Introduction: Merchant Acquiring Has Become a Core Regulated Fintech Activity in Turkey

Merchant acquiring is one of the most commercially important areas of the Turkish payment services market.

Almost every online marketplace, e-commerce company, subscription platform, mobile application and physical retailer ultimately requires a mechanism through which customers can pay and merchants can receive their funds.

Historically, this function was closely associated with banks and conventional POS infrastructure.

Today, the market also includes licensed payment institutions and electronic money institutions offering:

virtual POS services, physical POS infrastructure, merchant payment acceptance, payment aggregation, payment orchestration and related merchant services.

However, merchant acquiring is not merely a technical service.

Under Turkish payment legislation, acquiring payment instruments is expressly regulated as a payment service.

Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions identifies issuing and acquiring payment instruments among regulated payment services. The Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) currently confirms that payment institutions holding permission under Article 12(1)(c) are authorised, within that paragraph, specifically for “acquiring payment instruments.”

The current Payment Services Regulation defines acquiring in substance as a service which includes an agreement with the merchant and is provided so that a transaction using a payment instrument results in funds being transferred to that merchant.

This definition creates the central legal distinction.

A business that merely supplies software to a bank or licensed payment institution may potentially remain a technical provider.

A company that contracts with merchants, enables customers to use payment instruments at those merchants, processes the transactions and undertakes the regulated payment acceptance function enters the territory of merchant acquiring.

This distinction affects:

licensing, regulatory capital, merchant onboarding, safeguarding, AML/KYC, information systems, data protection and supervision.

It also determines whether the business can legally provide virtual POS or physical POS solutions to Turkish merchants.

This guide explains the principal legal requirements for merchant acquiring services in Turkey as of July 2026.

1. What Is Merchant Acquiring?

Merchant acquiring is the payment service that enables a merchant to accept a payment instrument from a customer and ultimately receive the corresponding funds.

The Turkish Payment Services Regulation defines the concept by reference to two particularly important characteristics.

First, the service includes an agreement with the merchant.

Second, the service is structured so that the payment transaction results in a transfer of funds to the merchant.

A typical acquiring relationship may therefore involve:

Customer → payment instrument → acquirer/payment institution → merchant

The payment instrument may include:

• a credit card;
• debit card;
• prepaid card;
• other qualifying payment instrument.

Merchant acquiring can be provided through both physical and digital acceptance infrastructure.

For fintech businesses, the most important modern acquiring product is often virtual POS.

2. Merchant Acquiring Is a Regulated Payment Service

Article 12 of Law No. 6493 treats the issuance and acquiring of payment instruments as a regulated payment service.

The CBRT’s current public register makes an important clarification regarding non-bank payment institutions: where an institution has authorisation under Article 12(1)(c), that permission is restricted to the acquiring side of the provision for the relevant authorised payment institutions.

Accordingly, an ordinary company cannot simply begin providing merchant acquiring because it has developed POS technology.

The company must determine whether it qualifies as an authorised payment service provider.

The Turkish payment services framework recognises authorised payment service providers including:

• banks;
• payment institutions;
• electronic money institutions;
• PTT within its statutory framework.

The CBRT remains the authority responsible for the regulation and supervision of payment and electronic money institutions under Law No. 6493.

For payment companies, merchant acquiring therefore normally requires the relevant CBRT operating permission.

3. Merchant Acquiring vs Payment Gateway

One of the most important distinctions in Turkish fintech law is the difference between:

merchant acquiring, and

technical payment infrastructure.

A payment gateway may transmit payment information between:

• a merchant;
• payment service provider;
• card network;
• bank.

Its services may include:

• API connectivity;
• encryption;
• tokenisation;
• data processing;
• transaction routing;
• authentication.

Where the provider genuinely remains technical and does not become the regulated payment service provider or acquire ownership of the funds transferred, the statutory technical-service-provider exclusion may potentially be relevant.

However, the commercial label “payment gateway” does not determine the legal result.

A company becomes much more likely to be treated as an acquirer where it:

• contracts directly with the merchant as payment provider;
• enables the merchant to accept payment instruments;
• determines merchant settlement arrangements;
• undertakes the payment acceptance obligation;
• participates in the regulated fund transfer to the merchant.

The legal analysis should therefore focus on the contractual and financial role, not merely the software architecture.

4. Merchant Acquiring vs Payment Aggregator

Merchant acquiring also overlaps with payment aggregation.

A payment aggregator may allow thousands of merchants to obtain access to payment acceptance through one integration.

From a commercial perspective, the aggregator may provide:

• virtual POS;
• merchant onboarding;
• unified reporting;
• fraud monitoring;
• reconciliation;
• multi-bank routing.

