Introduction: Foreign Investment in the Turkish Fintech Market

Türkiye has developed one of the most dynamic financial technology ecosystems in its region.

Payment institutions, electronic money companies, digital wallets, open banking businesses, digital banks, Banking as a Service providers and crypto asset companies have created substantial opportunities for both strategic and financial investors.

For international investors, however, investing in a Turkish fintech company requires more than ordinary corporate due diligence.

A foreign investor may generally be entitled to establish or acquire a Turkish company under Türkiye’s liberal foreign direct investment framework. Yet where the target is a regulated financial institution, ownership changes may require approval from the relevant financial regulator before closing.

This distinction is fundamental.

Türkiye’s Foreign Direct Investment Law No. 4875 is based on national treatment and generally replaces a broad foreign investment approval system with a notification-based framework. International investors generally have the same rights and liabilities as domestic investors when establishing companies and acquiring shares.

However, the FDI regime expressly operates subject to special sector laws.

A foreign investor acquiring a software startup may therefore complete a conventional Turkish corporate investment.

A foreign investor acquiring 60% of a licensed electronic money institution cannot necessarily do the same.

The transaction may involve regulatory approval by the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”).

Similarly:

• a digital-bank acquisition may require approval from the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”);
• investment in a crypto asset service provider may be subject to the Capital Markets Board of Türkiye (“CMB” or “SPK”) framework;
• a sufficiently large fintech acquisition may require Turkish Competition Board clearance;
• foreign-group data sharing may require compliance with KVKK Article 9;
• payment, electronic money and crypto businesses remain subject to MASAK AML/KYC requirements.

Foreign investment in Turkish fintech should therefore be understood through two complementary principles:

Türkiye is generally open to international investment, but regulated financial institutions remain subject to sector-specific ownership controls.

This guide explains the principal legal and regulatory considerations for foreign investment in Turkish fintech companies as of July 2026.

1. Is Foreign Investment Allowed in Turkish Fintech Companies?

As a general rule, yes.

Foreign investors can establish Turkish companies, subscribe for newly issued shares or acquire existing shares subject to the legislation applicable to the relevant business.

Türkiye’s official investment framework states that the Foreign Direct Investment Law is based on equal treatment and permits international investors to have the same rights and obligations as local investors.

International investors may also establish the forms of company recognised by the Turkish Commercial Code.

There is therefore no general rule requiring a fintech company to remain majority Turkish-owned merely because it operates in the technology sector.

The real question is whether the fintech conducts a regulated financial activity.

Where it does, ownership must also comply with the rules of the relevant financial authority.

2. The Foreign Direct Investment Law No. 4875

Law No. 4875 provides the fundamental framework for international investment in Türkiye.

According to Türkiye’s official investment authority, the FDI framework is designed to:

• encourage foreign direct investment;
• protect investor rights;
• apply national treatment;
• replace a general approval-based system with a notification-based system;
• facilitate international capital investment.

The framework also recognises principles concerning freedom of investment, freedom of transfer, investment protection and dispute settlement.

This is commercially important because foreign investment itself is generally not subject to a separate economy-wide approval simply because the shareholder is foreign.

Instead, approval requirements normally arise because of what the target company does, not merely because of the purchaser’s nationality.

3. National Treatment Does Not Eliminate Financial Sector Regulation

The principle of equal treatment should not be misunderstood.

It does not mean that foreign investors can ignore financial-sector authorisation rules.

Rather, it generally means that foreign investors are allowed to participate in the Turkish market under the same underlying regulatory framework.

For example:

A Turkish investor acquiring control of an electronic money institution may require CBRT approval.

A German, British, American or UAE investor acquiring the same stake may also require CBRT approval.

The requirement exists because the target is a regulated electronic money institution.

This is a sectoral regulatory approval, not a general prohibition on foreign ownership.

4. Ways to Invest in a Turkish Fintech Company

Foreign investment can be structured in several ways.

Share Acquisition

The investor purchases existing shares from founders or existing shareholders.

This can be used for:

• majority acquisitions;
• minority strategic investments;
• founder exits;
• private equity transactions.

Capital Increase

The investor subscribes for newly issued shares and investment capital enters the company directly.

This is common in:

• venture capital rounds;
• growth investments;
• strategic financing.

Joint Venture

A foreign investor may establish a joint venture with Turkish partners.

Türkiye’s official investment guidance notes that joint-stock companies are commonly preferred for joint venture structures because of their share-class flexibility and limited liability characteristics.

Full Acquisition

The investor acquires control or 100% ownership of the target, subject to regulatory approval where the company is licensed.

Establishing a New Regulated Company

Instead of acquiring an existing fintech, the investor may establish a new Turkish regulated entity and apply for the relevant licence.

The appropriate structure depends significantly on whether the target’s existing licence, customer base and technology justify paying an acquisition premium.

5. Why an A.Ş. Is Particularly Important in Fintech

The Turkish joint-stock company, or Anonim Şirket (A.Ş.), is particularly significant in regulated fintech.

