Introduction

The rapid development of digital commerce, mobile applications, online marketplaces, embedded finance, payment gateways, digital wallets and cross-border financial technology has made the Turkish payments market increasingly important for both domestic entrepreneurs and international fintech companies.

However, a business that facilitates payments in Türkiye cannot assume that it is merely a technology company.

Depending on the structure of the transaction, receiving funds from customers, transferring money, acquiring payment instruments, providing money remittance services, initiating payments or accessing consolidated payment-account information may constitute a regulated payment service under Turkish law.

The principal legislation governing payment institutions in Türkiye is Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions. Since 1 January 2020, the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) has been the principal authority responsible for the regulation, authorisation, supervision and oversight of payment institutions and electronic money institutions.

Accordingly, a company wishing to operate as a payment institution in Türkiye must first determine whether its business model constitutes a regulated payment service and, where required, obtain an operating licence from the CBRT before commencing the relevant activity.

This guide provides a detailed explanation of payment institution licensing in Turkey, including the regulated payment services, company formation requirements, shareholder qualifications, capital and own-funds obligations, CBRT application procedure, information systems, AML/KYC compliance and ongoing regulatory responsibilities.

1. What Is a Payment Institution Under Turkish Law?

A payment institution is a legal entity authorised under Law No. 6493 to provide payment services.

Not every fintech company that participates in the payment ecosystem is necessarily a payment institution.

A company that merely supplies software, cybersecurity infrastructure, data processing or other technical services without becoming the owner of the funds transferred may potentially fall outside the definition of a regulated payment service. Law No. 6493 specifically excludes certain technical services where the service provider does not at any stage become the owner of the transferred funds.

The distinction therefore depends primarily on what the company actually does.

For regulatory purposes, it is necessary to analyse the entire payment flow:

Who receives the money?

Who holds the customer’s funds?

Who transfers those funds?

Who enters into the agreement with the customer?

Does the company maintain a payment account?

Does it issue or accept a payment instrument?

Does it provide merchant acquiring?

Does it initiate a payment from an account maintained by another payment service provider?

Does it provide consolidated account information?

These questions are far more important than how the product is commercially marketed.

A business described as a “payment gateway”, “checkout solution”, “wallet”, “marketplace infrastructure” or “financial API” may still perform a regulated payment service.

2. Which Payment Services Require a Licence in Turkey?

Article 12 of Law No. 6493 defines the principal categories of regulated payment services.

These include services necessary for operating a payment account, including enabling funds to be placed into or withdrawn from the account.

The legislation also covers payment transactions involving the transfer of funds held in a payment account, including direct debits, card or similar payment transactions and regular payment orders.

Other regulated activities include:

• issuing or accepting payment instruments;
• money remittance;
• certain payments executed through information or electronic communication devices;
• intermediary services for bill payments;
• payment initiation services;
• account information services;
• other payment-related transactions or services that may reach thresholds determined by the CBRT in terms of size or market impact.

The current statutory categories are expressly listed in Article 12 of Law No. 6493.

This classification is extremely important because the CBRT licence is granted by reference to specific payment services.

A payment institution does not automatically receive permission to conduct every service listed in Law No. 6493.

The CBRT’s current public register identifies authorised payment institutions and shows which Article 12 services each institution is permitted to perform.

Consequently, licensing analysis should begin with identifying the exact statutory category into which the proposed business model falls.

3. Activities That May Fall Outside Payment Services Regulation

Law No. 6493 also contains exclusions from the definition of payment services.

Depending on their particular characteristics, these may include certain:

• direct cash transactions;
• payments through authorised commercial agents;
• non-profit cash collection arrangements;
• cash foreign-exchange transactions unrelated to payment accounts;
• payments involving certain negotiable instruments;
• technical service-provider activities;
• limited-network payment instruments;
• intra-group payments;
• certain ATM cash withdrawal services.

However, these exemptions should be interpreted carefully.

For example, the statutory technical-service-provider exclusion generally concerns services relating to areas such as data processing, data storage, security, verification, IT infrastructure and maintenance where the technical provider does not at any moment become the owner of the funds being transferred.

A company should therefore not rely on the mere fact that it describes itself as a “technical service provider.”

The contractual structure, operational processes and actual movement of money must support that classification.

This is especially important for marketplaces and SaaS businesses that collect customer payments and subsequently transfer merchants’ shares to sellers.