However, “payment aggregator” is not an independent Turkish licence category.

Where the aggregator contracts with the merchant and provides the regulated payment acceptance service, its activity must be classified under the relevant Law No. 6493 payment-service permissions.

For many aggregator models, merchant acquiring is therefore the regulatory core.

5. Virtual POS Services Are Specifically Addressed by the CBRT

The CBRT’s Guide on Relating Business Models Offered in the Payments Area to Payment Service Types specifically analyses virtual POS services.

The Guide describes virtual POS as software enabling merchants, particularly online sellers, to accept payments through credit cards, debit cards and qualifying prepaid cards without the physical use of the card.

The CBRT notes that licensed payment and electronic money institutions may connect through APIs to the POS infrastructures of different banks and make those POS services available to merchants through a unified software layer.

This resembles the commercial model used by many modern Turkish payment aggregators.

However, the CBRT’s legal conclusion is particularly important.

For the virtual POS business model described in the Guide, the CBRT states that authorisation may be required under:

• Article 12(1)(a);
• Article 12(1)(b); and
• Article 12(1)(c), limited to acquiring payment instruments.

Accordingly, businesses should not automatically assume that acquiring permission under Article 12(1)(c) alone covers every element of a virtual POS structure.

The exact flow of funds and accounts can require additional permission.

6. Why Articles 12(a) and 12(b) Can Matter for Virtual POS

The reason lies in settlement architecture.

In some virtual POS models, funds resulting from transactions are transferred from the underlying payment infrastructure to the payment institution, which then transfers them onward to merchants.

The CBRT Business Models Guide explains that such transaction flows can also resemble fund transfers involving payment accounts.

Accordingly, a payment company designing a virtual POS product should separately analyse:

• whether payment accounts are being operated;
• whether funds are transferred through such accounts;
• whether acquiring is being provided.

This illustrates a fundamental principle of Turkish fintech licensing:

One commercial product can involve several regulated payment services.

The product name “virtual POS” does not itself determine the complete licence scope.

7. Physical POS Services

The CBRT’s Business Models Guide also addresses physical POS services.

The Guide states that physical POS enables payment through credit cards, debit cards and qualifying prepaid cards at merchants using physical acceptance equipment.

For the business model examined by the CBRT, physical POS can similarly require authorisation under Article 12(1)(a), Article 12(1)(b) and Article 12(1)(c), with paragraph (c) limited to acquiring.

Accordingly, virtual and physical POS structures should both be analysed based on the complete fund flow.

8. Bank Card and Credit Card Law Must Also Be Considered

The CBRT expressly notes that the assessment of virtual POS and physical POS models under Law No. 6493 does not eliminate the relevance of Law No. 5464 on Bank Cards and Credit Cards and assessments that may fall within the BRSA’s regulatory sphere.

This is an important compliance warning.

Obtaining the correct CBRT payment institution permission does not automatically resolve every regulatory issue involving card-based payments.

Depending on the model, companies should also examine:

• card scheme rules;
• Bank Cards and Credit Cards Law;
• BRSA requirements;
• card network requirements.

Merchant acquiring therefore sits at the intersection of payment regulation and card regulation.

9. The Merchant Contract Is Central to Acquiring

The definition of acquiring expressly refers to an agreement with the merchant.

The merchant agreement should therefore identify the licensed institution that is providing the payment acceptance service.

This is especially important in structures involving:

• fintech brands;
• payment aggregators;
• upstream banks;
• technical payment gateways;
• marketplaces.

A customer-facing company cannot automatically rely on an upstream institution’s licence where it independently undertakes the regulated acquiring relationship.

The contract and the actual operational structure should be consistent.

10. Turkey’s Merchant Registration System

Türkiye has created a dedicated Merchant Registration System, known in Turkish as the İşyeri Kayıt Sistemi (“İKS”).

The system was introduced to facilitate payment transaction processes and reduce fraud and malicious activity.

The CBRT explains that the system, operated through the Interbank Card Center (“BKM”), assigns a unique merchant code to merchants selling goods and services through payment methods falling within regulated payment services.

Merchant acquiring companies must therefore incorporate the Merchant Registration System into onboarding.

11. Every Merchant Receives a Specific Merchant Code

Under Article 9 of the Payment Services Regulation, a merchant offering goods or services using a payment method within the regulated payment-service framework receives a merchant-specific code.

The code is issued by BKM.

The system links the merchant code with information including:

• merchant address;
• Turkish identification number or tax identification number;
• equivalent information for foreign merchants.

A merchant cannot have multiple merchant codes under the same framework, and the payment service provider entering into the merchant contract must take necessary measures to verify the accuracy of the information.

This creates a major compliance obligation for acquirers.

