Introduction: Why Fintech M&A in Turkey Requires Specialist Regulatory Due Diligence

Mergers and acquisitions involving financial technology companies are fundamentally different from ordinary corporate acquisitions.

A conventional technology acquisition may focus primarily on corporate ownership, intellectual property, software, employment, customer contracts, tax and commercial liabilities.

A fintech acquisition requires all of these reviews—but also a detailed examination of the target company’s regulatory licence and continuing compliance.

This distinction is critical because the value of many fintech companies is directly connected to their regulatory status.

A payment company without a valid payment institution licence may be little more than a software company.

An electronic money business whose authorisation is suspended may no longer be capable of operating its principal commercial model.

A crypto platform appearing on a regulatory website may still be in a transitional authorisation process rather than holding final operating permission.

A digital bank cannot simply transfer control to a new investor without considering Turkish banking regulation.

For these reasons, fintech mergers and acquisitions in Turkey require regulatory due diligence before the transaction structure, valuation and closing mechanics are finalised.

The Turkish financial technology market is supervised by several authorities depending on the target’s activity.

These principally include:

• the Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) for payment institutions and electronic money institutions;
• the Banking Regulation and Supervision Agency (“BRSA” or “BDDK”) for banks and digital banks;
• the Capital Markets Board of Türkiye (“CMB” or “SPK”) for crypto asset service providers and other capital-markets institutions;
• the Financial Crimes Investigation Board (“MASAK”) for AML and KYC compliance;
• the Turkish Competition Authority for merger control;
• the Personal Data Protection Authority for KVKK compliance.

The correct acquisition analysis should therefore answer not only:

“Does the target own its software?”

but also:

“Will the target still be legally permitted to conduct its regulated business after closing?”

That question should drive the entire M&A process.

1. What Is Fintech Regulatory Due Diligence?

Regulatory due diligence is a structured review of whether a fintech company:

• holds the required licences;
• operates within the scope of those licences;
• satisfies capital requirements;
• has obtained required shareholder approvals;
• maintains appropriate governance;
• complies with regulatory reporting;
• complies with AML/KYC obligations;
• has appropriate information systems;
• protects customer funds and assets;
• complies with data protection law;
• has unresolved regulator findings.

In a regulated fintech transaction, these matters can directly affect:

• purchase price;
• transaction structure;
• representations and warranties;
• indemnities;
• conditions precedent;
• escrow arrangements;
• earn-outs;
• closing timetable.

A regulatory problem discovered after closing may substantially reduce the value of the acquired company.

2. First Question: What Type of Fintech Company Is Being Acquired?

The first step is regulatory classification.

The target may be:

• a payment institution;
• an electronic money institution;
• an open banking provider;
• a digital wallet company;
• a digital bank;
• a Banking as a Service interface provider;
• a crypto asset trading platform;
• a crypto custody institution;
• a technology company providing software to regulated institutions;
• an unregulated fintech technology provider.

The classification determines which authority’s approval may be required.

A buyer should never rely merely on the company’s marketing description.

For example, a company describing itself as a “digital wallet” may actually be a licensed electronic money institution.

Another “fintech platform” may only provide software and have no regulated financial-services licence.

This distinction fundamentally affects valuation.

3. Share Deal vs Asset Deal

Fintech acquisitions are commonly structured as either:

Share Deals

The purchaser acquires shares in the existing regulated company.

The legal entity holding the licence continues to exist.

This structure may be commercially attractive because customer contracts, employees, licences and operational systems remain within the same entity.

However, the share transfer itself may require regulatory approval.

Asset Deals

The purchaser acquires selected assets such as:

• technology;
• intellectual property;
• customer contracts;
• trademarks;
• employees;
• infrastructure.

The licence generally does not automatically move with the purchased assets.

A regulatory authorisation is usually personal to the regulated institution.

Therefore, an asset acquisition should not assume that the buyer will automatically inherit the target’s payment, electronic money, banking or crypto authorisation.

For this reason, share deals are frequently more suitable where the regulated licence forms a substantial part of the target’s value.

4. Acquiring a Payment Institution or Electronic Money Institution

Payment institutions and electronic money institutions are regulated principally under Law No. 6493 and supervised by the CBRT.

The first M&A question should therefore be:

Will the transaction trigger a CBRT share transfer approval?

Under the current Payment Services Regulation, CBRT approval is required where a person directly or indirectly acquires shares representing at least 10% of the institution’s capital.

