Introduction: Are Digital Wallets Regulated in Turkey?

Yes.

Türkiye now has a specific regulatory framework governing digital wallet services within its payment-services legislation.

The legal position changed materially in October 2023, when the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) amended the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers and introduced both a statutory regulatory definition of a digital wallet and a dedicated Article 4/A governing digital wallet services.

The regulatory importance of this development should not be underestimated.

Before launching a digital wallet in Türkiye, founders and investors must now determine whether the proposed application is:

• merely a technical card-storage solution;
• a regulated digital wallet;
• a payment instrument;
• a Payment Initiation Service;
• an electronic money wallet;
• a limited-network or closed-loop product.

These distinctions directly affect the regulatory licence required from the CBRT.

The result is that there is no universal legal answer to the question:

“What licence does a digital wallet need in Turkey?”

The correct licence depends on what the wallet actually does.

A wallet that simply allows a customer to access an existing payment instrument may have one regulatory classification.

A wallet that stores value and allows the customer to spend the balance at merchants may require electronic money authorisation.

A wallet that initiates payments directly from accounts or cards issued by another payment service provider may additionally require Payment Initiation Service authorisation.

A technology company merely storing sensitive customer credentials on behalf of a regulated payment service provider may, subject to strict conditions, fall outside the special digital wallet regime altogether.

This guide examines the legal requirements for digital wallet providers in Turkey as of July 2026, including licensing, capital, electronic money, payment initiation, technical-provider exceptions, AML/KYC, data protection and information systems requirements.

1. Who Regulates Digital Wallets in Turkey?

The principal regulator is the Central Bank of the Republic of Türkiye.

Payment and electronic money services in Türkiye are regulated primarily through:

• Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions;
• the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers;
• the Information Systems Communiqué applicable to payment and electronic money institutions.

The CBRT continues to identify these regulations as the core legal framework governing Turkish payment services in 2026.

The CBRT also maintains current public registers identifying authorised:

• payment institutions; and
• electronic money institutions,

together with the payment-service categories for which each institution holds permission.

A digital wallet business should therefore begin its legal analysis by determining which CBRT-regulated payment activity the wallet performs.

2. What Is a Digital Wallet Under Turkish Law?

The Turkish Payment Services Regulation introduced a specific definition of “dijital cüzdan”, or digital wallet.

In substance, a digital wallet is a payment instrument offered through:

• an electronic device;
• an online service; or
• an application,

in which information relating to a payment account or payment instrument designated by the customer is stored and which allows the customer to conduct payment transactions using that information.

The definition is broad enough to cover many modern wallet applications.

Examples may include applications that allow a customer to:

• register payment cards;
• connect payment accounts;
• select between stored payment methods;
• authenticate transactions;
• initiate payments using stored payment information.

However, not every application commercially described as a “wallet” falls within this regulatory definition.

That distinction is crucial.

3. Not Every Wallet Application Is a Regulated Digital Wallet

Article 4/A expressly creates an important exclusion.

Where an electronic device, online service or application can store or identify only the payment account maintained by the same payment service provider and the payment instrument issued by that same provider, the application is not treated as a digital wallet service for purposes of Article 4/A.

Consider a simplified example.

A regulated bank develops its own mobile banking application.

The application displays only:

• the customer’s account held with that bank; and
• the bank’s own cards.

That application is not automatically treated as a separate digital wallet service merely because customers can see and use their own bank accounts and cards through the app.

The underlying payment and banking activities remain regulated, but the special digital-wallet classification does not necessarily apply.

The legal position changes where the application begins incorporating payment instruments or accounts from other providers.

4. Digital Wallet Services Can Only Be Provided by Payment Service Providers

Article 4/A establishes the central licensing principle:

Digital wallet services may be provided by payment service providers.

The Regulation defines payment service providers to include regulated institutions such as:

• banks;
• payment institutions;
• electronic money institutions;
• PTT within its statutory position.

The rule means that an ordinary technology startup cannot simply establish a Turkish company, develop a wallet application and begin offering a regulated digital wallet to customers without first analysing whether an appropriate payment-services authorisation is required.

The fact that the company never describes itself as a bank does not remove the licensing issue.