Merchant onboarding cannot be anonymous.

12. Merchant Codes Must Be Used in Merchant Payment Services

Payment service providers must use the merchant code when providing services that enable merchants to accept regulated payment methods.

This has important consequences for aggregator and PayFac-type structures.

A business should not structure thousands of unrelated merchants as though all transactions belonged to one unidentified “master merchant.”

The regulatory framework is designed to preserve merchant-level traceability.

13. The Acquirer Must Check the Merchant Before Starting Service

Article 10 of the Payment Services Regulation imposes a specific pre-onboarding requirement.

Before beginning merchant payment services, the payment service provider must check whether the merchant is registered in the Merchant Registration System.

Where the merchant is not registered, the provider must ensure registration.

Where the merchant is already registered, the payment service provider must check whether there is any negative record regarding that merchant.

If the negative record reflects a statutory prohibition on providing services, the payment service provider must comply with that prohibition.

Where there is no automatic prohibition, the negative information must nevertheless be taken into account as part of the institution’s risk-management assessment.

This means merchant acquiring requires legal and compliance approval—not merely sales approval.

14. Merchant Monitoring Must Continue After Onboarding

Merchant due diligence does not end when the merchant agreement is signed.

The Payment Services Regulation requires payment service providers to check the Merchant Registration System regularly regarding the merchants they serve.

This check must be conducted at least:

once every year.

Where negative information appears, the acquirer must take appropriate action depending on the content.

In practice, higher-risk merchants may justify more frequent internal review.

15. The Merchant Must Be Informed About İKS Data Sharing

Before signing the framework agreement, the payment service provider must clearly inform the merchant about information sharing and queries that will be carried out through the Merchant Registration System.

The institution must also obtain the merchant’s approval and ensure the framework agreement contains the necessary provisions concerning that approval.

Merchant agreements should therefore be specifically adapted to Turkish regulatory requirements.

An international acquiring template cannot simply be translated into Turkish and used without localisation.

16. Using Another Payment Service Provider’s Infrastructure

A payment company may provide merchant acquiring while using infrastructure supplied by another payment service provider.

The Regulation expressly recognises this model.

Where one payment service provider uses another provider’s infrastructure in supplying merchant payment services, the merchant-facing PSP must communicate specified merchant information to the infrastructure provider within:

ten business days.

The information includes the merchant code and relevant identity or tax information.

This rule is particularly important for:

• fintech aggregators;
• virtual POS platforms;
• payment institutions using bank POS infrastructure.

17. Using a Bank’s POS Does Not Automatically Remove Licensing Requirements

A common misconception is:

“We process payments through Bank X’s POS, therefore we are only a technology provider.”

That conclusion is not necessarily correct.

The Payment Services Regulation expressly contemplates a regulated payment service provider providing merchant services while using another payment service provider’s infrastructure.

Therefore, the existence of a licensed bank in the background does not automatically remove the front-end company’s acquiring obligations.

The real question remains:

Who provides the payment service to the merchant?

18. The Infrastructure Provider’s Use of Merchant Information Is Restricted

Article 10 also limits how the upstream infrastructure provider may use information received regarding merchants.

The relevant data may be used for purposes including:

• risk assessment;
• regulatory examination;
• technical setup;
• infrastructure activation.

However, it cannot be repurposed for unrelated objectives such as:

• marketing;
• customer acquisition.

This is commercially important where the upstream infrastructure provider competes with the fintech acquirer for the same merchants.

19. The Infrastructure Provider May Raise Merchant Risk Concerns

The infrastructure provider can require the merchant-facing PSP not to provide services to a particular merchant where this is justified by the provider’s risk policies.

However, the Regulation also states that the upstream infrastructure provider cannot prevent the PSP from providing merchant payment services for arbitrary reasons.

The framework therefore recognises both:

• legitimate financial risk management;
• competition concerns.

Merchant acquiring contracts between financial institutions should reflect this balance.

20. Transactions Must Be Monitored Merchant by Merchant

The Regulation expressly requires the payment service provider to record and monitor transactions so that they can be tracked specifically for each merchant.

This requirement is particularly important for large aggregators.

Systems should be capable of identifying:

• merchant;
• transaction amount;
• transaction date;
• payment channel;
• refunds;
• chargebacks;
• suspicious patterns.

A consolidated transaction ledger that cannot reliably identify the underlying merchant creates significant compliance risk.

21. Merchant Acquiring and MASAK

Merchant acquiring is also subject to Turkish anti-money laundering regulation.

MASAK’s Compliance Programme Regulation requires payment institutions to establish a formal compliance programme except for certain institutions exclusively providing specifically listed limited services.

The exclusions concern exclusive bill-payment intermediation, exclusive Payment Initiation Services and exclusive Account Information Services.

