently with the Digital Banks Regulation and the proposed business plan.

Step 4 – Submit the Establishment Application

The application should contain the corporate, shareholder, management, business and financial documentation required under banking legislation.

Under Banking Law No. 5411, establishment permission is granted by the BRSA Board if the statutory conditions are met.

Step 5 – Establish the Bank

Following establishment permission, incorporation, registration and organisational preparation must be completed.

Step 6 – Build Banking Infrastructure

The institution must establish personnel, information systems, risk management, internal controls and operational infrastructure.

Step 7 – Apply for Operating Permission

A separate application is required.

The BRSA examines whether the bank is genuinely capable of performing its planned activities.

31. Deadline for Applying for Operating Permission

An important licensing deadline should not be overlooked.

Banking Law No. 5411 provides that establishment permission may be revoked where the institution fails to apply for an operating licence within nine months following issuance of the establishment permission.

Consequently, founders should not obtain establishment permission before they have a realistic implementation timetable.

Technology, management recruitment, capitalisation and operational infrastructure must move rapidly after approval.

32. Requirements Before Starting Operations

Banking Law No. 5411 requires the bank, before commencing operations, to demonstrate that:

• its capital has been paid in cash and is sufficient for the intended activities;
• applicable system-entry obligations have been satisfied;
• corporate governance requirements are met;
• sufficient personnel and technical infrastructure exist;
• managers possess the required qualifications;
• the BRSA is satisfied that the institution is capable of performing the proposed activities.

The Digital Banks Regulation adds the specialised technology and governance requirements described above.

33. Operating Licence Decision

Operating permission is separate from establishment permission.

Under Banking Law No. 5411, the BRSA Board grants operating permission following the appropriate application.

The operating permission decision is published in the Official Gazette.

The Banking Law states that the operating permission decision should generally be made within three months following the application.

However, investors should not interpret this as meaning that an entire digital-bank establishment project will necessarily take three months.

The practical timeline includes incorporation, system construction, staffing, regulatory review, information-systems assessment and remediation of any deficiencies.

34. Foreign Investors and Digital Banks in Turkey

Foreign investment into Turkish banking is possible, but establishing a bank is subject to strict banking regulation.

A foreign investor should expect regulatory examination of:

• ultimate beneficial ownership;
• controlling shareholders;
• financial capacity;
• regulatory history;
• ownership in other financial institutions;
• transparency;
• source of capital;
• management structure.

Banking Law No. 5411 requires transparent ownership arrangements and specifically regulates direct and indirect share ownership.

A foreign banking or fintech licence does not automatically authorise the investor to operate a digital bank in Türkiye.

Local BRSA establishment and operating permissions remain necessary.

35. Can a Foreign Bank Simply Offer Digital Banking in Turkey?

A bank headquartered abroad may not treat its foreign banking licence as automatic permission to conduct local banking activity in Türkiye.

Banking Law No. 5411 contains separate requirements for foreign banks establishing branches in Türkiye.

The foreign regulator must not object to the Turkish activity, the capital reserved for Türkiye must meet applicable requirements, management must be qualified and an appropriate activity programme and transparent ownership structure must be presented.

For a specifically Turkish digital-bank project, investors should therefore plan around Turkish banking authorisation rather than foreign licence passporting.

36. Digital Bank vs Electronic Money Institution

One of the most important distinctions in Turkish Fintech Law is between a digital bank and an electronic money institution.

A digital bank is a bank regulated principally under Banking Law No. 5411.

An electronic money institution is a non-bank payment service provider regulated principally under Law No. 6493 and supervised by the CBRT.

A digital bank may have authority to:

• accept deposits or participation funds;
• lend money;
• provide banking products;
• operate banking accounts.

An EMI does not become a bank merely because its application resembles mobile banking.

Therefore, founders should not choose between a digital bank and an EMI based merely on branding.

The appropriate structure depends upon the financial services to be provided.

37. Digital Bank vs Banking as a Service

These concepts should also be distinguished.

A digital bank has its own banking licence.

A BaaS interface provider does not necessarily hold a banking licence. Instead, it enables customers to access services provided by a licensed service bank through its interface.

For fintech startups, BaaS can therefore provide an alternative to the considerable financial and regulatory burden of establishing an independent digital bank.