The relevant question is the function performed by the application.

5. Minimum Authorisation: Issuance of a Payment Instrument

The most important licensing requirement appears in Article 4/A(2).

A regulated entity providing a digital wallet must, at minimum, be authorised under the payment instrument category in Article 4(1)(c), limited to the issuance of a payment instrument.

This rule reflects the legal nature of a digital wallet.

Under the Regulation, a payment instrument can include personalised mechanisms such as:

• cards;
• mobile phones;
• passwords;
• similar personalised tools

used by the customer to submit a payment order.

The Regulation separately defines payment instrument issuance as providing the payer with the instrument necessary to initiate and process payment transactions.

A wallet provider should therefore verify that the precise authorisation required for its wallet functionality is reflected in its regulatory permission.

A general commercial registration as a technology company is insufficient.

6. The Wallet May Require Additional Payment-Service Licences

Holding the minimum digital-wallet authorisation does not necessarily permit every wallet functionality.

Article 4/A(3) expressly states that, depending on the services provided to customers through the digital wallet, the institution must also be authorised for the additional payment services corresponding to those activities.

This is one of the most important rules for wallet product development.

A company cannot obtain one wallet-related permission and then assume every new payment feature is automatically covered.

For example, adding:

• money transfers;
• merchant acquiring;
• payment account functions;
• Payment Initiation Services;
• other regulated payment functionality

can require additional authorisation.

Every significant product update should therefore include a licence-scope review.

7. When Does a Digital Wallet Require an Electronic Money Licence?

The distinction between a digital wallet and electronic money is central to Turkish fintech law.

A digital wallet does not automatically constitute electronic money.

However, Article 4/A(4) creates a specific situation in which electronic money authorisation becomes necessary.

Where:

1. the digital wallet is used as a payment instrument for purchases at merchants; and
2. the funds relating to the payment transaction are transferred through the digital wallet provider,

the wallet provider must generally also be authorised to issue electronic money under Article 18(2) of Law No. 6493.

This provision has major commercial consequences.

A fintech seeking to create a wallet in which customers:

• maintain a balance;
• use the wallet at unrelated merchants; and
• cause payments to move through the wallet provider

should carefully consider whether its model effectively requires an electronic money institution licence.

8. Digital Wallet vs Electronic Money Wallet

The distinction can be illustrated through two simplified models.

Model A: Payment Credential Wallet

The customer adds an existing credit card issued by Bank X.

The wallet stores the relevant payment credential and enables the customer to use that existing instrument.

No new stored monetary value is created by the wallet provider.

Model B: Stored-Value Wallet

The customer pays TRY 10,000 to the wallet provider.

The provider creates a TRY 10,000 wallet balance.

The customer can then spend that balance at third-party merchants.

This structure resembles electronic money much more closely.

Turkish law defines electronic money as monetary value:

• issued against funds accepted by the issuer;
• electronically stored;
• used for payment transactions;
• accepted by persons other than the issuer.

Electronic money institutions appearing on the CBRT’s current register are authorised under Article 18(2) to issue electronic money.

A wallet provider should therefore avoid describing every wallet balance as merely “virtual credit” without examining whether it legally constitutes electronic money.

9. Important Exception Where the Wallet Provider Also Serves the Merchant

Article 4/A(4) also contains an important qualification.

Where the payment account or payment instrument registered in the wallet is used directly for the merchant payment, and funds pass through the wallet provider only because that provider is also supplying the relevant payment services to the merchant, the transaction is not automatically treated as requiring electronic money authorisation under that paragraph.

This distinction matters in business models combining:

• wallet services; and
• merchant acquiring/payment acceptance.

The entire payment flow must therefore be mapped carefully.

The mere fact that money technically passes through one entity does not always mean electronic money is being issued.

Legal analysis should identify:

• whose payment instrument is used;
• whether value is stored;
• who contracts with the merchant;
• which payment service causes the fund movement.

10. External Cards and Accounts Can Trigger Payment Initiation Licensing

Another particularly important rule appears in Article 4/A(5).

Where a digital wallet is designed so that a payment account maintained by another payment service provider, or a payment instrument issued by another payment service provider, can be directly used through the wallet for merchant payments, the wallet provider must also be authorised for Payment Initiation Services under Article 4(1)(f).