Merchant acquiring is not one of these exceptions.

Accordingly, a payment institution providing merchant acquiring will generally need an institutional AML compliance programme.

This includes:

• risk management;
• monitoring and control;
• compliance officer;
• compliance unit;
• training;
• internal audit.

22. MASAK Has Introduced Specific Enhanced Measures for Acquiring

One of the most important developments for merchant acquiring is found in the MASAK Compliance Programme Regulation.

For payment services involving terminal services under Article 12(1)(a), Article 12(1)(b) and the acquiring element of Article 12(1)(c), the Regulation imposes enhanced measures when establishing a business relationship with merchants and carrying out other identification-triggering transactions.

This confirms that merchant acquiring is treated as an area of heightened financial crime risk.

Payment companies should therefore avoid viewing merchant KYC as a routine corporate-document collection exercise.

23. What Should Merchant KYC Include?

A robust merchant due diligence programme should generally establish:

• legal identity;
• trade registry information;
• tax identification;
• authorised representatives;
• beneficial ownership;
• actual business activity;
• expected transaction volumes;
• website or application;
• geographic exposure.

The acquirer should understand what the merchant actually sells.

This is particularly important for online businesses where the payment activity may differ from the commercial activity declared during onboarding.

24. Transaction Laundering Risk

Merchant acquiring companies face the specific risk of transaction laundering.

A merchant may tell the payment company that it sells ordinary consumer products while actually processing payments for:

• another business;
• prohibited products;
• fraudulent investments;
• illegal gambling;
• unlicensed financial activity.

This creates serious AML, fraud and regulatory exposure.

The acquirer should therefore monitor whether:

• transaction volume matches the merchant profile;
• average ticket size is reasonable;
• refund patterns are unusual;
• merchant websites match declared business activity.

Risk-based merchant monitoring should continue throughout the relationship.

25. Suspicious Transaction Reporting

MASAK has a dedicated suspicious transaction reporting framework for payment and electronic money institutions.

Its payment/e-money sector guide was updated to reflect current fintech products and transaction typologies.

A merchant acquiring institution should therefore be capable of detecting suspicious behaviour including:

• fictitious transactions;
• rapid unexplained turnover growth;
• abnormal refund patterns;
• circular transactions;
• merchant accounts used for third parties;
• transactions inconsistent with declared activities.

Suspicion—not transaction amount alone—is the relevant trigger for suspicious transaction reporting.

26. Safeguarding Merchant and User Funds

Payment companies must also distinguish between their own corporate money and funds relating to payment service users.

The CBRT expressly states that, under Article 22 of Law No. 6493, funds of payment-service users held by payment and electronic money institutions are protected in safeguarding accounts maintained at banks.

For merchant acquiring companies, treasury and settlement procedures should therefore clearly distinguish:

institution revenue

from

funds awaiting settlement.

A merchant settlement float should not automatically be treated as unrestricted working capital.

27. Merchant Settlement Terms

Merchant agreements should clearly regulate settlement.

Important issues include:

• settlement cycle;
• cut-off times;
• weekends and holidays;
• deductions;
• commission;
• refund adjustments;
• chargebacks;
• fraud reserves.

Settlement procedures should match the actual regulatory flow.

A contract stating that the payment company “owns” funds until it decides to pay the merchant can raise serious legal concerns where the economic reality involves protected payment-service funds.

28. Chargebacks

Chargebacks are especially important in card acquiring.

The merchant agreement should clearly establish:

• applicable chargeback rules;
• evidence requirements;
• merchant response deadlines;
• debit rights;
• dispute procedures.

However, merchant risk clauses should not be so broad that the payment institution can indefinitely retain every merchant’s settlement without objective justification.

A well-drafted contract should distinguish:

• actual chargeback exposure;
• fraud risk;
• general commercial disputes.

29. Rolling Reserves and Holdbacks

Payment companies may use risk-control mechanisms such as:

• rolling reserves;
• delayed settlement;
• security deposits;
• temporary holdbacks.

These mechanisms may be appropriate for higher-risk merchants.

However, the merchant agreement should explain:

• calculation;
• duration;
• circumstances for use;
• release conditions.

The payment institution should also analyse how the relevant funds are treated under payment-services safeguarding and accounting rules.

30. Virtual POS Is Not Necessarily Only an Acquiring Licence

For SEO and practical purposes, one misconception should be addressed directly.

Does a virtual POS company only need an Article 12(1)(c) licence?

Not necessarily.

The CBRT’s Business Models Guide states that the virtual POS model examined in the Guide requires authorisation under:

• Article 12(1)(a);
• Article 12(1)(b);
• Article 12(1)(c) limited to acquiring.