Although ordinary foreign investors may generally establish various company types recognised by the Turkish Commercial Code, several financial-sector licences require a joint-stock company structure.

This includes important categories of:

• payment institutions;
• electronic money institutions;
• regulated crypto asset service providers.

A foreign investor considering a startup that currently operates as an ordinary limited liability company should therefore first determine whether the proposed business model requires conversion or establishment of a separate regulated A.Ş.

Corporate structure should follow regulatory classification—not the other way around.

6. Foreign Investment in Payment Institutions

Payment institutions are regulated under Law No. 6493 and supervised by the CBRT.

The CBRT maintains an official list of payment institutions and identifies the specific payment services each institution is authorised to provide.

A foreign investor considering a payment institution should therefore verify:

• whether the operating licence remains valid;
• exactly which Article 12 payment services are authorised;
• whether expansion applications are pending;
• whether the licence has ever been suspended or restricted;
• whether regulatory capital requirements are satisfied.

A company marketing itself as a “payment company” may not necessarily be authorised to provide every payment service.

Licence scope directly affects valuation.

7. CBRT Approval for Payment Institution Share Transfers

An acquisition of a payment institution can require CBRT approval.

Under Article 12 of the current Payment Services Regulation, approval is required for transactions involving direct or indirect acquisition of at least 10% of the institution and for transactions causing holdings to cross the regulatory thresholds of:

10%, 20%, 33% and 50%.

Transfers causing a holding to fall below these thresholds are similarly regulated.

Approval is also required for the creation or transfer of shares carrying privileges to appoint members of the board of directors or audit committee, irrespective of the percentage involved.

A change of control in a corporate shareholder owning 10% or more of the regulated institution can also fall within the approval framework.

This is extremely important for international investors.

A transaction involving the parent company of a Turkish payment institution can trigger Turkish regulatory consequences even though no Turkish shares are directly transferred.

8. Indirect Foreign Acquisitions Must Be Analysed

Consider the following structure:

Foreign Investor A → acquires Foreign Holding B → which owns 70% of Turkish Payment Institution C.

The transaction documents may be signed in London, New York or Dubai.

Nevertheless, the transaction produces an indirect change in control of a Turkish regulated institution.

Turkish payment regulations expressly recognise both direct and indirect ownership and also regulate changes of control in corporate shareholders owning significant interests in the regulated institution.

International M&A teams should therefore include Turkish regulatory analysis even where the Turkish fintech subsidiary is only one component of a much larger global transaction.

9. Foreign Financial Institutions Face Additional Documentation

The CBRT examines the suitability of persons acquiring regulated stakes.

The current Payment Services Regulation also contains additional documentary requirements where the proposed acquirer is a bank or financial institution established abroad.

The application can require documentation concerning matters such as:

• the foreign institution;
• its regulatory status;
• audited financial information;
• corporate organisation;
• supervisory authority;
• international operations.

This means that a foreign bank or financial group investing in a Turkish payment company should begin preparation early.

Regulatory closing can require substantially more documentation than an ordinary venture-capital investment.

10. Foreign Investment in Electronic Money Institutions

Electronic money institutions are also regulated by the CBRT under Law No. 6493.

The CBRT maintains a separate official register showing authorised electronic money institutions and the additional payment services each institution may provide.

The regulatory share transfer framework applicable to payment institutions also applies to electronic money institutions.

Accordingly, a foreign investor acquiring a qualifying stake should assess CBRT approval before closing.

This becomes particularly important in acquisitions involving:

• digital wallets;
• prepaid products;
• merchant payment businesses;
• peer-to-peer payment platforms.

The commercial label used by the company does not determine the licence.

The regulatory authorisation does.

11. Current Capital Requirements Matter to Foreign Investors

A foreign investor should never analyse a licensed fintech only through conventional financial statements.

Regulatory capital requirements create an additional layer.

For payment and electronic money institutions, the CBRT updated minimum own-funds requirements effective 30 June 2026.

The minimum amounts are now:

TRY 20 million for payment institutions exclusively providing the specified bill-payment-intermediation service;

TRY 40 million for other payment institutions, excluding the separate pure account-information category specified in the Regulation;

TRY 105 million for electronic money institutions.

These amounts are own-funds requirements, not necessarily the same concept as the company’s statutory establishment or paid-in capital.

A target may appear solvent under ordinary corporate accounting while still facing a regulatory capital deficiency.

12. Capital Should Be Tested on a Post-Closing Basis

Foreign investors should calculate regulatory capital not merely as of the latest audited balance sheet but also on a pro forma post-closing basis.

Consider whether closing will involve:

• dividend distributions;
• shareholder loan repayment;
• transaction bonuses;
• restructuring expenses;
• repayment of related-party balances;
• integration costs.

A target that satisfies regulatory requirements before signing may fall below required levels immediately after closing.

The SPA should therefore contain appropriate restrictions on:

• pre-closing dividends;
• capital reductions;
• unusual related-party payments.

13. CBRT Enforcement Risk Must Be Included in Valuation

A valid licence should not automatically be treated as evidence of perfect regulatory compliance.