This rule directly links digital-wallet regulation with open banking.

Consider a wallet that allows the customer to choose:

• Bank A debit card;
• Bank B payment account;
• another payment provider’s payment instrument

and then initiates the merchant payment using the customer’s selected external payment source.

That structure can require Payment Initiation Service authorisation in addition to the wallet’s base regulatory permission.

Wallet companies should therefore not assume that integrating external bank accounts is purely a technical API feature.

It can change the regulatory licence.

11. Merely Loading the Provider’s Own Wallet Is Treated Differently

The Regulation also distinguishes situations in which another provider’s payment instrument is stored solely for the purpose of loading funds into:

• the customer’s payment account with the wallet provider; or
• a payment instrument issued by the wallet provider itself.

Such transactions are not automatically treated as Payment Initiation Services merely because an external payment instrument is technically stored.

This is a useful regulatory distinction.

The legal treatment depends not only on whether an external card exists inside the application, but on why it is stored and how it is used.

12. Card Vaults and Technical Storage Providers May Fall Outside the Digital Wallet Regime

Article 4/A(6) contains a particularly important exclusion for technology providers.

A business storing sensitive customer payment information on behalf of:

• a merchant; or
• a payment service provider

may fall outside the regulatory definition of a digital wallet where all of the required conditions are satisfied.

The Regulation requires, among other things, that the storage provider:

• does not directly become a party to the customer’s legal transaction;
• does not create the impression that the customer’s payment is being conducted through the storage provider itself;
• never becomes the owner of the funds involved in the payment;
• clearly allocates rights and obligations through contractual arrangements.

In addition, the technical provider cannot be the sole visible face of the service to the customer.

This is extremely important for:

• tokenisation companies;
• card vault providers;
• checkout technology;
• merchant payment credential storage;
• payment infrastructure providers.

A pure technical storage business may therefore operate differently from a consumer-facing digital wallet.

13. The “Visible Face” Test Is Important

The requirement that a technical provider not become the sole visible face of the wallet-like service is commercially significant.

Suppose Technology Company A stores card credentials for Merchant B.

The customer clearly understands that:

• Merchant B is selling the product; and
• Payment Institution C processes the payment.

Technology Company A operates invisibly in the background.

This may support the technical-storage exclusion.

Now consider another structure.

Technology Company A launches its own branded app.

The customer interacts only with Company A.

Company A stores multiple payment instruments and creates the clear impression that the payment transaction occurs through its wallet.

The fact that another licensed institution operates somewhere in the background may not be sufficient to treat Company A as a mere technical provider.

Customer perception and contractual role matter.

14. Limited Network and Closed-Loop Wallets

Article 4/A(7) expressly preserves the exclusions contained in:

• Article 12(2) of Law No. 6493;
• Article 18(5);
• Article 5(7) of the Payment Services Regulation.

This means that certain genuinely restricted wallet products can continue to benefit from the limited-network or closed-loop rules.

For example, a wallet usable only:

• within one retailer’s own network;
• within a genuinely limited store network;
• for a clearly restricted class of goods or services

may require a different analysis from a general-purpose consumer wallet.

However, the restrictions must be real.

The current Regulation makes clear that prepaid instruments designed to operate across all merchants added to a broad network, or structured for general card-scheme compatibility, do not automatically benefit from the limited-network exclusion.

A wallet should not be called “closed loop” merely to avoid licensing.

15. Digital Wallet Regulation Has Been Fully in Effect Since 2026

Digital-wallet rules were introduced in 2023 with transitional periods for existing businesses.

The deadlines were subsequently extended.

The final transition arrangement required businesses that were already providing digital wallet services before Article 4/A entered into force, and that fell within the payment institution or electronic money institution categories but lacked authorisation, to submit the necessary licence application to the CBRT by:

31 December 2025.

Existing licensed institutions providing wallet services were also required to comply with Article 4/A by that date.

This is particularly important in July 2026.

The transitional period has ended.

A company operating a regulated digital wallet today should therefore not rely on the argument that it is still awaiting the original regulatory transition.

Its current authorisation status must be defensible under Article 4/A.

