on August 3, 2026

Introduction

Türkiye has developed into an increasingly important market for financial technology businesses, particularly in digital payments, electronic money, digital wallets, open banking, payment infrastructure, digital banking, embedded finance and crypto-asset services.

For foreign investors and technology entrepreneurs, however, establishing a fintech company in Türkiye is fundamentally different from incorporating an ordinary software or e-commerce company.

The key reason is simple: financial technology is regulated according to what the business actually does, rather than how the founders describe the business.

A company may call itself a software developer, marketplace, financial technology platform or digital application. Nevertheless, if it receives or transfers customer funds, issues electronic money, provides payment initiation services, offers digital banking functions or operates a crypto-asset platform, it may require regulatory authorisation.

Accordingly, anyone considering how to establish a fintech company in Turkey should start with regulatory classification rather than ordinary company incorporation.

The main Turkish regulators relevant to fintech businesses include the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”), the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”), the Capital Markets Board of Türkiye (“CMB” or “SPK”), the Financial Crimes Investigation Board (“MASAK”), and the Turkish Data Protection Authority.

Which regulator becomes relevant depends upon the fintech company’s business model.

For payment services and electronic money, the central legislation is Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions. The CBRT confirms that payment services, payment institutions and electronic money institutions continue to be governed by Law No. 6493 together with the relevant secondary regulations.

This guide explains the principal legal steps for establishing and operating a fintech company in Türkiye as of July 2026.

1. The First Step: Determine What Type of Fintech Company You Are Establishing

Before incorporating a company, investors should determine the legal classification of the proposed fintech activity.

There is no single licence called a “fintech licence” in Türkiye.

Instead, different authorisations apply to different activities.

A fintech business may potentially operate as:

a payment institution;
an electronic money institution;
an account information service provider;
a payment initiation service provider;
a digital bank;
a Banking-as-a-Service interface provider;
a crypto-asset trading platform;
a crypto-asset custody provider;
a crowdfunding platform;
a financial technology service provider that does not itself perform regulated financial activities.

This distinction is critical.

A company offering technology to a bank may potentially operate without being directly licensed for banking activities, depending on the model.

By contrast, a company that itself accepts customer funds and transfers those funds may be performing a payment service.

Similarly, a digital wallet may be an ordinary technical application in one structure but constitute a regulated payment or electronic money service in another.

The legal assessment therefore needs to examine the entire transaction flow.

This includes determining:

who receives the customer funds;
where those funds are held;
who controls the payment account;
who initiates the payment;
who transfers the money;
whether monetary value is stored;
whether stored value is accepted by third parties;
whether the company has access to bank-account information;
whether the company executes transactions on behalf of customers;
whether crypto assets are traded, transferred or held in custody.

This regulatory classification should preferably be completed before significant investment is made into the technical infrastructure.

2. Can Foreign Investors Establish a Fintech Company in Turkey?

Foreign investors may establish companies in Türkiye, including companies operating in the financial technology sector.

However, general foreign investment rules and sector-specific financial regulation must be distinguished.

The fact that a foreign investor may legally incorporate a Turkish company does not automatically mean that the company may perform regulated financial services.

If the company’s activity falls within regulated payment, electronic money, banking or crypto-asset services, the relevant regulatory authorisation must also be obtained.

Foreign investors should therefore consider two separate legal questions:

First: Can the Turkish corporate vehicle be established?

Second: Does that Turkish company require a regulatory licence before commencing operations?

For regulated fintech businesses, the second question is generally the more complicated one.

Foreign shareholders must also take into account regulatory requirements concerning the financial strength, ownership structure, reputation and eligibility of qualifying shareholders.

For certain changes in ownership after licensing, regulatory approval may also be required.

Accordingly, the shareholding structure should be planned carefully from the beginning.

3. Choosing the Correct Corporate Structure

Fintech founders should not automatically choose between a limited liability company and a joint-stock company solely on the basis of ordinary incorporation costs.