4. Which Authority Issues Payment Institution Licences in Turkey?

The competent licensing authority is the Central Bank of the Republic of Türkiye.

The CBRT is responsible for authorising payment institutions and electronic money institutions and for their ongoing supervision and oversight.

The core legal framework consists principally of:

Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions;

the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers; and

the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data-Sharing Services of Payment Service Providers in the Field of Payment Services.

The CBRT maintains the applicable legislation and regulatory guidance within its current payments regulatory framework.

For entrepreneurs, this means that establishing the company at the trade registry is not equivalent to obtaining permission to perform payment services.

Corporate incorporation and regulatory licensing are separate processes.

5. Does a Payment Institution Have to Be a Joint-Stock Company?

Yes.

Article 14 of Law No. 6493 requires a payment institution to be established as a Turkish joint-stock company, known in Turkish as an anonim şirket or “A.Ş.”

The law also requires its shares to be issued against cash and to be registered shares, subject to the specific statutory regime applicable to certain account information service providers.

This requirement has practical importance for foreign fintech businesses entering Türkiye.

A foreign company should not automatically establish a Turkish limited liability company and assume that the entity can later obtain a payment institution licence without restructuring.

Where the intended activity clearly requires payment-institution authorisation, the corporate structure should generally be designed for regulatory compliance from the outset.

6. Payment Institution Shareholder Requirements

Financial-sector licensing involves regulatory scrutiny of shareholders as well as the company itself.

Under Article 14 of Law No. 6493, persons holding 10% or more of the capital of a payment institution and persons exercising control must satisfy the qualifications required for founders of banks under Banking Law No. 5411.

The CBRT application procedure therefore examines the ownership chain rather than merely the immediate shareholders appearing in the Turkish trade registry.

The licensing file may involve detailed information concerning:

• direct shareholders;
• indirect shareholders;
• ultimate beneficial owners;
• controlling persons;
• privileged shares;
• shareholder financial capacity;
• criminal records;
• tax and social security liabilities;
• corporate shareholders’ financial statements;
• ownership and control relationships.

The Payment Services Regulation requires extensive documentation concerning qualifying shareholders and controlling persons during the intelligence-review stage.

For international groups, this makes early preparation of the ownership structure particularly important.

A complex offshore ownership chain, nominee arrangement or opaque control structure may significantly complicate the licensing review.

7. Transparent Ownership and Organisational Structure

Law No. 6493 expressly requires the payment institution to have a transparent and clear ownership structure and organisational chart that does not prevent CBRT supervision.

This requirement should be considered when designing holding-company structures.

The regulator must be able to understand:

• who ultimately controls the applicant;
• how decisions are made;
• which entities provide financing;
• whether there are related-party relationships;
• which company owns critical technology;
• which services are outsourced;
• how the Turkish payment institution fits within the wider corporate group.

International fintech groups should therefore consider regulatory transparency before establishing multiple layers of holding companies.

8. Minimum Paid-In Capital for a Payment Institution

Law No. 6493 establishes statutory minimum paid-in capital requirements.

Under the current text of Article 14, a payment institution providing the bill-payment intermediary service specified in Article 12/1(e) must have at least TRY 1 million in fully paid cash capital free from collusive arrangements, while other payment institutions subject to the ordinary capital requirement must have at least TRY 2 million.

The Payment Services Regulation contains the same basic initial paid-in capital framework for the licensing process.

However, these amounts should not be confused with the minimum own-funds requirement.

That distinction is extremely important in 2026 because continuing minimum own-funds requirements are considerably higher than the basic statutory paid-in capital amounts.

9. Minimum Own-Funds Requirements in 2026

Payment institutions are subject to separate minimum own-funds requirements.

The CBRT updated these thresholds through its communiqué published on 31 January 2026, effective from 30 June 2026.

As of July 2026, the applicable minimum own-funds amounts are:

TRY 20 million for payment institutions providing the relevant bill-payment intermediary service;

TRY 40 million for other payment institutions, except institutions exclusively providing the account-information service falling within the specified exemption;

and TRY 105 million for electronic money institutions.

Therefore, a fintech investor should not develop a financial plan merely around the TRY 1 million or TRY 2 million statutory paid-in capital figures.

The regulatory own-funds requirement applicable at the final-approval and operational stages is much more significant.

In addition, the Payment Services Regulation contains calculation methods under which required own funds may increase according to payment volume.

Accordingly, regulatory capital planning should consider not only market entry but also expected growth.