The CBRT reported that its supervision of payment and electronic money institutions during 2025 resulted in:

• 7 operating licence revocations;
• 14 temporary suspensions;
• additional supervisory and enforcement measures.

A foreign buyer should therefore request more than the licence certificate.

Due diligence should include:

• inspection findings;
• warning letters;
• regulatory correspondence;
• remediation plans;
• administrative penalties;
• licence restriction or suspension history.

A regulatory problem discovered after acquisition may materially reduce the value of the business.

14. Foreign Investment in Digital Banks

A digital bank is legally a bank, not simply a fintech application.

The BRSA’s current banking legislation continues to include the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model.

Accordingly, investment in a Turkish digital bank must be analysed under:

• Banking Law No. 5411;
• BRSA shareholding regulations;
• digital banking regulations;
• related banking legislation.

The investor should not treat the transaction as the purchase of an ordinary technology startup.

15. BRSA Approval Thresholds for Bank Share Acquisitions

Banking Law Article 18 contains a strict ownership-control regime.

BRSA approval is required where a person directly or indirectly acquires shares representing at least 10% of a bank.

Approval is also required where ownership crosses the:

• 10%;
• 20%;
• 33%;
• 50%

thresholds.

Transfers falling below these levels are similarly regulated.

Shares granting privileges to appoint members of the board or audit committee are also subject to regulatory approval irrespective of percentage.

Accordingly, foreign investment in a Turkish digital bank can involve substantial regulatory scrutiny of:

• the investor;
• its ultimate owners;
• financial strength;
• regulatory history;
• source of funds.

16. Minority Investment Does Not Always Mean “No Regulatory Approval”

A frequent mistake is assuming that only majority acquisitions require permission.

This is incorrect in several regulated financial sectors.

A minority investment can still require approval.

For example:

12% of a payment institution can trigger CBRT approval.

15% of a bank can trigger BRSA approval.

A minority shareholding carrying board appointment privileges can also become regulated even where the economic percentage appears relatively small.

Foreign venture capital and private equity investors should therefore conduct the regulatory analysis before signing the term sheet.

17. Foreign Investment in Crypto Asset Service Providers

Türkiye’s crypto regulatory framework changed fundamentally through Law No. 7518, effective in July 2024.

The CMB subsequently introduced two comprehensive Communiqués on 13 March 2025.

Communiqué III-35/B.1 regulates matters including:

• establishment;
• operating permission;
• founders;
• shareholders;
• share transfers;
• management;
• internal systems;
• information systems;
• audits.

Communiqué III-35/B.2 regulates services, custody, token listing and capital adequacy.

Accordingly, foreign investment in a Turkish crypto exchange is now an investment in a regulated capital-markets institution.

18. CMB Shareholder Suitability for Crypto Investments

Foreign investors should expect the CMB to examine the ownership structure of the CASP.

The CMB’s current application framework expressly contains separate documentation concerning proposed:

• individual shareholders; and
• corporate shareholders.

The regulatory review may involve issues including:

• financial strength;
• criminal history;
• transparency;
• direct and indirect ownership;
• ultimate beneficial ownership;
• source of funds;
• corporate control.

Opaque nominee structures can therefore create significant difficulties.

For foreign investors, a transparent and well-documented ownership chain is commercially preferable.

19. Current Crypto Capital Requirements

Crypto regulation creates substantial capital barriers.

For 2026, the CMB increased the minimum establishment capital for a crypto trading platform to:

TRY 250 million

For a crypto custody institution, the minimum establishment capital is:

TRY 630 million

These requirements should influence foreign investment strategy.

A buyer should determine whether the target:

• currently satisfies capital requirements;
• will continue to satisfy them after closing;
• requires additional funding;
• has customer asset levels capable of creating additional equity obligations.

A nominal purchase price may therefore represent only part of the total cash commitment needed for a regulated crypto investment.

20. Transitional Crypto Status Requires Particular Caution

A foreign investor acquiring an existing Turkish crypto company should verify the target’s exact CMB status.

This is essential because the CMB continues to maintain a temporary Operating Entities List.

The CMB expressly warns that appearance on this list does not mean that the relevant company has been authorised under the applicable legislation.

Accordingly:

“The company is listed on the SPK website”

does not necessarily mean:

“The company holds final operating permission.”

Due diligence should verify:

• establishment permission;
• operating permission;
• transitional status;
• custody arrangements;
• regulatory applications;
• CMB correspondence.

21. Foreign Investors Should Review the Licence, Not the Marketing Deck

This principle applies across fintech sectors.

A target’s investor presentation might describe the business as:

• licensed fintech;
• regulated wallet;
• open banking leader;
• digital asset institution.

The legal due diligence should independently verify the actual regulatory position.

For payment and e-money institutions, the CBRT publishes current authorised lists and licence scopes.

For crypto companies, the CMB operates separate establishment and operating-permission procedures.

The regulator’s records should always prevail over promotional descriptions.

