Introduction: Can Non-Financial Companies Offer Financial Services in Turkey?

Embedded finance has become one of the most important developments in global financial technology.

Retailers, e-commerce platforms, SaaS companies, marketplaces, mobility businesses, telecommunications companies and other non-financial enterprises increasingly want to integrate financial services directly into their existing customer journeys.

A consumer may therefore:

• open an account without leaving a shopping application;
• obtain financing at checkout;
• hold money in a branded wallet;
• receive a prepaid or debit card;
• pay merchants directly through an app;
• initiate bank transfers;
• obtain access to banking services through a non-bank platform.

Commercially, all of these models can be described as embedded finance.

Turkish law, however, does not regulate embedded finance through one single statute or licence.

There is no general “Embedded Finance Licence” in Türkiye.

Instead, each financial function must be classified under the regulatory framework that applies to the underlying activity.

Payments and electronic money are primarily regulated by the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) under Law No. 6493 and its secondary regulations. Banking and Banking as a Service are regulated by the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”). Other financial activities may fall within separate regulatory regimes.

For a non-financial company, the central legal issue is therefore:

How far can financial functionality be embedded into a commercial platform before the platform itself becomes a regulated financial service provider?

The answer depends principally on:

• who contracts with the customer;
• who owns or controls customer funds;
• who maintains the account;
• who issues electronic money;
• who issues the payment instrument;
• who makes the credit decision;
• who receives payment instructions;
• how the service is presented to customers.

This guide examines the legal framework for embedded finance in Turkey as of July 2026, with a particular focus on non-financial companies seeking to integrate payment, wallet, card, account, open banking and lending functionality into their products.

1. What Is Embedded Finance?

Embedded finance generally means integrating a financial service into a non-financial product or customer experience.

The financial service does not necessarily appear as a separate banking or fintech application.

Instead, it becomes part of the customer’s ordinary commercial journey.

For example:

An e-commerce company may allow its merchants to receive payments through accounts embedded into the merchant dashboard.

A mobility application may provide drivers with a branded payment card.

A retailer may offer customers a wallet that can be loaded with money and used for purchases.

A SaaS provider may allow business users to access bank accounts, make transfers or obtain working-capital financing directly from its software.

The commercial advantage is clear.

Customers do not need to leave the platform to obtain the financial service.

But the legal architecture behind the product remains critical.

2. Turkey Does Not Have a General Embedded Finance Licence

Embedded finance is not a separate regulated activity under Turkish law.

Instead, the regulatory classification follows the financial function being embedded.

A product may therefore involve:

• payment account services;
• money transfers;
• merchant acquiring;
• payment instrument issuance;
• electronic money;
• digital wallets;
• Payment Initiation Services;
• Account Information Services;
• banking services;
• consumer or commercial finance.

CBRT’s current registers confirm that payment institutions and electronic money institutions are authorised service by service under Article 12 of Law No. 6493 rather than under a broad general “fintech” authorisation. All authorised electronic money institutions separately hold electronic money issuance authority under Article 18(2).

Accordingly:

The embedded finance label does not determine the licence. The underlying financial activity determines the licence.

3. The First Regulatory Distinction: Technology or Financial Service?

The most important question for a non-financial company is whether it is:

providing technology around a financial service

or

providing the regulated financial service itself.

These are not the same thing.

Consider a retailer embedding a payment button.

If a licensed payment institution:

• contracts with the customer;
• receives the payment instruction;
• processes the funds;
• bears responsibility for the payment service,

while the retailer merely displays the interface, the retailer may remain outside the regulated payment-provider role.

However, if the retailer itself:

• receives customer money;
• maintains customer balances;
• performs transfers;
• contracts as the payment provider,

the regulatory position changes significantly.

The legal structure must therefore be determined before the user interface is designed.

4. Embedded Payments

Payments are among the easiest financial products to embed into a non-financial application.

An e-commerce platform may integrate:

• virtual POS;
• card acceptance;
• account-to-account payments;
• merchant settlement;
• payment links;
• QR payments.

Turkish payment services are governed principally by Law No. 6493 and the Payment Services Regulation, with the CBRT acting as regulator and supervisor.

A non-financial company therefore has two broad options.

It may partner with an authorised payment service provider and remain outside the regulated payment role.

Alternatively, it may establish or acquire an authorised payment institution and provide the relevant services directly.

The correct option depends on the company’s intended control over:

• customers;
• payment instructions;
• funds;
• settlement;
• pricing.

5. A Licensed Partner Does Not Automatically Transfer Its Licence

This principle is essential.

