Introduction: Does Every Fintech Company Need a Financial Licence in Turkey?

No.

Not every company developing financial technology, payment software, digital wallets, financial APIs or payment-related infrastructure is automatically required to obtain a payment institution or electronic money institution licence in Türkiye.

However, the opposite assumption is equally dangerous.

A startup cannot avoid regulation merely by describing itself as a:

• technology company;
• software provider;
• marketplace;
• payment gateway;
• digital wallet;
• financial platform;
• API provider.

Turkish financial regulation focuses primarily on what the business actually does, how money flows through the business model, who controls customer funds and which financial service is provided to the end user.

This distinction is particularly important under Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions.

Article 12 of Law No. 6493 first defines regulated payment services and then identifies a series of transactions and services that are not considered payment services within the scope of the Law. The current consolidated version contains exclusions ranging from direct cash payments and commercial-agent arrangements to technical service providers, limited-network instruments, intra-group payments and certain independent ATM services.

At the same time, Article 13 provides that payment services may generally be provided only by recognised payment service providers, while a payment institution wishing to conduct regulated payment activity must obtain authorisation from the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”).

This creates the central regulatory question for every fintech founder:

Is the proposed business actually providing a regulated payment service, or is it supplying technology or conducting another activity that falls outside the regulated payment perimeter?

The answer can determine whether the business needs:

• millions of Turkish lira in regulatory capital;
• a Turkish joint-stock company;
• CBRT authorisation;
• regulatory shareholders;
• internal control and risk management;
• information systems compliance;
• safeguarding arrangements;
• MASAK compliance structures.

Accordingly, a proper fintech licensing exemption analysis in Turkey should be completed before launch—not after the platform has already begun processing customer money.

This guide explains when a financial licence may not be required, the principal statutory exclusions, the risks of relying on an exemption and the circumstances in which an apparently unregulated technology model can cross into regulated financial activity.

1. The Starting Point: What Counts as a Payment Service?

Before asking whether an exemption applies, the business must first determine whether its activity falls within a regulated payment-service category.

Article 12(1) of Law No. 6493 currently identifies regulated activities including:

• operating activities necessary for placing money into or withdrawing money from a payment account;
• money transfers from payment accounts;
• direct debits;
• card or similar payment transactions;
• issuing or acquiring payment instruments;
• money remittance;
• specified telecommunications-based payment services;
• bill-payment intermediation;
• Payment Initiation Services;
• Account Information Services;
• other payment activities designated by the CBRT based on their scale or impact.

A company performing one of these services cannot simply rely on the fact that its platform uses software.

Every modern payment institution uses software.

The fact that an activity is technologically delivered does not transform a regulated payment service into an unregulated technology service.

2. The Fundamental Rule: Only Authorised Providers Can Provide Payment Services

Law No. 6493 identifies banks, electronic money institutions, payment institutions and PTT as payment service providers within the statutory structure.

The Law also provides that persons other than the CBRT and authorised payment service providers cannot provide payment services.

A payment institution therefore requires CBRT authorisation where its activity falls within the regulated perimeter and no exclusion applies.

The regulatory consequences of incorrectly assuming an exemption can be severe.

Article 28 of Law No. 6493 provides that persons who operate as a payment institution or electronic money institution without obtaining the required permission may face one to three years’ imprisonment and a judicial fine of up to 5,000 days. Similar criminal exposure can arise from creating the impression of being an authorised payment or electronic money institution without the legally required permission.

For this reason, regulatory classification should never be based merely on commercial convenience.

3. Article 12(2): Transactions That Are Not Payment Services

Article 12(2) contains the principal statutory perimeter exclusions.

The provision currently excludes several categories of transactions and services from classification as payment services.

These include:

• direct cash payments without an intermediary;
• qualifying commercial-agent transactions;
• certain non-profit or charitable cash collection and delivery;
• specified cash-back type transactions;
• cash foreign-exchange transactions not connected to payment accounts;
• specified negotiable instruments and paper-based payment instruments;
• certain settlement-system transactions;
• payments connected with qualifying capital-markets activities;
• technical service providers that never become owners of transferred funds;
• limited-network or limited-purpose payment instruments;
• certain telecommunications/digital-content transactions;
• own-account payments between payment service providers and their agents or branches;
• specified intra-group payments;
• qualifying independent ATM cash-withdrawal services;
• other services that the CBRT may designate.

These categories are extremely important for fintech structuring.

However, they should be interpreted according to the substance of the business model, not merely the terminology used in contracts.

