Introduction: Fintech Compliance in Turkey Is No Longer a Single-Licence Exercise

Establishing, investing in or acquiring a fintech company in Türkiye requires substantially more regulatory planning than incorporating an ordinary technology company.

A business may describe itself commercially as a:

• fintech startup;
• digital wallet;
• payment application;
• embedded finance provider;
• open banking platform;
• Banking as a Service business;
• crypto platform;
• blockchain company;
• digital bank.

However, Turkish law regulates the actual financial activity performed, rather than the commercial label chosen by the company.

This distinction is fundamental.

A software company providing accounting tools to banks may not require a financial-services licence.

A company that receives customer funds and executes payment transactions may fall within the payment-services regulatory framework.

A digital wallet may constitute a regulated payment or electronic money service depending on its structure.

A company accessing payment account information or initiating payments may fall within open banking regulation.

A business commercially marketing itself as a “neobank” may actually require a payment, electronic money, Banking as a Service or banking structure depending upon the services provided.

Crypto exchanges and crypto custody businesses are now subject to a separate Capital Markets Board regime.

As a result, fintech regulatory compliance in Turkey should begin with legal classification of the business model before the product is launched.

The principal regulators include the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) for payment and electronic money institutions, the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”) for banks and digital banks, and the Capital Markets Board of Türkiye (“CMB” or “SPK”) for crypto asset service providers and other capital-market institutions.

A regulated fintech may simultaneously be subject to the Financial Crimes Investigation Board (“MASAK”), the Personal Data Protection Authority, the Competition Authority and Türkiye’s broader cybersecurity framework.

The CBRT’s current regulatory pages continue to identify Law No. 6493 and its secondary legislation as the framework governing payment services and electronic money, while its current public registers show the specific activity scopes of authorised payment and electronic money institutions.

For startups, this means compliance needs to be incorporated into product design.

For investors, it means regulatory due diligence should be treated as a central component of valuation.

The question is not simply:

“Does the company have a licence?”

The better questions are:

“Does the company have the correct licence for every service it actually provides?”

“Is the company still complying with the financial, AML, cybersecurity, data protection and consumer rules necessary to keep that licence?”

This guide provides a practical fintech regulatory compliance checklist for startups, founders, foreign investors and M&A buyers operating in Türkiye in 2026.

1. Checklist Item One: Classify the Business Model Before Incorporation

The first legal task should be a regulatory classification memorandum.

The founders should identify exactly what the platform will do.

Questions should include:

Does the company receive customer money?

Does it transfer funds?

Does it issue stored monetary value?

Can customers hold balances?

Does it issue or acquire payment instruments?

Does it initiate payments from accounts held at other financial institutions?

Does it consolidate account information?

Does it provide a digital wallet?

Does it provide bank products through another bank’s infrastructure?

Does it buy, sell, transfer or custody crypto assets?

Does it make lending decisions?

The answers determine which regulator and licence may apply.

This exercise should take place before significant software development, because the regulatory classification can affect:

• company type;
• capital;
• shareholder requirements;
• information systems;
• outsourcing;
• customer onboarding;
• documentation.

A startup that develops the entire product first and seeks regulatory advice immediately before launch may discover that fundamental features must be redesigned.

2. Checklist Item Two: Identify the Correct Financial Regulator

Türkiye does not have one universal “fintech licence.”

Different regulators supervise different activities.

CBRT

The CBRT regulates payment institutions and electronic money institutions under Law No. 6493. Its public lists identify currently authorised institutions and precisely which Article 12 payment services each institution may provide.

BRSA

The BRSA regulates banks, including digital banks, and Banking as a Service structures involving service banks.

The BRSA’s current legislation database continues to list the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model as part of the banking regulatory framework.

CMB

The CMB regulates crypto asset service providers under the crypto framework introduced following the 2024 amendments to Capital Markets Law No. 6362.

The CMB currently maintains separate procedures for:

• establishment applications;
• operating permission applications.

It expressly states that incomplete or improperly formatted crypto applications will not be processed.

A business model involving several regulated activities may interact with more than one regulatory framework.

3. Checklist Item Three: Do Not Conduct Licensable Activity Before Authorisation

Fintech founders should distinguish between:

establishing a company, and

obtaining permission to perform a regulated financial activity.

Registering a company with the trade registry does not create a payment institution licence.

Adding words such as “payment,” “finance,” “crypto” or “digital bank” to branding does not create regulatory authority.

Likewise, a foreign licence generally does not automatically passport into Türkiye.

A foreign payment or crypto company planning Turkish market entry should conduct a separate Turkish regulatory analysis.

Investors should also examine whether the target historically performed regulated activity before obtaining permission.

Historical unlicensed activity may create regulatory risk even where the business subsequently becomes licensed.

4. Checklist Item Four: Verify the Exact Scope of the Licence

Possessing “a licence” is not enough.

A payment institution may be authorised for some payment services but not others.

