Introduction: Banking as a Service in Turkey

Banking as a Service, commonly abbreviated as BaaS, has become one of the most important business models at the intersection of banking and financial technology.

Under a conventional banking model, customers generally access banking products through distribution channels controlled directly by a licensed bank.

Banking as a Service changes this structure.

A technology company, fintech platform, marketplace, e-commerce company or other digital business may provide the customer-facing interface, while the actual regulated banking services are supplied by a licensed bank in the background.

Türkiye is particularly significant in this area because it has adopted an express regulatory framework for BaaS rather than leaving the model to general outsourcing or banking principles.

The principal legislation is the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model, published in the Official Gazette on 29 December 2021.

As of July 2026, the Regulation continues to appear within the Banking Regulation and Supervision Agency’s current Banking Law regulatory framework.

The Regulation describes Banking as a Service as a model under which customers access the systems of a licensed service bank through open banking services by using an interface offered by an interface provider.

This framework creates significant opportunities for companies wishing to introduce financial products without establishing an independent bank.

However, Banking as a Service should not be misunderstood as a system for “renting” a bank licence.

The Turkish framework keeps the licensed bank at the centre of the regulated relationship.

The bank determines whether banking services will be provided, customer identification remains subject to banking regulation, the legal customer relationship must be established with the bank, banking transactions remain on the bank’s balance sheet, and the interface provider is subject to significant regulatory, outsourcing, information-security and contractual requirements.

For this reason, businesses planning to launch embedded finance, embedded banking, fintech banking APIs, branded financial services or neobank-style platforms in Türkiye should analyse the BaaS regime before designing their commercial and technology structure.

This guide explains the main legal requirements.

1. What Is Banking as a Service?

Banking as a Service is a business model in which a licensed financial institution makes regulated banking functionality available through the interface of another business.

A simplified example illustrates the structure.

Assume that an e-commerce platform has two million customers.

The platform wants to offer users:

• banking accounts;
• debit cards;
• consumer financing;
• payment functionality;
• money transfers.

Obtaining a full banking licence would require substantial capital, management infrastructure, risk management, regulatory approval and ongoing supervision.

Instead, the platform may cooperate with a licensed Turkish bank.

The customer continues using the e-commerce company’s mobile application, but the underlying bank account, credit product or other banking service is legally provided by the licensed bank.

Under Turkish legislation, the bank is referred to as the service bank.

The non-bank business operating the digital interface is referred to as the interface provider.

This structure allows financial services to become embedded inside a non-financial digital ecosystem.

2. Legal Definition of Banking as a Service in Turkey

The Turkish BaaS Regulation contains a specific legal definition.

Under the Regulation, Banking as a Service is the model in which customers can perform banking transactions by connecting directly with the systems of service banks through open banking services using the interface provided by an interface provider.

The definition therefore contains several key elements:

A licensed bank must exist.

The banking service must ultimately be provided by the service bank.

An interface provider must exist.

The customer accesses the service through a mobile application or browser-based interface operated by another business.

Open banking infrastructure is involved.

The connection to the bank is established through the bank’s open banking services.

The customer performs banking transactions through the interface.

The interface provider is more than an advertising or referral channel.

This distinction separates a true BaaS structure from an ordinary marketing partnership.

3. Who Regulates Banking as a Service in Turkey?

Banking as a Service falls within the regulatory jurisdiction of the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”).

The principal legal framework includes:

• Banking Law No. 5411;
• Regulation on the Operating Principles of Digital Banks and Banking as a Service Model;
• Regulation on Information Systems and Electronic Banking Services of Banks;
• rules governing outsourcing and support services;
• Regulation on Remote Identification Methods to be Used by Banks;
• Regulation on the Sharing of Confidential Information;
• other banking, AML and personal data legislation.

The BRSA’s current regulatory database lists the Digital Banks and BaaS Regulation, the Information Systems Regulation, confidentiality regulation, outsourcing regulation and remote identification regulation among the current rules applicable under Turkish Banking Law.

Accordingly, a BaaS project must be designed as a regulated banking collaboration rather than an ordinary software contract.