22. Investing in an Unregulated Fintech Technology Company

Not every fintech is a regulated financial institution.

A business may only provide:

• software development;
• banking technology;
• fraud detection;
• accounting tools;
• analytics;
• infrastructure.

Such a company may fall outside direct financial licensing requirements.

However, due diligence should verify that the company does not in reality provide regulated financial services without authorisation.

A technology company may cross the regulatory line where it:

• executes payments;
• holds customer funds;
• issues electronic money;
• provides regulated open banking services;
• provides regulated crypto services.

Foreign investors should therefore perform business-model classification before concluding that no financial regulatory approval is relevant.

23. Banking as a Service Investments

BaaS creates a different investment structure.

A foreign investor may invest in an interface provider rather than a bank.

Under the Turkish BaaS model, the regulated banking services are supplied by the service bank, while customers access them through the interface provider’s application.

A foreign investor should review:

• whether the interface provider is properly structured;
• agreements with service banks;
• BRSA permissions relevant to the relationship;
• outsourcing requirements;
• data localisation;
• cybersecurity;
• other financial licences potentially required by the interface provider.

A BaaS structure does not automatically eliminate licensing requirements under other legislation.

For example, payment initiation or account information activity may separately require analysis under Law No. 6493.

24. Foreign Investment in Open Banking Companies

Open banking providers may require CBRT authorisation where they provide:

• Payment Initiation Services;
• Account Information Services.

Foreign investment in a licensed open banking provider should therefore be analysed within the payment-institution share-transfer framework.

The buyer should also investigate the target’s:

• GEÇİT integration;
• API infrastructure;
• strong customer authentication;
• data security;
• KVKK compliance.

Open banking businesses can appear asset-light from a traditional accounting perspective while carrying substantial technology and regulatory risk.

25. E-TUYS Notifications for Foreign-Owned Companies

Foreign investment may also create reporting obligations under the Turkish FDI framework.

Companies and branches established in Türkiye by international investors use the Electronic Incentive Application and Foreign Investment Information System (“E-TUYS”) for foreign investment notifications.

The official investment guidance identifies electronic forms including:

• FDI Activity Information Form;
• FDI Capital Data Form;
• FDI Share Transfer Data Form.

Accordingly, the fact that a transaction does not require general FDI approval does not mean there are no foreign investment reporting obligations.

Sectoral approval and FDI notification should be treated separately.

26. Competition Law Can Apply to Foreign Fintech Investments

A foreign acquisition may also require Turkish Competition Board clearance.

The Turkish Competition Authority substantially revised the merger-control thresholds in February 2026.

Under the updated framework:

• the former TRY 250 million individual threshold became TRY 1 billion;
• the former TRY 750 million Turkish aggregate threshold became TRY 3 billion;
• the former TRY 3 billion worldwide threshold became TRY 9 billion.

The precise combination of turnover tests under the current Communiqué must be applied to the parties in each transaction.

Therefore, financial-sector regulatory permission does not automatically replace competition clearance.

A transaction may require both.

27. Special Competition Rules for Technology Undertakings

Fintech companies can also fall within the Competition Authority’s special regime for technology undertakings.

The 2026 amendments changed this system.

The technology-undertaking exception is now limited to technology undertakings established in Türkiye, and the updated rules also introduce a TRY 250 million individual turnover consideration for relevant transactions involving such targets.

Because fintech businesses frequently fall within financial technology and digital technology categories, merger-control analysis should be conducted even where the target appears relatively small compared with the foreign buyer.

A global financial institution acquiring a Turkish fintech startup can create notification obligations because the purchaser’s worldwide turnover may be substantial.

28. Competition Clearance Should Be a Closing Condition

Where Turkish merger clearance is mandatory, the parties should not close before approval.

The Share Purchase Agreement should therefore identify Competition Board approval as a condition precedent where applicable.

The same applies to:

• CBRT approval;
• BRSA approval;
• CMB approval.

The regulatory closing sequence should be determined before signing.

Otherwise, the transaction can become contractually binding while legally incapable of completion within the expected timetable.

29. Source of Funds Is a Regulatory Issue

Foreign investors should be prepared to demonstrate the legitimate source of funds used for regulated fintech acquisitions.

This is especially important in:

• payment institutions;
• e-money institutions;
• banks;
• crypto asset service providers.

For payment/e-money acquisitions, the current CBRT regulation expressly requires the share-transfer application to include an explanation concerning the source used to purchase the shares together with transaction documentation.

A complicated acquisition structure involving:

• shareholder loans;
• offshore holding companies;
• trust structures;
• layered investment vehicles

should therefore be documented carefully.

Unexplained funding can delay regulatory approval.

30. Ultimate Beneficial Ownership Must Be Transparent

Financial regulators generally need to understand who ultimately controls the regulated business.

Foreign investment structures should therefore be mapped through the entire ownership chain.

A due diligence ownership chart should identify:

• direct shareholder;
• intermediate holding companies;
• fund vehicles;
• controlling investors;
• ultimate natural persons where legally relevant.