The CBRT currently publishes the exact Article 12 activity categories for each payment and electronic money institution.

A regulatory due diligence report should therefore compare:

licensed activities

with

actual products and revenue streams.

For example, an investor should determine whether a payment institution marketed as an open banking business actually holds the necessary scope for payment initiation or account information services.

Similarly, electronic money authorisation should not be assumed merely because a company offers a branded wallet.

Product expansion should trigger a licence-scope review.

5. Checklist Item Five: Meet Regulatory Capital and Own-Funds Requirements

Fintech regulation increasingly requires significant financial capacity.

The relevant requirement differs according to the regulated business.

Payment and Electronic Money Institutions

The 2026 minimum own-funds requirements applicable from 30 June 2026 are:

TRY 20 million for the specified bill-payment-intermediation category;

TRY 40 million for the relevant general payment institution category, excluding the specific pure account-information-service position;

TRY 105 million for electronic money institutions.

These amounts were increased from the 2025 levels under the annual revaluation mechanism.

Startups should understand that own funds are not simply the same thing as incorporation capital.

Ongoing financial position matters.

Digital Banks

The Digital Banking Regulation provides that a digital bank requires at least TRY 1 billion in paid-in capital for operating permission. Where capital reaches TRY 2.5 billion, the bank may apply for removal of specified digital-bank activity restrictions, but removal is subject to BRSA assessment rather than occurring automatically.

Crypto Platforms

For 2026, the CMB has set minimum establishment capital at:

TRY 250 million for crypto trading platforms, and

TRY 630 million for crypto custody institutions.

A financial model should therefore distinguish the regulatory minimum from the actual funding necessary for technology, staff, audit, cybersecurity, legal, compliance and operating costs.

6. Checklist Item Six: Maintain Capital After Launch

Regulatory capital is not merely an entrance ticket.

A regulated fintech must continue satisfying financial requirements during operations.

This means founders and investors should monitor the consequences of:

• operating losses;
• dividends;
• related-party payments;
• shareholder loans;
• acquisition financing;
• rapid customer growth;
• regulatory capital calculations.

For M&A transactions, capital should be recalculated on a post-closing pro forma basis.

A company that complies before a dividend or acquisition closing may fall below regulatory requirements immediately afterwards.

Capital maintenance should therefore be included in board reporting and investor covenants.

7. Checklist Item Seven: Structure Shareholders and Ultimate Ownership Transparently

Regulators do not examine only the fintech company.

They also examine the persons behind it.

Financial-sector licensing commonly requires transparency regarding:

• direct shareholders;
• indirect shareholders;
• controlling companies;
• ultimate beneficial owners;
• source of funds;
• financial reputation.

This is especially relevant to foreign investors, private equity funds, venture capital structures and international holding companies.

The CMB’s current crypto establishment documentation, for example, contains separate declarations for proposed natural-person and corporate shareholders.

Opaque ownership structures can delay applications and transactions.

A clean ownership chart showing every level from the Turkish fintech to the ultimate controller should be prepared early.

8. Checklist Item Eight: Check Regulatory Approval Before Any Share Transfer

Fintech shares should not be transferred like shares in an ordinary software startup.

Depending on the institution and the ownership percentage, prior regulatory approval may be necessary.

This matters during:

• seed and Series A investments;
• strategic investment;
• founder exits;
• M&A transactions;
• group reorganisations;
• indirect parent-company acquisitions.

Even a minority investment can trigger regulatory review where statutory thresholds or governance rights are crossed.

The investment agreement should therefore identify regulatory approvals as conditions precedent where necessary.

Investors should not assume that a transaction can close first and be notified later.

9. Checklist Item Nine: Build Corporate Governance for a Regulated Institution

A fintech board cannot function merely as a startup advisory board focused on growth and fundraising.

Regulated businesses need documented responsibility for areas such as:

• compliance;
• risk management;
• internal control;
• information systems;
• customer asset protection;
• AML;
• business continuity.

In a regulated environment, the board should receive structured compliance reports.

Minutes should demonstrate that material regulatory risks are actually considered.

A recurring investor question should be:

“Which regulatory risks are reported to the board, how often, and who is accountable for remediation?”

Governance documents should match operational reality.

10. Checklist Item Ten: Establish Internal Control, Risk Management and Audit

The larger and more regulated the fintech becomes, the less acceptable informal founder supervision becomes.

Depending on the licence, formal functions may include:

• internal control;
• risk management;
• internal audit;
• compliance;
• information security.

For crypto asset service providers, the CMB framework expressly requires detailed organisational, control, risk, technology and audit structures as part of establishment and operating permission.

Internal control should examine everyday operating processes.

Risk management should identify emerging threats.

Internal audit should independently test whether the company’s own controls work.

A compliance manual that has never been tested is not the same as a functioning compliance system.

11. Checklist Item Eleven: Create a MASAK Compliance Framework

Anti-money laundering compliance is one of the most important ongoing obligations in Turkish fintech.