4. Who Is the Service Bank?

The service bank is the licensed bank providing banking services through the BaaS model.

The Regulation permits a service bank to provide only those banking services that already fall within its own operating permission.

A bank therefore cannot use BaaS as a mechanism for entering a regulated activity it is not otherwise authorised to conduct.

This principle is fundamental.

If a bank does not have authority to offer a particular service directly, it cannot obtain that authority simply by providing the service through a fintech interface.

The underlying regulatory licence of the bank therefore determines the permissible scope of the BaaS product.

5. Who Is an Interface Provider?

The Regulation defines an interface provider as a business established as a capital company that enables customers to carry out banking transactions through a mobile application or browser-based interface by accessing banking services supplied by the service bank through open banking services.

This category can potentially include businesses such as:

• fintech companies;
• marketplaces;
• e-commerce companies;
• telecommunications companies;
• accounting platforms;
• retail applications;
• mobility platforms;
• enterprise software providers;
• loyalty ecosystems;
• super-apps.

The interface provider may control the customer experience and branding, but it should not be confused with the underlying bank.

6. Must an Interface Provider Be Established in Turkey?

Yes.

One of the most important restrictions for foreign fintech companies is contained directly in Article 13 of the Regulation.

A service bank may provide BaaS only to interface providers resident in Türkiye.

This requirement has major implications for international technology groups.

A UK, EU, US or Gulf-based fintech company should not assume that its foreign corporate entity can directly act as a Turkish BaaS interface provider.

In many cases, establishing an appropriate Turkish capital company will be necessary.

The Turkish entity then becomes subject to the regulatory conditions applicable to the interface provider.

7. Can a Bank Be an Interface Provider?

No.

The Regulation expressly provides that banks cannot act as interface providers within the BaaS model.

The logic is that the interface-provider category is intended primarily for non-bank companies providing the customer-facing environment.

A bank may instead participate as the service bank providing the underlying regulated financial product.

8. Does an Interface Provider Need a Banking Licence?

Not necessarily.

One of the principal commercial advantages of BaaS is that the interface provider does not automatically need to establish itself as an independently licensed bank.

However, this does not mean the interface provider operates in an unregulated environment.

The company may require specific BRSA permission in connection with its role as an outsourcing or support-service provider.

Furthermore, if the interface provider independently performs another regulated financial activity, such as payment initiation or account information services under Law No. 6493, separate authorisation may be required.

The BaaS Regulation expressly states that BRSA permission for an interface provider does not eliminate authorisation requirements arising under other legislation, including licences potentially required for payment initiation and account information services under Article 12 of Law No. 6493.

Therefore:

BaaS permission does not function as a universal fintech licence.

Each activity must be classified separately.

9. The Interface Provider Cannot Pretend to Be a Bank

Branding is a regulatory issue in Turkish BaaS structures.

The Regulation prohibits an interface provider that does not hold the relevant licences from using names, descriptions, documents, announcements or advertisements that create the impression that it is:

• a bank;
• a payment institution;
• an electronic money institution;
• another regulated payment service provider.

The interface provider may also not create the impression that it independently accepts deposits, participation funds or other regulated customer funds.

This means marketing language must be reviewed carefully.

Statements such as:

“Open your bank account with us,”

“Deposit your money with our platform,”

or

“We provide banking services”

may create regulatory risk if they fail to make the role of the licensed service bank clear.

The customer should understand which entity is legally providing the banking service.

10. Who Makes the Banking Decision?

The service bank remains responsible for the banking decision.

This is particularly important for lending.

The Regulation expressly provides that the service bank determines whether banking services will be provided to the customer through the interface provider.

This includes credit allocation decisions.

An interface provider may collect information, provide technological tools or facilitate the application process, but it should not effectively replace the regulated bank’s decision-making authority where the banking legislation reserves that decision to the bank.

For example, a fintech company cannot simply approve loans using its own independent underwriting policy while treating the partner bank as a passive funding vehicle.

The legal and operational decision-making process must preserve the service bank’s regulatory responsibility.