For payment institutions, the current Regulation expressly requires indirect ownership analysis through corporate chains and calculates indirect shareholding through relevant ownership relationships.

This makes transparency particularly important for private equity and multinational group transactions.

31. MASAK Compliance Should Be Reviewed Before Investment

Payment institutions, electronic money institutions and crypto asset service providers are subject to Turkish AML rules administered by MASAK.

A foreign investor should review whether the target has properly established:

• KYC;
• beneficial ownership identification;
• PEP screening;
• sanctions controls;
• transaction monitoring;
• suspicious transaction reporting;
• compliance officer functions;
• record retention.

An AML deficiency may lead to sanctions and regulatory consequences after the investor has completed the acquisition.

The purchaser is therefore acquiring not merely the company’s licence and technology—but also its compliance history.

32. AML Due Diligence Should Test Reality, Not Policies

A target may provide an impressive AML policy.

That does not demonstrate operational compliance.

Foreign investors should test:

• samples of customer KYC files;
• high-risk customer reviews;
• corporate beneficial ownership records;
• unresolved transaction monitoring alerts;
• suspicious transaction escalation;
• remote onboarding.

For crypto platforms, this should also include:

• Travel Rule infrastructure;
• blockchain analytics;
• self-hosted wallet procedures.

The key question is whether the AML programme functions consistently in real transactions.

33. KVKK and Foreign Investors

Acquiring a Turkish fintech usually creates significant personal data issues.

The target may process:

• customer identities;
• financial records;
• payment information;
• KYC documents;
• merchant information;
• crypto wallet information;
• employee records.

A foreign buyer should therefore review compliance with Law No. 6698 on the Protection of Personal Data (“KVKK”).

This includes:

• lawful processing;
• privacy notices;
• security;
• data retention;
• data subject rights;
• international transfers.

34. Due Diligence Data Rooms Can Create Cross-Border Transfers

Where a foreign investor or foreign adviser accesses personal information stored in a Turkish M&A data room, this may create an international transfer issue.

Article 9 of KVKK was materially amended in 2024.

The current framework permits cross-border transfers through mechanisms including:

• adequacy decisions;
• standard contracts;
• Binding Corporate Rules;
• other specified safeguards;
• limited exceptional transfers.

The due diligence process itself should therefore be designed in compliance with KVKK.

35. Turkish Standard Contracts

Türkiye has adopted four standard contract modules for international personal data transfers:

• controller to controller;
• controller to processor;
• processor to processor;
• processor to controller.

Where standard contracts are used, they must be notified to the Personal Data Protection Authority within:

five business days after signing.

This becomes particularly important after closing when a newly acquired Turkish fintech is integrated into the foreign investor’s global:

• cloud environment;
• CRM;
• cybersecurity infrastructure;
• group reporting systems.

36. Post-Closing Data Integration Should Not Be Automatic

A common foreign-investor assumption is:

“Once we own the Turkish company, we can move all customer information into the group’s global systems.”

This is legally risky.

Group ownership does not eliminate:

• KVKK Article 9;
• banking confidentiality;
• payment-sector localisation requirements;
• CMB information systems rules.

The integration plan should therefore be legally reviewed before customer information becomes accessible to the foreign parent.

The fact that companies are within the same group does not make the international transfer automatically lawful.

37. Cybersecurity Due Diligence

Foreign investors should treat cybersecurity as a dedicated legal and technical due diligence workstream.

The review should examine:

• information systems audits;
• penetration tests;
• vulnerability reports;
• regulatory IT findings;
• privileged access;
• previous cyber incidents;
• data breaches;
• cloud architecture;
• disaster recovery.

For licensed fintech institutions, cybersecurity deficiencies can threaten more than customer trust.

They can affect regulatory compliance and ultimately the institution’s ability to maintain its operating permission.

38. Intellectual Property Ownership

Fintech valuation commonly depends heavily upon software and intellectual property.

Foreign investors should verify whether the target actually owns:

• source code;
• mobile applications;
• APIs;
• algorithms;
• trademarks;
• domain names;
• software databases.

Problems frequently arise where technology was created by:

• founders personally;
• freelance developers;
• foreign group companies;
• outsourced development agencies.

The target should hold valid assignments of the relevant intellectual property.

A licence to conduct financial services is of limited value where the institution does not control the technology required to operate the service.

39. Technology Licensing and Open-Source Software

Fintech technology frequently contains third-party and open-source software.

Due diligence should identify:

• software licences;
• usage restrictions;
• copyleft exposure;
• commercial licensing fees;
• termination provisions;
• cybersecurity vulnerabilities.

This is especially important where the target’s core platform was rapidly assembled during an early startup stage.

Foreign investors should not assume that technical functionality equals legal ownership.

40. Customer Funds and Assets

Where the target handles customer money or crypto assets, foreign investors should independently analyse how those assets are protected.

For payment and electronic money companies, this includes safeguarding arrangements.

For crypto businesses, it includes:

• customer asset segregation;
• custody arrangements;
• wallet architecture;
• reconciliation;
• proof-of-reserves audits.