Approval is also required where an existing shareholder’s direct or indirect holding crosses the:

• 10%;
• 20%;
• 33%;
• 50%

thresholds, either upward or downward.

Transactions involving privileges to appoint members of the board of directors or audit committee are also subject to approval regardless of these percentages.

A change of control in a legal entity holding 10% or more of the licensed payment or e-money institution can itself trigger CBRT approval.

This means that regulatory approval may arise even where the shares of the licensed Turkish company are not transferred directly.

5. Indirect Acquisitions Can Trigger CBRT Approval

This is particularly important in international transactions.

Consider the following structure:

A foreign holding company owns 80% of a Turkish electronic money institution.

A global investor acquires control of the foreign holding company.

No shares of the Turkish institution are transferred directly.

Nevertheless, control of the shareholder owning more than 10% of the regulated Turkish company has changed.

The CBRT rules expressly capture certain changes of control at shareholder level.

Therefore, an international acquisition involving a multinational fintech group should analyse the Turkish subsidiaries even where the transaction is formally executed outside Türkiye.

6. Information Required for a CBRT Share Transfer Application

The Payment Services Regulation requires the purchaser to provide substantial documentation when applying for approval.

The required file includes matters such as:

• explanation of the source of funds used to acquire the shares;
• copy of the share transfer agreement;
• corporate resolutions approving the acquisition;
• documents demonstrating the acquirer’s regulatory suitability;
• declarations concerning qualified shareholders and control.

The CBRT also publishes a specific Share Transfer Application Document Checklist.

This has a direct impact on the SPA.

The share purchase agreement should normally make CBRT approval a condition precedent to closing where required.

The parties should not complete the transfer first and attempt to obtain regulatory approval afterwards.

7. Buyer Suitability Is Part of the M&A Process

The regulator does not merely review the target.

It also examines the purchaser.

An investor acquiring a significant interest in a payment or electronic money institution may need to demonstrate:

• financial strength;
• transparent ownership;
• source of acquisition funds;
• absence of relevant insolvency history;
• suitability to become a qualified shareholder;
• regulatory reputation.

Accordingly, the due diligence process should operate in both directions.

The purchaser investigates the target.

At the same time, the purchaser must prepare itself for regulatory scrutiny.

This becomes especially important where the buyer is:

• a private equity fund;
• international fintech group;
• family office;
• offshore holding structure;
• financial institution established abroad.

8. Regulatory Status of the Payment or E-Money Target

The buyer should verify the target directly against the CBRT’s current public registers.

The CBRT publishes current lists of authorised payment institutions and electronic money institutions together with their permitted activity scopes.

The due diligence review should establish:

• whether the licence remains active;
• which payment services are authorised;
• whether any activity has been suspended;
• whether the licence has been restricted;
• whether the institution has applied for additional permissions.

This is critical because not every payment or e-money institution has the same licence scope.

9. Regulatory Enforcement History Can Materially Affect Value

A target may technically still hold a licence while facing serious supervisory issues.

The CBRT’s January 2026 supervisory announcement illustrates the importance of this risk.

Following its 2025 supervisory work, the CBRT reported licence cancellations, temporary suspensions, dividend restrictions and administrative monetary penalties across the payment and electronic money sector.

A fintech buyer should therefore request:

• CBRT inspection reports;
• supervisory correspondence;
• warning letters;
• administrative sanction decisions;
• licence suspension decisions;
• remediation plans;
• outstanding information requests.

A target should not be valued solely by looking at the public licence register.

10. Merger Transactions Between Licensed Payment Companies

Fintech consolidation may also be structured through a legal merger rather than a share acquisition.

The Turkish market already contains practical examples of licensed electronic money companies combining through merger structures.

For example, the CBRT’s current register records that Moka Ödeme ve Elektronik Para Kuruluşu A.Ş.’s legal personality ended following its merger with Birleşik Ödeme Hizmetleri ve Elektronik Para A.Ş., with the surviving business operating under the Moka United name.

This demonstrates that mergers can be used within the licensed payment sector.

However, the regulatory consequences for licences, corporate identity, customer funds, information systems and supervisory approvals must be structured before registration of the merger.

11. Digital Bank and Bank Acquisitions

A digital bank is legally a bank.

Accordingly, acquiring a digital bank requires analysis under Banking Law No. 5411 rather than ordinary fintech company rules.