Certain regulated fintech businesses are specifically required to operate as a joint-stock company (anonim şirket – A.Ş.).

For example, payment institutions must generally be incorporated as joint-stock companies under Law No. 6493.

The CBRT expressly confirms that a legal entity seeking authorisation as a payment institution must be established in the form of a joint-stock company and satisfy the requirements imposed upon the company and its shareholders by Article 14 of Law No. 6493. Electronic money institutions are likewise subject to the joint-stock-company requirement under Article 18.

Therefore, establishing an ordinary limited liability company and planning to “convert it later if necessary” may create unnecessary restructuring costs and regulatory delays.

A proposed regulated fintech company’s articles of association should also be prepared carefully.

The corporate purpose and scope should accurately reflect the activities that the company intends to perform and should be consistent with the regulatory application.

4. Payment Institution Licence in Turkey

Companies intending to provide payment services should determine whether they require authorisation as a payment institution.

Payment institutions are principally governed by Law No. 6493 and the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers.

Under Turkish law, payment services may only be provided by authorised payment service providers.

The CBRT currently regulates and supervises payment institutions and maintains a public list identifying authorised payment institutions and the particular payment services each institution is permitted to provide.

This illustrates an important principle:

A payment institution licence is not necessarily an unlimited permission to conduct every type of payment activity.

The scope of the authorisation matters.

A licensed payment institution proposing to introduce a new service should therefore determine whether the new activity already falls within its existing licence or whether regulatory approval for expansion is required.

Depending on the business model, payment activities may include matters such as:

execution of payment transactions;
money remittance;
merchant acquiring;
payment instrument-related services;
payment initiation;
account information services;
services concerning payment accounts.

The exact regulatory classification should be determined individually.

5. Electronic Money Institution Licence in Turkey

A fintech company that intends to issue stored monetary value may fall within the electronic money regime.

Under Law No. 6493, electronic money generally involves monetary value issued against funds, stored electronically and capable of being used for payment transactions, subject to the statutory definition and applicable exceptions.

Electronic money institutions require CBRT authorisation.

The CBRT states that authorised electronic money institutions may issue electronic money under Article 18 of Law No. 6493. They may additionally provide those payment services for which they have received the relevant authorisation.

This distinction is particularly relevant for businesses developing:

prepaid payment products;
mobile wallets;
multi-merchant wallets;
stored-value applications;
fintech ecosystems;
marketplace payment products.

A company should not assume that describing customer balances as “credits”, “points” or “wallet balance” prevents them from qualifying as electronic money.

The actual economic function is decisive.

6. Capital and Own-Funds Requirements

Financial technology licensing in Türkiye involves substantial financial requirements.

Payment and electronic money institutions must comply with both statutory capital requirements and continuing own-funds obligations.

These amounts are subject to regulatory updates.

As of 30 June 2026, the CBRT’s updated minimum own-funds requirements are:

TRY 20 million for institutions exclusively performing the relevant bill-payment intermediation service specified in the regulation;
TRY 40 million for other payment institutions falling within the relevant category, excluding institutions exclusively providing the specified account information service;
TRY 105 million for electronic money institutions.

These amounts were introduced by the CBRT communiqué published on 31 January 2026 and entered into force on 30 June 2026.

These figures concern minimum own-funds requirements and should not automatically be treated as synonymous with every capital requirement applicable at the incorporation or licensing stage.

The precise paid-in capital and own-funds obligations must therefore be checked according to the type of institution and the date of the regulatory application.

This is particularly important because the CBRT periodically updates financial thresholds.

A business plan prepared using regulatory capital figures from several years earlier may therefore be materially inaccurate.

7. CBRT Licence Application Process

A company seeking authorisation as a payment or electronic money institution must undergo a formal CBRT licensing process.

The CBRT’s guidance expressly confirms that payment and electronic money institutions may operate only after obtaining the required authorisation under Law No. 6493.