10. Special Position of Account Information Service Providers

Payment institutions exclusively providing the account information service referred to in Article 12/1(g) of Law No. 6493 are subject to a special regulatory regime.

Article 14/A provides exceptions from certain share-issuance and minimum-capital requirements for institutions exclusively providing this service.

Instead, the Payment Services Regulation provides for professional liability insurance or an equivalent guarantee mechanism for institutions exclusively carrying out the relevant activity.

This illustrates why there is no universal capital requirement applicable to every fintech business.

The exact service category matters.

A company developing an open-banking application should therefore determine whether it only provides account-information services or whether it also performs payment initiation or other regulated payment services.

11. CBRT Payment Institution Licence Application: General Structure

One of the most important issues for investors is understanding the actual CBRT payment institution licence application process.

The current Payment Services Regulation provides for a staged application procedure.

Broadly, the process involves:

1. initiating the process before registration of the regulated trade name;
2. corporate registration and preparation;
3. the intelligence review stage (istihbari inceleme);
4. the final approval stage;
5. publication of the operating licence in the Official Gazette;
6. commencement of activity and post-licensing notification.

The Regulation expressly states that applications are conducted through the intelligence-review stage and final-approval stage.

A licence application should therefore not be treated as a single-form administrative filing.

It is a comprehensive regulatory review.

12. Stage One: Beginning the Application Before Trade Name Registration

The Payment Services Regulation contains an unusual but important procedural requirement.

An applicant whose trade name will contain wording showing that it is a payment institution must first submit specified notification forms to the CBRT before registering that regulated trade name with the trade registry.

The required initial submission includes the forms specified in Annexes EK-11-A, EK-11-B, EK-11-C and EK-11-D, together with the draft articles of association and evidence of payment of the application fee.

Under the current Regulation, the application fee is TRY 500,000, together with the applicable statutory financial charges. The fee is non-refundable even where the licensing application ultimately fails.

The CBRT subsequently issues documentation confirming commencement of the application process.

The applicant must then continue to the intelligence-review stage within the regulatory time limit.

13. Six-Month Period to Enter the Intelligence Review Stage

After the CBRT issues the document confirming initiation of the application, the applicant generally has six months from notification of that document to apply for the intelligence-review stage.

Failure to proceed within this period causes the initial application document to lose validity, requiring a new application if the company wishes to continue pursuing a licence.

This deadline demonstrates why a payment institution licence application should not be initiated prematurely.

Before starting the formal process, the founders should ensure that they have sufficient resources to complete:

• corporate establishment;
• ownership documentation;
• financial preparation;
• management appointments;
• business planning;
• information-systems development;
• compliance architecture.

Starting too early without operational readiness may lead to deadlines being missed.

14. Intelligence Review Stage

The intelligence-review stage is primarily concerned with the applicant, its shareholders, management, financial position and proposed business.

The application must include a board resolution authorising the licence application and a detailed business programme and business plan explaining the applicant’s proposed activities and organisational structure.

The Regulation requires extensive additional documents concerning shareholders, controlling persons, directors and the general manager.

The CBRT may also request additional information and documentation.

The review is therefore not merely documentary in the formal sense.

The regulator assesses whether the company’s ownership, management, resources and proposed business model are appropriate for participation in the regulated payments sector.

15. What Should the Payment Institution Business Plan Include?

A strong business plan is one of the most important parts of a payment institution licence application.

It should clearly explain:

• the payment services requested;
• target customer groups;
• anticipated transaction volumes;
• payment flows;
• merchant relationships;
• bank relationships;
• revenue model;
• fees and commissions;
• organisational structure;
• branches or representatives;
• outsourcing;
• technological infrastructure;
• risk management;
• customer complaint mechanisms;
• financial projections.

The plan should also correspond with the technical system that the applicant ultimately implements.

A common regulatory problem arises when the legal application describes one business model while the software architecture implements another.

For example, a company may describe itself as merely facilitating transactions while its actual platform temporarily receives and controls customer funds.

In regulated financial services, the legal, financial and technical descriptions should be aligned.

16. Final Approval Stage

Approval of the intelligence-review stage does not itself constitute a payment institution licence.

Once the CBRT approves that stage, the applicant must generally apply for final approval within 120 days of written notification.

The CBRT may extend this period by up to 60 days where the applicant provides a reasonable justification.

Failure to make the final-approval application within the relevant period causes the applicant to lose the rights arising from the intelligence-review stage and requires the process to be repeated.