Article 18 of the Banking Law requires BRSA approval where a person acquires, directly or indirectly, shares representing 10% or more of the capital of a bank.

Approval is also required where shareholdings cross the:

• 10%;
• 20%;
• 33%;
• 50%

thresholds.

Shares carrying privileges to appoint members of the board or audit committee are subject to regulatory approval regardless of percentage.

Therefore, an acquisition of a Turkish digital bank is a regulated banking acquisition even where the buyer considers the target primarily a technology business.

12. BRSA Practice Confirms Active Share Transfer Supervision

The BRSA continues to actively review share transfers and restructurings in the banking and financial institution sector.

Its 2025 Annual Report states that 15 share transfer permissions were granted during 2025, including four involving banks and eleven involving non-bank financial institutions. The BRSA also reviewed a major banking demerger transaction involving QNB Bank and Enpara Bank.

This demonstrates that bank ownership changes are not merely corporate-law transactions.

They are supervisory events.

The buyer should therefore build BRSA approval timing into the acquisition timetable.

13. Digital Bank Due Diligence Requires More Than Licence Verification

A digital-bank acquisition should examine whether the institution continues to satisfy:

• capital requirements;
• digital-bank activity restrictions;
• customer eligibility restrictions;
• corporate governance rules;
• information systems requirements;
• remote onboarding requirements;
• AML obligations;
• service continuity requirements.

A bank with a valid licence may nevertheless require substantial post-closing remediation.

For that reason, buyers should assess not only whether the licence exists but also the cost of keeping it compliant.

14. Crypto Asset Service Provider M&A

Crypto company acquisitions have become particularly complex following Türkiye’s regulatory reforms.

Law No. 7518 brought crypto asset service providers under CMB regulation in July 2024.

Two comprehensive CMB communiqués entered into force on 13 March 2025.

Communiqué III-35/B.1 expressly regulates:

• founders and shareholders;
• share transfers;
• managers;
• internal control;
• risk management;
• information systems;
• audits.

Communiqué III-35/B.2 regulates operational services, crypto custody and capital adequacy.

Therefore, acquiring a Turkish crypto platform should now be treated as an acquisition of a regulated financial institution.

15. Do Not Assume That a Crypto Company Is Fully Licensed

This is one of the most important crypto M&A risks.

During Türkiye’s transition into the permanent crypto licensing framework, companies may be at different stages of regulatory authorisation.

A buyer should therefore verify:

• establishment permission;
• operating permission;
• transitional regulatory status;
• custody arrangements;
• CMB applications;
• unresolved deficiencies.

The CMB itself maintains specific application procedures for establishment and operating permissions and requires applications to follow its current formal documentation standards.

The regulatory status should be established through actual CMB decisions and correspondence rather than management statements.

16. Crypto Share Transfers Require CMB Analysis

Communiqué III-35/B.1 expressly regulates share transfers in crypto asset service providers.

Therefore, the buyer should analyse whether:

• CMB approval is required;
• the buyer satisfies shareholder suitability criteria;
• indirect ownership changes are relevant;
• closing should be conditional upon regulatory approval.

This issue is particularly significant for venture capital and private equity investors.

A crypto company can no longer treat every investment round as an ordinary startup financing round.

17. Crypto Custody Is a Major M&A Due Diligence Issue

A crypto platform’s custody architecture can determine the viability of the acquisition.

The current CMB rules require substantial controls concerning:

• customer asset custody;
• technology infrastructure;
• customer asset separation;
• security;
• custody provider relationships.

The CMB’s 2025 annual report confirms that crypto regulation requires platforms to establish custody infrastructure and, within the applicable framework, contract with qualifying crypto custody institutions.

An investor should therefore understand exactly where the target’s customers’ crypto assets are held.

18. Proof of Reserves Should Be Reviewed

The Turkish CMB framework also includes proof-of-reserves audits.

The CMB adopted detailed principles in 2025 requiring periodic proof-of-reserves review for crypto asset service providers.

In crypto M&A, the buyer should request:

• proof-of-reserves reports;
• wallet lists;
• custody reconciliations;
• customer liabilities;
• audit qualifications;
• information system audit reports.

The most serious acquisition risk may not appear on the target’s balance sheet.

It may be a deficiency between customer crypto liabilities and actual available assets.