Customer assets must never be valued as though they were unrestricted corporate cash.

The distinction between company assets and customer assets is fundamental to regulated fintech valuation.

41. Employment and Key Personnel

Foreign investment can also create operational risk where the fintech depends heavily on a small number of founders or regulatory specialists.

The buyer should identify:

• compliance officer;
• chief technology personnel;
• information security personnel;
• key developers;
• executives responsible for regulator relationships.

Retention may be particularly important where the individuals satisfy licence-related experience or management conditions.

A purchase agreement may therefore include:

• retention bonus;
• earn-out;
• continued employment;
• transition services.

42. Work Permits for Foreign Managers

Foreign investment does not automatically grant foreign executives the right to work in Türkiye.

Where the investor intends to appoint foreign personnel, applicable immigration and work-permit rules should be reviewed separately.

The FDI framework supports the employment of foreign personnel but operates together with Türkiye’s work-permit legislation.

Board membership and day-to-day employment should also be distinguished.

A person may be legally capable of owning shares or holding a corporate office while separately requiring permission to perform employment activities physically in Türkiye.

43. Tax Structuring

Foreign fintech investment should also include tax planning.

Potential matters include:

• taxation of share acquisitions;
• dividend distributions;
• withholding;
• capital gains;
• financing structures;
• transfer pricing;
• related-party service agreements;
• applicable double-tax treaties.

The FDI framework recognises freedom of transfer as an important principle of international investment in Türkiye.

However, freedom to transfer profits should not be confused with tax exemption.

Before repatriating dividends or proceeds, investors should determine:

• applicable Turkish tax;
• treaty relief;
• corporate-law distribution requirements;
• regulatory capital restrictions.

44. Financing the Acquisition

Foreign investors may finance a fintech acquisition through:

• equity;
• shareholder loans;
• external acquisition finance;
• combinations of debt and equity.

However, heavily leveraged structures should be examined carefully where the target is a regulated financial institution.

The investor should consider:

• regulatory capital requirements;
• restrictions on extraction of funds;
• related-party transactions;
• capital adequacy;
• tax implications.

An acquisition structure that depends upon immediately distributing substantial cash from the regulated target may conflict with the need to maintain regulatory capital.

45. Investment Through a Turkish Holding Company

Some foreign investors prefer to establish a Turkish holding vehicle and acquire the fintech through that structure.

Potential commercial advantages can include:

• simplified local governance;
• additional Turkish investments;
• joint venture structuring;
• financing flexibility.

However, inserting a holding company does not eliminate look-through regulatory analysis.

Financial regulators may examine:

• indirect share ownership;
• control;
• ultimate beneficial owners.

The regulated approval requirements should therefore be assessed based on the entire ownership structure.

46. Shareholders’ Agreements in Regulated Fintech

Foreign minority investors frequently rely on shareholders’ agreements to protect their position.

Typical rights include:

• board appointment;
• reserved matters;
• veto rights;
• information rights;
• anti-dilution protection;
• pre-emption;
• tag-along;
• drag-along.

However, in regulated fintech, governance rights can themselves affect regulatory analysis.

A 9% shareholder with extensive control or board appointment rights may raise different regulatory questions from an ordinary passive 9% investor.

The investment team should therefore analyse:

economic ownership and governance control together.

47. Regulatory Approval Should Be a Condition Precedent

Where sector approval is required, the SPA or investment agreement should normally provide that the transaction closes only after the necessary permission has been obtained.

Potential conditions include:

• CBRT share transfer approval;
• BRSA approval;
• CMB permission;
• Competition Board clearance.

The agreement should also establish:

• who prepares the application;
• which information the seller must provide;
• how regulators are contacted;
• whether both parties must cooperate;
• long-stop date;
• consequences of refusal.

A foreign investor should not transfer the purchase price before determining whether the regulated shares can lawfully be transferred.

48. Regulatory Cooperation Covenants

Regulated transactions require substantial cooperation between seller and buyer.

For example, the regulator may require:

• purchaser financial information;
• ultimate ownership documentation;
• target regulatory records;
• criminal record information;
• audited financial statements;
• corporate approvals.

The investment agreement should require each party to promptly provide information necessary for regulatory filings.

However, obligations should also respect:

• confidentiality;
• personal data;
• legally privileged information.

49. Material Adverse Regulatory Change

The period between signing and closing may last several months where regulatory approvals are required.

A buyer may therefore seek protection if the target experiences a serious regulatory event during that period.

Relevant events may include:

• licence suspension;
• major CBRT/CMB/BRSA investigation;
• material capital deficiency;
• cyberattack;
• major MASAK sanction;
• loss of a critical banking partner.

A regulatory material adverse change clause should be drafted carefully so that ordinary supervision does not automatically allow withdrawal while serious licence-threatening events remain covered.

50. Foreign Investor Due Diligence Checklist

Before investing in a Turkish fintech company, a foreign investor should review at least the following.

Regulatory Classification

Is the target actually regulated?

Licence

Which licence does the company hold?