The regulatory application involves substantially more than submitting incorporation documents.

Depending upon the activity, the application process may require information concerning:

shareholders;
ultimate beneficial owners;
managers;
corporate governance;
paid-in capital;
financial resources;
business model;
projected transaction volumes;
organisational structure;
risk management;
internal controls;
accounting;
compliance;
information systems;
cybersecurity;
outsourcing;
customer fund protection;
operational continuity.

The company’s regulatory file and actual operational structure must be consistent.

A fintech applicant should therefore avoid presenting an idealised business model to the regulator while implementing a technically different structure in practice.

8. Technology Infrastructure Is Part of the Licence Application

One of the most important differences between fintech licensing and ordinary company formation is the role of technology.

For an ordinary commercial company, software architecture is generally a business decision.

For a regulated fintech company, technology architecture can be a regulatory issue.

The CBRT’s regulatory framework includes the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data-Sharing Services of Payment Service Providers in the Field of Payment Services. The framework regulates information systems and associated payment-service data-sharing requirements.

A licensing assessment may therefore require consideration of:

system architecture;
access controls;
authentication;
log management;
backup systems;
disaster recovery;
business continuity;
cybersecurity;
penetration testing;
outsourcing;
customer-data security;
database architecture;
API security;
incident management.

Founders should consequently involve legal, compliance and technical teams together when designing the product.

9. Open Banking Companies in Turkey

Open banking is an important part of the Turkish fintech market.

Law No. 6493 includes regulated services relating to:

payment initiation, and
account information services.

A fintech platform that allows customers to view payment-account information from multiple institutions or initiate payments using accounts maintained by another payment service provider may therefore fall within the regulated open banking framework.

Türkiye has also implemented payment-services data-sharing infrastructure, including the ÖHVPS framework.

For fintech entrepreneurs developing personal finance applications, accounting integrations, corporate cash-flow tools or embedded payment functionality, open banking classification should therefore be examined at an early stage.

API access does not by itself mean an activity is unregulated.

The legal function performed through that API remains decisive.

10. Digital Banks and Banking as a Service

A business model involving banking should be distinguished from payment and electronic money services.

Banks in Türkiye are principally regulated under Banking Law No. 5411 and supervised by the BRSA.

Türkiye also has a specific regulatory framework for digital banking and Banking as a Service through the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model.

The BRSA continues to list this regulation within the current Turkish banking legislation.

This framework is especially relevant to embedded-finance companies.

A fintech business may provide the digital interface while a licensed bank supplies underlying banking infrastructure.

However, such an arrangement does not mean the interface provider may independently perform every banking activity.

The contractual and technological allocation of roles between the service bank and fintech interface provider must comply with applicable banking legislation.

11. Establishing a Crypto Fintech Company in Turkey

Companies planning to operate crypto exchanges or crypto custody services must consider a separate regulatory regime.

Türkiye fundamentally restructured crypto-asset regulation through Law No. 7518, which amended Capital Markets Law No. 6362.

The legislation entered into force on 2 July 2024, bringing crypto-asset service providers under CMB regulation and supervision.

The secondary framework was substantially established through two communiqués published on 13 March 2025:

Communiqué III-35/B.1 on the Establishment and Operating Principles of Crypto Asset Service Providers, and

Communiqué III-35/B.2 on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers.

The regulations cover areas including:

establishment;
operating authorisation;
founders and shareholders;
share transfers;
managers;
personnel requirements;
organisational structure;
internal control;
internal audit;
risk management;
information systems;
technological infrastructure;
record keeping;
independent audits;
proof-of-reserves audits;
crypto trading;
custody;
transfers;
token listing;
capital adequacy.

Accordingly, establishing a crypto exchange in Türkiye can no longer be approached as the incorporation of an ordinary technology company.

It has become a regulated financial-services project.