The MASAK Compliance Programme Regulation expressly includes:

• electronic money institutions;
• most payment institutions, subject to specified exceptions;
• crypto asset service providers.

The stated exceptions from the full formal compliance-programme obligation include payment institutions exclusively providing certain limited services such as the specified bill-payment, payment initiation and account-information services. This does not necessarily remove every other AML obligation.

A compliant AML framework should address:

• customer identification;
• beneficial ownership;
• customer risk classification;
• transaction monitoring;
• suspicious transaction reporting;
• PEPs;
• sanctions;
• enhanced due diligence;
• record retention.

Fintech founders should budget for AML as an operational function rather than treating it as a template document prepared for licensing.

12. Checklist Item Twelve: Apply a Risk-Based KYC Programme

Not every customer creates the same financial crime risk.

A fintech should classify customers according to risk factors such as:

• customer type;
• geographic exposure;
• business activity;
• transaction volume;
• technology channel;
• ownership complexity;
• crypto exposure;
• source of funds.

MASAK’s updated Enhanced Measures Guide specifically addresses high-risk customers, technological risks, risky jurisdictions, CASP relationships and additional obligations concerning payment and electronic money terminal services.

High-risk relationships may require:

• additional documentation;
• source-of-funds review;
• management approval;
• lower limits;
• stronger monitoring.

“Fully automated KYC” should not mean “no human compliance judgment.”

13. Checklist Item Thirteen: Crypto Businesses Need Travel Rule and Blockchain-Specific AML Controls

Crypto businesses require additional controls beyond traditional bank-style AML.

MASAK’s September 2025 updated CASP Guide addresses:

• KYC;
• remote identification;
• enhanced measures;
• Travel Rule;
• crypto transfer timing and limits;
• politically exposed persons;
• suspicious transaction reporting;
• compliance programmes.

A Turkish crypto platform should therefore be technically capable of handling information concerning the parties to qualifying crypto transfers.

Blockchain analytics can support this process, but automated risk scores should not replace a documented compliance decision.

A platform should also distinguish between:

• another regulated CASP;
• self-hosted wallet;
• high-risk wallet;
• suspicious blockchain exposure.

14. Checklist Item Fourteen: Design Remote Customer Onboarding Lawfully

Digital onboarding is central to fintech, but it creates several overlapping obligations.

The institution must consider:

• sector-specific remote identification rules;
• MASAK;
• authentication;
• fraud controls;
• KVKK;
• evidentiary records.

A payment institution, digital bank and crypto exchange may all onboard customers remotely, but they do not necessarily operate under identical technical requirements.

The customer journey should be legally reviewed screen by screen.

Important questions include:

Is every requested piece of information necessary?

Is the customer properly informed?

Can the institution prove which terms were accepted?

Can identity evidence be produced later during litigation or regulatory inspection?

Convenience should not destroy evidentiary reliability.

15. Checklist Item Fifteen: Comply With KVKK From Product Design

Fintech companies process highly detailed personal information.

This can include:

• identity data;
• contact information;
• financial data;
• transaction history;
• device information;
• fraud information;
• KYC records;
• wallet addresses.

Türkiye’s Personal Data Protection Authority and TÖDEB published a dedicated Good Practices Guide for the Protection of Personal Data in the Payment and Electronic Money Sector on 14 July 2026.

The Guide addresses the categories of data processed in the sector, controller/processor status, legal grounds, transfers, controller obligations and data security.

A fintech KVKK project should therefore include:

data inventory → legal basis → privacy notice → retention → security → data subject rights → international transfers.

A copied privacy policy is not a compliance programme.

16. Checklist Item Sixteen: Do Not Use Consent as the Legal Basis for Everything

A frequent fintech mistake is asking customers to consent to every data-processing operation.

This can create regulatory confusion.

Some processing may instead be necessary because:

• the law requires it;
• the customer contract requires it;
• the institution has a statutory legal obligation;
• legitimate interests apply within KVKK conditions.

The correct legal basis should be determined separately for each processing purpose.

For example, AML information required by law should not be presented as optional merely because an onboarding checkbox uses the word “consent.”

Privacy notice and consent mechanisms should be legally differentiated.

17. Checklist Item Seventeen: Map Every Cross-Border Data Transfer

Fintech technology stacks are frequently international.

Data may leave Türkiye through:

• cloud services;
• CRM software;
• fraud tools;
• support systems;
• analytics;
• group access;
• remote developers.

KVKK Article 9 was materially restructured in 2024.

Türkiye now maintains four official standard contractual transfer modules:

• controller to controller;
• controller to processor;
• processor to processor;
• processor to controller.

Where standard contracts are used, they must be notified to the Personal Data Protection Authority within five business days after signature. The Authority reiterated and operationalised this requirement in July 2026.

Every foreign SaaS or cloud procurement should therefore include an Article 9 review before customer data begins to flow.