4. Technical Service Providers: One of the Most Important Fintech Exemptions

The technical service provider exclusion under Article 12(2)(ğ) is particularly important for software companies.

The provision excludes technical services supporting payment activities where the provider does not at any point become the owner of the funds being transferred.

The statutory category includes services relating to matters such as:

• processing data;
• storing data;
• securing information;
• maintaining confidentiality;
• authentication;
• information technology infrastructure;
• communication networks;
• supply and maintenance of tools used for payment services.

This creates substantial space for unlicensed financial technology companies.

A company may potentially provide:

• payment software;
• API infrastructure;
• fraud detection;
• authentication technology;
• transaction-processing technology;
• payment gateway infrastructure;
• secure data transmission;
• card-data processing technology;
• cloud or infrastructure support,

without itself becoming a regulated payment institution—provided that the company remains within the technical-service perimeter.

5. The Critical Question: Does the Technology Provider Touch or Control the Funds?

One of the most important elements of the technical-service exemption is that the provider must not become the owner of the transferred funds during the transaction.

This should be analysed broadly from a risk perspective.

Questions should include:

Does customer money enter an account belonging to the technology company?

Can the technology company decide when money is released?

Can it redirect funds?

Does it determine the recipient?

Does it deduct money before transferring the balance?

Does it provide a customer payment account?

Does it independently execute payment orders?

The further the company moves from pure technology and into control over customer funds or payment execution, the greater the risk that the activity falls within regulated payment services.

Merely calling a company a “payment gateway” does not resolve the analysis.

The real money flow matters.

6. Payment Gateway Services Can Be Purely Technical

Payment gateway services provide a useful example.

A technology company may enable payment information to move securely between a merchant and a licensed payment service provider without ever receiving customer funds.

Where the company’s function is limited to:

• secure transmission;
• data processing;
• technological integration;
• authentication;

the technical service provider exclusion may potentially apply.

The Turkish Competition Authority has also recognised the statutory distinction between regulated payment services and payment-gateway-type technical infrastructure falling under Article 12(2)(ğ) where the technical provider never becomes owner of the funds.

However, a gateway that begins collecting, holding, allocating or settling customer money may require a completely different analysis.

7. White-Label Payment Software May Not Require a Licence

A fintech can also sell white-label financial software without necessarily becoming a payment service provider.

This distinction has been specifically addressed in the CBRT’s open banking guidance.

The CBRT examined an example in which a technology company licensed white-label software to a corporate customer so that the corporate customer could manage its own bank account information and operational processes.

The technology company’s role was limited to:

• software licensing;
• integration;
• maintenance;
• technical support.

The software operated within the corporate customer’s environment, and the banks’ legal relationship remained directly with the corporate account holder.

The CBRT concluded that the technology company did not need an Account Information Service or Payment Initiation licence in that scenario and referred directly to the Article 12(2)(ğ) technical service provider exclusion.

This is highly relevant for B2B fintech software businesses.

8. But White-Label Software Can Cross Into Regulated Open Banking

The technical exemption is not unlimited.

Suppose the software company does more than provide infrastructure.

Imagine that the company:

• independently connects to several banks;
• obtains customers’ account information;
• consolidates those accounts on its own platform;
• provides the consolidated information directly to customers.

That begins to resemble the regulated Account Information Service under Article 12(1)(g).

The CBRT’s guidance states that businesses providing consolidated payment-account information online to customers generally require authorisation for Account Information Services.

Similarly, a company that allows users to initiate payment orders from payment accounts held with other providers may enter the regulated Payment Initiation Service under Article 12(1)(f).

The practical distinction is therefore:

providing software to a customer is not automatically the same as providing the regulated financial service to that customer.

9. Commercial Agent Exemption

Article 12(2)(b) excludes qualifying payment transactions carried out through a commercial representative authorised to negotiate or conclude the sale or purchase of goods or services on behalf of either the payer or the payee.

This exemption can be important for:

• marketplaces;
• agency platforms;
• commercial intermediaries;
• certain collection structures.

However, the exemption should be approached cautiously.

A business cannot become a commercial agent merely by inserting the words “commercial representative” into its user agreement.

The actual legal relationship matters.

Relevant questions include:

Does the intermediary genuinely have authority to negotiate the underlying sale?

Can it conclude the contract for the seller or buyer?

Is the platform commercially involved in the underlying goods or services?

Or is it merely collecting money for unrelated third parties?

A platform whose real function is only receiving money from buyers and forwarding it to sellers may face significantly greater licensing risk.

10. Marketplace Models Require Detailed Regulatory Analysis

Online marketplaces are one of the most sensitive areas of fintech licensing perimeter analysis.