11. On Whose Balance Sheet Are the Banking Transactions?

The relevant banking services are carried out on the balance sheet of the service bank.

This is one of the most important structural principles of Turkish BaaS.

A BaaS interface provider does not become the legal holder of deposits or loans simply because those products appear within its mobile application.

For example:

• a deposit is the service bank’s liability;
• a loan is recorded within the service bank’s banking structure;
• regulated banking risk remains associated with the licensed bank.

This principle distinguishes BaaS from an independent fintech balance-sheet model.

12. The Customer Must Have a Contract With the Service Bank

A customer cannot receive banking services solely under a contract with the interface provider.

The Regulation requires a contractual relationship between the customer and the service bank in accordance with Article 76 of Banking Law No. 5411.

This requirement is fundamental.

There may also be a contract between the customer and the interface provider covering the technology platform or associated services.

However, the regulated banking relationship must still exist between the customer and the bank.

A legally compliant BaaS structure therefore often involves at least two contractual layers:

Customer – Service Bank Agreement

and

Customer – Interface Provider Agreement.

A third contractual relationship also exists between:

Service Bank – Interface Provider.

These agreements must be consistent with each other.

13. Remote Customer Onboarding in BaaS

In many BaaS models, the customer relationship is established entirely online.

Where the contract between the customer and service bank is established electronically, the process must comply with the Turkish rules governing remote identification and electronic contract formation.

The service bank remains responsible for identifying the customer under the applicable banking remote identification framework.

Türkiye’s remote onboarding framework is separately regulated, and the BRSA continues to list the Remote Identification Regulation within the current banking rules.

This means the BaaS customer journey must be designed around regulatory requirements from the beginning.

It is not sufficient to build an ordinary signup process and add KYC at the end.

14. Who Is Responsible for the Electronic Contract?

Where onboarding starts and is completed through the interface provider’s mobile application or browser-based interface, the interface must satisfy applicable electronic banking security requirements.

The Regulation also makes the service bank responsible for ensuring that the contractual information displayed to the customer accurately reflects the contract and that the customer approves the relevant information.

This requires coordination between the bank’s legal documentation and the fintech’s user interface.

Product design therefore becomes part of legal compliance.

For example, the order of screens, confirmation buttons, customer authentication and contract presentation may all be legally significant.

15. Joint Cybersecurity Responsibility

Cybersecurity is one of the most important features of the Turkish BaaS framework.

The service bank and interface provider are jointly responsible for ensuring that the mobile or browser-based interface used by customers complies with authentication and transaction security requirements applicable to electronic banking.

The service bank may not provide BaaS through an interface provider whose systems fail to satisfy those requirements.

It also cannot receive relevant outsourcing services from an interface provider whose systems are inadequate.

This rule means that a bank cannot outsource technological risk and then claim that cybersecurity failures are solely the fintech company’s problem.

The bank must conduct meaningful technical due diligence before entering the partnership.

16. Information Systems Requirements

Turkish banks are subject to extensive information systems regulation.

The BRSA’s current legislative framework includes the Regulation on Information Systems and Electronic Banking Services of Banks, which addresses matters such as information-security governance, electronic banking, authentication, continuity and outsourcing.

BaaS interface providers become relevant to this framework because customers use their applications to access regulated banking services.

A compliant technology environment may therefore need to address:

• secure API architecture;
• authentication;
• authorisation;
• encryption;
• transaction security;
• access management;
• audit logs;
• cybersecurity monitoring;
• fraud controls;
• incident response;
• disaster recovery;
• penetration testing;
• business continuity.

A commercially attractive interface is not sufficient if it cannot meet banking-grade information-security standards.

17. Interface Providers as Outsourcing Institutions

The interface provider has a dual regulatory position.

It receives banking services from the service bank, but it may simultaneously provide services to the bank.

The Regulation therefore treats the interface provider as an outsourcing/support-service institution in relation to activities such as:

• facilitating establishment of the customer relationship;
• enabling the bank to provide banking services through the interface.

This is legally significant.

The relationship is therefore not merely:

Bank sells API access to fintech.