Licence Scope

Which services are authorised?

Regulatory Authority

CBRT, BRSA or CMB?

Share Transfer Approval

Will the investment trigger prior regulatory permission?

Indirect Control

Does a parent-level transaction create Turkish approval requirements?

Shareholder Suitability

Can the investor satisfy qualifying shareholder conditions?

Source of Funds

Can the investment funding be documented?

Capital

Will the target satisfy regulatory capital after closing?

Regulatory History

Has the target faced suspensions, penalties or inspection findings?

MASAK

Is the AML programme operational?

Customer Funds

Are payment/e-money customer funds properly protected?

Crypto Assets

Are customer crypto holdings fully reconciled and properly held?

Cybersecurity

Has the target passed relevant technology audits?

Data Protection

Does the company comply with KVKK?

International Transfers

Can post-closing group data sharing lawfully occur?

Competition

Is Turkish merger clearance required?

E-TUYS

Have foreign investment reporting requirements been identified?

Intellectual Property

Does the company own its technology?

Contracts

Will key banking, cloud and commercial contracts survive the change of control?

Frequently Asked Questions About Foreign Investment in Turkish Fintech Companies

Can foreigners own a fintech company in Turkey?

Generally yes.

Türkiye’s Foreign Direct Investment Law applies national treatment and generally allows international investors to establish and acquire Turkish companies on the same basis as domestic investors, subject to special sector legislation.

Is there a general foreign investment approval requirement?

Türkiye’s general FDI system is principally notification based rather than based on a general prior approval regime. Regulated sectors can nevertheless require specific approvals.

Can a foreign investor acquire a payment institution?

Yes in principle, but qualifying share acquisitions can require prior CBRT approval.

What shareholding levels trigger CBRT approval?

The current payment-services framework regulates direct or indirect acquisitions at or above 10% and transactions crossing the 10%, 20%, 33% and 50% thresholds, together with certain privileged shares and changes of control.

Can a foreign investor acquire an electronic money institution?

Yes in principle, subject to the same regulated shareholding and shareholder suitability framework applicable under Law No. 6493 and the Payment Services Regulation.

What are the 2026 payment/e-money own-funds requirements?

Effective 30 June 2026, the CBRT set the relevant minimums at TRY 20 million for the specified bill-payment category, TRY 40 million for the other relevant payment-institution category, and TRY 105 million for electronic money institutions.

Can a foreign investor own a digital bank?

Foreign investment is possible in principle, but a digital bank is a bank and therefore falls within BRSA and Banking Law share acquisition requirements.

What ownership thresholds apply to banks?

Banking Law Article 18 requires approval for qualifying direct or indirect transactions involving 10%, 20%, 33% and 50% thresholds and specified privileged shares.

Can foreigners invest in Turkish crypto exchanges?

Yes in principle, subject to the CMB’s CASP shareholder, capital, establishment and operating rules.

What is the minimum capital for a crypto platform in 2026?

The 2026 minimum establishment capital is TRY 250 million.

What is the minimum capital for a crypto custody institution?

The 2026 minimum establishment capital is TRY 630 million.

Is every crypto company on the SPK website fully licensed?

No.

The CMB expressly states that its current Operating Entities List is temporary and inclusion does not itself mean that the entity has been authorised.

Does foreign investment need to be reported through E-TUYS?

Foreign-owned companies and branches use the E-TUYS system for specified FDI information, including activity, capital and share-transfer data.

Can a foreign acquisition require Turkish Competition Board approval?

Yes.

The 2026 merger-control rules contain updated turnover thresholds and special provisions relevant to technology undertakings.

What are the new general merger-control thresholds?

The 2026 amendments increased the individual turnover threshold from TRY 250 million to TRY 1 billion, the Turkish aggregate threshold from TRY 750 million to TRY 3 billion and the worldwide threshold from TRY 3 billion to TRY 9 billion within the applicable notification tests.

Can a foreign buyer access Turkish fintech customer data during due diligence?

Potentially, but personal data disclosure and international access must comply with KVKK. Data minimisation, confidentiality and Article 9 transfer requirements should be considered.

Can customer data be transferred to the foreign parent after closing?

Not automatically.

Post-closing transfers must comply with KVKK Article 9 and any stricter banking, payment or capital-markets confidentiality and localisation rules.

Conclusion: How Foreign Investors Should Approach Turkish Fintech Investments

Foreign investment in Turkish fintech companies is generally welcomed within Türkiye’s liberal investment framework.

Foreign Direct Investment Law No. 4875 is based upon national treatment and a notification-oriented approach rather than a general foreign ownership approval regime.

International investors can generally establish Turkish companies or acquire existing Turkish businesses under the same basic corporate framework applicable to local investors.

This makes Türkiye commercially accessible to international venture capital funds, private equity investors, banks, payment groups, crypto companies and strategic technology investors.

However, fintech investment has an additional dimension:

financial regulatory approval.

The FDI regime does not override sector-specific financial legislation.

For payment institutions and electronic money institutions, the CBRT regulates qualifying ownership changes.