19. Regulatory Capital Should Be Recalculated at Closing

For every regulated fintech target, the purchaser should confirm that the company will remain adequately capitalised after the transaction.

This is especially important where:

• transaction costs are paid by the target;
• shareholder loans are repaid at closing;
• dividends are distributed before closing;
• related-party balances are settled;
• restructuring costs arise.

A company satisfying capital requirements before signing may fall below the required level after pre-closing distributions.

Capital adequacy should therefore be tested on a pro forma post-closing basis.

20. MASAK Compliance Is a Major Acquisition Liability

AML compliance is one of the highest-risk areas in fintech M&A.

Payment institutions, electronic money institutions and crypto asset service providers are subject to obligations administered by MASAK.

The buyer should review:

• customer identification;
• beneficial ownership;
• remote KYC;
• customer risk classification;
• transaction monitoring;
• PEP screening;
• sanctions controls;
• suspicious transaction reporting;
• record retention.

The critical question is not whether the target has an “AML Policy.pdf”.

The question is whether the policy actually works.

21. Sampling Customer Files

One effective due diligence technique is to sample customer files.

The buyer may review anonymised or appropriately structured samples involving:

• high-risk customers;
• corporate customers;
• foreign customers;
• PEP relationships;
• major merchants;
• large crypto accounts.

The review can identify systematic weaknesses such as:

• missing beneficial owners;
• outdated KYC;
• inadequate source-of-funds checks;
• incomplete merchant due diligence;
• inconsistent risk classifications.

Where the target has millions of customers, compliance quality must be assessed statistically and procedurally rather than by reviewing every account.

22. Suspicious Transaction Reporting Should Be Tested Carefully

The buyer should examine whether the target maintains effective internal escalation systems for suspicious transactions.

Important questions include:

• Are transaction monitoring alerts reviewed?
• How many alerts remain unresolved?
• How long does review take?
• Are STR decisions documented?
• Is the compliance officer sufficiently independent?
• Has MASAK identified reporting deficiencies?

A low number of suspicious transaction reports does not automatically mean the company has low AML risk.

It may instead indicate weak monitoring.

23. Cybersecurity Due Diligence

Fintech M&A should always contain a dedicated information systems and cybersecurity workstream.

Areas to examine include:

• penetration test results;
• vulnerability reports;
• information systems audits;
• cyber incidents;
• access rights;
• privileged user accounts;
• authentication;
• encryption;
• disaster recovery;
• source code security;
• outsourced cloud infrastructure.

This is particularly important because the regulatory framework for payment/e-money institutions and crypto companies expressly contains detailed information systems requirements. The CMB’s crypto framework, for example, specifically regulates technology infrastructure and information systems.

A cybersecurity deficiency may therefore be both a technical risk and a licensing risk.

24. Intellectual Property Due Diligence

The value of a fintech company often lies heavily in its software.

The buyer should verify ownership of:

• source code;
• mobile applications;
• APIs;
• trademarks;
• domain names;
• databases;
• proprietary algorithms.

A frequent startup problem is that software was originally developed by:

• founders personally;
• freelancers;
• outsourced development agencies;
• foreign group companies.

The buyer should verify that all necessary intellectual property rights were validly assigned to the target company.

A regulated licence does not compensate for a lack of ownership of the technology required to operate the business.

25. Open-Source Software Risk

Fintech technology stacks frequently include open-source software.

Due diligence should examine:

• licence type;
• attribution obligations;
• copyleft obligations;
• source disclosure risk;
• cybersecurity vulnerabilities.

The buyer should pay particular attention where proprietary financial software incorporates components subject to strong copyleft licences in a manner capable of affecting distribution obligations.

A software bill of materials can be useful in larger transactions.

26. Customer Funds and Safeguarding

For payment and e-money companies, due diligence should verify whether customer funds have been properly protected.

The review should include:

• safeguarding accounts;
• reconciliation;
• settlement timing;
• customer funds held at banks;
• operational accounts;
• merchant settlement processes.

Misuse of customer funds can produce regulatory, civil and criminal consequences.

A buyer should therefore independently reconcile material safeguarding balances where possible.

27. Data Protection Due Diligence

Fintech businesses process substantial volumes of personal and financial information.

The due diligence process itself also involves personal data processing.

The Turkish Personal Data Protection Authority’s July 2026 academic journal specifically included analysis of personal data protection issues arising during M&A due diligence, reflecting the increasing importance of this issue.