A retailer, marketplace or SaaS platform cannot simply say:

“Our payment provider is licensed, therefore every payment-related activity we perform is covered by their licence.”

A financial licence belongs to the regulated institution.

It is not transferred commercially to the embedded-finance partner.

The non-financial company must remain within the role allocated to it under the regulatory architecture.

If it independently begins providing services requiring authorisation, the licensed partner’s status does not automatically cure that issue.

6. Embedded Payment Accounts

A more advanced embedded finance model gives customers account-like functionality.

For example, a platform may allow merchants to:

• receive money;
• view a balance;
• transfer money;
• make payments.

Once a customer is effectively being given a payment account, Article 12 payment-account activities become highly relevant.

The account must be maintained by an authorised payment service provider with the appropriate licence scope.

The non-financial company may provide the branded user interface while the regulated institution maintains the underlying account.

However, customer documentation should clearly identify which entity legally provides the payment account.

7. Embedded Electronic Money

Electronic money is another major embedded finance model.

A retailer or platform may want to create a branded stored-value product.

For example:

Customer pays TRY 5,000.

The application displays a TRY 5,000 balance.

The customer can spend that value at merchants.

Where value is issued against customer funds, stored electronically and usable for payment to persons other than the issuer, electronic money regulation becomes central.

CBRT confirms that institutions on its electronic money institution register are authorised to issue electronic money under Article 18(2) of Law No. 6493.

A non-financial brand cannot independently issue regulated electronic money merely because a licensed EMI supplies backend technology.

The legal issuer must remain the authorised institution.

8. Regulatory Capital Changes the Economics of the Business

The distinction between a commercial platform and a regulated financial institution has significant financial consequences.

The CBRT updated minimum own-funds requirements through the Communiqué published on 31 January 2026, effective 30 June 2026.

The current minimums are:

• TRY 20 million for the specified bill-payment category;
• TRY 40 million for other payment institutions, excluding the separately treated pure Account Information Service category;
• TRY 105 million for electronic money institutions.

A marketplace that merely integrates a licensed EMI may therefore have a very different capital profile from a marketplace that decides to obtain its own EMI licence.

The regulatory structure should be included in the business plan before fundraising.

9. Embedded Digital Wallets

Digital wallets are specifically regulated under Article 4/A of the Payment Services Regulation.

The current rule provides that digital wallet services may be offered by payment service providers.

The wallet provider must at minimum have the relevant authorisation for issuance of a payment instrument, while additional permissions may be required depending on what customers can do through the wallet.

This is particularly important for non-financial companies.

A retailer may commercially want to launch:

“RetailerPay”

or

“Market Wallet.”

But developing a wallet interface does not mean the retailer can independently provide the regulated wallet service.

The underlying licence architecture must be analysed.

10. Not Every Branded Wallet Makes the Brand a Payment Institution

A non-financial company can potentially provide the customer-facing branding while a licensed payment service provider supplies the regulated wallet.

However, the legal responsibilities must remain clear.

The parties should identify:

• who issues the payment instrument;
• who maintains the customer’s payment account;
• whether electronic money is issued;
• who owns customer funds;
• who carries out KYC;
• who handles payment complaints.

A white-label contract cannot simply state that the commercial brand “owns the customer” while leaving regulatory obligations undefined.

11. Embedded Prepaid and Payment Cards

Cards are a common embedded finance product.

A retailer, mobility company or SaaS platform may want to issue a branded:

• prepaid card;
• payment card;
• business spending card.

The legal analysis again depends on the structure.

Where the card accesses electronic money or a payment account, the regulated institution maintaining that balance or account must hold appropriate authority.

In Banking as a Service structures, Turkish rules expressly require the service bank’s name and logo to remain visible on a card issued by the service bank for the interface provider.

This illustrates a wider principle:

Embedded branding does not permit the licensed financial institution to disappear completely from the product.

12. Embedded Merchant Payments

Marketplaces and platforms frequently want to integrate payment acceptance for sellers.

Where the non-financial company merely provides a marketplace interface and a licensed payment institution handles acquiring and merchant settlement, the platform may remain outside the payment-service role.

However, if the platform itself begins:

• contracting with merchants as the payment provider;
• receiving their payment funds;
• controlling settlement;
• maintaining merchant balances,

merchant acquiring and other payment services can become relevant.

CBRT’s current payment institution register confirms that Article 12(1)(c) authorisation granted to payment institutions is limited to acquiring payment instruments.

Embedded checkout should therefore not be confused with unrestricted authority to operate a payment aggregator.

13. Closed-Loop and Loyalty Products

Not every commercial value system necessarily requires a full EMI architecture.