It is also:

Fintech provides regulated customer-interface and operational services to the bank.

The service agreement should reflect both directions of the relationship.

18. BRSA Permission for the Interface Provider

Providing services to a service bank as an interface provider within the relevant outsourcing framework is subject to BRSA Board permission.

The Regulation states that authorisation is granted following the necessary regulatory assessment, including examination of information systems.

Therefore, a fintech company should not assume that signing a commercial agreement with a willing bank is enough to launch BaaS.

Regulatory permission may also be required before the arrangement becomes operational.

This is one of the most important differences between Turkish BaaS and informal banking API partnerships in less regulated jurisdictions.

19. Can an Interface Provider Accept Deposits?

As a general principle, an interface provider should not independently accept deposits or participation funds on behalf of the service bank.

The Regulation specifically addresses the outsourcing framework on the assumption that the interface provider does not accept such funds, subject to the separate regulatory position that may arise where the interface provider is itself an authorised payment service provider.

This distinction matters greatly for transaction design.

A fintech should analyse exactly where customer money moves.

If the interface provider receives the money into its own account before transferring it to the bank, the structure may create payment-services or other regulatory issues.

The safest BaaS architecture is not determined only by user experience.

The underlying fund flow must also comply with financial regulation.

20. Can an Interface Provider Collect Credit Card Applications?

The Regulation expressly permits the service bank to receive outsourcing services from the interface provider for the collection of credit card applications through the interface provider’s service channels.

This provides a useful example of the type of embedded banking service that may be structured through BaaS.

The interface can potentially be used to:

• collect customer information;
• initiate applications;
• present banking products;
• facilitate onboarding;
• deliver the bank’s services digitally.

However, the underlying regulatory decision remains with the bank.

21. Mandatory Content of the BaaS Agreement

The contract between the service bank and interface provider is one of the most important documents in a Turkish BaaS project.

The Regulation requires the agreement to address several specific matters.

Among other things, the structure must ensure that the customer is clearly informed that the interface provider is not itself a licensed bank or another regulated financial institution unless it separately holds the relevant authorisation.

The customer-facing documentation should also identify:

• the service bank;
• banking services supplied by the bank;
• responsibilities of the service bank;
• terms governing the customer-bank relationship;
• customer-service channels of the bank;
• bank call-centre information.

The Regulation also requires contractual transparency concerning the standard customer agreements used by the parties.

22. The Service Bank’s Name and Logo Must Be Visible

Transparency concerning the identity of the regulated bank is mandatory.

The service bank’s name and logo must be displayed on the homepage of the interface provider’s website.

Where the bank issues a card payment instrument for the interface provider, the name and logo of the bank must also be visible on the card.

This requirement prevents white-label banking from becoming completely invisible banking.

The interface provider may retain its own commercial identity, but the customer must still be able to identify the institution legally responsible for the regulated banking service.

23. Confidential Banking Data

BaaS involves substantial data sharing.

The service bank may need to provide customer financial information to the interface provider to make embedded banking functionality possible.

However, Turkish banking law contains strict customer confidentiality rules.

The BaaS Regulation integrates these obligations into the service model and limits the circumstances in which confidential data may be processed by the interface provider.

Processing must generally be connected to grounds such as:

• performance of the interface provider’s contract with the customer;
• fulfilment of legal obligations;
• establishment, exercise or protection of rights.

The data may only be processed to the extent and for the period necessary for the relevant lawful purpose.

This significantly restricts unrestricted monetisation of banking data.

24. Can Customer Banking Data Be Used for Advertising?

Not automatically.

One of the most commercially important questions in embedded finance concerns whether an interface provider can use banking information for customer analytics, targeted advertising or unrelated commercial profiling.

The Turkish BaaS framework limits processing of confidential information transferred by the service bank.

The legal basis and purpose of processing must therefore be analysed carefully.

A customer’s use of a BaaS application does not automatically permit the platform to use transaction data for every commercial purpose.

Depending on the proposed processing, Banking Law confidentiality rules, the BaaS Regulation and Law No. 6698 on the Protection of Personal Data (“KVKK”) may all become relevant.