16. Establishing a Turkish Digital Wallet Company

Where a digital wallet requires a payment or electronic money licence, the company must satisfy the corporate conditions applicable to the selected regulated institution.

Law No. 6493 requires ordinary payment institutions and electronic money institutions to be established as a Turkish joint-stock company (Anonim Şirket/A.Ş.).

For ordinary payment institutions, the Law includes requirements concerning:

• shareholder suitability;
• registered shares;
• cash-paid shares;
• management;
• personnel;
• technical infrastructure;
• internal controls.

Electronic money institutions are subject to similar requirements and need specific CBRT permission to issue electronic money.

A limited liability company cannot simply begin issuing regulated electronic money because it has developed a mobile wallet.

17. Statutory Paid-In Capital Requirements

Under Law No. 6493, the statutory paid-in capital minimum for an ordinary payment institution is generally TRY 2 million, except for the specified bill-payment category, while the statutory minimum paid-in capital for an electronic money institution is TRY 5 million.

However, these historical statutory capital floors should not be confused with the significantly higher ongoing own-funds requirements applicable in 2026.

This distinction is essential in financial modelling.

A startup that assumes it can operate a nationwide wallet by funding only the nominal statutory paid-in capital will underestimate the real regulatory financial requirement.

18. 2026 Own-Funds Requirements for Digital Wallet Providers

Effective 30 June 2026, the CBRT increased the minimum own-funds requirements.

The applicable minimums are:

• TRY 20 million for the specified bill-payment intermediary category;
• TRY 40 million for other payment institutions, excluding the separate pure Account Information Service category;
• TRY 105 million for electronic money institutions.

For a digital-wallet project, this means the regulatory economics depend heavily upon the selected licence architecture.

A payment-institution wallet may face the relevant general payment institution own-funds requirement.

A stored-value wallet requiring an electronic money licence faces the substantially higher TRY 105 million own-funds floor.

These amounts should be included in the business plan before fundraising.

19. Digital Wallet Licensing Application Process

The CBRT currently publishes a dedicated process for payment and electronic money institution licence applications.

The process broadly contains three principal stages:

Trade Registry and Initial Application Stage

Before registration of the regulated trade name, prescribed forms and the initial application documentation must be submitted to the CBRT.

The CBRT’s currently published application notice states an application fee of TRY 500,000, together with applicable statutory charges. The fee is non-refundable even where the application is ultimately unsuccessful.

Intelligence Review Stage

After the CBRT issues the document confirming that the initial application has been made, the company must proceed to the intelligence review stage within the specified six-month period and submit the documents required by the Regulation.

Final Approval Stage

Following approval of the intelligence review, the company must apply for final approval within the regulatory period—currently 120 days under the published procedure—and complete the additional operational, financial and technical documentation requirements.

The CBRT’s current application-stage notice also identifies a TRY 1 million licence fee, together with applicable statutory liabilities, following authorisation and commencement of activities.

A wallet startup should therefore not view licensing as merely submitting an application form.

The CBRT evaluates the institution itself, its shareholders and its operational readiness.

20. Information Systems Are Central to Digital Wallet Licensing

Digital wallets are technologically intensive regulated businesses.

Information systems must therefore be designed in accordance with the CBRT’s separate Information Systems Communiqué applicable to payment and electronic money institutions.

The CBRT’s current payments legislation expressly continues to include this information systems and data-sharing regulation.

A wallet provider should consider matters including:

• customer authentication;
• protection of sensitive payment data;
• encryption;
• access control;
• transaction logging;
• fraud detection;
• vulnerability management;
• penetration testing;
• incident response;
• disaster recovery;
• outsourcing.

Cybersecurity compliance should be designed before launch rather than retrofitted after the licence application is filed.

21. Digital Wallets and Sensitive Customer Data

Wallet providers may process particularly valuable data.

Depending on the architecture, a wallet may store:

• card details;
• payment instrument information;
• customer identifiers;
• account information;
• transaction history;
• authentication credentials;
• device information.

The Payment Services Regulation expressly defines sensitive customer data by reference to information capable of enabling fraud or unauthorised transactions where compromised.

For wallet businesses, information security and privacy therefore overlap directly.