The correct licence depends on how the funds and accounts operate.

Therefore, a virtual POS startup should prepare a full transaction-flow map rather than filing for acquiring permission based only on the commercial label.

31. Regulatory Capital for Merchant Acquiring Companies in 2026

Payment companies must maintain adequate financial resources.

The CBRT updated the minimum own-funds amounts through the Communiqué published on 31 January 2026, effective from 30 June 2026.

For payment institutions other than the specified bill-payment category and the pure account-information category, the minimum is:

TRY 40 million.

Electronic money institutions are subject to TRY 105 million, while the specified bill-payment category is subject to TRY 20 million.

A merchant acquiring payment institution therefore generally falls within the TRY 40 million minimum own-funds category, subject to the full calculation rules applicable to the institution.

This is an ongoing prudential requirement.

32. Minimum Own Funds Are Different From Paid-In Capital

The Payment Services Regulation also contains statutory capital requirements during the licence application process.

For ordinary payment services, the Regulation specifies a minimum paid-in capital of TRY 2 million at the application stage.

However:

TRY 2 million paid-in capital does not mean the institution can operate in 2026 with only TRY 2 million of regulatory financial resources.

The continuing minimum own-funds requirement for the relevant merchant acquiring payment institution category is much higher.

Founders and investors should therefore distinguish:

paid-in capital

from

ongoing minimum own funds.

33. The Licensing Application Is Substantive

Obtaining an acquiring licence is not a simple notification.

The CBRT evaluates matters including:

• shareholders;
• source of capital;
• management;
• business model;
• organisational structure;
• fraud statistics methodology;
• information systems;
• financial capacity.

The current Payment Services Regulation requires detailed documentation concerning qualified shareholders and controllers, management and planned operations as part of the authorisation process.

A serious acquiring business should therefore prepare regulatory infrastructure before submitting the licence application.

34. Merchant Acquiring and Information Systems

Merchant acquiring is fundamentally technology dependent.

The CBRT’s current payment-services legal framework includes the dedicated Information Systems Communiqué applicable to payment and electronic money institutions.

A merchant acquiring company should maintain controls covering:

• authentication;
• encryption;
• access management;
• logging;
• fraud detection;
• penetration testing;
• vulnerability management;
• business continuity;
• outsourcing.

API security is particularly important for virtual POS businesses.

35. Sensitive Payment Information

Merchant acquiring companies may process highly sensitive information concerning:

• payment instruments;
• transactions;
• merchants;
• consumers;
• devices.

Security architecture should minimise unnecessary storage of card and authentication information.

Where third-party infrastructure is used, access should be strictly controlled and contractually documented.

Cybersecurity incidents in acquiring systems can expose thousands of merchants simultaneously.

36. KVKK Compliance for Merchant Acquirers

Merchant acquiring companies also process personal data under Law No. 6698 on the Protection of Personal Data (“KVKK”).

In July 2026, the Personal Data Protection Authority and TÖDEB published a dedicated Good Practices Guide on the Protection of Personal Data in the Payment and Electronic Money Sector.

The Guide addresses:

• categories of personal data;
• controller/processor relationships;
• processing conditions;
• transfers;
• controller obligations;
• information security.

Merchant acquiring institutions should therefore review personal data relating to:

• individual merchants;
• company representatives;
• beneficial owners;
• customers;
• fraud investigations.

37. Merchant Data Is Not Automatically Free Marketing Data

The Payment Services Regulation itself demonstrates the importance of purpose limitation.

Where merchant information is supplied to another PSP because its infrastructure is being used, the upstream PSP cannot use that information for unrelated purposes such as marketing or customer acquisition.

This principle should also be reflected in data architecture.

A bank providing backend acquiring infrastructure should not automatically convert the fintech’s merchant list into a sales database.

38. Cross-Border Technology and Data

Many acquiring businesses use foreign:

• cloud systems;
• fraud engines;
• analytics tools;
• CRM;
• payment technology.

These arrangements require review under KVKK’s cross-border data-transfer regime.

But payment companies face an additional issue.

Compliance with KVKK alone does not override sector-specific CBRT information systems and localisation rules.

The technology architecture must therefore be reviewed under both:

data protection law, and

payment-sector information systems regulation.

39. Foreign Merchant Acquirers

A foreign payment company cannot assume that its overseas acquiring licence permits it to provide regulated merchant acquiring directly in Türkiye.

Türkiye does not operate a general cross-border payment passport under which a foreign licence automatically replaces CBRT authorisation.

A foreign acquirer intending to contract Turkish merchants should therefore consider structures such as:

• establishing and licensing a Turkish payment institution;
• acquiring an existing Turkish licensed institution;
• partnering with a Turkish PSP while remaining purely technical.