25. Data Localization Requirements

The Turkish BaaS Regulation contains particularly important requirements concerning the location of systems and data.

Where confidential information is processed by the interface provider or its relevant service providers, the Regulation requires systems and data backups to be maintained in Türkiye.

This is one of the most important compliance points for international fintech groups.

A global technology company cannot necessarily use its ordinary worldwide infrastructure without modification.

The proposed architecture should identify:

• where the production environment is located;
• where backups are stored;
• which group companies can access data;
• which cloud providers are used;
• whether customer secrets leave Türkiye;
• whether disaster recovery infrastructure is domestic.

The technology architecture should therefore be legally reviewed before implementation.

26. Cloud Computing Under the BaaS Model

Cloud infrastructure is also expressly addressed.

Where the interface provider uses cloud computing in connection with relevant systems and backups, the BaaS Regulation links the structure to the permitted private-cloud and community-cloud models under Turkish banking information systems regulation.

This means the interface provider cannot simply choose a cloud configuration based only on price or technical convenience.

The bank and fintech must ensure that the cloud structure satisfies banking-sector regulatory conditions.

For international fintech companies, cloud architecture is therefore both:

an IT decision, and

a regulatory decision.

27. Data Transfers Abroad and KVKK

Separate from banking-sector localization and confidentiality rules, international fintech groups must also consider Turkish personal data legislation.

Article 9 of Law No. 6698 was materially amended in 2024.

The current system provides mechanisms such as standard contractual clauses and binding corporate rules for qualifying international transfers. The Turkish Data Protection Authority continues to publish the relevant standard contracts as of July 2026.

However, general KVKK transfer mechanisms do not automatically override stricter banking-sector localization or customer-secrecy requirements.

A BaaS business should therefore analyse both layers separately.

For example:

A transfer may theoretically satisfy KVKK Article 9 but still create difficulty under banking information systems or confidentiality rules.

28. Audit Rights of the Service Bank

The service bank must be capable of supervising the interface provider.

The BaaS agreement must ensure that the bank can conduct audits and review relevant information, documents and records concerning the interface provider’s regulated activities.

This requirement means the fintech should expect significant ongoing oversight from the partner bank.

The service bank cannot simply rely on annual certifications supplied by the fintech.

It needs contractual rights enabling regulatory-quality monitoring.

For interface providers, this can affect negotiations concerning:

• audit rights;
• access to systems;
• incident reporting;
• subcontractors;
• records;
• compliance documentation.

29. Mandatory Termination Rights

The service contract must also allow the service bank to terminate the arrangement immediately where specified regulatory problems arise.

For example, termination rights must address circumstances in which the interface provider’s information systems cease to comply with applicable requirements or the BRSA withdraws the permission allowing the interface provider to act as an outsourcing provider.

This has important commercial consequences.

A BaaS business dependent upon one bank should therefore consider the operational impact of regulatory termination.

Exit planning and continuity arrangements should be considered from the beginning.

30. Can BaaS Services Be Subcontracted?

The Regulation restricts transfer of the services covered by the BaaS relationship.

The services provided by the interface provider to the bank and services received from the bank cannot simply be transferred onward contrary to the regulatory framework.

This should be considered when the fintech relies heavily on third-party SaaS providers, white-label technology or outsourced development and operations.

Subcontracting architecture needs to be transparent.

A company cannot present itself as the regulated interface provider while another unknown provider effectively controls critical operations without proper regulatory consideration.

31. Can an Interface Provider Work With More Than One Bank?

Potentially, yes.

However, the Regulation provides that an interface provider’s ability to work with more than one service bank is subject to BRSA permission.

This provision is highly relevant for fintech business strategy.

A platform may initially integrate with one bank but later seek to offer:

• deposits from Bank A;
• loans from Bank B;
• cards from Bank C.

Such a multi-bank strategy should not be implemented merely through additional API contracts.

The regulatory permission requirements must also be analysed.

32. Notification Duties of the Service Bank

A service bank must publicly disclose the interface providers to which it supplies BaaS and the scope of relevant services.