18. Checklist Item Eighteen: Do Not Confuse KVKK Permission With Financial-Sector Data Localisation

A valid KVKK transfer mechanism does not automatically mean the fintech’s financial regulator permits the same architecture.

This is particularly important for:

• payment institutions;
• electronic money institutions;
• banks;
• crypto institutions.

Financial regulators maintain separate information systems and localisation requirements.

Therefore, the company should separately ask:

Can the data legally be transferred under KVKK?

and

Does CBRT, BRSA or CMB regulation permit the technical architecture?

The answer to the first question does not override the second.

19. Checklist Item Nineteen: Treat Cybersecurity as a Licensing Issue

Cybersecurity is no longer merely an IT matter.

Türkiye’s Cybersecurity Law No. 7545, published on 19 March 2025, created a broader national cybersecurity framework, and the Cyber Security Presidency now operates as a central authority for national cyber risk and critical infrastructure.

Regulated fintech companies are also subject to sector-specific information systems requirements.

The CBRT’s current payment-services regulatory framework includes a dedicated Communiqué governing the information systems of payment and electronic money institutions and payment-services data-sharing services.

Fintech cybersecurity programmes should cover:

• access management;
• MFA;
• vulnerability management;
• penetration testing;
• logging;
• incident response;
• secure software development;
• disaster recovery;
• vendor security.

Cybersecurity compliance should be reported to the board.

20. Checklist Item Twenty: Prepare a Multi-Regulator Incident Response Plan

A single cybersecurity incident can create several legal obligations.

For example, a breach affecting a payment institution could potentially involve:

• CBRT;
• Personal Data Protection Authority;
• Cyber Security Presidency;
• customers;
• law enforcement.

The company’s incident response plan should therefore include a legal notification matrix.

It should identify:

• which event triggers which notification;
• who makes the decision;
• applicable deadlines;
• who communicates with customers;
• how digital evidence will be preserved.

A plan saying merely “IT will investigate the breach” is not enough.

21. Checklist Item Twenty-One: Review Cloud and Outsourcing Before Signing Vendor Contracts

Regulated fintech companies frequently depend on third-party providers for:

• cloud;
• customer support;
• KYC;
• fraud monitoring;
• software development;
• cybersecurity;
• data analytics.

Before signing a vendor contract, legal and security teams should determine:

• whether outsourcing is permitted;
• whether regulator approval is needed;
• where the data is stored;
• whether sub-processors are used;
• whether the regulator can audit;
• whether the fintech has audit rights;
• what happens after termination.

The regulated institution generally remains responsible for outsourced operations.

A critical cloud supplier should therefore undergo regulatory due diligence comparable to a material commercial partner.

22. Checklist Item Twenty-Two: Protect Customer Funds and Assets

Fintech compliance is heavily focused on ensuring customer property is not treated as company property.

For payment and electronic money institutions, customer funds must be protected under the statutory safeguarding framework.

For crypto businesses, customer assets require appropriate segregation, tracking and custody.

This distinction should also appear in accounting and treasury policies.

Founders must never treat customer balances as working capital.

Investors should independently verify safeguarding and customer asset reconciliation during due diligence.

A large “cash balance” may not actually belong to the company.

23. Checklist Item Twenty-Three: Crypto Platforms Need Custody, Token Listing and Market Surveillance Controls

Crypto compliance goes well beyond obtaining a CMB permission.

The regulated operating architecture may need to include:

• custody;
• customer asset segregation;
• wallet controls;
• listing procedures;
• proof-of-reserves processes;
• market surveillance;
• cybersecurity;
• capital adequacy.

The CMB’s current application structure expressly separates establishment and operating-permission processes, meaning establishment approval should not be confused with authority to launch regulated operations.

The CMB also extended certain transitional custody and authorisation deadlines in March 2026, linking the next stage of transition to the sufficiently widespread availability of authorised crypto custody services.

Crypto startups should therefore check the latest CMB bulletin immediately before any licensing or M&A transaction.

24. Checklist Item Twenty-Four: Do Not Assume Every Crypto Company on the CMB Website Is Fully Licensed

Crypto due diligence requires special care during the transition into the permanent licensing framework.

Investors should obtain actual regulatory decisions and correspondence.

They should determine whether the target has:

• establishment approval;
• operating permission;
• transitional status;
• outstanding regulatory deficiencies;
• required custody arrangements.

Public-list appearance alone should never replace documentary due diligence.

A crypto acquisition price should reflect the target’s actual authorisation status, not merely its marketing claim that it is “SPK registered.”

25. Checklist Item Twenty-Five: Build Consumer Protection Into the Interface

Consumer protection is part of fintech product design.

Key issues include:

• transparent fees;
• clear contractual terms;
• accessible complaint processes;
• unauthorized payment procedures;
• fair account termination;
• accurate advertising;
• evidence of electronic acceptance.

Mobile screens should not hide legally material information.

Important fees should be disclosed before customers approve transactions.

Contracts should avoid provisions attempting to waive mandatory consumer rights.