Retailers may operate:

• loyalty points;
• retailer-specific gift products;
• limited-network payment instruments.

Whether a product falls outside the full payment/e-money regime depends on the specific statutory exclusions and how restricted the acceptance network genuinely is.

A product accepted only by the issuing retailer presents a different regulatory profile from a “loyalty wallet” that gradually becomes spendable across hundreds of unrelated merchants.

Product expansion should therefore trigger a renewed licence-perimeter review.

14. Embedded Open Banking

A non-financial company may also want to embed bank-account information or payment initiation.

For example, accounting software may display:

• bank account balances;
• transactions;
• cash-flow information.

Or an e-commerce application may allow users to initiate account-to-account payments.

Payment Initiation Services and Account Information Services are regulated categories under Article 12, and CBRT’s current registers identify institutions specifically authorised under the relevant (f) and (g) categories.

A software company’s regulatory position depends on whether it merely provides technology to the customer or whether it itself becomes the intermediary providing the regulated open-banking service.

15. Embedded Banking: Turkey Has a Formal BaaS Framework

Banking services require a different regulatory architecture.

Türkiye specifically regulates Servis Modeli Bankacılığı, internationally known as Banking as a Service or BaaS, under the Regulation on the Operating Principles of Digital Banks and Service Model Banking. BDDK’s current legislation list continues to identify this Regulation as part of the banking framework.

The model distinguishes between:

• the service bank; and
• the interface provider.

An interface provider is a capital company whose mobile application or browser-based interface allows customers to access banking services supplied through the service bank.

This is one of the clearest legal routes available to non-financial companies seeking to embed actual banking products into their platforms.

16. Only a Bank Provides the Banking Service

The BaaS rules make the allocation of responsibility clear.

A service bank may provide service-model banking only to interface providers resident in Türkiye and only within the bank’s own authorised activities.

Banks themselves cannot act as interface providers.

Most importantly, decisions on whether banking services will be offered—including the credit allocation decision—remain with the service bank, and banking services are performed through the service bank’s balance sheet.

Therefore, a supermarket or SaaS company cannot become a bank merely by integrating banking APIs.

The bank remains the regulated banking institution.

17. Customer Must Have a Contract With the Service Bank

The BaaS model does not allow the underlying bank/customer relationship to disappear.

The service bank may provide banking services to the interface provider’s customer only after a contractual relationship has been established between the customer and the service bank.

Where the contract is established electronically, the customer must be identified by the service bank in accordance with the applicable remote-identification rules.

This is a major distinction between embedded banking and simple software.

The non-financial company may own the customer experience.

The banking contract remains with the bank.

18. Non-Financial Interface Providers Must Not Pretend to Be Banks

Turkish BaaS regulation places strong emphasis on transparency.

An interface provider cannot, without the necessary separate authorisations, use language creating the impression that it:

• is a bank;
• is a payment institution;
• is an electronic money institution;
• accepts deposits or payment funds like a regulated provider.

The interface provider’s agreement with customers must expressly clarify where it does not possess those financial licences, and the banking services supplied by the service bank must be clearly identified.

This has direct implications for marketing.

Statements such as:

“Open your bank account with our marketplace”

can be legally problematic if the marketplace is merely an interface provider and the account is actually with the service bank.

19. The Service Bank Must Remain Visible

The BaaS rules contain unusually specific customer-disclosure requirements.

Among other things, the interface provider’s website must visibly identify the service bank or banks whose services are used.

The customer-facing documentation must disclose the banking services provided by the service bank and provide access to the bank’s complaint channels.

Where the service bank issues a card for the interface provider, the bank’s name and logo must be visibly displayed on the card.

Embedded banking therefore allows commercial branding, but it does not allow complete regulatory invisibility.

20. The Interface Provider Is Not Merely an Ordinary Software Vendor

A BaaS interface provider has a more regulated role than an ordinary technology vendor.

Where it facilitates establishment of the service-bank/customer relationship or allows customers to receive the bank’s services through its interface, it is treated as a support service provider to the service bank.

Providing that support service is subject to BDDK approval under the BaaS framework.

A non-financial company should therefore distinguish:

ordinary API integration

from

regulated BaaS interface-provider status.

21. Interface Provider and Bank Share Cybersecurity Responsibility

Embedded banking creates direct information-security obligations.

The BaaS Regulation provides that the interface provider and service bank are jointly responsible for ensuring that the customer-facing mobile or browser interface complies with specified authentication and transaction-security requirements.

A service bank cannot continue providing BaaS services to an interface provider whose systems fail those requirements.