A compromised wallet can create both:

• financial loss; and
• personal data exposure.

22. KVKK Compliance for Digital Wallet Providers

Wallet providers also process personal data under Law No. 6698 on the Protection of Personal Data (“KVKK”).

In July 2026, the Turkish Personal Data Protection Authority published a dedicated Good Practices Guide on the Protection of Personal Data in the Payment and Electronic Money Sector, prepared together with TÖDEB.

The Guide addresses:

• controller/processor roles;
• categories of data processed;
• legal grounds;
• personal data transfers;
• data-controller obligations;
• data security.

For digital wallet companies, KVKK compliance should therefore address:

• privacy notices;
• processing legal bases;
• retention;
• marketing use;
• outsourced processors;
• international cloud providers;
• cross-border transfers;
• breach management.

Financial data collected for payment or regulatory purposes should not automatically be reused for unrelated marketing.

23. International Cloud Services Require Particular Care

A digital wallet provider may want to use international:

• cloud infrastructure;
• fraud prevention tools;
• CRM software;
• analytics platforms;
• customer-support services.

However, international personal data transfers must satisfy KVKK Article 9.

In addition, payment and electronic money institutions are subject to sector-specific CBRT information systems and localisation rules.

Therefore:

A transfer being lawful under KVKK does not automatically mean the cloud architecture is permitted under payment-services regulation.

Both analyses are required.

This issue should be examined before the wallet’s production infrastructure is selected.

24. MASAK AML and KYC Requirements

Digital wallets can also create substantial money-laundering and fraud risks.

Electronic money institutions and most payment institutions fall within the Turkish AML framework administered by MASAK.

MASAK states that electronic money institutions and payment institutions—subject to specific exceptions for institutions exclusively providing certain limited services—are required to establish formal compliance programmes.

A wallet AML programme may therefore need to address:

• customer identification;
• beneficial ownership;
• remote onboarding;
• PEP screening;
• sanctions;
• transaction monitoring;
• suspicious transaction reporting;
• unusual wallet loading;
• rapid wallet-to-wallet transfers;
• merchant misuse.

A consumer-friendly wallet onboarding flow cannot legally become an anonymous financial account outside the AML framework.

25. Remote Onboarding

Digital wallets are typically designed for immediate mobile onboarding.

However, customer convenience must be coordinated with:

• MASAK customer identification;
• sector-specific remote identification;
• fraud prevention;
• information systems security;
• KVKK.

A compliant wallet should be capable of proving:

• who opened the account;
• how identity was verified;
• what terms were accepted;
• which device or authentication mechanism was used.

These records may become critical in disputes involving:

• account takeover;
• identity fraud;
• unauthorised payments;
• suspicious transactions.

26. Consumer Protection and Wallet Contracts

A digital wallet provider should also prepare customer-facing documentation in accordance with payment and consumer legislation.

Material terms should explain:

• who provides the regulated service;
• how the wallet works;
• which payment instruments can be added;
• applicable fees;
• transaction limits;
• customer security obligations;
• complaint channels;
• wallet termination;
• redemption where electronic money is involved.

The customer should not have to discover the legal provider only after a dispute occurs.

This is particularly important in:

• white-label wallets;
• co-branded wallets;
• embedded finance arrangements.

27. White-Label Digital Wallets

A non-financial brand may wish to launch a wallet using another institution’s regulated infrastructure.

For example:

Retail Company A markets the wallet.

Electronic Money Institution B issues electronic money and provides the regulated payment service.

Technology Company C supplies the application.

This structure may be legally possible, but the allocation of roles must be clear.

The arrangement should determine:

• who contracts with the customer;
• who holds customer funds;
• who issues the payment instrument;
• who issues electronic money;
• who processes complaints;
• who handles KYC;
• who stores sensitive payment data.

A white-label structure does not transfer the regulated licence from Institution B to Companies A or C.

The customer-facing design should not create a misleading impression about which entity provides the regulated financial service.

28. Foreign Digital Wallet Providers

A digital wallet licence obtained in another country does not automatically provide authorisation to offer regulated wallet services in Türkiye.