The applicant should therefore reach the intelligence-review approval stage with a realistic plan for rapidly completing operational readiness.

17. What Does the CBRT Examine at Final Approval?

At final approval, the regulator moves from examining the proposed institution toward examining whether it is genuinely ready to operate.

The Payment Services Regulation requires verification of matters including:

• paid-in capital;
• initial capital;
• compliance with minimum own-funds requirements;
• establishment of appropriate operational units;
• complaint-handling units;
• internal control systems;
• risk-management systems;
• accounting systems;
• information systems;
• regulatory reporting infrastructure;
• sufficient personnel.

The Regulation also requires information concerning the office from which the company will operate, including its location, physical characteristics, security measures and photographs.

After reviewing the documentation, CBRT personnel may conduct an on-site examination covering the management structure, staff, office conditions, technical equipment and records.

In other words, the final stage is an operational-readiness test.

A newly established company cannot realistically expect to obtain a payment institution licence based merely on an attractive business plan and sufficient capital.

18. Information Systems Requirements

Technology is central to payment institution licensing.

The applicant must establish technological infrastructure capable of providing payment services securely, continuously and efficiently.

The Payment Services Regulation requires institutions to have sufficient qualified personnel and technical equipment, establish necessary information systems and technological infrastructure, maintain adequate records and communication systems and create effective complaint-handling infrastructure.

The separate CBRT information-systems communiqué contains more detailed rules governing technological systems and payment-services data-sharing architecture.

Relevant areas may include:

• identity and access management;
• strong customer authentication;
• transaction security;
• logging;
• fraud detection;
• cybersecurity;
• backup;
• disaster recovery;
• business continuity;
• penetration testing;
• incident response;
• data storage;
• outsourcing;
• API security;
• open banking infrastructure.

For this reason, the technology team should normally participate in the licence project from its earliest stage.

19. Outsourcing and Cloud Infrastructure

Fintech businesses frequently rely on third-party infrastructure providers.

However, regulated payment institutions cannot treat outsourcing as an ordinary commercial matter.

The CBRT has specific requirements concerning external service providers and information systems.

Community-cloud services provide a clear example. As of the end of 2025, the CBRT reported that six external service providers had received suitability approval to offer community-cloud services to payment and electronic money institutions, and additional regulated institutions obtained approval to use such environments during 2025.

Therefore, before selecting a cloud, cybersecurity, payment-processing or core-infrastructure provider, applicants should determine whether regulatory approval or special contractual conditions apply.

A technology contract signed before regulatory analysis may later have to be renegotiated.

20. AML and KYC Requirements for Payment Institutions

Payment institutions are also subject to Turkish anti-money laundering legislation.

The principal legislation is Law No. 5549 on Prevention of Laundering Proceeds of Crime, together with MASAK regulations.

MASAK specifically identifies payment institutions among regulated obligated parties, subject to exceptions for certain institutions exclusively providing specified services. For institutions required to establish a compliance programme, the framework includes institutional policies and procedures, risk management, monitoring and control, appointment of a compliance officer and compliance unit, training and internal audit.

Payment and electronic money institutions are also subject to sector-specific suspicious transaction reporting requirements. MASAK updated its guidance for the sector to reflect financial-technology developments and sector risks.

Accordingly, a payment institution should build AML/KYC processes before commercial launch.

A regulatory compliance programme may include:

• customer identification;
• beneficial ownership verification;
• risk classification;
• sanctions screening;
• politically exposed person controls;
• transaction monitoring;
• suspicious transaction reporting;
• enhanced due diligence;
• record keeping;
• internal escalation procedures;
• compliance training.

AML compliance should be incorporated directly into the user onboarding and transaction-processing infrastructure.

21. Personal Data Protection and KVKK

Payment institutions routinely process large volumes of personal data.

This can include:

• identification data;
• contact information;
• transaction history;
• payment-account information;
• device information;
• IP addresses;
• customer-support records;
• fraud indicators;
• financial behaviour.

Accordingly, Turkish Personal Data Protection Law No. 6698, commonly referred to as the KVKK, is a central part of payment-institution compliance.

The Turkish Data Protection Authority has published a dedicated Good Practices Guide on the Protection of Personal Data in the Payment and Electronic Money Sector, covering subjects including data-controller and processor roles, legal grounds for processing, data transfers, controller obligations and data security.