A marketplace may:

• introduce buyer and seller;
• structure the commercial relationship;
• collect the purchase price;
• deduct commission;
• transfer the remainder to the merchant.

Depending on the precise legal and operational model, this can potentially intersect with the commercial-agent exemption.

However, Article 12 gives the CBRT an important supervisory power concerning this exemption.

Where transactions conducted under Article 12(2)(b) reach a level determined by the CBRT based on total scale and area of impact, the CBRT may decide that those activities should be treated as regulated payment services.

Therefore, even an initially qualifying marketplace exemption is not necessarily a permanent safe harbour.

Scale matters.

11. The TRY 50 Million Reporting Threshold for Certain Exemptions

The Payment Services Regulation imposes a special notification requirement for businesses relying on Article 12(2)(b) and Article 12(2)(h).

Where the total transaction amount conducted under the relevant exemption exceeds:

TRY 50 million during the preceding twelve months,

the service provider must submit a report to the CBRT during January containing information regarding matters such as:

• description of the service;
• detailed business flows;
• transaction volumes;
• average, minimum and maximum transaction values;
• customer network;
• merchant network;
• number and type of merchants;
• geographical distribution.

The CBRT’s guidance explains that the threshold is assessed separately for relevant categories and that marketplace transaction volume should be understood by reference to the total sales value including commission—not merely the marketplace’s own commission income.

This is critically important.

A marketplace cannot argue that it remains below TRY 50 million merely because its commission revenue is TRY 5 million where the underlying customer payments total TRY 100 million.

12. The CBRT Can Pull an Exempt Model Back Into Regulation

The notification obligation serves an important regulatory purpose.

After reviewing an exempt business, the CBRT may determine that the activity has become sufficiently significant to affect the sound development of or confidence in the payments market.

The Regulation expressly allows the CBRT to decide that the relevant activity should be treated as a payment service.

This produces a crucial principle for founders and investors:

An exemption can be dynamic.

A model that was comfortably outside licensing requirements when processing TRY 2 million in annual transactions may require a different analysis after growing to hundreds of millions of Turkish lira.

Regulatory perimeter analysis should therefore be repeated as the business scales.

13. Limited Network Exemption

Article 12(2)(h) excludes certain payment instruments that can be used only:

• at the issuer’s own premises;
• within a limited network of service providers;
• for a limited range of goods or services,

under a commercial agreement with the issuer.

This is often referred to internationally as the limited network exemption.

Potential examples can include appropriately structured:

• store cards;
• campus cards;
• fuel cards;
• employee benefit instruments;
• transport-related payment products;
• restricted gift cards.

However, not every branded prepaid card qualifies.

14. Closed-Loop Payment Instruments and Electronic Money

A similar but distinct exclusion exists under Article 18(5) concerning certain prepaid instruments.

The Law provides that prepaid instruments usable only:

• within the issuer’s own store network;
• for a specified category of goods or services; or
• within a particular service network pursuant to an agreement,

can fall outside the electronic money regime.

The CBRT nevertheless retains power to bring such instruments within the Law where their size and impact reach the relevant regulatory level.

This creates the legal basis for certain genuinely closed-loop prepaid products to operate without a full electronic money institution licence.

15. Not Every Gift Card Is Outside the E-Money Regime

The Payment Services Regulation narrows the practical interpretation of the limited-network prepaid exclusion.

For an instrument to qualify, it must genuinely be restricted to a particular store or store network.

The CBRT’s guidance confirms that an instrument designed to be accepted by all merchants added through agreements with the issuer, or issued so as to be compatible with general card-scheme infrastructure, does not automatically qualify as a limited-network instrument.

This distinction is extremely important.

A startup cannot create what is economically a general-purpose payment card and label it a “gift card” to avoid electronic money regulation.

The actual acceptance network determines the legal analysis.

16. Limited Network Providers Can Also Face Reporting Obligations

Article 12(2)(h) limited-network models are subject to the same important TRY 50 million reporting mechanism discussed above.

Where qualifying transaction volume exceeds the regulatory threshold during the previous twelve months, the service provider must report to the CBRT.

The CBRT can then evaluate:

• size;
• merchant reach;
• customer reach;
• geographic spread;
• effect on the payments market.

A limited network that becomes economically indistinguishable from a general payment network may therefore lose the practical benefit of remaining outside the licensing perimeter.

17. Intra-Group Payment Exemption

Article 12(2)(j) excludes certain payment services between:

• a parent company and its subsidiaries; or
• subsidiaries within the same corporate group,

provided that no payment service provider outside the same corporate group intermediates the payment service in the manner described by the provision.