This means cybersecurity cannot simply be allocated contractually to the bank.

The non-financial platform must itself invest in financial-grade security.

22. BaaS Data Has Strong Localisation Restrictions

Embedded banking also involves strict handling of confidential banking information.

The BaaS rules require systems and backups used by the interface provider to process specified confidential data to be located in Türkiye.

Where cloud services are used, the Regulation restricts the permitted architecture to prescribed private-cloud or BDDK-approved community-cloud models under the conditions described in the banking information-systems framework.

A global SaaS company should therefore not assume that it can use exactly the same international cloud architecture for a Turkish BaaS product as it uses elsewhere.

23. Can a Non-Financial Company Offer Embedded Credit?

Yes, but the legal lender must be correctly structured.

Under the BaaS regime, the service bank makes the credit decision and the banking service is carried on the bank’s balance sheet.

Another possible regulated route involves licensed financing companies under Law No. 6361.

BDDK explains that a financing company can finance purchases of goods or services by paying the seller directly on behalf of the customer, with the customer repaying the financing company.

Accordingly, a retailer can embed a credit journey into checkout without necessarily becoming the creditor itself.

The regulated bank or financing company should remain legally responsible for the regulated credit product.

24. Embedded Lending Should Not Be Confused With Ordinary Instalment Sales

Commercial instalment arrangements and regulated financing can have different legal characteristics.

Where a non-financial company merely sells its own goods under a legally permitted deferred-payment arrangement, the structure may be different from operating an independent lending business.

But where the platform:

• advances money;
• finances third-party goods or services;
• charges financing returns;
• repeatedly operates a credit business,

banking, financing-company and consumer-credit rules should be analysed separately.

A company should therefore avoid treating “Buy Now Pay Later” as a universally unregulated fintech category.

The actual legal creditor and payment flow matter.

25. Embedded Cards Linked to Bank Credit

A BaaS interface provider can also facilitate bank card or credit-card products.

The Regulation expressly recognises that a service bank may collect credit-card applications through the interface provider’s channels.

However, the bank remains the regulated provider, and card issuance must comply with the applicable banking and card legislation.

The non-financial platform may therefore embed the application journey.

It does not independently become a credit-card issuer merely because the card carries co-branding.

26. Embedded Finance and Crypto Assets

Crypto services should not be treated as an ordinary embedded-payment extension.

The Turkish crypto regulatory framework changed materially following the 2024 amendments to the Capital Markets Law.

The CMB’s III-35/B.1 and III-35/B.2 Communiqués, effective since 13 March 2025, regulate establishment, operating permission, governance, custody, trading activities, information systems and capital adequacy for crypto asset service providers. The CMB currently maintains formal establishment and operating application processes for platforms and custody providers.

A shopping app cannot therefore add an embedded crypto exchange merely by purchasing API access from a technology vendor if the platform itself falls within the regulated crypto service perimeter.

27. Crypto Cannot Be Used as a Shortcut Around Payment Regulation

Türkiye also maintains restrictions on use of crypto assets in payments.

The CBRT’s regulation prohibits crypto assets from being used directly or indirectly in payments and restricts payment-service and electronic-money business models designed around such use.

Accordingly, an embedded-finance company cannot simply replace a regulated money transfer or wallet flow with crypto and assume that payment regulation disappears.

Crypto and payment regulation must be analysed separately.

28. AML and KYC in Embedded Finance

Embedded finance often creates confusion regarding who is responsible for KYC.

The answer depends on the regulated service.

Electronic money institutions and most payment institutions are required to establish formal MASAK compliance programmes.

The programme includes:

• policies and procedures;
• risk management;
• monitoring and control;
• a compliance officer and compliance unit;
• training;
• internal audit.

The fact that customer onboarding takes place inside a retailer’s or marketplace’s application does not remove the regulated institution’s AML responsibilities.

29. The Non-Financial Platform Can Assist With KYC but Cannot Make the Obligation Disappear

An embedded finance partner may technically collect:

• identification information;
• documents;
• device data;
• onboarding answers.

However, the regulated financial institution should retain the ability to verify that applicable KYC requirements have been satisfied.

The parties should clearly allocate:

• who collects information;
• who verifies identity;
• who performs sanctions/PEP screening;
• who determines customer risk;
• who reports suspicious transactions.

A technology workflow can support regulatory compliance.

It cannot replace legal responsibility.

30. Embedded Finance Increases Transaction-Monitoring Complexity

A non-financial platform often has information that the regulated financial institution does not.

For example, a marketplace knows:

• what goods a merchant sells;
• whether deliveries occur;
• customer complaints;
• refund patterns.