The Regulation also requires the bank to submit copies of the service agreements and certain amendments to the BRSA within one week following signature.

This reinforces the regulated and transparent nature of the relationship.

BaaS agreements are not simply private commercial arrangements hidden from the regulator.

They form part of the bank’s supervised operational structure.

33. Does a Bank Need a New Banking Licence to Offer BaaS?

Generally, a service bank does not need to obtain an expansion of its banking activities merely because it begins distributing existing authorised services through a BaaS structure.

The Regulation treats BaaS as falling within the framework of banking activities permitted under Article 4 of Banking Law No. 5411, provided that the services themselves are within the bank’s existing operating permission.

This is important commercially.

The bank is using a new distribution architecture, not necessarily obtaining authority for a new financial product.

34. AML and KYC in Banking as a Service

BaaS does not reduce anti-money laundering obligations.

Banks remain subject to Law No. 5549 on Prevention of Laundering Proceeds of Crime and MASAK regulations.

MASAK confirms that regulated financial institutions must implement customer due diligence measures, including customer identification, technological risk measures and additional controls required under Turkish AML legislation.

Because the service bank remains responsible for identifying the customer, the BaaS onboarding architecture should allow the bank to fulfil its AML/KYC obligations effectively.

A compliant structure may involve:

• customer identity verification;
• beneficial ownership checks;
• politically exposed person screening;
• sanctions screening;
• customer risk scoring;
• transaction monitoring;
• suspicious transaction reporting;
• enhanced due diligence.

The interface provider’s technology must support rather than obstruct those processes.

35. BaaS and Embedded Finance

BaaS and embedded finance are closely connected but not legally identical concepts.

Embedded finance refers broadly to integrating financial services into a non-financial product.

Examples include:

• a marketplace offering seller financing;
• an accounting application offering business bank accounts;
• a retailer offering branded cards;
• a travel application offering payment products;
• a mobility platform offering financial services to drivers.

BaaS is one possible regulated infrastructure through which embedded banking can be implemented.

Therefore:

Every BaaS project is likely to involve embedded banking, but not every embedded finance project necessarily constitutes BaaS.

For example, a marketplace integrating a licensed payment institution may involve embedded payments rather than Banking as a Service.

The regulatory classification should depend upon the actual product.

36. BaaS vs Open Banking

These concepts should also be distinguished.

Open banking generally enables regulated access to banking data or initiation of transactions through secure interfaces.

Banking as a Service uses open banking services as part of the infrastructure through which banking products are made available through an interface provider.

Under the Turkish definition, BaaS expressly involves customers connecting to the service bank’s systems through open banking services.

Open banking is therefore part of the technical and regulatory foundation of Turkish BaaS.

37. BaaS vs Digital Banking

A digital bank holds its own banking licence.

An interface provider generally does not.

This produces fundamentally different regulatory positions.

A digital bank:

• has its own bank balance sheet;
• accepts permitted deposits or participation funds;
• grants its own loans;
• is directly supervised as a bank;
• must satisfy substantial capital requirements.

An interface provider:

• distributes banking services supplied by another bank;
• operates the customer-facing interface;
• does not independently become the regulated bank merely because the product is branded through its application.

For many fintech startups, BaaS therefore provides a more realistic route to embedded banking than applying for an independent banking licence.

38. Foreign Fintech Companies Entering the Turkish BaaS Market

International fintech companies should consider several issues before entering Türkiye.

The most important is the domestic-residency requirement for interface providers.

A service bank may provide BaaS only to interface providers resident in Türkiye.

Foreign groups should therefore consider:

1. establishing a Turkish capital company;
2. structuring ownership transparently;
3. identifying a licensed Turkish service bank;
4. designing the API architecture;
5. determining BRSA permission requirements;
6. implementing domestic data infrastructure;
7. preparing customer contracts;
8. implementing AML/KYC integration;
9. reviewing KVKK requirements;
10. analysing any additional payment-services licences.

A foreign fintech licence does not automatically replace these Turkish requirements.