Payment institutions should therefore coordinate regulatory licensing with their data-protection programme.

This is particularly important where the fintech business uses foreign cloud systems, fraud-prevention software, international group-company databases or overseas customer-support services.

22. Protection of Customer Funds

Payment institutions handle money belonging to payment-service users.

These funds are therefore subject to specific safeguarding rules.

The Payment Services Regulation contains dedicated provisions governing the protection of payment funds.

A payment institution should establish accounting and operational systems that allow customer funds to be identified and protected in accordance with the regulatory framework.

This requirement must be integrated into the company’s bank-account structure and reconciliation processes rather than treated solely as a contractual clause.

Importantly, Law No. 6493 states that funds received by payment and electronic money institutions in connection with payment services are not treated as bank deposits or participation funds under the banking legislation.

Payment institutions should therefore avoid presenting themselves to customers in a way that creates the impression that they are ordinary deposit-taking banks.

23. Can a Payment Institution Provide Loans?

No, not as an ordinary lending business.

Article 14 of Law No. 6493 expressly provides that a payment institution may not engage in lending activities.

The CBRT may determine whether particular activities conducted in connection with payment services amount to lending.

This restriction is highly relevant to buy-now-pay-later models, deferred settlement products and embedded-finance structures.

A payment company wishing to offer credit should therefore examine whether the credit must instead be supplied by an appropriately authorised bank or financing institution.

The product architecture must separate payment activity from regulated lending where necessary.

24. Scope of the Licence

The final CBRT approval expressly determines which payment services the institution is authorised to perform.

The Payment Services Regulation states that the scope of the licence is specified by reference to the payment services covered by the authorisation.

If the institution subsequently wishes to enter a new regulated activity, it must obtain CBRT approval for the expansion.

This is important for fintech companies whose products evolve rapidly.

A company may initially obtain authorisation only for money remittance but later decide to add merchant acquiring, payment initiation or another service.

The existing licence should not be assumed to cover that new activity automatically.

The CBRT reported that six institutions received approval for expansions of their operating licences during 2025, illustrating that licence expansion is a separate regulatory process in practice.

25. When Does the Licence Become Effective?

After the statutory requirements and regulatory conditions have been satisfied, the CBRT may issue final approval.

The operating licence becomes effective when the authorisation decision is published in the Official Gazette.

Before publication, the applicant must provide evidence that the applicable financial activity permit certificate fee obligation has been fulfilled.

The company must then notify the CBRT after commencing operations.

The Regulation requires a licensed institution to notify the CBRT within 10 days after commencing activity and to provide evidence of payment of the regulatory licence fee, which the Regulation currently specifies as TRY 1 million, together with the associated statutory financial obligations.

26. How Long Does a Payment Institution Licence Take in Turkey?

Law No. 6493 provides that, once the information and documents required for the authorisation application have been fully completed, the CBRT should conclude the application within six months.

However, this should not be interpreted as meaning that every payment institution will become licensed six months after first contacting the CBRT.

The overall project can take longer because the process includes:

• the preliminary stage;
• incorporation;
• preparation of documents;
• intelligence review;
• responses to requests for additional documentation;
• technology development;
• final approval;
• on-site review;
• completion of financial and regulatory requirements.

The six-month statutory decision period begins only after the required information and documents are complete.

Applicants should therefore plan the overall licensing project based on operational readiness rather than a simplistic six-month assumption.

27. Foreign Companies Applying for a Payment Institution Licence

Foreign investors may own Turkish payment institutions, subject to the applicable shareholder and regulatory requirements.

However, a payment institution licensed in another country cannot simply use its foreign licence as a substitute for Turkish authorisation.

Turkish residents receiving regulated payment services generally require the local regulatory framework to be considered.

Certain cooperation structures between Turkish payment service providers and foreign legal entities are possible.

The CBRT currently publishes approved cooperation arrangements under Article 19 of the Payment Services Regulation, including collaborations involving foreign payment businesses.

Accordingly, an international fintech company may consider different entry models:

• establishing a new Turkish payment institution;
• acquiring a licensed Turkish payment institution;
• cooperating with an existing licensed Turkish institution;
• supplying purely technical services without itself providing the regulated payment service.

The correct model depends on the movement of funds, contractual responsibilities and customer relationship.

28. Acquiring an Existing Payment Institution

Some investors prefer to acquire an existing licensed payment institution rather than apply for a new licence.