Transactions involving direct or indirect acquisition of at least 10%, crossings of the 10%, 20%, 33% and 50% ownership thresholds and specified control or privileged-share changes may require CBRT approval.

The investor itself can therefore become the subject of regulatory due diligence.

Foreign acquirers should be prepared to demonstrate:

• ownership;
• financial strength;
• source of funds;
• regulatory reputation;
• ultimate control.

For banks and digital banks, the regulatory intensity is still greater.

A digital bank remains a bank and falls within Banking Law No. 5411. The bank-share acquisition regime also applies 10%, 20%, 33% and 50% thresholds and regulates privileged ownership rights.

Crypto investments now require similar regulatory seriousness.

Since Law No. 7518 and the March 2025 CMB regulations, crypto asset service providers are subject to detailed rules governing establishment, shareholders, share transfers, management, capital, information systems and custody.

Financial capacity is particularly important.

For 2026, a crypto trading platform is subject to minimum establishment capital of TRY 250 million, while a crypto custody institution requires TRY 630 million.

Foreign investors considering an existing crypto target must also distinguish transitional regulatory status from final authorisation.

The CMB expressly states that appearing on its temporary Operating Entities List does not itself mean that the company has received authorisation.

The same disciplined approach should be applied to payment and electronic money targets.

A buyer should verify the current CBRT licence register, exact permitted activities and regulatory enforcement history rather than relying on management representations.

The CBRT’s 2025 supervisory results, published in January 2026, demonstrate that licence revocation and suspension are real regulatory risks within the sector.

Foreign investors should also remember that regulatory capital must continue after the transaction.

As of 30 June 2026, minimum own-funds levels for relevant payment/e-money categories have increased to TRY 20 million, TRY 40 million and TRY 105 million respectively.

Consequently, acquisition financing and post-closing distributions must be structured so that they do not create a regulatory capital deficiency.

Competition law represents another potential closing condition.

The Competition Authority materially revised merger-control thresholds in February 2026. The general threshold structure now includes significantly higher TRY 1 billion, TRY 3 billion and TRY 9 billion figures within the applicable turnover tests, while special treatment for technology undertakings has also been revised.

A large foreign financial group acquiring a relatively young Turkish fintech may therefore still need Turkish Competition Board clearance.

The transaction documentation should address these approvals from the beginning.

Where required, the SPA or investment agreement should make:

CBRT approval, BRSA approval, CMB approval and Competition Board clearance

conditions precedent to closing.

The parties should also establish clear procedures for regulatory applications, cooperation, information provision and the consequences of approval being refused.

Foreign investment reporting remains relevant even where no general investment approval is required.

Foreign-owned businesses use Türkiye’s E-TUYS system to report specified foreign investment information, including activity, capital and share-transfer data.

Personal data is another area where post-closing integration must be planned carefully.

A multinational group cannot automatically transfer all Turkish customer data into foreign group systems simply because it owns the company.

KVKK Article 9 creates a separate international transfer framework using mechanisms such as standard contracts and Binding Corporate Rules.

For standard contracts, the five-business-day notification requirement should also be included in post-closing compliance planning.

Where the target is a regulated financial institution, sector-specific confidentiality, information systems and localisation rules may impose additional restrictions.

The foreign investor should therefore prepare a regulatory integration plan rather than immediately connecting the target to global infrastructure.

MASAK, cybersecurity and intellectual property due diligence are equally important.

A fintech’s true value depends not only on revenue and customer growth, but also on whether:

• customer onboarding is lawful;
• AML alerts are properly investigated;
• customer funds are protected;
• cybersecurity is reliable;
• technology is actually owned by the company;
• regulator relationships remain stable.

Ultimately, international investors should approach the Turkish fintech market through an integrated legal strategy.

The correct investment sequence is generally:

classify the target → verify the licence → analyse ownership approval → investigate regulatory history → test capital → review AML/KVKK/cybersecurity → determine Competition Board requirements → structure the SPA → obtain approvals → close → complete E-TUYS and post-closing regulatory integration.

For foreign investors considering a payment institution, electronic money company, digital wallet, open banking provider, digital bank, BaaS company, crypto exchange or crypto custody institution in Turkey, this regulatory planning should begin before the final purchase price is agreed.

The central principle can be stated simply:

Türkiye generally welcomes foreign fintech investment, but acquiring a regulated fintech means acquiring both a business and its regulatory responsibilities.

The strongest transactions are therefore those in which foreign investment law, financial-sector regulation, corporate law, competition law, AML, data protection and technology due diligence are considered together from the beginning.

Legal Disclaimer: This publication provides general information concerning foreign investment in fintech companies in Türkiye as of July 2026. It does not constitute legal, tax, regulatory or investment advice. Financial-sector ownership requirements, capital thresholds, Competition Board thresholds, FDI reporting requirements and regulatory practices may change. Every proposed investment should be reviewed individually based on the target company’s business model, licence, ownership structure, investor profile, transaction size and regulatory status at the relevant time.