This exemption can be important for:

• treasury centres;
• group cash management;
• internal payment infrastructures;
• corporate ERP systems.

The CBRT’s open banking guidance has specifically recognised an intra-group structure as capable of falling within Article 12(2)(j), meaning that a separate licence was not required in the scenario examined.

However, this should not be extended to unrelated third-party customers.

A platform serving 500 independent companies cannot normally describe them as an “economic group” merely because they use the same application.

18. Own-Account Transactions Between Payment Providers, Agents and Branches

Article 12(2)(i) also excludes qualifying payment transactions conducted in the providers’ own name and for their own account between payment service providers and their agents or branches.

This is principally an institutional exemption designed to prevent internal settlement-type transactions from being treated as separate customer payment services.

It is generally less relevant to an independent fintech startup but can matter in regulated group and agency structures.

19. Certain Settlement and Capital Markets Transactions Are Excluded

Article 12(2)(f) excludes certain own-account payment transactions taking place within payment and securities settlement structures among bodies such as:

• the CBRT;
• settlement institutions;
• central counterparties;
• clearing houses;
• payment service providers;
• other system participants.

Article 12(2)(g) separately excludes certain payment transactions connected with capital-market activities under Capital Markets Law No. 6362.

These exclusions prevent specialised settlement infrastructure from automatically being treated as ordinary retail payment services.

However, they do not create a general exemption from capital markets regulation.

A service excluded from Law No. 6493 may still be heavily regulated under CMB legislation.

20. Certain Telecommunications and Digital Content Payments

Article 12(2)(ı) contains a specialised exclusion for certain transactions made through information or electronic communications devices where:

• the communications operator is not acting merely as an intermediary between the customer and merchant; and
• the purchased goods or services are delivered to and used through the relevant electronic or communications device.

This can be relevant to certain:

• digital content;
• mobile services;
• electronic services.

However, ordinary mobile payment intermediation remains a regulated payment service under Article 12(1)(d).

The distinction therefore depends on the precise role of the telecommunications operator and the nature of the purchased product.

21. Independent ATM Operators

Article 12(2)(k) excludes qualifying cash-withdrawal services through ATMs where the ATM operator:

• does not provide another payment service;
• is not a party to the framework agreement with the customer withdrawing money;
• operates the ATM on behalf of one or more card issuers.

This can allow certain independent ATM infrastructure businesses to operate outside the payment institution licence framework.

However, adding services such as customer payment accounts, money transfers or other payment functionality can alter the analysis.

22. Direct Cash Transactions

The simplest exclusion is Article 12(2)(a).

A payment made directly in cash from the payer to the recipient without an intermediary is not a regulated payment service under Law No. 6493.

This may appear obvious, but it illustrates the fundamental purpose of payment institution regulation.

The Law is principally concerned with intermediary structures that facilitate, execute or control payment transactions.

Ordinary payment of cash by a customer directly to a merchant does not require a payment licence.

23. Charitable and Non-Profit Cash Collection

Article 12(2)(c) excludes qualifying payments involving the collection and delivery of cash within non-profit or charitable activities.

However, the wording focuses on specified cash collection and delivery.

A commercial fundraising platform processing card or account payments for hundreds of organisations should not automatically assume that it falls within this exclusion merely because some recipients are charities.

The technological and financial flow must be analysed separately.

24. Cash Foreign Exchange Transactions

Article 12(2)(d) excludes cash foreign exchange purchases and sales where the transaction is not connected with a payment account.

This exclusion does not mean that foreign exchange dealing is generally unregulated.

Foreign exchange offices and other currency businesses can be subject to separate legislation.

Again, the principle is:

Outside Law No. 6493 does not mean outside all Turkish financial regulation.

25. Negotiable Instruments and Paper-Based Instruments

Article 12(2)(e) also excludes payment transactions involving specified instruments such as:

• negotiable instruments under the Turkish Commercial Code;
• foreign bank cheques;
• travellers’ cheques;
• paper postal money orders.

This is primarily designed to distinguish traditional paper-based legal instruments from regulated modern payment services.

It has less relevance for digital fintech startups but remains part of the statutory perimeter.

26. Banks Do Not Need a Separate Payment Institution Licence

Banks deserve separate treatment.

Banks are already recognised by Law No. 6493 as payment service providers.

They therefore do not need to establish a separate payment institution solely because they provide payment services within their banking authority.

The CBRT has expressly noted in its open banking implementation reporting that banks participating as authorised open banking providers do not need the same separate CBRT payment institution authorisation required by non-bank companies because they are already regulated under Banking Law No. 5411.