The target’s compliance review should examine:

• privacy notices;
• processing legal bases;
• consent practices;
• VERBIS;
• retention;
• security;
• data breaches;
• data subject requests;
• international transfers.

28. Data Room Access Must Also Be KVKK-Compliant

M&A parties should not assume that every item in the virtual data room can automatically be disclosed to a bidder.

Documents may contain:

• employee personal data;
• customer information;
• merchant records;
• KYC files;
• financial information.

Data room preparation should therefore follow data-minimisation principles.

Depending upon the transaction, parties may use:

• anonymisation;
• redaction;
• aggregation;
• restricted-access folders;
• clean-team structures.

Sensitive customer information should not be uploaded merely because the purchaser requests “all documents.”

29. Foreign Buyers and Cross-Border Due Diligence

Where a foreign buyer receives data from Türkiye, the disclosure may constitute a cross-border personal data transfer.

KVKK Article 9 was materially reformed in 2024.

Standard contracts and Binding Corporate Rules now operate as important transfer mechanisms.

Where standard contracts are used, they must be notified to the Personal Data Protection Authority within five business days after signing.

Therefore, an international buyer should structure data room access before personal data is transferred abroad.

30. Competition Law and Merger Control

Fintech acquisitions may also require approval from the Turkish Competition Board.

Türkiye substantially updated the merger-control thresholds in February 2026.

Under the new framework, the principal monetary thresholds were increased so that:

• the general aggregate Turkish turnover threshold increased from TRY 750 million to TRY 3 billion;
• the general individual Turkish turnover threshold increased from TRY 250 million to TRY 1 billion;
• the relevant worldwide turnover threshold increased from TRY 3 billion to TRY 9 billion.

Therefore, merger-control analysis should be performed before signing or at least before closing.

31. Fintech Companies Can Fall Within the Technology Undertaking Rules

Fintech acquisitions are especially important under Turkish merger control because the Competition Authority maintains a special regime for technology undertakings.

Following the 2026 amendments, the special technology-undertaking treatment was narrowed to technology undertakings established in Türkiye.

The Competition Authority also changed the relevant turnover treatment so that the TRY 250 million threshold applies to the relevant Turkish technology target in circumstances covered by the special rule.

Because fintech companies frequently provide financial technology, software or digital services, this rule should be analysed carefully.

A relatively small fintech acquisition may still require Competition Board clearance.

32. Do Not Close Before Competition Clearance

Where a transaction is subject to mandatory Competition Board approval, closing before clearance can create gun-jumping risk.

The SPA should therefore include Competition Board approval as a condition precedent where required.

The parties should also regulate pre-closing conduct carefully.

The purchaser should not begin exercising control over the target before completion merely because the SPA has been signed.

Examples of sensitive conduct include:

• directing pricing;
• controlling customers;
• approving ordinary business decisions;
• integrating teams;
• sharing competitively sensitive information without safeguards.

The distinction between protecting the value of the target and exercising premature control is important.

33. Clean Teams in Competitor Transactions

Where the buyer and target compete in the same market, due diligence may involve competitively sensitive information.

Examples include:

• merchant pricing;
• customer lists;
• commission rates;
• future strategy;
• supplier terms.

A clean-team protocol can reduce competition-law risk.

Under such a structure, sensitive information may be restricted to:

• external advisers;
• designated independent personnel;
• specific non-commercial executives.

The information may then be reported to decision makers only in aggregated form.

This is particularly useful where two payment companies or competing fintech platforms are considering a combination.

34. Foreign Investment in Turkish Fintech Companies

Türkiye generally operates a relatively liberal foreign investment framework.

The official Invest in Türkiye platform explains that Foreign Direct Investment Law No. 4875 is based on equal treatment and uses a notification-based rather than a general approval-based foreign investment system.

Accordingly, Türkiye does not impose a general economy-wide foreign investment screening approval simply because a purchaser is foreign.

However, this should not be confused with sectoral financial regulation.

A foreign investor acquiring:

• a bank;
• payment institution;
• electronic money institution;
• crypto asset service provider

may still require approval from the relevant financial regulator.

The relevant distinction is:

general FDI approval versus regulated financial institution ownership approval.

35. Employee Due Diligence

Fintech companies frequently depend heavily on key technical and regulatory employees.

The buyer should examine:

• employment agreements;
• key executives;
• compliance officer;
• information security personnel;
• developers;
• incentive plans;
• confidentiality obligations;
• IP assignment;
• non-compete clauses.