12. CMB Application for Crypto Asset Service Providers

The CMB maintains specific application procedures for crypto-asset service providers.

Separate documentation exists for the establishment of crypto trading platforms and custody institutions.

The CMB expressly states that applications must use its updated forms and attachments and warns that applications containing deficiencies or failing to comply with the required format will not be processed.

This means that regulatory preparation should begin substantially before the planned commercial launch.

The founders should determine:

ownership structure;
regulatory capital;
managers;
technological infrastructure;
custody arrangement;
internal control organisation;
risk-management systems;
AML policies;
customer onboarding system.

Establishing the corporate vehicle is only one stage of the process.

13. AML and KYC Obligations

A licensed fintech company should have a functioning anti-money laundering framework from the outset.

The core Turkish legislation is Law No. 5549 on Prevention of Laundering Proceeds of Crime, supported by MASAK regulations and guidance.

Payment institutions, electronic money institutions and crypto-asset service providers are among the sectors for which MASAK publishes suspicious transaction reporting guidance.

Depending upon the institution, the compliance framework may include:

customer identification;
customer verification;
beneficial ownership identification;
customer risk classification;
sanctions screening;
politically exposed person checks;
transaction monitoring;
enhanced due diligence;
suspicious transaction reporting;
retention of records;
internal AML procedures;
compliance officers;
staff training.

AML compliance should be built into the fintech software architecture.

For example, onboarding systems should be capable of preventing account activation where mandatory identification requirements have not been satisfied.

Transaction monitoring systems should also allow unusual activity to be identified and escalated.

14. Remote Customer Onboarding

Remote identification is particularly important for fintech businesses because customers often never visit a physical branch or office.

Turkish regulations permit remote onboarding in various regulated sectors subject to applicable requirements.

However, remote onboarding should not be interpreted as simply uploading an identity card photograph.

The institution must implement the relevant verification procedures and technical security standards applicable to its sector.

The regulatory framework may involve:

identity-document verification;
security controls;
authenticity checks;
customer presence or liveness procedures;
record keeping;
fraud prevention;
enhanced verification where necessary.

Foreign fintech companies should examine these requirements when designing onboarding flows for Turkish residents.

15. Turkish Data Protection Law and Fintech Companies

Every fintech company established in Türkiye should consider Law No. 6698 on the Protection of Personal Data (“KVKK”).

Fintech companies process particularly sensitive commercial datasets, including:

customer identity information;
bank account information;
transaction history;
payment data;
telephone numbers;
email addresses;
device data;
IP addresses;
behavioural information;
fraud indicators;
authentication records.

The company should establish an appropriate legal basis for each data-processing activity.

It should also prepare the required privacy notices and implement internal policies relating to:

data retention;
deletion;
access rights;
cybersecurity;
data breaches;
processors;
third-party services;
customer requests.

Consent should not automatically be treated as the legal basis for every processing operation.

Where another legal basis exists, obtaining unnecessary consent can itself create compliance complications.

16. International Data Transfers and Foreign Cloud Providers

This issue is especially important for foreign-owned fintech companies.

A Turkish fintech may use:

Amazon Web Services;
Microsoft Azure;
Google Cloud;
overseas CRM systems;
foreign fraud-prevention providers;
international analytics providers;
overseas customer-support infrastructure;
global group-company databases.

These services may involve transfers of personal data outside Türkiye.

Türkiye materially amended the international personal-data-transfer regime under Article 9 of Law No. 6698 in 2024.

The amendments entered into force on 1 June 2024 and introduced mechanisms including standard contracts and binding corporate rules.

The Turkish Data Protection Authority currently publishes four standard-contract models addressing transfers between different combinations of data controllers and processors.

For this reason, international fintech investors should map the company’s data flows before launch.

The question is not merely where the principal server is physically located.

Companies should identify every foreign recipient that may receive or access Turkish customer data.

17. Consumer Protection and Fintech Contracts

Fintech companies dealing with individual customers must also consider Turkish consumer law.