The payment institution knows:

• payment amounts;
• beneficiaries;
• transaction velocity;
• account flows.

Combining these risk indicators may be important for detecting:

• fraud;
• money laundering;
• transaction laundering;
• fake merchants.

Embedded finance agreements should therefore create lawful and operationally effective information-sharing mechanisms.

31. KVKK Is a Central Embedded Finance Issue

Embedded finance creates significant personal data sharing between:

• the commercial platform;
• the bank;
• payment institution;
• electronic money institution;
• technology vendors.

In July 2026, the Turkish Personal Data Protection Authority published a dedicated Good Practices Guide for the payment and electronic money sector with TÖDEB.

The Guide addresses:

• controller and processor roles;
• categories of personal data;
• processing conditions;
• transfers;
• controller obligations;
• data security.

A generic privacy policy is therefore rarely sufficient for an embedded payment or wallet product.

32. The Platform Is Not Automatically a Data Processor

One common legal mistake is assuming:

“The bank is the controller and our platform is always the processor.”

The actual data role depends on which party determines the purposes and essential means of processing.

A commercial platform may process some information:

• on behalf of the financial institution;

while separately using other information for:

• its own customer relationship;
• fraud prevention;
• loyalty programmes;
• marketing.

The controller/processor analysis may therefore differ by processing activity.

Embedded-finance contracts should contain a detailed data map rather than a single blanket classification.

33. Financial Data Should Not Automatically Be Reused for Marketing

A customer may provide information for:

• KYC;
• account opening;
• transaction execution.

That does not automatically mean every participant can use the same information for unrelated advertising or behavioural profiling.

The 2026 KVKK payment/e-money guide specifically addresses lawful processing grounds, transfers and data-security responsibilities in the sector.

The commercial platform should therefore separate:

financial-service processing

from

marketing processing.

34. Outsourcing and Technology Contracts

A regulated institution can use technology supplied by a non-financial company.

However, outsourcing does not eliminate regulatory responsibility.

A robust embedded finance agreement should address at least:

• licence allocation;
• regulatory cooperation;
• KYC;
• cybersecurity;
• incident response;
• audit rights;
• data access;
• subcontracting;
• business continuity;
• termination.

The licensed financial institution should be able to demonstrate to its regulator that it retains adequate oversight and control.

35. Product Changes Can Change the Licence Requirement

Embedded finance products evolve rapidly.

A platform may begin with simple payment acceptance and later add:

• wallet balances;
• P2P transfers;
• customer IBANs;
• open banking;
• credit.

Each new function can alter the regulatory analysis.

The CBRT’s current registers illustrate that permissions are service-specific. An institution authorised for one Article 12 activity is not automatically authorised for every other payment activity.

Regulatory review should therefore be built into product governance.

36. Foreign Non-Financial Companies Entering Turkey

A foreign marketplace or SaaS company may wish to replicate an embedded finance model already used in Europe, the UK or the United States.

That model should not automatically be copied into Türkiye.

The Turkish regulatory structure may require:

• a Turkish licensed payment partner;
• an electronic money institution;
• a BaaS service bank;
• a Turkish-resident interface provider;
• additional data-localisation arrangements.

In particular, Turkish BaaS rules allow service banks to provide BaaS only to interface providers resident in Türkiye.

Foreign groups may therefore need a Turkish subsidiary or a different operating architecture.

37. Embedded Finance and Regulatory Partner Risk

Non-financial companies are often heavily dependent on their regulated partners.

If a partner loses its licence, an embedded wallet or payment product may cease functioning immediately.

This is a real risk.

The CBRT reported that during its 2025 supervision:

• 7 operating licences were revoked;
• 14 operating licences were temporarily suspended;
• 72 institutions received administrative fines totalling approximately TRY 373.2 million;
• 331 suspected unauthorised payment-service cases were referred to prosecutors and/or courts.

A serious embedded finance strategy therefore requires ongoing regulatory due diligence on the licensed partner.

38. Multi-Provider Strategies

Some platforms may reduce dependency by working with more than one licensed financial institution.

This can improve operational resilience.

However, it also creates additional complexity.

Customers need to know:

• which institution holds their money;
• which institution provides each financial product;
• which terms apply;
• where complaints should be directed.

In BaaS, working with multiple service banks is itself subject to the specific BDDK approval framework for interface providers.

Operational diversification should therefore not create regulatory confusion.

39. Embedded Finance M&A Due Diligence

Investors acquiring a non-financial company with embedded finance features should conduct specialised regulatory due diligence.