A regulatory licence may depend operationally upon personnel satisfying certain qualification requirements.

If those employees leave immediately after closing, the buyer may face both commercial and regulatory disruption.

Retention packages should therefore be considered before completion.

36. Founder Dependency

Early-stage fintech companies are often highly dependent upon founders.

The founder may personally control:

• key merchant relationships;
• software architecture;
• regulator communications;
• banking relationships;
• strategic partnerships.

Due diligence should identify whether the business can genuinely operate independently of the founder after acquisition.

A sophisticated investor may structure:

• earn-out;
• retention;
• consultancy;
• transition services

to reduce founder-dependency risk.

37. Material Commercial Contracts

Fintech target value frequently depends upon a relatively small number of major contracts.

The buyer should review:

• sponsor-bank agreements;
• card scheme agreements;
• acquiring agreements;
• cloud contracts;
• payment network agreements;
• KYC vendors;
• major merchants;
• outsourcing contracts;
• crypto custody agreements.

Particular attention should be paid to change-of-control provisions.

A regulatory acquisition may be approved while a critical commercial partner retains the contractual right to terminate because ownership has changed.

38. Outsourcing Agreements

Regulated fintech companies cannot outsource without limits.

The target’s outsourced arrangements should therefore be reviewed for compliance with:

• regulatory outsourcing requirements;
• information security;
• audit rights;
• data access;
• business continuity;
• subcontracting.

A company may have excellent software but still depend on a vendor arrangement that does not satisfy regulatory requirements.

This can become a post-closing remediation expense.

39. Tax Due Diligence

Tax review remains important even though fintech transactions have strong regulatory characteristics.

Due diligence should consider:

• corporate tax;
• VAT;
• withholding;
• payroll;
• transfer pricing;
• related-party transactions;
• historical tax audits;
• tax incentives.

The buyer should also model the tax consequences of:

• share sale;
• merger;
• demerger;
• asset acquisition.

The most tax-efficient transaction structure should nevertheless not be selected if it creates an unacceptable regulatory result.

40. Litigation and Customer Complaints

Fintech companies can face large numbers of relatively small customer disputes.

Due diligence should analyse trends rather than simply counting court cases.

Relevant areas include:

• unauthorised transactions;
• account freezes;
• fraud;
• chargebacks;
• merchant disputes;
• customer fund recovery;
• crypto withdrawal complaints;
• data protection complaints.

A high volume of similar complaints may reveal a systemic operational problem.

41. Regulatory Representations and Warranties

The SPA for a fintech acquisition should contain specialised regulatory warranties.

Examples include warranties concerning:

• valid licences;
• authorised activity scope;
• regulatory filings;
• capital compliance;
• regulator correspondence;
• AML;
• customer funds;
• data protection;
• information security;
• absence of undisclosed investigations.

Generic wording stating that the company “complies with all laws” is frequently insufficient for a major regulated fintech transaction.

The warranties should reflect the actual licensing framework.

42. Specific Indemnities

Where due diligence identifies a known regulatory risk, the buyer may require a specific indemnity.

Examples include:

• historical MASAK deficiency;
• unresolved CBRT audit;
• customer fund reconciliation issue;
• KVKK breach;
• unresolved tax investigation;
• unlicensed historic activity.

A known risk should not necessarily be left inside a general warranty subject to ordinary limitations.

It may require separate protection.

43. Conditions Precedent

Regulatory conditions precedent are central to fintech M&A.

Depending upon the transaction, closing conditions may include:

• CBRT share transfer approval;
• BRSA approval;
• CMB approval;
• Competition Board clearance;
• required contractual consents;
• remediation of a capital deficiency;
• regulatory licence confirmation.

The SPA should clearly state:

• who prepares applications;
• who controls communications;
• what cooperation is required;
• long-stop date;
• consequences if approval is refused;
• whether behavioural commitments can be accepted.

44. Regulatory Material Adverse Change Clauses

The signing-to-closing period can be significant where multiple approvals are required.

The buyer may therefore seek protection against material regulatory deterioration.

Potential events include:

• licence suspension;
• major cyberattack;
• regulator investigation;
• capital deficiency;
• significant AML finding;
• loss of a critical banking partner.

A carefully drafted regulatory MAC clause can protect the buyer while avoiding an excessively broad termination right.