39. BaaS Regulatory Due Diligence

Investors considering a Turkish BaaS fintech should conduct specialised regulatory due diligence.

Important areas include:

BRSA Permission

Has the interface provider received the necessary regulatory permission?

Service Bank Agreement

Does the agreement satisfy Article 13 requirements?

Scope of Services

Are all financial services within the service bank’s banking licence?

Payment Licences

Does the interface provider separately perform activities requiring authorisation under Law No. 6493?

Customer Contracts

Is the service bank properly identified as the banking provider?

Branding

Does the fintech avoid presenting itself as an independently licensed bank?

Cybersecurity

Does the interface satisfy banking authentication and transaction-security requirements?

Data Localization

Are systems and backups structured consistently with Turkish banking rules?

KVKK

Are international data transfers lawful?

AML/KYC

Can the bank properly identify and monitor customers?

Subcontractors

Are critical vendors and cloud providers compliant?

A problem in any of these areas may affect both regulatory viability and company valuation.

40. Banking as a Service Compliance Checklist for Turkey

Before launching a BaaS project in Türkiye, businesses should confirm at least the following:

Service Bank:
A properly licensed Turkish bank has been selected.

Interface Provider:
The fintech is established as an appropriate capital company resident in Türkiye.

BRSA Permission:
Required approval for the interface-provider outsourcing relationship has been obtained.

Banking Scope:
The bank’s existing licence covers every banking service offered.

Customer Contract:
The customer has a legally valid relationship with the service bank.

Remote Identification:
The onboarding system complies with banking KYC requirements.

Branding:
The interface provider does not misleadingly represent itself as the licensed bank.

Bank Disclosure:
The bank’s identity and logo are properly visible.

Decision Making:
Credit and other regulated banking decisions remain with the service bank.

Balance Sheet:
Banking transactions are correctly recorded by the service bank.

Cybersecurity:
The customer interface meets banking information-security standards.

Data Localization:
Systems and backups containing relevant banking secrets comply with domestic-location requirements.

Cloud Infrastructure:
Cloud arrangements satisfy applicable banking standards.

Customer Secrets:
Banking data is processed only for legally permitted purposes.

KVKK:
Personal data processing and international transfers comply with Law No. 6698.

AML/KYC:
The structure allows the bank to satisfy MASAK obligations.

Audit:
The bank has adequate rights to inspect the interface provider.

Termination:
The agreement includes mandatory regulatory termination rights.

Multi-Bank Arrangements:
Additional BRSA approval is obtained where the interface provider intends to work with multiple service banks.

Frequently Asked Questions About Banking as a Service in Turkey

Is Banking as a Service regulated in Turkey?

Yes.

Türkiye has an express BaaS framework under the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model. The Regulation remains listed within the BRSA’s current banking legislation as of July 2026.

Who regulates BaaS in Turkey?

The Banking Regulation and Supervision Agency regulates the model.

What is a service bank?

A service bank is the licensed bank that provides the underlying banking services through the BaaS structure.

What is an interface provider?

An interface provider is a capital company through whose mobile application or browser-based interface customers access banking services supplied by the service bank through open banking infrastructure.

Does an interface provider need to be established in Turkey?

Yes. The Regulation states that service banks may provide BaaS only to interface providers resident in Türkiye.

Does a fintech need a banking licence to become an interface provider?

Not necessarily. However, BRSA permission may be required for its role as an outsourcing provider, and additional licences may be required if it independently provides payment or other regulated financial services.

Can an interface provider call itself a bank?

Not unless it independently has the required banking authorisation. The Regulation prohibits misleading use of banking and regulated payment-service terminology.

Who approves loans in a BaaS structure?

The service bank. The Regulation expressly states that the service bank makes decisions concerning whether banking services are provided, including credit allocation.

Whose balance sheet contains BaaS loans and deposits?

The relevant banking services are carried out on the service bank’s balance sheet.

Does the customer need a contract with the bank?

Yes. A contractual relationship must exist between the customer and the service bank.

Who performs customer identification?

The service bank is responsible for customer identification under the applicable remote identification framework.