However, BaaS has its own licensing, outsourcing, cybersecurity and contractual requirements.

38. Regulatory Due Diligence for Digital Bank Investments

An investor acquiring shares in or financing a Turkish digital bank should perform regulatory due diligence beyond ordinary corporate review.

Areas to investigate include:

Banking licence:
Has both establishment and operating permission been properly obtained?

Capital:
Does the institution maintain adequate regulatory capital?

Activity restrictions:
Is it operating within the restrictions applicable to digital banks?

Customer base:
Are credit customers within the permitted categories?

Information systems:
Have regulatory deficiencies been identified?

Cybersecurity:
Has the institution suffered material security incidents?

AML/KYC:
Are customer onboarding and transaction monitoring systems effective?

Remote onboarding:
Does customer acquisition comply with BRSA requirements?

Outsourcing:
Are material technology providers compliant?

Data protection:
Are personal data and banking secrecy appropriately managed?

A regulatory weakness can materially affect the valuation of a digital banking investment.

39. Common Mistakes When Establishing a Digital Bank in Turkey

Treating a Digital Bank as a Fintech Startup

A digital bank is a fully regulated credit institution.

Underestimating Capital

TRY 1 billion is the minimum paid-up capital for operating permission, not necessarily the entire project budget.

Building the App Before Regulatory Architecture

The technology must be designed according to banking information-systems requirements.

Choosing an Inexperienced Board

At least one board member must satisfy the specific information-systems experience requirement.

Ignoring Customer Restrictions

Digital banks remain subject to restrictions concerning their credit-customer base.

Assuming Branchless Means No Physical Infrastructure

At least one physical customer complaint office is required.

Ignoring Service Continuity

Mobile and internet banking continuity commitments are subject to a minimum regulatory threshold.

Assuming BaaS Means Renting a Banking Licence

The service bank remains responsible for banking services and the customer relationship.

Assuming a Foreign Banking Licence Is Enough

Türkiye requires local regulatory authorisation.

40. Digital Bank Licensing Checklist for Turkey

Before applying for a digital bank licence in Turkey, investors should review at least the following:

Corporate Structure

Establish an appropriate Turkish joint-stock banking company.

Founders

Confirm founder eligibility and financial standing.

Ownership

Create a transparent direct and indirect ownership structure.

Capital

Plan for at least the TRY 1 billion digital-bank minimum, subject to BRSA authority and project-specific requirements.

Management

Appoint banking and technology executives satisfying regulatory qualifications.

Board

Ensure appropriate information-systems expertise is represented.

Business Plan

Prepare a five-year commercial strategy and detailed financial projections.

Customer Strategy

Ensure the proposed lending customer base complies with digital-bank restrictions.

Internal Systems

Build risk management, compliance, internal audit and internal control.

Technology

Develop BRSA-compliant information systems.

Cybersecurity

Implement authentication, transaction security and incident controls.

Remote Onboarding

Establish compliant customer-identification systems.

AML/KYC

Implement financial crime monitoring.

Outsourcing

Review cloud, software and support providers.

Customer Complaints

Establish the required physical complaint office and digital complaint processes.

Licence Applications

Complete both establishment permission and operating permission procedures.

Frequently Asked Questions About Digital Banking Law in Turkey

Is digital banking regulated in Turkey?

Yes. Digital banks are principally governed by Banking Law No. 5411 and the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model.

Which authority regulates digital banks?

Digital banks are licensed and supervised by the Banking Regulation and Supervision Agency and Banking Regulation and Supervision Board.

What is the minimum capital for a digital bank in Turkey?

The Digital Banks Regulation sets the minimum paid-up capital required for operating permission at TRY 1 billion, paid in cash and free from fictitious transactions. The Board may increase this amount.

Can a digital bank open branches?

Generally no. The digital-bank model is branchless, subject to limited permitted physical facilities and activities. At least one physical office must nevertheless be maintained for customer complaints.

Can a digital bank accept deposits?

A digital deposit bank may conduct the activities available to deposit banks subject to its licence and the restrictions imposed on digital banks. A digital participation bank operates according to the participation banking model.

Who can borrow from a digital bank?

The Regulation generally limits credit customers to financial consumers and SMEs, subject to specified exceptions.

Can a digital bank become a conventional bank?