45. Pre-Closing Covenants

The SPA should also preserve the target’s regulated condition until closing.

The seller may be required to ensure that the target:

• maintains its licences;
• preserves regulatory capital;
• does not distribute unusual dividends;
• does not materially change customer fund arrangements;
• continues regulatory reporting;
• does not enter major new regulated activities without consent.

However, purchaser consent rights must be structured carefully to avoid premature control under competition law.

46. Closing Mechanics

Fintech transactions may require regulatory sequencing.

A typical process might be:

1. sign SPA;
2. submit sector-regulator application;
3. submit Competition Board filing where necessary;
4. obtain contractual consents;
5. satisfy regulatory conditions;
6. obtain approvals;
7. close share transfer;
8. register corporate changes;
9. notify authorities as required.

The transaction timetable should therefore be prepared around regulatory approvals rather than commercial convenience alone.

47. Post-Closing Regulatory Integration

Closing is not the end of the regulatory process.

Post-closing work may include:

• board changes;
• management notifications;
• updated shareholder registers;
• regulatory notifications;
• beneficial ownership updates;
• information systems integration;
• AML programme harmonisation;
• data migration;
• branding changes.

Rapid technical integration immediately after closing can itself create risk.

For example, transferring the target’s customer database into the buyer’s foreign group infrastructure may create KVKK Article 9 issues.

Technology integration therefore requires its own legal plan.

48. Fintech M&A Regulatory Due Diligence Checklist

A buyer should consider at least the following.

Licence

What licence does the company actually hold?

Activity Scope

Which services are authorised?

Regulator

Which authority supervises the target?

Share Transfer Approval

Will the acquisition require CBRT, BRSA or CMB approval?

Indirect Control

Will an offshore parent-company transaction trigger Turkish approval?

Competition

Is Turkish Competition Board clearance required?

Capital

Does the target satisfy minimum regulatory capital?

Enforcement

Are there investigations, sanctions or remediation programmes?

AML

Does the MASAK compliance programme operate effectively?

Customer Funds

Are customer balances properly safeguarded?

Crypto Custody

Where applicable, are crypto assets fully reconciled?

Information Systems

Are regulatory technology requirements satisfied?

Cybersecurity

Have material incidents occurred?

Data Protection

Does the target comply with KVKK?

International Transfers

Are cross-border data transfers lawful?

Intellectual Property

Does the company own its core software?

Key Contracts

Do material contracts contain change-of-control clauses?

Employees

Are key regulatory and technical employees retained?

Tax

Are material historical liabilities present?

Frequently Asked Questions About Fintech M&A in Turkey

Does acquiring a payment institution require CBRT approval?

Potentially yes.

Acquisitions reaching or crossing the 10%, 20%, 33% or 50% thresholds can require CBRT approval, as can certain privileged shares and indirect changes of control.

Does acquiring an electronic money institution require CBRT approval?

Yes, the same regulated share-transfer framework generally applies to licensed electronic money institutions under Law No. 6493 and the Payment Services Regulation.

Does acquiring a digital bank require BRSA approval?

Yes where the acquisition falls within Banking Law Article 18 thresholds or involves privileged shares. The relevant thresholds include 10%, 20%, 33% and 50%.

Are crypto company share transfers regulated?

Yes. Communiqué III-35/B.1 expressly regulates CASP founders, shareholders and share transfers.

Is appearing on a regulator’s website enough to establish regulatory compliance?

No.

The purchaser should verify the exact licence, scope, current status and regulator correspondence rather than relying solely on a public listing.

Can a foreign investor acquire a Turkish fintech company?

Generally yes. Türkiye’s general FDI framework is based on equal treatment and a notification rather than economy-wide approval system. However, acquisitions of regulated financial institutions remain subject to applicable sector approvals.

Do fintech acquisitions require Competition Board approval?

Some do.

The current 2026 merger-control regime uses updated turnover thresholds and special rules for qualifying technology undertakings.

What are the 2026 general merger thresholds?

The Competition Authority increased the general thresholds in February 2026, including a TRY 3 billion aggregate Turkish turnover threshold, TRY 1 billion individual threshold and TRY 9 billion worldwide threshold within the applicable tests.

Are fintech companies treated as technology undertakings for merger control?

They can be. The technology-undertaking definition and special threshold treatment must be separately analysed based on the company’s activities and Turkish establishment.