Important questions include:

Product Map

Which financial services are embedded?

Licence Holder

Which institution legally provides each regulated service?

Customer Contracts

Does the documentation correctly identify the regulated provider?

Money Flow

Does the target ever control or hold customer funds?

Wallet

Who issues electronic money?

Cards

Who legally issues the payment or credit card?

Lending

Who makes the credit decision and books the credit exposure?

BaaS

Does the target have the required interface-provider approval?

AML

Can the financial partner meet its KYC responsibilities?

Data

Are KVKK roles correctly allocated?

Cybersecurity

Can the licensed institution audit the embedded-finance platform?

Partner Risk

What happens if the regulated partner is suspended?

A target may describe itself as a technology company while its actual operations have moved materially into the regulated perimeter.

40. Common Embedded Finance Legal Mistakes

Mistake 1: “Embedded Finance Is Not Regulated”

Incorrect.

The individual financial services embedded into the platform are regulated.

Mistake 2: “Our Partner’s Licence Covers Us”

Not automatically.

The non-financial company must remain within its permitted role.

Mistake 3: “We Can Hold Customer Wallet Balances Because an EMI Supports Us”

The legal issuer and holder of regulated customer funds must be correctly structured.

Mistake 4: “BaaS Means We Can Become a Bank Without a Licence”

Incorrect.

The service bank remains the bank, makes the banking decision and carries banking activity on its balance sheet.

Mistake 5: “The Bank Can Be Completely Invisible”

Not under the Turkish BaaS model.

Customer contracts and interfaces must identify the service bank, and the bank’s name/logo must remain visible in specified circumstances.

Mistake 6: “Our Interface Is Only Software, So Cybersecurity Is the Bank’s Problem”

Incorrect.

The BaaS framework establishes joint responsibility for specified interface authentication and transaction-security requirements.

Mistake 7: “Every BNPL Product Is Unregulated”

Incorrect.

The actual creditor and financing structure determine which banking, financing and consumer rules apply.

Mistake 8: “We Can Add Crypto Payments to the Wallet”

Turkish rules continue to restrict direct and indirect use of crypto assets in payments.

Mistake 9: “Customer Consent Solves Every Data Issue”

Financial-data processing must be assessed under the actual KVKK processing grounds, transfer rules and sector-specific obligations.

Practical Embedded Finance Compliance Checklist for Non-Financial Companies

Before launching embedded finance in Türkiye, management should answer the following questions.

1. What Financial Service Is Being Embedded?

Payment, wallet, account, card, lending, open banking or banking?

2. Which Regulator Has Jurisdiction?

CBRT, BDDK or another financial authority?

3. Who Is the Licensed Provider?

The customer journey should have a clearly identified regulated institution.

4. Does the Platform Touch Customer Funds?

If yes, identify precisely why and under whose legal authority.

5. Are Payment Accounts Provided?

Verify the relevant Article 12 permission.

6. Is Electronic Money Issued?

Identify the Article 18(2) EMI.

7. Is There a Digital Wallet?

Review Article 4/A.

8. Are Cards Issued?

Determine whether the card is a payment/e-money or bank product and identify the legal issuer.

9. Are Bank Accounts or Credit Embedded?

Review the BaaS framework and service-bank relationship.

10. Who Makes Credit Decisions?

The regulated lender should retain the regulated decision-making function.

11. Is the Commercial Brand Misleading?

Do not imply that an unlicensed platform is itself a bank, EMI or payment institution.

12. Is KYC Properly Allocated?

Document which entity verifies customers and who remains legally responsible.

13. Are AML Information Flows Sufficient?

The regulated institution should receive the information needed for effective monitoring.

14. Are KVKK Roles Clear?

Identify controllers and processors activity by activity.

15. Are Data Transfers Lawful?

Review both KVKK and sector-specific localisation rules.

16. Is Cybersecurity Financial-Grade?

The embedded interface may itself fall within specific regulatory security obligations.

17. Are Audit Rights Included?

The regulated partner should be able to inspect outsourced services.

18. What Happens if the Licence Holder Is Suspended?

Prepare operational continuity and migration plans.

19. Are New Product Features Legally Reviewed?

Licence scope should be reassessed before every major expansion.

Frequently Asked Questions About Embedded Finance in Turkey

Is embedded finance legal in Turkey?

Yes. Embedded finance can be structured legally through authorised financial institutions and properly allocated roles. There is no single embedded finance licence.

Can a retailer offer financial services?

A retailer can integrate regulated financial services supplied by licensed payment institutions, electronic money institutions, banks or other authorised providers. Whether the retailer itself needs a licence depends on its actual role.