This should not be described as an “unregulated exemption.”

Banks are far more heavily regulated.

They simply operate through a different regulatory status.

27. PTT Also Has a Special Statutory Position

PTT is separately recognised under Law No. 6493 as a payment service provider.

The Payment Services Regulation applies a specialised regime to PTT rather than requiring it to satisfy every ordinary payment institution establishment requirement.

Again, this is not an example of financial activity being unregulated.

It is an example of a specific institution operating through a distinct statutory basis.

28. Pure Account Information Providers Are Not “Licence Exempt”

Another important distinction concerns Account Information Service Providers.

Article 14/A provides a lighter institutional regime for payment institutions that exclusively provide Account Information Services.

For those businesses, certain ordinary requirements concerning:

• shares being issued for cash;
• all shares being registered;
• minimum statutory capital

do not apply.

However:

this is not a licensing exemption.

A business providing regulated Account Information Services still requires the appropriate authorisation.

The fact that it benefits from a lighter capital or corporate regime does not place it outside Law No. 6493.

This distinction is particularly important in fintech SEO content because “exemption from capital requirement” should not be confused with “exemption from licence.”

29. A Software Company Can Be Unlicensed—but Its Client May Still Need a Licence

Consider a fintech software business providing:

• payment orchestration software;
• merchant dashboard software;
• reconciliation;
• fraud monitoring;
• API infrastructure.

The technology provider may qualify as a technical service provider.

However, the company using that software may still be conducting regulated payment services.

This creates a common model:

Unlicensed technology provider → licensed payment institution → customer.

This structure is lawful in principle where properly designed.

The technology provider supports the regulated entity but does not independently become the payment service provider.

Outsourcing therefore does not eliminate the licensed institution from the business model.

30. A Technology Company Should Avoid Holding Itself Out as the Regulated Provider

Even where a technology business legitimately falls outside the licence requirement, branding should accurately reflect that position.

Article 28 contains criminal sanctions not only for unlicensed regulated activity but also for creating the impression of operating as a payment or electronic money institution without required permission.

An unlicensed technology company should therefore be cautious with expressions such as:

• “our payment account”;
• “we hold your money”;
• “licensed payment service”;
• “send money with us”,

where the actual regulated service is supplied by another institution.

The regulated entity should be clearly identified to customers.

31. Digital Wallets Require Particular Care

The term digital wallet does not itself determine whether a licence is required.

A wallet can function in several ways.

It may merely store:

• tokenised card credentials;
• customer authentication information;
• technical payment instrument information.

Alternatively, the wallet may allow the customer to:

• hold funds;
• hold electronic money;
• transfer balances;
• receive money;
• make payments through an account.

The second model can create regulated payment or electronic money activity.

Fintech founders should therefore classify what is inside the “wallet,” not merely what the user interface calls it.

32. Closed-Loop Wallets Can Qualify for an Exclusion

A genuinely closed-loop wallet usable only:

• at the issuer’s own stores;
• within a tightly defined store network; or
• for a genuinely limited range of products,

may potentially benefit from the limited-network or prepaid instrument exclusions.

However, the more the wallet becomes capable of:

• paying unrelated merchants;
• accepting multiple merchant categories;
• withdrawing cash;
• transferring money between users;
• functioning through general card schemes,

the weaker the exemption becomes.

The CBRT’s limited-network guidance makes clear that broad acceptance can remove the product from the Article 18(5) exclusion.

33. Merchant Acquiring Is Generally a Regulated Activity

One area where startups should be particularly careful is merchant acquiring.

Article 12(1)(c) includes issuing or accepting payment instruments among regulated payment services.

A technology provider supplying software to a licensed acquirer may fall outside the licence perimeter.

However, a company independently contracting with merchants to provide regulated payment acceptance and settlement may require CBRT authorisation depending on the structure.

Calling the product:

• virtual POS technology;
• merchant gateway;
• checkout software,

does not itself determine the regulatory result.

34. Payment Facilitation Models Must Be Reviewed Case by Case

International payment facilitator or “PayFac” structures cannot simply be imported into Türkiye without a local regulatory analysis.

The platform may perform functions including:

• onboarding sub-merchants;
• routing transactions;
• receiving settlement;
• deducting fees;
• paying merchants.

Some elements may be technical.

Others may constitute regulated merchant acquiring or fund transfer.

The key regulatory questions include:

Who has the merchant agreement?

Who receives customer money?

Who controls settlement?

Who decides when the merchant is paid?