A mobile application does not remove the business from ordinary contract-law and consumer-law obligations.

Customer agreements may need to regulate matters including:

service scope;
fees and commissions;
transaction authorisation;
liability;
unauthorised transactions;
complaints;
account suspension;
termination;
customer obligations;
personal data;
communication channels.

Where services are provided remotely, the applicable distance-contracting rules should also be considered.

Terms drafted solely under foreign law should not automatically be translated into Turkish and used without legal review.

Turkish mandatory provisions may override contractual terms.

18. Foreign Fintech Companies Providing Services into Turkey

Foreign fintech companies sometimes attempt to enter Türkiye without establishing a licensed local entity.

This requires careful analysis.

A company cannot simply assume that authorisation obtained in the United Kingdom, European Union, United States or another jurisdiction automatically permits regulated services in Türkiye.

Türkiye does not operate a general fintech passporting system under which a foreign payment licence automatically becomes valid domestically.

There are, however, regulatory mechanisms allowing certain cooperation structures between authorised Turkish payment service providers and foreign legal entities.

The CBRT publishes a list of cooperation arrangements approved under Article 19 of the relevant Payment Services Regulation. The list includes arrangements between authorised Turkish institutions and foreign financial technology companies.

Accordingly, foreign fintech companies should consider whether market entry should occur through:

establishment of a Turkish regulated entity;
acquisition of an existing regulated institution;
partnership with a licensed Turkish institution;
permitted cross-border cooperation;
provision of purely technical services that remain outside regulated financial activity.

Each structure carries different regulatory risks.

19. Buying an Existing Licensed Fintech Company

Rather than applying for a new licence, some investors consider purchasing an existing Turkish payment or electronic money institution.

This can sometimes appear commercially attractive.

However, acquiring a licensed company does not mean the transaction can be treated like an ordinary share acquisition.

Regulatory approval requirements concerning share transfers and changes in control should be analysed.

Extensive regulatory due diligence is also essential.

The buyer should investigate:

validity of the licence;
precise licence scope;
historical regulatory correspondence;
administrative fines;
AML deficiencies;
suspicious transaction systems;
customer-money protection;
outstanding regulatory investigations;
information systems;
cybersecurity incidents;
data breaches;
outsourcing contracts;
capital adequacy;
related-party transactions.

Regulatory compliance problems can directly affect the value of a fintech target.

20. CBRT Enforcement Risk Should Be Taken Seriously

Licensing is not the end of the regulatory process.

Payment and electronic money institutions remain subject to continuous supervision.

This is particularly important in light of recent CBRT enforcement activity.

The CBRT announced on 29 January 2026 that its supervisory and oversight activities during 2025 had resulted in:

cancellation of operating licences of 7 institutions;
temporary suspension of operating licences of 14 institutions;
imposition of a requirement on 12 institutions to obtain CBRT approval before distributing dividends.

This demonstrates that regulatory compliance is not a one-time licensing exercise.

A fintech company must remain compliant throughout its operations.

21. Typical Legal Documents Required by a Fintech Startup

Depending upon the business model, a Turkish fintech company may require a substantial legal-document package.

This can include:

Corporate Documents

articles of association;
shareholders’ agreement;
board regulations;
signature authorities;
corporate governance policies.

Customer Documents

framework payment services agreement;
electronic money agreement;
wallet terms;
user terms and conditions;
fee schedules;
consumer disclosures.

Privacy Documents

privacy notice;
cookie notice;
data processing agreements;
international transfer documentation;
data retention policy.

Compliance Documentation

AML policy;
customer acceptance policy;
KYC procedures;
suspicious transaction procedures;
sanctions policy;
risk assessment methodology.

Technology Documents

information security policy;
incident response procedure;
access management policy;
business continuity plan;
disaster recovery framework;
outsourcing agreements;
cloud service agreements.