Can a marketplace offer a wallet?

Potentially yes. However, digital wallets are regulated under Article 4/A, and electronic money authority may also be required depending on the wallet’s functionality.

Can a retailer issue its own electronic money?

Only if the legal issuer has the required electronic money authority. CBRT confirms that authorised EMIs hold Article 18(2) authority to issue electronic money.

What is the minimum own-funds requirement for an EMI in 2026?

From 30 June 2026, the minimum own-funds floor is TRY 105 million, subject to the complete prudential calculation framework.

What is the minimum for an ordinary payment institution?

The general payment institution minimum is TRY 40 million from 30 June 2026, excluding separately treated categories.

Can a non-financial company provide banking through its app?

Yes, through a properly structured Banking as a Service model. The service bank remains the banking provider and the interface provider provides customer access.

Must the interface provider be located in Turkey?

The BaaS Regulation provides that a service bank may provide service-model banking only to interface providers resident in Türkiye.

Does the customer need a contract with the bank?

Yes. A contractual relationship must be established between the customer and the service bank before the bank provides banking services through the interface.

Who makes the credit decision in BaaS?

The service bank. The Regulation expressly states that the bank determines whether banking services, including credit, will be provided.

Can the embedded finance platform call itself a bank?

Not unless it has the required banking status. Interface providers face specific restrictions against creating that impression.

Can the platform hide the service bank?

The Turkish BaaS framework requires customer-facing disclosures identifying the service bank and, in specified circumstances, visible use of the bank’s name and logo.

Can embedded lending be offered by a financing company?

A licensed financing company can finance purchases of goods or services by paying the seller on behalf of the borrower, with repayments made by the borrower to the financing company.

Are embedded finance businesses subject to MASAK?

The regulated payment/e-money institution generally is. Electronic money institutions and most payment institutions must maintain formal compliance programmes.

Who performs KYC?

The allocation depends on the model, but the regulated institution cannot simply abandon its statutory customer-identification responsibilities because onboarding occurs through another company’s app.

Does KVKK apply?

Yes. Embedded finance normally involves extensive processing and sharing of financial personal data. The KVKK Authority published dedicated payment/e-money sector guidance in July 2026.

Can a foreign SaaS company launch embedded finance directly in Turkey?

A foreign company can potentially provide technology, but regulated Turkish financial services require separate local regulatory analysis. In BaaS, the interface provider must be Türkiye-resident.

Can an e-commerce platform embed crypto payments?

The CBRT’s current rule continues to prohibit direct or indirect use of crypto assets in payments and related payment-service models.

Conclusion: How Should Non-Financial Companies Structure Embedded Finance in Turkey?

Embedded finance regulation in Turkey is best understood as a regulatory architecture rather than a single licence.

A non-financial company can integrate sophisticated financial functionality into its application.

But every financial feature must have a legally identified provider.

The correct starting point is therefore not:

“Which embedded finance licence do we need?”

The correct starting point is:

“What regulated financial services does our customer journey contain?”

For payments, the analysis starts with Law No. 6493 and CBRT regulation.

Payment institutions are authorised for specific Article 12 service categories, and electronic money institutions separately hold electronic money issuance authority under Article 18(2).

This means a non-financial business may integrate:

• checkout;
• wallets;
• payment accounts;
• payment cards;
• transfers;

but the licensed provider behind those functions must hold the correct permissions.

Digital wallets require particular care.

Article 4/A expressly provides that regulated digital wallet services may be provided by payment service providers and requires at least the relevant payment-instrument authority, with additional licence requirements depending on functionality.

Accordingly, a retailer cannot simply launch a wallet and rely on the argument that the product exists only inside its commercial application.

The regulatory classification follows the underlying payment functions.

Electronic money creates an even clearer boundary.

Where customers provide money, receive electronically stored value and use that value for payments to third parties, the legal electronic-money issuer must be identified.

A commercial brand cannot borrow an EMI licence from another company.

The EMI can provide the regulated infrastructure.

The brand can provide the customer experience.

But the licence remains with the authorised institution.

This distinction also has significant financial consequences.

From 30 June 2026, the minimum own-funds requirement for the general payment institution category is TRY 40 million, while electronic money institutions must maintain at least TRY 105 million under the current minimum framework.

For startups and investors, this creates a major strategic decision.

A company can either:

remain a non-financial technology/commercial platform and partner with regulated providers

or

become a regulated financial institution itself.

Both structures can be viable.

They have very different capital, governance and compliance consequences.

Banking as a Service provides a particularly important third route.