The correct structure depends on who legally provides the payment service.

40. Merchant Acquiring and Marketplaces

Marketplaces require particularly careful analysis.

A marketplace may commercially collect payments from buyers and transfer amounts to sellers.

In some circumstances, the commercial-agent exclusion under Law No. 6493 may be relevant.

However, a marketplace cannot avoid payment regulation merely by describing itself as an agent.

Where its practical role is providing merchant payment acceptance to unrelated sellers, merchant acquiring rules may become relevant.

Marketplace structures should therefore be reviewed according to:

• underlying sale relationship;
• contractual authority;
• money flow;
• control over settlement.

41. Merchant Acquiring and PayFac Models

International companies frequently use the expression Payment Facilitator (“PayFac”).

A PayFac may onboard large numbers of smaller merchants under an upstream acquiring relationship.

Turkish law does not recognise “PayFac” as a standalone regulatory exemption.

The company should determine whether it is:

a licensed acquirer,

a regulated payment institution using another PSP’s infrastructure,

or

a genuine technical provider.

The Payment Services Regulation’s rules on using another PSP’s infrastructure provide an important framework for the second structure.

42. Merchant Acquiring Due Diligence

An investor acquiring a payment company should conduct specialised acquiring due diligence.

Important questions include:

Licence Scope: Does the company have the necessary Article 12 permissions?

Virtual POS: Does the business model require Articles 12(a), (b) and (c)?

İKS: Are merchants correctly registered?

Merchant Monitoring: Are negative records checked?

Upstream Infrastructure: Are banks and PSP relationships compliant?

AML: Is merchant KYC functioning?

Safeguarding: Are merchant settlement funds properly protected?

Capital: Does the company meet the current TRY 40 million minimum?

KVKK: Is merchant/customer information lawful?

Cybersecurity: Has the POS infrastructure been properly audited?

A payment company may have significant gross transaction volume while carrying substantial regulatory risk.

43. Current CBRT Enforcement Makes Compliance Particularly Important

The CBRT’s January 2026 supervisory announcement demonstrates that payment regulation is actively enforced.

For 2025, the CBRT reported:

• 7 licence revocations;
• 14 licence suspensions;
• dividend restrictions imposed on 12 institutions;
• TRY 373.2 million in administrative fines across 72 institutions;
• 331 suspected unauthorised payment-service cases referred to prosecutors and/or courts.

The CBRT also publicly suspended acquiring-related permissions in individual enforcement cases during 2025.

Merchant acquiring should therefore be treated as a high-compliance financial activity.

44. Common Merchant Acquiring Compliance Mistakes

One common mistake is assuming virtual POS is only software. The CBRT treats virtual POS structures as capable of involving regulated payment services.

Another is relying entirely on an upstream bank’s licence. Using another PSP’s infrastructure does not automatically remove the front-end provider’s regulatory obligations.

A third is failing to identify merchants individually. Türkiye’s İKS framework requires merchant-specific codes and merchant-level monitoring.

A fourth is treating merchant KYC as a one-time formality. The Regulation requires at least annual checks of relevant negative records, while MASAK imposes heightened measures in terminal acquiring relationships.

Finally, payment companies frequently underestimate capital requirements by confusing application-stage paid-in capital with the current TRY 40 million minimum own-funds requirement.

45. Merchant Acquiring Compliance Checklist

Before launching merchant acquiring services in Türkiye, a payment company should verify that:

The business model has been legally classified.

The company knows whether it provides acquiring, payment accounts, fund transfers or several services simultaneously.

The correct Article 12 permissions have been obtained.

Virtual POS structures should be compared with the CBRT Business Models Guide.

Each merchant is identifiable.

A valid merchant code must be used where required.

Merchant information is verified.

Identity and tax information should be checked.

İKS is reviewed before onboarding.

Negative records must be taken into account.

Existing merchants are monitored.

At minimum, relevant İKS checks should be repeated annually.

Upstream PSP arrangements are compliant.

Merchant data should be transmitted within the required ten-business-day framework where another PSP’s infrastructure is used.

Transactions are recorded merchant by merchant.

The system should not obscure individual merchants.

MASAK requirements are operational.

Merchant KYC, beneficial ownership, risk assessment and suspicious transaction monitoring must function in practice.

Safeguarding is correctly structured.

Merchant/payment-service funds should remain separate from ordinary company money.

Regulatory capital is sufficient.

The applicable minimum own funds are TRY 40 million for the general payment institution category from 30 June 2026.

Cybersecurity is robust.

Virtual and physical POS systems should meet CBRT information systems standards.

KVKK compliance is documented.