These documents should correspond to the company’s actual processes rather than existing merely as templates stored in a compliance folder.

22. Practical Step-by-Step Process to Establish a Fintech Company in Turkey

For most regulated fintech projects, the following sequence provides a useful starting framework.

Step 1: Define the Business Model

Map every product and transaction.

Determine exactly what the customer sees and what happens behind the application.

Step 2: Conduct Regulatory Classification

Determine whether the activity constitutes:

payment services;
electronic money;
open banking;
banking;
investment services;
crypto-asset services;
an unregulated technology service.

Step 3: Identify the Relevant Regulator

Depending on the activity, the principal regulator may be:

CBRT;
BRSA;
CMB.

MASAK and the Data Protection Authority may also have compliance roles.

Step 4: Design the Shareholding Structure

Review founder and investor eligibility and determine whether future investment rounds could trigger regulatory approval requirements.

Step 5: Incorporate the Appropriate Company

Where the regulatory regime requires a joint-stock company, the Turkish entity should be structured accordingly.

Step 6: Prepare Regulatory Capital

Verify the capital and own-funds requirements applicable on the proposed application date.

Step 7: Build Governance and Compliance Systems

Establish:

internal control;
risk management;
AML compliance;
customer onboarding;
complaints management;
internal reporting.

Step 8: Build the Technical Infrastructure

Ensure technology architecture complies with sector-specific information-security requirements.

Step 9: Prepare the Licence Application

Regulatory documentation should accurately reflect both the corporate and operational structure.

Step 10: Obtain Authorisation Before Launch

A regulated financial service should not begin merely because the company has been incorporated.

Company registration and regulatory authorisation are different legal processes.

23. Common Mistakes When Establishing a Fintech Company in Turkey

International investors frequently make several avoidable mistakes.

Establishing the Wrong Company Type

A limited liability company may be unsuitable where the law requires an A.Ş.

Developing the Product Before Regulatory Classification

Significant development costs may be wasted if the product architecture later proves incompatible with regulation.

Assuming the Company Is Merely a Technology Provider

Regulators assess economic functions rather than marketing descriptions.

Using Another Company’s Licence Informally

A regulated institution’s licence cannot simply be “rented” to an unrelated fintech business.

Ignoring Shareholder Requirements

Financial regulation may impose qualification requirements upon significant shareholders.

Underestimating AML Compliance

AML obligations are operational requirements, not simply contractual clauses.

Ignoring International Data Transfers

Foreign cloud services may create KVKK compliance requirements.

Treating Licensing as a One-Time Exercise

Continuing capital, reporting, cybersecurity and regulatory obligations remain after authorisation.

24. How Long Does It Take to Establish a Fintech Company in Turkey?

There is no universal period applicable to every fintech project.

An ordinary company can be incorporated relatively quickly.

A regulated fintech institution is different.

The overall timeline depends upon:

licence type;
completeness of application documents;
shareholder structure;
capital readiness;
management appointments;
technical infrastructure;
regulatory questions;
internal control arrangements;
AML systems;
information-security readiness.

Therefore, companies should distinguish between:

company incorporation time, and

time required to become legally operational as a regulated fintech institution.

A company may legally exist long before it is entitled to provide regulated services.

25. Do You Need a Fintech Lawyer in Turkey?

A fintech lawyer’s role should begin before the incorporation stage.

Regulatory advice is particularly important because fintech classification depends upon the precise product and transaction flow.

A lawyer advising on a Turkish fintech project should ideally review:

ownership;
corporate structure;
payment flow;
licence requirements;
customer contracts;
banking partnerships;
AML procedures;
personal data;
technology outsourcing;
cross-border arrangements;
regulatory applications.

A seemingly minor adjustment to how customer money flows through an application can fundamentally change the licensing analysis.

For this reason, legal and technical architecture should be developed together.

Frequently Asked Questions About Establishing a Fintech Company in Turkey

Can a foreigner establish a fintech company in Turkey?