Fintech companies should also monitor complaint patterns because repeated complaints often indicate a systemic compliance problem.

26. Checklist Item Twenty-Six: Review Marketing Before Publication

Advertising creates regulatory risk, particularly for:

• crypto;
• investment products;
• credit products;
• “free” payment services.

Marketing should not exaggerate:

• returns;
• security;
• government protection;
• regulatory status.

A regulated platform should not imply that the regulator guarantees investment value.

Marketing teams should also understand that influencer campaigns can create legal responsibility.

Legal review should occur before—not after—a campaign generates complaints.

27. Checklist Item Twenty-Seven: Separate Crypto Trading From Crypto Payments

A particularly important distinction in Türkiye is that regulation of crypto trading does not mean crypto assets may automatically be used as payment instruments.

The CBRT continues to list the Regulation on the Disuse of Crypto Assets in Payments among its current payment-services legislation.

Crypto startups should therefore distinguish between:

• crypto investment/trading services governed by the CMB framework; and
• payment use cases subject to the CBRT’s crypto-payment restrictions.

A licence in one regulatory area does not automatically create permission in another.

28. Checklist Item Twenty-Eight: Open Banking Requires Both Licensing and Technical Integration

Payment initiation and account information services are regulated payment services.

For a company seeking to provide open banking services, regulatory compliance may include:

• CBRT permission;
• BKM/GEÇİT technical integration;
• authentication;
• secure API infrastructure;
• customer consent;
• KVKK;
• cybersecurity.

A startup should therefore avoid treating open banking as simply obtaining access to a bank API.

The business model combines financial licensing with technical certification and data governance.

29. Checklist Item Twenty-Nine: BaaS Does Not Eliminate Licensing Analysis

Banking as a Service allows banking services to be accessed through a fintech interface.

However, BaaS does not mean the interface provider automatically becomes a bank.

The BRSA’s current regulatory framework continues to recognise both digital banking and Banking as a Service under the applicable regulation.

A BaaS startup should identify:

• the service bank;
• the interface provider;
• contractual responsibility;
• customer onboarding;
• information systems;
• outsourcing;
• other licences required for services performed by the interface provider.

A payment initiation function, for example, may still require separate payment-services analysis.

30. Checklist Item Thirty: Foreign Investors Must Review Turkish Approval Requirements

Türkiye generally allows foreign investment, but regulated fintech investment can involve sector-specific ownership approval.

An investor should analyse:

• direct ownership;
• indirect ownership;
• board rights;
• control rights;
• capital increases;
• group restructurings.

A transaction executed entirely abroad may still affect control over a Turkish regulated fintech.

Accordingly, Turkish regulatory analysis should be included in multinational M&A even where the Turkish subsidiary represents only a small part of the global transaction.

31. Checklist Item Thirty-One: Check Competition Law Before Closing Investments or Acquisitions

Fintech acquisitions can also trigger Turkish merger-control rules.

Türkiye updated its merger and acquisition thresholds in February 2026.

The Competition Authority states that the principal thresholds were increased so that:

• the former TRY 250 million threshold became TRY 1 billion;
• the former TRY 750 million Turkish turnover threshold became TRY 3 billion;
• the former TRY 3 billion worldwide turnover threshold became TRY 9 billion.

The amendments also revised the special rules concerning technology undertakings.

This is important for fintech because payment, financial technology and digital businesses may fall within technology-undertaking analysis.

Where Competition Board approval is required, it should be a condition precedent to closing.

32. Checklist Item Thirty-Two: Perform Regulatory Due Diligence Before Investing

Fintech due diligence should be broader than ordinary legal due diligence.

Investors should request at least:

Licence documentation

Regulator correspondence

Capital calculations

AML policies and testing

Customer fund reconciliation

Cybersecurity audits

Penetration tests

KVKK records

Cross-border transfer contracts

Complaint data

Material outsourcing contracts

Shareholder approvals

Litigation and regulatory investigations

Due diligence should ask not only what the company’s policies say but whether those policies operate in practice.

For example:

A 100-page AML manual has limited value if thousands of transaction monitoring alerts remain unresolved.

33. Checklist Item Thirty-Three: Treat Regulatory Enforcement History as a Valuation Issue

The importance of continuing compliance is demonstrated by recent CBRT enforcement.

The CBRT reported that its 2025 supervision of payment and electronic money institutions resulted in:

• 7 operating licence revocations;
• 14 temporary suspensions.

The CBRT’s 2025 annual report further records 72 institutions receiving administrative monetary penalties totalling approximately TRY 373.2 million and confirms that multiple share transfer, licence expansion and suspension decisions were actively handled during the year.

This demonstrates that financial regulation is not theoretical.

Investors should price regulatory risk.

A rapidly growing fintech with unresolved supervisory findings may be less valuable than a slower-growing competitor with strong compliance infrastructure.

34. Checklist Item Thirty-Four: Verify Intellectual Property Ownership

Fintech investors often focus on regulatory licences and overlook software ownership.