Merchant and consumer data should have identified legal bases and transfer rules.

Frequently Asked Questions About Merchant Acquiring in Turkey

What is merchant acquiring under Turkish law?

Merchant acquiring broadly refers to a payment service involving an agreement with the merchant and enabling payment-instrument transactions to be accepted and processed so that funds are transferred to the merchant.

Is merchant acquiring regulated in Turkey?

Yes. Acquiring payment instruments is a regulated payment service under Law No. 6493. The CBRT’s current register expressly identifies Article 12(1)(c) permission for payment institutions as limited to acquiring.

Who regulates merchant acquiring?

The CBRT regulates and supervises payment and electronic money institutions under Law No. 6493.

Does a virtual POS provider need a payment licence?

Potentially yes. The CBRT’s Business Models Guide states that the virtual POS model it analyses requires permissions under Article 12(1)(a), (b) and Article 12(1)(c), limited to acquiring.

What about physical POS?

The same CBRT Guide states that the physical POS model examined also requires Articles 12(1)(a), (b) and acquiring under (c).

Can a payment company use another bank’s POS infrastructure?

Yes, subject to the applicable regulatory structure. The Payment Services Regulation expressly addresses merchant services supplied using another payment service provider’s infrastructure.

Does using a bank’s infrastructure mean the fintech does not need a licence?

No. The actual merchant-facing payment service must still be classified. An upstream bank does not automatically eliminate the front-end provider’s acquiring obligations.

What is the Merchant Registration System?

The İKS is the BKM-operated central system through which unique merchant codes and related merchant information are generated and monitored to support payment transactions and combat fraud.

Must merchants be checked before onboarding?

Yes. The payment service provider must check the İKS before starting merchant services and evaluate negative records.

How often must existing merchants be checked?

Relevant negative-record checks must be performed regularly and at least once each year.

Can multiple merchants be processed under one unidentified master account?

The regulatory framework requires merchant-specific codes and merchant-level tracking, making structures that obscure the underlying merchant particularly risky.

What is the 2026 minimum own-funds requirement?

For the general payment institution category applicable to merchant acquiring businesses, the minimum is TRY 40 million from 30 June 2026, subject to the full regulatory calculation framework.

Are merchant acquiring companies subject to MASAK?

Yes. Merchant acquiring payment institutions generally fall within the formal MASAK compliance-programme regime.

Are there special AML measures for acquiring?

Yes. MASAK’s current Compliance Programme Regulation contains enhanced measures for merchant relationships involving terminal services under Article 12(a), (b) and the acquiring portion of Article 12(c).

Does KVKK apply to merchant acquiring?

Yes. Merchant acquiring companies process personal data relating to merchants, representatives, customers and transactions. The 2026 payment/e-money sector guide specifically addresses data processing, transfers and security in this sector.

Conclusion: How to Structure Merchant Acquiring Services Legally in Turkey

Merchant acquiring services in Turkey are firmly within the regulated payment-services framework.

The legal starting point is Article 12 of Law No. 6493.

The CBRT’s current authorised institution register expressly confirms that the relevant Article 12(1)(c) permission for payment institutions covers acquiring payment instruments.

However, payment companies should not reduce merchant acquiring compliance to obtaining a single checkbox under Article 12(c).

The complete transaction architecture matters.

The CBRT’s Business Models Guide demonstrates this particularly clearly for virtual and physical POS.

For the models analysed by the CBRT, the required authorisation includes:

payment account activity under Article 12(a),

fund transfers under Article 12(b),

and

payment instrument acquiring under Article 12(c).

This has a significant practical implication.

A payment company should design its licence around its actual:

money flow, account structure and merchant settlement process.

The product name alone is not sufficient.

A company may describe its product as:

• virtual POS;
• payment aggregator;
• checkout solution;
• merchant payment infrastructure;
• PayFac.

The regulator will analyse what the company actually does.

The merchant relationship is equally important.

Turkish law defines acquiring in a way that includes contracting with the merchant and enabling a transaction that ultimately results in transfer of funds to that merchant.

Where a fintech merely provides technical infrastructure behind a licensed acquirer, its position may be substantially different.

Where the fintech itself contracts with the merchant and assumes the acquiring function, licensing becomes central.

Merchant onboarding is also now heavily institutionalised through Türkiye’s Merchant Registration System.

Every relevant merchant receives a unique merchant code generated through BKM, and the contracting payment service provider must take steps to verify merchant information.

Before providing acquiring services, the PSP must check whether the merchant is registered and whether negative records exist.

Where necessary, negative information must feed into the institution’s risk management.

Existing merchants must also be checked at least annually.

This makes merchant onboarding a regulated compliance function rather than a purely commercial sales process.