A foreign wallet provider targeting the Turkish market should separately analyse:

• whether Article 4/A applies;
• whether a Turkish payment or electronic money institution is needed;
• whether it can operate through a Turkish regulated partner;
• data localisation;
• KVKK;
• AML/KYC.

Türkiye does not operate a general passporting system under which a foreign payment institution licence automatically substitutes for CBRT authorisation.

29. Digital Wallet M&A and Investment

Investors acquiring a digital wallet company should conduct regulatory due diligence.

Important questions include:

Licence Status

Does the company actually hold the required Article 4/A-compatible authorisation?

Electronic Money

Does the wallet hold or issue stored value requiring EMI authorisation?

Payment Initiation

Does it use externally issued payment instruments or accounts in a way requiring Article 4(1)(f) permission?

Historical Compliance

Was the company operating before the transitional deadline?

Did it submit the required application by 31 December 2025?

Regulatory Capital

Does it satisfy the 2026 own-funds requirements?

Customer Funds

Are wallet balances properly protected?

MASAK

Is KYC and transaction monitoring functional?

Technology

Does the information systems architecture satisfy CBRT requirements?

KVKK

Are customer data and international transfers compliant?

These matters can materially affect company valuation.

30. Common Digital Wallet Licensing Mistakes

Assuming Every Mobile Payment App Is the Same

Wallet architecture determines the regulatory treatment.

Calling Stored Value “Points”

The commercial name does not determine whether value constitutes electronic money.

Relying Only on a Technology Partner

A licensed backend provider does not automatically exempt the customer-facing company if that company itself provides regulated payment services.

Ignoring External Cards and Accounts

Integrating payment instruments from another provider can trigger Payment Initiation Service requirements.

Assuming Card Storage Is Always a Wallet

Pure technical credential storage may fall outside Article 4/A where all statutory conditions are met.

Ignoring Own-Funds Requirements

A wallet licence may create a TRY 40 million or TRY 105 million ongoing own-funds burden depending on the regulatory model.

Relying on the Old Transition Period

The final Article 4/A transition deadline was 31 December 2025.

31. Practical Digital Wallet Licensing Checklist

Before launching a wallet in Türkiye, founders should determine:

Is the Product a Digital Wallet?

Does it store customer-selected payment account or payment instrument information and enable payments using that information?

Does the Own-Instrument Exception Apply?

Does the application store only the provider’s own account and own payment instrument?

Is the Provider a Payment Service Provider?

A regulated wallet generally needs to be provided through the statutory payment-services structure.

Does the Licence Include Payment Instrument Issuance?

Article 4/A requires this as the basic wallet authorisation.

Are Additional Payment Services Provided?

Map each feature against the regulated service categories.

Does the Wallet Store Monetary Value?

If yes, electronic money authorisation may be required.

Can the Wallet Be Used at Merchants?

Analyse whether funds flow through the wallet provider.

Are External Accounts or Cards Directly Used?

Payment Initiation Service authorisation may be necessary.

Is the Company Merely a Technical Storage Provider?

Test every Article 4/A(6) condition.

Is the Wallet Closed Loop?

Examine the limited-network and electronic money exclusions.

Is Regulatory Capital Available?

Model ongoing own-funds requirements.

Is the Information Systems Architecture Compliant?

Review infrastructure before licensing.

Is AML/KYC Operational?

Do not launch customer accounts without the appropriate financial crime controls.

Is KVKK Compliance Complete?

Map customer information, data transfers and vendors.

Frequently Asked Questions About Digital Wallet Licensing in Turkey

Are digital wallets regulated in Turkey?

Yes. Digital wallets are specifically regulated under Article 4/A of the Payment Services Regulation.

When was the digital wallet regulation introduced?

The dedicated wallet definition and Article 4/A were introduced through the amendment published on 7 October 2023.

Who regulates digital wallets?

The principal financial regulator is the Central Bank of the Republic of Türkiye.

Does every wallet app need a licence?

No.

An application storing only the payment account and payment instrument of the same payment service provider is expressly excluded from the special Article 4/A digital wallet classification. Pure technical storage models may also qualify for the Article 4/A(6) exclusion.

What is the minimum licence for a regulated digital wallet?