Who bears the payment service obligation toward the merchant?

The answer determines whether the business remains a technical provider or enters the payment-service perimeter.

35. Embedded Finance Does Not Automatically Avoid Licensing

Embedded finance creates a similar issue.

A retailer, marketplace or software company may integrate:

• payments;
• wallets;
• accounts;
• cards;
• lending

into its application.

The fact that financial functionality is “embedded” does not make it unregulated.

The correct structure may involve the non-financial company providing only the interface while a licensed institution supplies the actual financial product.

Where the fintech independently performs the regulated financial activity, a licence can still be required.

Embedded finance therefore depends heavily on regulatory role allocation.

36. Outsourcing a Regulated Service Does Not Make the Service Unregulated

A common misunderstanding is:

“We do not need a licence because a bank processes the payment in the background.”

This is not necessarily correct.

Nearly every payment ultimately moves through regulated banking infrastructure.

The important question is what the fintech itself provides to the customer.

Where the fintech independently:

• receives a payment order;
• provides a payment account;
• consolidates account information;
• initiates a payment;
• contracts as the payment provider,

the presence of a bank somewhere in the transaction chain does not automatically eliminate the fintech’s licensing obligations.

37. Foreign Fintech Companies Do Not Receive Automatic Passporting

Another common assumption is that a company licensed in:

• the European Union;
• the United Kingdom;
• the United States;
• the UAE;
• Singapore

can provide payment services directly into Türkiye without Turkish authorisation.

Turkish law does not provide a general foreign fintech passport equivalent to the internal passporting arrangements available within some regional systems.

A foreign company actively offering regulated payment services to customers in Türkiye should therefore separately analyse Turkish authorisation.

The fact that a business is lawfully licensed abroad is relevant to regulatory credibility but does not automatically eliminate Turkish licensing requirements.

38. “No Payment Licence” Does Not Mean “No Financial Licence”

This is one of the most important conclusions in fintech perimeter analysis.

A business may fall outside Law No. 6493 and still require authorisation under another regulatory framework.

Examples include:

Lending

A model may need analysis under Banking Law or financial company legislation.

Digital Banking

A digital bank operates under BRSA banking regulation.

Crypto

Crypto asset services fall within the CMB regime introduced through the 2024–2025 reforms.

Investment Services

Capital market activities can require CMB authorisation.

Foreign Exchange

Certain FX business models are subject to Treasury and financial regulation.

Insurance

Insurance distribution and insurance technology can trigger insurance regulation.

Therefore, the correct question is not:

“Do we need a payment institution licence?”

The correct question is:

“Which Turkish financial regulatory regime, if any, applies to this entire business model?”

39. When Should a Startup Obtain a Formal Regulatory Perimeter Analysis?

A regulatory classification review is particularly important where the startup:

• handles customer money;
• settles merchants;
• issues a wallet;
• stores monetary value;
• enables peer-to-peer transfers;
• provides virtual IBANs;
• integrates bank account information;
• initiates payments;
• provides payment gateway functionality;
• operates a marketplace;
• uses prepaid instruments;
• provides embedded finance.

The analysis should include an actual diagram showing:

Customer → Fintech → Bank/Payment Institution → Merchant/Recipient

for every material flow of funds and information.

Written contractual descriptions alone are often insufficient.

40. Practical Licence Exemption Checklist

Before concluding that a fintech does not need a payment or e-money licence in Türkiye, management should answer the following questions.

Does the Company Receive Customer Money?

If yes, where does the money legally sit?

Does the Company Control Settlement?

Can the company decide when or where funds are transferred?

Does the Company Maintain Customer Balances?

If yes, do those balances represent stored monetary value?

Does the Company Initiate Payments?

Does it transmit customer payment orders from accounts held at other institutions?

Does It Aggregate Account Information?

Is consolidated payment-account information presented to customers?

Is It Merely a Technical Service Provider?

Does it provide software, data processing, security or communications while never becoming owner of the funds?

Is There a Commercial Agent Relationship?

Does the intermediary actually have authority to negotiate or conclude the underlying sale?

Is the Payment Instrument Truly Limited?

Can it only be used in a defined store network or for a limited category of goods?

Has Transaction Volume Exceeded TRY 50 Million?

If relying on Article 12(2)(b) or (h), has the Article 82 reporting obligation been triggered?

Is the Activity Intra-Group?

Are all relevant payment participants genuinely within the same corporate group?

Is Another Licence Regime Relevant?

Could the business instead be banking, lending, capital markets or crypto activity?