This may reduce certain market-entry delays, but it introduces another category of regulatory risk.

Share transfers involving regulated institutions may require CBRT approval depending on the structure and percentages involved.

Furthermore, detailed regulatory due diligence is essential.

A buyer should examine:

• current licence status;
• scope of authorised services;
• historical CBRT inspections;
• administrative fines;
• AML compliance;
• customer complaints;
• safeguarding of funds;
• cybersecurity incidents;
• data-protection compliance;
• information systems;
• outsourcing;
• capital and own funds;
• pending investigations;
• related-party transactions.

Buying a company with an existing licence is not the same as buying a clean licence.

The buyer acquires the company’s regulatory history as well.

29. CBRT Supervision After Licensing

Obtaining a payment institution licence is only the beginning of regulatory supervision.

The CBRT continues to monitor payment and electronic money institutions after authorisation.

The importance of ongoing compliance is demonstrated by the CBRT’s enforcement figures for 2025.

According to the CBRT’s January 2026 announcement, supervision during 2025 resulted in:

• cancellation of the licences of 7 institutions;
• temporary suspension of licences of 14 institutions;
• requirements imposed on 12 institutions to obtain CBRT approval before distributing dividends;
• administrative fines totalling approximately TRY 373.24 million imposed on 72 institutions;
• referrals relating to 331 files concerning suspected unauthorised payment-service activity to prosecutors and/or courts.

These figures demonstrate that payment regulation in Türkiye is actively enforced.

30. Risks of Providing Payment Services Without a Licence

Operating without the required licence can create both administrative and criminal consequences.

The CBRT expressly states that persons providing regulated payment services or electronic money activities without the necessary authorisation may face imprisonment and judicial fines under Article 28 of Law No. 6493.

The legislation also contains sanctions relating to creating the impression of operating as a payment or electronic money institution without authorisation.

For fintech startups, this means that “launch first, obtain a licence later” can be an extremely dangerous strategy.

Beta testing, pilot transactions and limited customer launches should also be reviewed from a regulatory perspective where real funds are involved.

31. Payment Institution Licensing Checklist

Before filing a payment institution licence application in Turkey, investors should verify that the following areas have been addressed:

Regulatory Classification

Identify exactly which Article 12 payment services the company intends to perform.

Corporate Structure

Establish the appropriate Turkish joint-stock company and prepare regulator-compatible articles of association.

Shareholder Eligibility

Review qualifying shareholders, controllers and ultimate beneficial owners.

Capital and Own Funds

Prepare both the statutory paid-in capital and the substantially higher 2026 own-funds requirement applicable to the institution.

Management

Appoint qualified directors, general management and sufficient personnel.

Business Plan

Prepare detailed commercial, operational and financial projections.

Technical Infrastructure

Build systems capable of secure and uninterrupted payment operations.

Internal Systems

Establish risk management, internal controls, accounting and regulatory reporting.

AML/KYC

Develop customer due diligence, transaction monitoring and suspicious transaction reporting procedures.

Data Protection

Establish KVKK-compliant customer-data processing procedures.

Customer Fund Protection

Design bank-account, reconciliation and safeguarding processes.

Customer Agreements

Prepare payment-services framework agreements and customer disclosures.

Complaints

Create an effective complaint and objection handling function.

Outsourcing

Review technology and operational outsourcing arrangements against CBRT rules.

Regulatory Application

Prepare the intelligence-review and final-approval files in accordance with the Payment Services Regulation.

Frequently Asked Questions About Payment Institution Licensing in Turkey

Who issues payment institution licences in Turkey?

The Central Bank of the Republic of Türkiye issues and supervises payment institution licences under Law No. 6493.

Does a payment institution need to be incorporated in Turkey?

A payment institution seeking authorisation under Article 14 must be incorporated as a joint-stock company meeting the statutory requirements.

What is the minimum capital for a payment institution in Turkey?

The statutory paid-in capital requirement under Law No. 6493 is TRY 1 million for the specified bill-payment intermediary category and TRY 2 million for other ordinary payment institutions. However, these figures should not be confused with ongoing minimum own-funds requirements, which from 30 June 2026 are TRY 20 million and TRY 40 million respectively for the relevant categories.

How much is the CBRT payment institution licence application fee?

The current Payment Services Regulation specifies an application fee of TRY 500,000, plus applicable statutory charges. The application fee is non-refundable.

How long does the licensing process take?