The target should own or validly license:

• source code;
• mobile application;
• APIs;
• algorithms;
• trademarks;
• domains;
• databases.

Particular attention should be paid to software developed by:

• founders;
• freelancers;
• external agencies;
• overseas group companies.

A regulated fintech with no clear title to its core software creates significant post-closing risk.

Open-source licence exposure should also be reviewed.

35. Checklist Item Thirty-Five: Review Key Employees and Regulatory Personnel

Certain employees may be operationally critical.

Examples include:

• compliance officer;
• information security officer;
• senior IT manager;
• internal control personnel;
• key developers;
• AML specialists.

The company should maintain succession planning.

An investor should determine whether the target becomes non-compliant or operationally incapable if one founder or one senior employee resigns.

Employment agreements should address confidentiality and intellectual property.

36. Checklist Item Thirty-Six: Maintain a Regulatory Calendar

One of the simplest but most effective compliance tools is a regulatory calendar.

It should contain deadlines relating to:

• periodic regulatory reports;
• capital calculations;
• independent audits;
• information systems audits;
• penetration tests;
• AML training;
• internal audit;
• policy review;
• shareholder notifications;
• licence renewals or permission updates where relevant;
• KVKK transfer notifications.

Responsibility should be assigned by name or department.

A missed filing because “everybody thought somebody else was responsible” remains a compliance failure.

37. Checklist Item Thirty-Seven: Maintain a Regulatory Change Management Process

Fintech regulation in Türkiye changes frequently.

Examples from the last two years include:

• the comprehensive crypto regulatory regime;
• new crypto capital thresholds;
• MASAK crypto guidance;
• expanded open banking functionality;
• amendments to data transfer rules;
• the Cybersecurity Law;
• new Competition Authority thresholds;
• new sector-specific KVKK guidance.

Therefore, a company should maintain a formal process for regulatory changes.

For each new rule, management should determine:

1. Does it apply to us?
2. Which policy or system must change?
3. Who owns remediation?
4. What is the deadline?
5. How will compliance be evidenced?

A legal newsletter that nobody operationalises is not an effective regulatory change process.

38. Compliance Checklist for a Fintech Startup Before Launch

Before launch, the founders should be able to answer yes to the following questions.

Regulatory Classification

Do we know exactly which regulated financial services the product provides?

Licence

Have all necessary permissions been obtained before customer-facing activity begins?

Corporate Structure

Is the company type and ownership structure compatible with the licence?

Capital

Do we satisfy both establishment and ongoing capital requirements?

Shareholders

Can we document the ultimate ownership and source of funds?

Governance

Are regulatory responsibilities properly allocated?

AML

Is KYC and transaction monitoring operational?

Remote Onboarding

Can customer identity and consent be proved?

KVKK

Has every material data processing activity been mapped?

Cross-Border Data

Have foreign cloud and SaaS transfers been legally structured?

Cybersecurity

Have security testing, access controls and incident plans been implemented?

Outsourcing

Have critical vendors been reviewed against financial-sector rules?

Customer Assets

Are customer funds or crypto assets properly segregated and reconciled?

Consumer Protection

Are fees, complaints and contractual terms transparent?

Regulatory Reporting

Is a compliance calendar operational?

A negative answer should produce an action plan before launch.

39. Regulatory Due Diligence Checklist for Fintech Investors

An investor’s checklist should be more demanding.

The purchaser should determine:

Does the target have the correct licence?

Not merely a licence—the correct scope.

Is the licence currently active?

Check current regulatory records.

Has the regulator investigated the target?

Request correspondence.

Is capital sufficient after closing?

Model the transaction.

Are shareholders properly approved?

Review historic share transfers.

Are customer funds reconciled?

Verify safeguarding.

Is AML functioning?

Sample customer files and alerts.

Is personal data lawfully processed?

Review KVKK and transfers.

Is cybersecurity adequate?

Review audits, incidents and penetration tests.

Are customer complaints systemic?

Analyse trends.

Does the target own the software?

Verify IP.

Will the acquisition itself require permission?

Check CBRT, BRSA, CMB and Competition Authority requirements.

This transforms compliance from a legal checklist into an investment valuation tool.

40. The Regulatory Red Flags Investors Should Take Most Seriously

Not every deficiency is equally important.

Certain issues should receive immediate escalation.

Unlicensed Core Activity

This may threaten the legality of the entire business model.

Licence Suspension or Material Regulator Investigation

This can affect continuity of operations.

Customer Asset Shortfall

Potentially catastrophic.

Regulatory Capital Deficiency

May threaten the licence.

Systematic AML Failure

Can create regulatory and criminal exposure.

Major Cybersecurity Weakness

Can threaten customer assets and business continuity.

Invalid Cross-Border Data Architecture

Can require extensive technical remediation.

Unapproved Historic Share Transfers

Can affect ownership legality.

Lack of Software Ownership

Can materially undermine the commercial asset being purchased.