Where several answers create uncertainty, the safer strategy is to obtain a documented regulatory analysis before launch.

Frequently Asked Questions About Fintech Licensing Exemptions in Turkey

Does every fintech company in Turkey need a financial licence?

No.

Pure technology companies and businesses falling within statutory exclusions may operate without a payment institution or e-money licence. However, the actual business model must be assessed under Law No. 6493 and any other relevant financial legislation.

What is the main payment licensing exemption provision?

Article 12(2) of Law No. 6493 lists transactions and services that are not treated as payment services.

Does a payment software provider need a payment institution licence?

Not necessarily.

Article 12(2)(ğ) excludes qualifying technical service providers where their services remain technical and they never become owner of the transferred funds.

Does a payment gateway require a licence?

A pure technology gateway may potentially operate under the technical service provider exclusion. A gateway that receives, controls or settles customer funds may require a different analysis.

Can a white-label open banking software company operate without a licence?

Potentially yes where it merely supplies software to the customer and does not itself provide regulated Payment Initiation or Account Information Services. The CBRT has expressly analysed a white-label technical provider model as falling outside the licensing requirement in a qualifying scenario.

Does an Account Information Service require a licence?

Yes, where the company itself provides the regulated service of consolidating customers’ payment-account information online.

Is a pure AISP exempt from all licensing?

No.

Article 14/A provides certain lighter corporate and capital requirements for institutions exclusively providing Account Information Services, but this is not a complete licence exemption.

Can a marketplace collect money without a payment licence?

Potentially, depending on the exact commercial-agent structure and other facts. The marketplace must not assume that merely being an e-commerce platform creates an exemption.

What is the TRY 50 million exemption reporting rule?

Businesses conducting activities under Article 12(2)(b) or (h) must report to the CBRT where the relevant transaction volume during the preceding twelve months exceeds TRY 50 million.

Does exceeding TRY 50 million automatically mean a licence is required?

The threshold triggers reporting. The CBRT may then determine that the activity should be treated as a regulated payment service depending on its size and impact.

What is the limited network exemption?

Article 12(2)(h) excludes qualifying instruments usable only at the issuer’s premises, within a limited network or for a limited range of goods or services.

Can a closed-loop gift card operate without an e-money licence?

Potentially.

Article 18(5) excludes certain prepaid instruments used only within the issuer’s store network, for limited goods/services or within a qualifying limited service network.

Can a general-purpose prepaid card be called a closed-loop card?

Not safely. The CBRT framework indicates that instruments designed for widespread merchant acceptance or compatibility with general card schemes will not automatically qualify for the limited-network exclusion.

Are intra-group payment services exempt?

Specified payments between a parent and subsidiaries or among subsidiaries can fall within Article 12(2)(j), subject to the statutory conditions.

Do banks need a payment institution licence?

Banks are already statutory payment service providers. The CBRT has specifically noted that banks participating in regulated open banking do not need the same separate payment institution authorisation required by non-bank providers.

Does an EU payment licence work automatically in Turkey?

No general passporting mechanism allows a foreign payment institution licence automatically to replace Turkish authorisation.

What happens if a fintech provides payment services without the required licence?

Article 28 provides criminal sanctions including one to three years’ imprisonment and judicial fines of up to 5,000 days for qualifying unauthorised activity.

Conclusion: When Can a Fintech Operate Without a Payment Licence in Turkey?

The question “Does my fintech need a licence in Turkey?” cannot be answered by looking at the company name, mobile application or marketing materials.

The answer depends on the real business model.

Law No. 6493 creates a broad regulated perimeter covering:

• payment accounts;
• transfers;
• merchant acquiring;
• payment instruments;
• remittance;
• bill payments;
• payment initiation;
• account information services.

At the same time, Article 12(2) creates important exclusions for activities that should not be treated as regulated payment services.

For technology startups, the technical service provider exemption is particularly important.

A company can potentially supply sophisticated payment technology without becoming a payment institution where its role remains limited to functions such as:

• software;
• data processing;
• security;
• authentication;
• communication infrastructure;
• maintenance,

and the provider does not become owner of the funds being transferred.

The CBRT’s own open banking guidance confirms that white-label software, integration and technical-support models can remain outside the licence requirement where the customer itself remains the relevant account holder and the technology provider does not independently provide the regulated Account Information or Payment Initiation Service.

However, the boundary can be narrow.

Once the technology company itself begins:

• collecting customer money;
• executing payment orders;
• controlling settlement;
• maintaining customer balances;
• aggregating account information for customers,

it may cross from technology into regulated financial services.

Marketplace models require similar caution.