Article 4/A requires at least authorisation under the payment instrument category, limited to issuance of the payment instrument.

Can a digital wallet require an electronic money licence?

Yes.

Where the wallet is used as a payment instrument at merchants and funds relating to the payment are transferred through the wallet provider, electronic money authorisation is generally required, subject to the specific exception in Article 4/A(4).

Can a wallet trigger Payment Initiation Service licensing?

Yes.

Where another payment provider’s account or payment instrument registered in the wallet is directly used for merchant payments in the manner described by Article 4/A(5), Payment Initiation Service authorisation is required.

Can a card-storage company operate without a wallet licence?

Potentially.

Article 4/A(6) creates an exclusion for qualifying technical storage providers that do not contract directly with the customer, do not create the impression of being the payment provider, never own the payment funds and satisfy the other contractual conditions.

Can a closed-loop wallet be exempt?

Potentially. Article 4/A preserves the limited-network and specified prepaid-instrument exclusions, subject to their conditions.

What happened to existing unlicensed wallets?

The final transitional rule required qualifying pre-existing unlicensed wallet providers to apply to the CBRT by 31 December 2025, while existing regulated institutions had to achieve Article 4/A compliance by the same date.

What are the 2026 own-funds requirements?

From 30 June 2026, the relevant general payment-institution own-funds minimum is TRY 40 million, while electronic money institutions must maintain at least TRY 105 million, subject to the precise regulatory category and calculation rules.

How much is the CBRT licence application fee?

The CBRT’s currently published payment/e-money application-stage guidance states a TRY 500,000 application fee, plus applicable statutory charges.

Is there also a licence fee?

Yes. The CBRT’s published procedure identifies a TRY 1 million licence fee, plus applicable statutory charges, in connection with authorisation and commencement of activity.

Are wallet providers subject to MASAK?

Electronic money institutions and most payment institutions are subject to extensive MASAK obligations, including formal compliance-programme requirements subject to specified exceptions.

Does KVKK apply?

Yes. Wallets process significant financial and personal information. The Personal Data Protection Authority published dedicated payment and electronic money sector guidance in July 2026.

Conclusion: How to Structure a Legally Compliant Digital Wallet in Turkey

Digital wallet licensing in Turkey now requires careful analysis of the wallet’s actual technological and financial architecture.

The key regulatory provision is Article 4/A of the Payment Services Regulation.

Since October 2023, Turkish law has expressly defined digital wallets and established specific licensing rules governing who can provide them and which additional permissions may be required.

The first question should always be:

Is the application legally a digital wallet?

An application that stores only the payment account and payment instrument of the same regulated payment service provider does not fall within the special digital-wallet definition under Article 4/A(1).

Likewise, certain technical storage businesses can remain outside the wallet regime where they act only on behalf of a merchant or payment provider, never become owners of customer funds, do not contract directly with the customer and do not present themselves as the customer-facing payment provider.

Where Article 4/A does apply, the institution must at minimum possess the appropriate authorisation relating to the issuance of a payment instrument.

However, that is only the starting point.

The wallet’s additional functions determine whether further regulated payment services must be added to the licence.

The most important additional analysis concerns electronic money.

Where customers can use a digital wallet at merchants and the transaction funds are transferred through the wallet provider, the provider will generally need authority to issue electronic money under Law No. 6493, subject to the specific merchant-service exception contained in Article 4/A(4).

This can transform the regulatory economics of a wallet project.

From 30 June 2026, an electronic money institution is subject to a minimum own-funds requirement of TRY 105 million, compared with the relevant TRY 40 million requirement applying to the general payment institution category.

Consequently, deciding whether a wallet genuinely issues stored monetary value is not an academic legal question.

It can change the capital requirement by tens of millions of Turkish lira.

The second critical issue is Payment Initiation Services.

Where the customer uses a payment account held with another provider, or a payment instrument issued by another provider, directly through the wallet for merchant payments, Article 4/A(5) can require Payment Initiation Service authorisation.

This rule means digital wallets increasingly overlap with Türkiye’s open banking regulatory framework.

Product managers should therefore seek regulatory review before adding external account or card functionality.

The third major issue is distinguishing a regulated wallet from a technical payment credential service.