Law No. 6493 provides for the CBRT to conclude an application within six months after all required information and documents have been completed. The total project duration may nevertheless be longer because of preliminary preparation, intelligence review, operational readiness and final approval.

Can a payment institution offer loans?

Payment institutions may not conduct lending activities.

Can a European payment institution operate in Turkey with its EU licence?

A foreign licence does not automatically create authorisation to provide regulated payment services in Türkiye. Local licensing or an appropriately structured and authorised cooperation model may be necessary.

Can a payment institution provide open banking services?

Yes, subject to obtaining the relevant authorisation. Payment initiation and account information services are expressly recognised under Article 12 of Law No. 6493.

Can a payment institution use cloud services?

Potentially, but outsourcing and information-systems requirements must be reviewed under the CBRT regulatory framework. Some community-cloud arrangements are specifically subject to CBRT suitability and approval mechanisms.

Is obtaining the licence enough to operate indefinitely?

No. Licensed institutions remain subject to continuing CBRT supervision, capital and own-funds rules, AML obligations, information-systems requirements, reporting duties and other regulatory obligations. The significant enforcement action taken during 2025 demonstrates that licences may be suspended or cancelled for regulatory deficiencies.

Conclusion: Obtaining a Payment Institution Licence in Turkey

Obtaining a payment institution licence in Turkey is a comprehensive financial regulatory process rather than an ordinary company registration procedure.

The process begins with one fundamental question:

Does the proposed business model constitute a payment service under Article 12 of Law No. 6493?

Once the answer is yes, the founders must determine precisely which payment services will be provided and structure the company accordingly.

A Turkish payment institution must generally be incorporated as a joint-stock company, satisfy shareholder and control requirements, maintain a transparent ownership structure and establish adequate capital, personnel, technical infrastructure, internal controls, risk management and customer-protection systems.

The financial planning of the company must also distinguish between initial paid-in capital and minimum own funds. This distinction is particularly significant following the 2026 CBRT update increasing minimum own-funds requirements to TRY 20 million and TRY 40 million for the relevant payment-institution categories from 30 June 2026.

The CBRT authorisation procedure consists of multiple stages.

After the preliminary application process and corporate registration, the institution proceeds through an intelligence review. Once this stage has been approved, the applicant generally has 120 days to submit its final-approval application, subject to a possible limited extension. The final stage examines whether the company has genuinely established the personnel, internal systems, technological infrastructure, office, financial resources and compliance organisation necessary to operate safely.

The licence itself is specific to the payment services authorised by the CBRT.

A company authorised for one payment activity should not assume that it may automatically introduce another regulated product. New services may require an expansion of the existing licence.

Payment institution regulation also extends far beyond Law No. 6493.

A compliant Turkish payment company must coordinate payment-services regulation with:

• MASAK anti-money laundering and KYC requirements;
• Turkish personal data protection law;
• cybersecurity and information-systems rules;
• outsourcing restrictions;
• customer-fund safeguarding;
• consumer and contractual requirements;
• ongoing regulatory reporting.

The CBRT’s enforcement record also makes clear that licensing is not merely a formality. In 2025 alone, operating licences were cancelled or temporarily suspended for numerous institutions, while substantial administrative fines were imposed across the sector.

For foreign fintech investors, another key principle is that a foreign payment licence should not be assumed to provide automatic access to the Turkish market.

Market entry may instead require establishment of a licensed Turkish institution, acquisition of an existing regulated entity or cooperation with an authorised Turkish payment service provider, depending on the exact business model.

Therefore, companies planning to obtain a payment institution licence in Turkey, establish a payment company in Turkey, launch a payment gateway, provide money remittance services, offer merchant acquiring, develop open banking services or enter the Turkish fintech market should conduct regulatory classification before committing substantial resources to the product.

The most efficient licensing strategy is usually one in which corporate structure, financial planning, legal compliance and technological architecture are designed together from the beginning.

A fintech business that develops its software first and investigates Turkish payment regulation only after launch may face expensive restructuring, delayed market entry or even enforcement risk.

By contrast, early regulatory planning can significantly improve the likelihood of a structured and commercially viable licensing process.

Legal Disclaimer: This article provides general information regarding payment institution licensing and Turkish payment services regulation as of July 2026. It does not constitute legal advice. Capital requirements, regulatory fees, own-funds thresholds, application requirements and supervisory practices may change. Every payment-service business model should therefore be reviewed individually under the legislation in force at the date of the proposed application.