Payment aggregators should therefore build a workflow combining:

sales → merchant KYC → İKS check → AML risk classification → contract → technical onboarding → ongoing monitoring.

The merchant agreement should reflect the same structure.

The merchant must be informed about İKS data sharing and queries before the framework agreement is executed, and the required consent provisions should appear in the agreement.

Where another payment service provider’s infrastructure is used, additional obligations arise.

The merchant-facing PSP must transmit specified merchant information to the infrastructure provider within ten business days.

At the same time, the infrastructure provider is restricted from using that information for unrelated purposes such as marketing or customer acquisition.

These provisions are particularly relevant to fintech payment aggregators using bank virtual POS infrastructure.

They show that Turkish regulation recognises multi-layer acquiring structures.

But the regulatory responsibility must remain clear.

The merchant-facing PSP cannot simply disappear behind the upstream bank.

AML compliance is another core part of merchant acquiring.

Merchant acquiring payment institutions are not among the payment-institution categories exempted from the full MASAK compliance programme.

Accordingly, they generally require formal:

• risk management;
• monitoring and control;
• compliance officer structure;
• training;
• internal audit.

Moreover, MASAK has expressly introduced heightened measures for terminal acquiring services involving Articles 12(a), 12(b) and the acquiring element of Article 12(c).

This should be treated as a major compliance priority.

Merchant acquiring businesses can become attractive channels for:

• transaction laundering;
• fictitious sales;
• illegal businesses;
• misuse of merchant accounts;
• fraudulent refund activity.

Accordingly, the acquirer’s obligation is not simply to know the merchant’s company name.

It should understand the merchant’s actual business and whether transaction activity matches that business.

Safeguarding represents another essential element.

The CBRT confirms that payment-service-user funds at payment and electronic money institutions are protected through bank safeguarding accounts under Article 22 of Law No. 6493.

Merchant settlement architecture should therefore clearly distinguish customer/payment funds from corporate operating money.

Fintech companies should never build their cash-flow model around the assumption that settlement balances are ordinary working capital.

The capital requirements for entering this market are also meaningful.

From 30 June 2026, the current minimum own-funds requirement for the general payment institution category is TRY 40 million.

This should not be confused with the much lower paid-in capital floor stated in the licensing provisions of the Payment Services Regulation.

A serious acquiring business therefore needs:

regulatory capital plus operational capital.

Technology expenditure, fraud losses, employees, legal costs, cybersecurity, insurance, compliance and merchant support all sit above the regulatory minimum.

Data protection is equally important.

The July 2026 payment and electronic money sector good-practices work led by the Personal Data Protection Authority and TÖDEB specifically covers controller/processor relationships, processing grounds, transfers and data security.

Merchant acquirers should therefore map the entire data flow alongside the money flow.

The same merchant may generate:

• tax information;
• beneficial ownership information;
• transaction data;
• customer information;
• fraud indicators;
• device information.

Legal processing grounds and data-access rights should be determined for each category.

Finally, businesses should recognise that CBRT enforcement in the payment sector is active.

The regulator reported seven licence revocations, fourteen licence suspensions and approximately TRY 373.2 million in administrative fines during its 2025 supervisory work, while hundreds of suspected unauthorised-payment cases were referred to judicial authorities.

For merchant acquiring companies, the practical message is therefore straightforward:

A successful acquiring business needs more than a POS integration. It needs the correct licence, merchant-level regulatory visibility, strong AML controls, protected funds, sufficient regulatory capital and an auditable technology infrastructure.

The recommended legal sequence for establishing merchant acquiring services in Türkiye is:

classify the business model → map payment and settlement flows → identify all Article 12 permissions → determine virtual/physical POS requirements → obtain the appropriate CBRT licence → build İKS onboarding → establish merchant AML controls → prepare Turkish merchant contracts → structure safeguarding and settlement → implement cybersecurity and KVKK controls → launch only within the approved licence scope.

For payment companies, fintech investors and international merchant acquirers entering Türkiye, this regulatory architecture should be developed before commercial scale is achieved.

The central principle is simple:

In Turkish payment law, merchant acquiring is not merely payment technology. Once a company contracts with merchants and provides the regulated acceptance function leading to merchant settlement, it becomes part of the regulated financial services infrastructure.

Legal Disclaimer: This publication provides general information concerning merchant acquiring, virtual POS, physical POS and payment-company regulation in Türkiye as of July 2026. It does not constitute legal, financial or regulatory advice. The required CBRT permissions depend on the exact money flow, payment-account structure, merchant relationship, POS infrastructure and additional services offered by the company. Card-based models may also require separate assessment under Law No. 5464 and BRSA-related regulation. Each acquiring model should therefore be individually reviewed before launch.