Can an interface provider work with multiple banks?

Potentially, but the Regulation makes this subject to BRSA permission.

Can customer banking data be hosted abroad?

The answer requires careful analysis. The BaaS Regulation contains domestic system and backup requirements concerning confidential information, while international transfers of personal data are separately governed by KVKK.

Conclusion: The Future of Banking as a Service in Turkey

Banking as a Service regulation in Turkey provides a clear legal foundation for one of the most important developments in modern fintech: the integration of regulated banking into non-bank digital platforms.

The Turkish model allows fintech companies, technology businesses, e-commerce platforms and other capital companies to create sophisticated embedded-banking experiences without necessarily obtaining their own banking licence.

However, this flexibility is balanced by strict regulatory safeguards.

The licensed service bank remains at the centre of the legal banking relationship.

It must decide whether regulated banking products will be provided, including credit allocation decisions.

The customer’s banking contract must be established with the service bank.

The relevant banking products are carried on the bank’s balance sheet.

The interface provider cannot misrepresent itself as the bank or as another regulated financial institution unless it independently possesses the necessary authorisation.

Türkiye also imposes important requirements upon the interface provider.

A service bank may provide BaaS only to an interface provider resident in Türkiye.

The interface provider’s role as an outsourcing institution is subject to regulatory supervision and BRSA permission.

Its customer-facing mobile or browser interface must satisfy banking authentication and transaction-security requirements, with the service bank and interface provider sharing responsibility for compliance.

Data governance is another central part of the Turkish framework.

Banking customer information cannot simply become unrestricted fintech marketing data.

Customer secrets must be processed within the permitted legal framework.

Systems and backups involving relevant confidential data are subject to domestic-location requirements, while cloud services must be designed consistently with banking information-systems rules.

International companies must additionally consider Turkey’s personal data transfer rules under Law No. 6698. The current KVKK framework permits mechanisms including standard contracts for qualifying international transfers, but these general mechanisms must be assessed together with stricter banking-sector requirements.

AML and customer identification obligations also remain fundamental.

The BaaS structure does not shift the bank’s regulatory obligations to the technology company. The service bank must be capable of complying with MASAK customer due diligence requirements and banking remote identification rules even where the entire user journey takes place inside the fintech company’s application.

For foreign fintech investors, the BaaS framework can provide a commercially attractive alternative to establishing a fully licensed digital bank.

Instead of committing the capital and infrastructure necessary for an independent banking licence, a foreign fintech group may establish a Turkish interface-provider entity and partner with an existing licensed bank.

Nevertheless, the structure must be developed as a regulated financial-services project.

A compliant Turkish BaaS project requires the coordinated design of:

• corporate structure;
• BRSA permissions;
• service bank agreements;
• customer contracts;
• open banking APIs;
• cybersecurity;
• remote onboarding;
• AML/KYC;
• banking secrecy;
• personal data protection;
• cloud architecture;
• domestic data infrastructure;
• outsourcing;
• regulatory reporting.

The most important practical principle is therefore straightforward:

Banking as a Service should not be treated as a shortcut around Turkish banking regulation.

It is instead a regulated mechanism that allows licensed banks and technology companies to cooperate while preserving the bank’s regulatory responsibility.

For companies planning to establish a BaaS platform, embedded banking product, neobank application, fintech banking interface, e-commerce financial ecosystem or Banking as a Service partnership in Turkey, legal and regulatory analysis should begin before the product is technically launched.

Proper structuring from the beginning can substantially reduce the risk of regulatory redesign, licensing problems, data-localization failures and disputes concerning responsibility between the fintech company and service bank.

As embedded finance continues to develop, Banking as a Service is likely to remain one of the most commercially significant areas of Turkish Fintech Law.

Legal Disclaimer: This publication provides general information concerning Banking as a Service regulation in Türkiye as of July 2026. It does not constitute legal advice. Banking regulations, BRSA requirements, information-systems rules and data protection obligations may change. Each BaaS, embedded banking or fintech platform should be assessed individually according to its exact services, fund flows, technology infrastructure and contractual arrangements.