Article 4/A(6) provides meaningful room for technology companies to provide sensitive customer data storage services without becoming regulated digital-wallet providers.

However, the conditions are strict.

The technology company must remain genuinely behind the regulated merchant/payment-provider relationship.

It cannot own customer funds.

It cannot become a direct contractual party to the payment.

It cannot give customers the impression that it is itself conducting the regulated payment transaction.

And it cannot be the only visible face of the service.

This distinction should be reflected not merely in contractual documentation but in the actual user experience.

Branding can therefore create regulatory risk.

A company may technically use a licensed payment institution in the background yet still create the impression that it is independently operating a wallet.

The legal structure, customer interface and money flow must tell the same story.

Closed-loop wallets require separate analysis.

Article 4/A expressly preserves the statutory limited-network and prepaid-instrument exceptions.

A wallet restricted to one retailer or a genuinely narrow merchant/product ecosystem may therefore operate differently from a general-purpose wallet.

But the network must genuinely remain limited.

Expanding acceptance across unrelated merchants can eventually transform a closed-loop product into a regulated payment or electronic money service.

The transitional phase is also effectively over.

Following several deadline extensions, pre-existing wallet businesses that required payment or electronic money authorisation had until 31 December 2025 to apply to the CBRT, while already regulated institutions had the same deadline to align their wallet services with Article 4/A.

Therefore, a wallet operating in July 2026 should have a clear current regulatory basis.

For new projects, licensing should be incorporated into the business plan from the beginning.

The CBRT licence process is not a simple registration.

The currently published procedure involves an initial trade-registry/application phase, an intelligence review and a final approval stage. The CBRT’s published application guidance currently identifies a TRY 500,000 application fee and a TRY 1 million licence fee, together with relevant statutory charges.

Financial capacity alone is also insufficient.

A wallet provider may need to demonstrate:

• appropriate shareholders;
• experienced management;
• internal controls;
• risk management;
• technical infrastructure;
• information security;
• customer support and complaint functions.

After authorisation, the compliance burden continues.

Digital wallet providers may simultaneously be subject to:

MASAK, for customer identification, AML/KYC, transaction monitoring and suspicious transaction reporting;

KVKK, for the processing and transfer of customer financial and identity data;

CBRT information systems rules, for authentication, cybersecurity, logging, outsourcing and business continuity;

consumer protection and payment legislation, for contracts, fees, customer security and unauthorised transactions.

MASAK’s current framework expressly includes electronic money institutions and most payment institutions within the institutional AML compliance regime, subject to identified limited exceptions.

Data protection has also become increasingly sector specific. In July 2026, the Personal Data Protection Authority and TÖDEB published a dedicated guide for the payment and electronic money sector addressing legal bases, controller/processor status, transfers and data security.

Accordingly, launching a digital wallet requires far more than mobile application development.

A legally structured project should generally proceed as follows:

map the proposed wallet → identify the payment instruments and accounts → map the movement of funds → determine whether value is stored → identify merchant relationships → determine whether external accounts/cards are directly used → classify the necessary payment services → determine payment institution vs electronic money institution architecture → calculate regulatory capital → design AML/KVKK/cybersecurity controls → apply for CBRT authorisation → launch only within the approved scope.

For founders, the most important principle is:

The licence follows the money flow and functionality—not the product name.

Calling a product:

• “wallet”;
• “super app”;
• “payment app”;
• “digital account”;
• “stored-value platform”

does not determine its regulatory treatment.

For investors, the same principle should guide due diligence.

The investor should not ask only whether the target has a CBRT licence.

It should ask:

Does the target have the precise licence required for the way its wallet actually works?

That distinction is increasingly critical in Türkiye’s rapidly maturing fintech market.

Legal Disclaimer: This publication provides general information concerning digital wallet licensing and regulation in Türkiye as of July 2026. It does not constitute legal, financial or regulatory advice. The regulatory classification of a wallet depends on its exact payment flow, merchant structure, stored-value model, payment instruments, external account functionality, contractual arrangements and technological architecture. Each wallet project should therefore be individually assessed under Law No. 6493, Article 4/A of the Payment Services Regulation and the current CBRT regulatory framework before launch.