Potentially. Where the relevant paid-up capital reaches TRY 2.5 billion, the bank may apply to the BRSA for complete or gradual removal of the special digital-bank restrictions. Approval is not automatic.

What is Banking as a Service in Turkey?

BaaS is a regulated model in which customers access the banking services of a licensed service bank through the mobile or web interface of an interface provider.

Can a foreign fintech become a BaaS interface provider?

The Regulation provides that service banks may provide the BaaS model only to interface providers resident in Türkiye. A foreign group may therefore need an appropriate Turkish establishment and must satisfy the applicable regulatory requirements.

Does a digital bank need a physical office?

Yes. At least one physical office is required for customer complaints even though conventional bank branches are prohibited.

What availability level is required for mobile banking?

The committed continuity percentage for internet and mobile banking channels of digital banks cannot be below 99.8% under the Digital Banks Regulation.

Conclusion: Establishing a Digital Bank in Turkey

Digital Banking Law in Turkey provides a sophisticated regulatory framework for branchless banking and Banking as a Service.

Türkiye does not treat a digital bank as a lightly regulated fintech business.

A digital bank is a genuine credit institution subject to Banking Law No. 5411, BRSA licensing and supervision, capital adequacy, corporate governance and banking-sector obligations.

The principal additional framework is the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model.

The regulation permits digital banks to perform banking activities available to their respective deposit or participation banking category, but imposes specific restrictions particularly concerning physical branches and credit customers.

From an investment perspective, one of the most important requirements is the minimum TRY 1 billion paid-up capital required for operating permission.

Investors seeking broader activity may eventually consider the TRY 2.5 billion capital route under which a digital bank can apply for gradual or complete removal of the special operating restrictions. However, the decision remains subject to BRSA approval and regulatory assessment.

The licensing process itself consists of two fundamental stages:

establishment permission, followed by

operating permission.

An establishment approval does not authorise the bank to commence commercial banking operations.

The applicant must first construct the institution’s corporate, managerial, financial and technological infrastructure and satisfy the BRSA that it is capable of operating safely. Banking Law No. 5411 also makes clear that adequate personnel, technical infrastructure, governance and capital are necessary before operations can commence.

Technology governance is particularly significant.

A digital bank must have senior management capable of understanding digital banking risks, the senior executive responsible for information systems must hold at least assistant-general-manager status, and at least one board member must have ten years of professional experience in information systems management.

Digital banks are also subject to demanding operational resilience requirements. Mobile and internet banking channels must be designed around the regulatory continuity threshold, with the Regulation requiring a committed availability level of at least 99.8%.

For foreign fintech companies, the Banking as a Service model offers another important path into Turkish financial services.

Instead of establishing an independent bank, a fintech can potentially operate as an interface provider through which customers access banking services supplied by a regulated service bank.

Nevertheless, BaaS is not equivalent to “renting” a bank licence.

The service bank remains responsible for the regulated banking services, the banking relationship must be established between the customer and the service bank, the relevant services remain on the service bank’s balance sheet and the interface provider is subject to technology, outsourcing and security requirements.

International investors should therefore carefully compare three possible Turkish market-entry models:

establishing an independent digital bank;

acquiring an existing banking institution;

or

entering the market through a Banking as a Service structure.

Each structure involves substantially different capital requirements, regulatory responsibility and implementation timelines.

The most important practical principle is to conduct regulatory planning before developing the final technology and commercial structure.

A digital-bank project requires integration between banking law, corporate governance, shareholder structuring, information systems, cybersecurity, AML/KYC, personal data protection, outsourcing, remote customer onboarding, consumer protection and capital planning.

Businesses and international investors planning to establish a digital bank in Turkey, apply for a BRSA digital banking licence, acquire a Turkish digital bank, develop a Banking as a Service platform or launch an embedded banking business in Türkiye should therefore undertake detailed regulatory analysis at the earliest stage of the project.

The Turkish digital banking market offers significant opportunities, but market entry requires the same level of legal, financial and technological preparation expected from any regulated banking institution.

Legal Disclaimer: This publication provides general information regarding digital banking regulation in Türkiye as of July 2026. It does not constitute legal advice. Capital requirements, customer limits, regulatory thresholds, BRSA policies and banking legislation may change. Each digital banking, Banking as a Service or embedded-finance project should be assessed individually under the legislation and regulatory decisions applicable at the relevant time.