A strong due diligence report should distinguish deal-breaking risk from ordinary remediation.

41. Building a Fintech Compliance Function

A regulated fintech should generally avoid placing the entire compliance burden on one junior lawyer.

The compliance function should connect:

legal

with

AML

with

risk

with

cybersecurity

with

product

with

operations.

The product team should understand why certain features are restricted.

The compliance team should understand how the technology actually works.

The board should understand which risks could threaten the licence.

Compliance therefore becomes an operational function rather than a document-producing department.

42. The Role of Legal Counsel in Fintech Compliance

Fintech legal counsel should ideally participate throughout the business lifecycle.

During establishment:

• classify the model;
• determine licensing;
• structure shareholders;
• prepare regulatory applications.

During operations:

• review product changes;
• monitor regulation;
• review contracts;
• manage regulator interaction.

During investment:

• analyse share transfer permissions;
• structure conditions precedent;
• conduct due diligence.

During incidents:

• coordinate regulator notifications;
• protect privilege;
• manage customer and regulator communications.

The strongest fintech legal strategy is preventative.

Correcting a regulatory structure before launch is generally less expensive than defending enforcement after launch.

Frequently Asked Questions About Fintech Regulatory Compliance in Turkey

Is there one fintech licence in Turkey?

No.

The required licence depends on the service performed. Payment/e-money activity falls principally within the CBRT framework; banking and digital banking fall under BRSA; regulated crypto asset services fall under CMB.

Who regulates payment institutions in Turkey?

The CBRT regulates and supervises payment institutions under Law No. 6493 and publishes current authorised institutions and activity scopes.

Who regulates electronic money institutions?

The CBRT. Its current register identifies authorised electronic money issuers and the additional payment-service scopes for which each is authorised.

What are the payment and e-money minimum own-funds requirements in 2026?

From 30 June 2026, the relevant amounts are TRY 20 million, TRY 40 million and TRY 105 million depending on the payment/e-money category.

What is the minimum capital for a digital bank?

The Digital Banking Regulation provides a minimum paid-in capital requirement of TRY 1 billion.

What is the minimum establishment capital for a crypto exchange in 2026?

TRY 250 million for a platform.

What is the minimum establishment capital for a crypto custody institution?

TRY 630 million for 2026.

Are fintech companies subject to MASAK?

Many regulated fintech entities are. The formal compliance-programme regime expressly includes electronic money institutions, most payment institutions subject to identified exceptions, and crypto asset service providers.

Do crypto companies need Travel Rule compliance?

Yes. MASAK’s current CASP guidance expressly addresses the Travel Rule, remote identification, enhanced measures, transfer limits, PEPs and suspicious transaction reporting.

Does KVKK apply to fintech companies?

Yes. The Personal Data Protection Authority published dedicated payment and electronic money sector good-practice guidance in July 2026.

Can fintech data be stored abroad?

Potentially, but KVKK Article 9 and applicable sector-specific financial information systems rules must both be considered.

How quickly must a Turkish KVKK standard contract be notified?

Within five business days after signing.

Is cybersecurity regulated separately?

Yes. In addition to sector-specific CBRT, BRSA and CMB information systems regulation, Türkiye has Cybersecurity Law No. 7545 and the Cyber Security Presidency.

Can crypto be used freely for payments because crypto exchanges are now regulated?

No. CMB regulation of crypto trading should not be confused with CBRT restrictions concerning the use of crypto assets in payments. The CBRT continues to list the Regulation on the Disuse of Crypto Assets in Payments as current payment legislation.

Can a foreign fintech licence be used directly in Turkey?

Generally, a foreign authorisation does not automatically replace the Turkish permission required for regulated services directed toward the Turkish market.

Can foreigners invest in Turkish fintech companies?

Generally yes, but sector-specific ownership approvals may apply where the target is a regulated financial institution.

Can a fintech acquisition require Competition Board approval?

Yes. Türkiye revised its merger-control thresholds in February 2026, including TRY 1 billion, TRY 3 billion and TRY 9 billion thresholds within the applicable notification tests and revised technology-undertaking rules.

Is a compliance policy enough?

No.

Regulators increasingly expect operational evidence showing that policies are actually implemented through controls, systems, audits, monitoring and board oversight.

Conclusion: Fintech Compliance in Turkey Should Be Built Into the Business Model

Fintech regulatory compliance in Turkey has become significantly more institutionalised.

A founder can no longer approach regulation as a one-time licence application completed immediately before product launch.

An investor should not treat regulatory due diligence as a minor appendix to a commercial acquisition report.

The Turkish framework now operates across several interconnected regulatory layers.

Payment institutions and electronic money institutions remain subject to detailed CBRT licensing and supervision under Law No. 6493. The CBRT publicly identifies authorised institutions and their permitted activity scopes, making licence verification an essential first step for both customers and investors.

Regulatory supervision is active.

The CBRT’s 2025 supervisory results demonstrate that enforcement can result in licence suspension, licence cancellation and substantial administrative fines.