Yes. Foreign investors can establish Turkish companies. However, regulated financial activities require the relevant sector-specific authorisation.

Is there a fintech licence in Turkey?

There is no single general fintech licence. The required authorisation depends on the business model.

Which authority licenses payment institutions in Turkey?

Payment institutions and electronic money institutions are authorised and supervised by the Central Bank of the Republic of Türkiye.

Does a payment institution have to be a joint-stock company?

Yes. Law No. 6493 requires payment institutions to be established as joint-stock companies and satisfy the statutory requirements applicable to the company and its shareholders.

Can I establish a digital wallet company in Turkey?

Yes, but the regulatory treatment depends upon the wallet’s functionality.

A wallet that stores monetary value, executes payment transactions or provides another regulated payment service may require appropriate authorisation.

Can a foreign payment company serve Turkish customers with its European licence?

A foreign licence does not automatically authorise regulated payment services in Türkiye.

Local licensing or an authorised cooperation structure may therefore be necessary depending upon the business model.

Are crypto companies regulated in Turkey?

Yes. Crypto-asset service providers are regulated under Capital Markets Law No. 6362 and CMB regulations following the reforms introduced in 2024 and 2025.

Can a Turkish fintech use foreign cloud providers?

Possibly, but both sector-specific information systems requirements and Turkish personal data legislation must be examined.

Cross-border personal data transfers must comply with Article 9 of Law No. 6698.

What are the minimum own-funds requirements for payment institutions in 2026?

From 30 June 2026, relevant CBRT minimum own-funds thresholds include TRY 20 million, TRY 40 million and TRY 105 million depending upon the type of payment or electronic money institution. The precise classification and separate capital requirements should be reviewed before filing an application.

Conclusion

Establishing a fintech company in Türkiye requires much more than incorporating a company and creating a financial application.

The regulatory structure should be determined from the beginning.

A successful fintech market-entry strategy normally requires coordination between:

corporate law, financial regulation, AML compliance, personal data protection, cybersecurity, technology architecture and commercial contracts.

The first and most important step is identifying the legal nature of the proposed service.

If the business receives or transfers money, issues stored value, accesses payment accounts, initiates payments, provides banking functions, trades crypto assets or holds customer assets, regulatory authorisation may be required.

Payment institutions and electronic money institutions operate under the supervision of the CBRT. Digital banking and Banking-as-a-Service arrangements may fall within BRSA regulation. Crypto-asset platforms and custody providers are regulated by the CMB. AML obligations are supervised through MASAK legislation, while personal data processing remains subject to Law No. 6698.

International investors should also understand that incorporating a Turkish company does not itself give that company permission to conduct regulated financial activities.

The regulatory licence must be obtained separately where required.

In addition, compliance does not end when a licence is issued. The significant CBRT enforcement measures announced for 2025—including licence cancellations and temporary suspensions—demonstrate that Turkish regulators actively supervise the sector.

For this reason, fintech businesses should design their legal structure, financial flows, compliance systems and technical infrastructure as an integrated project.

Foreign investors and entrepreneurs planning to establish a fintech company in Turkey, obtain a payment institution licence, obtain an electronic money licence, establish a digital wallet, operate an open banking service, launch an embedded-finance business or establish a crypto-asset platform should undertake a detailed regulatory assessment before incorporation and commercial launch.

Proper legal planning at the beginning of a fintech project can significantly reduce licensing delays, restructuring costs, regulatory sanctions and investment risks later.

Legal Disclaimer: This publication provides general information concerning the establishment and regulation of fintech companies in Türkiye as of July 2026. It does not constitute legal advice. Regulatory requirements, financial thresholds and licensing conditions may vary according to the business model and may be amended over time. Each fintech project should therefore be assessed individually before incorporation, investment or commencement of regulated activities.

Categories:

Genel

How to Establish a Fintech Company in Turkey: Legal and Regulatory Guide