Türkiye’s BDDK framework expressly allows Türkiye-resident interface providers to offer customers access to banking services supplied by service banks.

This makes BaaS one of the strongest legal foundations for embedded banking in Türkiye.

However, BaaS does not turn the non-financial company into a bank.

The service bank decides whether the customer will receive banking services, including credit, and the banking activity is recorded on the service bank’s balance sheet.

The customer must also have a direct contractual relationship with the service bank.

Where onboarding is remote, the service bank remains responsible for regulated customer identification.

The interface provider must therefore accept an important limitation:

It can own the experience without owning the banking licence.

Turkish law also requires that distinction to remain visible to customers.

The interface provider must disclose the role of the service bank and cannot mislead customers into believing that the platform itself is a bank or another licensed financial institution when it is not.

That principle extends beyond BaaS.

For every embedded finance model, customer-facing design should be consistent with legal reality.

If Bank A provides the bank account, the documentation should not tell customers that Retailer B is their bank.

If EMI C issues electronic money, Marketplace D should not claim that it independently issues the funds.

If Payment Institution E executes the payment, Technology Company F should not represent itself as independently licensed to provide that service unless it actually is.

Embedded lending requires the same discipline.

Where credit is supplied through BaaS, the service bank retains the credit decision.

Where a licensed financing company is used, the financing company provides the regulated financing and pays the seller in accordance with the financing-company framework.

The checkout page may therefore belong to the retailer.

The legal lender should still be correctly identified.

Crypto services create a different boundary.

Türkiye’s post-2024 crypto framework now requires CMB establishment and operating permission analysis for crypto platforms and custody providers, while CBRT rules continue to restrict the use of crypto assets in payments.

A non-financial company should therefore resist the temptation to treat crypto as an unregulated embedded finance shortcut.

AML/KYC allocation is equally important.

The user may interact entirely with the commercial platform, but the regulated financial institution remains subject to MASAK obligations.

Electronic money institutions and most payment institutions must maintain formal compliance programmes covering risk management, monitoring, compliance officers, training and internal audit.

This means the commercial platform and regulated provider need effective information sharing.

An e-commerce marketplace may know that a merchant suddenly changed its website and products.

A payment institution may know that the merchant’s payment volume increased twentyfold.

Neither party should operate in complete informational isolation where those facts may be relevant to fraud or AML.

Data protection adds another layer.

The KVKK Authority’s July 2026 Payment and Electronic Money Sector Good Practices Guide reflects the increasing importance of controller/processor classification, lawful processing, data transfers and information security in fintech.

Embedded finance companies should therefore create both:

a money-flow map, and

a data-flow map.

The money-flow map should show:

customer → platform → licensed provider → merchant/bank/beneficiary.

The data-flow map should show:

customer → commercial platform → regulated provider → technology vendors → cloud infrastructure.

Both maps should be legally consistent.

Cybersecurity must also be treated as a joint commercial and regulatory issue.

This is particularly clear under BaaS, where the service bank and interface provider bear joint responsibility for specified authentication and transaction-security requirements.

A commercial application containing embedded banking therefore needs substantially stronger controls than an ordinary shopping or SaaS interface.

Finally, non-financial companies should treat licence dependency as a business-continuity issue.

CBRT’s 2025 enforcement results demonstrate that payment and electronic money licences can be suspended or revoked and that unauthorised payment activity is actively investigated.

A platform whose entire wallet or payment ecosystem depends on one licensed partner should know exactly what happens if that provider becomes unavailable.

The ideal legal sequence for embedded finance in Türkiye is therefore:

define the customer journey → identify every financial function → identify the regulator → identify the licensed provider → map contracts → map funds → map data → allocate AML responsibility → verify cybersecurity → confirm branding/disclosures → prepare partner-continuity plans → launch.

For non-financial companies, the central rule can be summarised simply:

You can embed the financial service into your product, but you cannot embed away the financial regulation.

The most successful Turkish embedded finance models will therefore be those where the financial service feels seamless to the customer while the legal responsibilities behind the product remain precise, transparent and fully compliant.

Legal Disclaimer: This publication provides general information concerning embedded finance, embedded payments, electronic money, digital wallets, Banking as a Service, lending, crypto assets and related fintech regulation in Türkiye as of July 2026. It does not constitute legal, financial, tax or regulatory advice. Regulatory classification depends on the exact customer relationship, money flow, account structure, credit structure, branding, technology, contractual allocation and data-processing architecture. Each embedded finance business model should therefore be individually reviewed under applicable CBRT, BDDK, CMB, MASAK and KVKK legislation before launch.