The commercial-agent exemption can be important where the platform genuinely acts with authority to negotiate or conclude the underlying transaction on behalf of a buyer or seller.

But the exemption is not simply a contractual label.

The CBRT also retains power to bring qualifying commercial-agent and limited-network activities within the payment-services regime when their scale and market impact become significant.

This supervisory power is supported by a concrete reporting obligation.

Where transactions conducted under Article 12(2)(b) or (h) exceed TRY 50 million during the preceding twelve months, the provider must submit detailed information to the CBRT during January.

The CBRT may subsequently determine that the business has become significant enough to require treatment as a payment service.

Therefore:

Fintech exemptions must be monitored, not merely identified once.

A business that qualified for an exclusion during its startup phase may require licensing analysis again after substantial growth.

The limited-network and closed-loop instrument exemptions are another important example.

Turkish law allows certain restricted instruments to remain outside the general payment/e-money regime.

Article 18(5), for example, excludes qualifying prepaid instruments usable only within the issuer’s store network, for a limited category of goods or services or within a defined service network.

But the product must genuinely remain limited.

A prepaid card that becomes accepted across a broad range of unrelated merchants or operates through general card infrastructure cannot safely be treated as closed-loop merely because the issuer uses that expression in its documents. The CBRT’s guidance specifically narrows the circumstances in which the exclusion applies.

Intra-group models may also operate differently.

Article 12(2)(j) can exclude qualifying payments among a parent and its subsidiaries or among subsidiaries within the same group. The CBRT has recognised this distinction within its open banking guidance.

Yet this does not justify offering the same payment infrastructure to unrelated third-party businesses without reanalysing licensing requirements.

Another important distinction concerns banks.

Banks do not need to obtain a separate payment institution licence to provide payment services within their statutory banking framework because they are already recognised as payment service providers. The CBRT has confirmed this principle specifically in relation to open banking participation.

This is not an exemption from financial regulation.

It is a different regulatory route.

The same conceptual caution applies to the entire subject.

When a service falls outside Law No. 6493, that does not mean the company is automatically unregulated.

A business may instead require:

• a banking authorisation;
• consumer finance authorisation;
• CMB permission;
• crypto asset service provider authorisation;
• foreign exchange permission;
• insurance authorisation.

Accordingly, “no payment licence required” and “no financial licence required” are not synonymous.

This is why fintech founders should perform a complete regulatory perimeter analysis rather than searching only for a payment institution exemption.

The analysis should map both:

fund flows, and

data/service flows.

For every transaction, the company should determine:

Who is the customer?

Who holds the money?

Who receives the payment order?

Who decides where the funds move?

Whose account is involved?

Who contracts with the merchant?

Who provides the regulated service to the customer?

Who is merely supplying technology?

The answers usually reveal the true regulatory position far more accurately than the product’s commercial description.

For investors, the same analysis becomes part of regulatory due diligence.

An investor acquiring a “fintech technology company” should determine whether the business has correctly relied on an exemption.

A historical misclassification could mean the company has actually conducted regulated payment activity without permission.

Given that Article 28 imposes serious criminal sanctions for unauthorised payment and electronic money activity, this is not a technical compliance issue that should be ignored.

The safest compliance strategy is therefore:

First classify the activity.

Then identify the statutory exclusion.

Then test every condition of that exclusion against the actual business model.

Then examine whether another financial regulatory regime applies.

Finally, continue monitoring the exemption as the business grows and changes.

For fintech businesses planning to operate as payment gateways, white-label technology companies, closed-loop wallets, marketplaces, limited-network card issuers, corporate treasury platforms, open banking technology providers or embedded finance companies in Turkey, this analysis can determine whether millions of Turkish lira in regulatory capital and a lengthy financial licensing process are legally required.

Used correctly, the exemptions in Turkish payment law create legitimate room for innovation.

Used incorrectly, they can expose founders, executives and investors to significant regulatory and criminal risk.

The core principle is therefore straightforward:

A fintech company does not need a licence simply because it uses financial technology—but once it becomes the provider of the regulated financial service rather than the technology supporting that service, the licensing analysis changes fundamentally.

Legal Disclaimer: This publication provides general information concerning fintech licensing exemptions and the regulatory perimeter under Turkish law as of July 2026. It does not constitute legal or regulatory advice. The applicability of an exemption depends on the exact contractual structure, money flow, customer relationship, merchant network, technology architecture and scale of operations. The CBRT may also determine that certain otherwise excluded activities should be treated as payment services depending on their size and impact. Every fintech business model should therefore be assessed individually before launch or material expansion.