Financial capacity is also increasingly important.

From 30 June 2026, payment and electronic money institutions are subject to increased minimum own-funds requirements, while crypto trading platforms and custody providers now face establishment capital levels of TRY 250 million and TRY 630 million respectively.

These requirements mean that fintech founders should create regulatory capital plans alongside commercial budgets.

Money required for the licence should not be confused with money required to operate the business.

Digital banking represents an even more capital-intensive regulated model. The current digital banking framework requires at least TRY 1 billion in paid-in capital for operating permission and subjects digital banks to the broader banking regulatory regime.

AML compliance is equally central.

MASAK expressly requires compliance programmes from electronic money institutions, most payment institutions subject to specified exceptions and crypto asset service providers.

For crypto companies, AML compliance has become increasingly specialised.

The updated CASP Guide addresses remote identification, enhanced measures, Travel Rule compliance, crypto transfer controls, PEPs and suspicious transaction reporting.

A regulated fintech should therefore treat KYC and monitoring as part of the technology architecture itself.

Data protection has undergone similarly important change.

Türkiye’s cross-border data transfer regime now uses standard contracts, BCRs and other safeguards under the reformed KVKK Article 9 system. Standard contracts must be notified to the Authority within five business days.

At the same time, payment and electronic money companies now have the benefit of dedicated sector guidance published by the Personal Data Protection Authority and TÖDEB in July 2026.

Fintech companies using global cloud, CRM, KYC, fraud-prevention or analytics providers should therefore map data transfers before those systems become operational.

Cybersecurity is another area where regulatory expectations are increasing.

Türkiye’s Cybersecurity Law No. 7545 complements existing sector-specific information systems regulation.

For fintech management, the key practical lesson is that a cyberattack may create several problems simultaneously:

• operational disruption;
• regulatory reporting;
• customer loss;
• personal data breach;
• financial liability;
• reputational damage.

This is why incident response must involve legal and compliance teams from the beginning rather than only after the technical investigation is complete.

For investors, these regulatory areas should be converted into due diligence questions.

A fintech target should be assessed according to:

licence validity, licence scope, capital, shareholder approvals, AML, customer assets, cybersecurity, data protection, consumer complaints and regulator history.

The answers should influence valuation and transaction documentation.

A known regulatory deficiency may require:

• price adjustment;
• pre-closing remediation;
• specific indemnity;
• escrow;
• closing condition.

Competition regulation should also be included in transaction planning. Türkiye’s February 2026 merger-control reforms materially increased the principal notification thresholds while retaining specific rules relevant to technology transactions.

The most important strategic principle is therefore that fintech compliance should not be organised regulator by regulator in isolated silos.

The same product feature can trigger several legal frameworks.

Consider a foreign cloud-based digital wallet.

The company may need to consider:

CBRT licensing because it provides payment or electronic money services;

MASAK because customers and transactions require AML controls;

KVKK because financial and identity information is processed;

Article 9 because the cloud may involve an international transfer;

cybersecurity regulation because the platform controls customer financial activity;

consumer law because fees and contractual terms are presented to retail users.

The correct compliance architecture therefore follows the customer journey and the technology rather than simply maintaining separate legal folders.

For a fintech startup, the ideal sequence is:

classify the service → determine the regulator → structure the company → secure the required capital → obtain permission → build AML/KVKK/cybersecurity into the product → test systems → launch → monitor compliance continuously.

For an investor, the ideal sequence is:

verify licence → compare licence with actual activity → review regulator correspondence → test capital → analyse shareholder approval → examine AML/KVKK/cybersecurity → reconcile customer assets → check competition approval → price regulatory risk → close only after required permissions.

The central lesson is straightforward:

A fintech licence is not the end of compliance. It is the beginning of continuing regulatory responsibility.

In Türkiye’s increasingly mature fintech market, long-term success will depend not only on customer growth and technology but also on the ability of founders, management and investors to demonstrate that the business can operate safely, transparently and lawfully under a multi-regulator framework.

For payment institutions, electronic money companies, digital wallet providers, open banking businesses, digital banks, Banking as a Service companies, crypto exchanges and other fintech startups in Turkey, regulatory compliance should therefore be treated as a core business function from day one.

For investors, the same principle can be stated differently:

Never value a Turkish fintech licence without valuing the compliance infrastructure required to keep it.

That distinction is increasingly likely to separate sustainable regulated fintech businesses from companies whose growth eventually becomes constrained by regulatory intervention.

Legal Disclaimer: This publication provides general information concerning fintech regulatory compliance in Türkiye as of July 2026. It does not constitute legal, financial, tax or investment advice. Regulatory classification, capital requirements, licence scopes, AML requirements, data protection rules, cybersecurity standards and merger-control thresholds may change. Each fintech project, investment or transaction should be reviewed individually according to its business model, technology architecture, customer base, ownership structure and the legislation in force at the relevant time.