Can the buyer review customer personal data during due diligence?

Only within a legally compliant structure.

Data minimisation, redaction, purpose limitation and KVKK requirements should be considered. International data-room access may also create a cross-border transfer.

Can a foreign buyer receive personal data from the Turkish target?

Potentially, but KVKK Article 9 must be satisfied. Standard contracts are one available safeguard and must be notified to the Authority within five business days after signing.

Is a general legal compliance warranty sufficient in a fintech SPA?

Usually not for a material regulated acquisition.

Fintech SPAs should generally contain specific representations concerning licences, AML, capital, safeguarding, information systems, cybersecurity, customer funds and regulatory investigations.

Conclusion: Regulatory Due Diligence Is the Core of Fintech M&A in Turkey

Fintech mergers and acquisitions in Turkey require a fundamentally different approach from ordinary technology M&A.

The central asset being acquired may not be the code, brand or customer database.

It may be the regulated financial institution itself.

For payment institutions and electronic money institutions, ownership changes can trigger CBRT approval at relatively low shareholding thresholds.

Direct or indirect acquisitions reaching 10%, or crossing the 20%, 33% or 50% thresholds, can require regulatory permission. Certain changes involving privileged shares or control of significant corporate shareholders are also regulated.

For banks and digital banks, Banking Law Article 18 imposes a similarly strict ownership-control framework.

Crypto transactions have also entered a new regulatory phase.

Since the 2024–2025 reforms, crypto asset service providers are subject to specific CMB rules concerning shareholders, share transfers, management, internal systems, custody and capital adequacy.

Accordingly, a buyer acquiring a crypto platform should not approach the transaction as a conventional Web3 startup acquisition.

The regulatory status must be independently established.

Competition law adds another layer.

Türkiye significantly revised its merger-control regime in February 2026, increasing the principal notification thresholds while revising the special rules applicable to technology undertakings. Because fintech businesses frequently operate within software, payments and digital platform markets, the special technology rules should be reviewed even where the target’s revenue appears relatively modest.

Personal data is another major risk area.

Due diligence requires substantial information sharing, but the existence of an M&A transaction does not suspend KVKK.

Where the buyer is established abroad, data-room disclosure can also create an international transfer requiring Article 9 compliance. Türkiye’s post-2024 system recognises standard contracts and Binding Corporate Rules as transfer safeguards, while standard contracts must be notified within five business days of signing.

For foreign investors, the broader investment environment remains relatively liberal.

The Foreign Direct Investment Law generally operates on equal treatment and notification rather than a general prior-approval system. Nevertheless, that principle does not override sector-specific financial licensing requirements.

The result is that a foreign investor may generally be free to invest in Türkiye while still needing:

• CBRT approval for a payment or e-money acquisition;
• BRSA approval for a bank acquisition;
• CMB approval for qualifying crypto ownership changes;
• Competition Board clearance for a notifiable concentration.

These approvals must be reflected in the SPA.

A well-structured fintech acquisition should therefore make regulatory permissions conditions precedent to closing, allocate responsibility for regulatory filings and provide a realistic long-stop date.

Regulatory due diligence should also go substantially beyond confirming that a licence certificate exists.

A sophisticated buyer should examine:

• whether the target operates within its licence scope;
• whether regulatory capital remains sufficient;
• whether the regulator has identified deficiencies;
• whether customer funds are fully reconciled;
• whether AML/KYC systems function in practice;
• whether cyber controls satisfy financial-sector standards;
• whether customer data is processed lawfully;
• whether intellectual property is actually owned by the company;
• whether critical contracts survive a change of control.

For payment and electronic money companies, particular attention should be paid to customer safeguarding and CBRT inspection history.

For crypto businesses, the review should focus on custody, proof of reserves, information systems and exact CMB authorisation status.

For digital banks, the acquisition analysis must reflect the fact that the target is a bank—not merely a mobile application.

The regulatory findings should then be translated into transaction documentation.

A material compliance risk may require:

• price adjustment;
• escrow;
• specific indemnity;
• pre-closing remediation;
• post-closing covenant;
• walk-away right.

This is the point at which good regulatory due diligence becomes commercial M&A advice.

The purpose is not simply to produce a long list of legal issues.

It is to determine which issues affect value, which issues can be fixed and which issues threaten the transaction itself.

For investors planning to acquire a payment institution, electronic money company, digital wallet provider, open banking company, digital bank, BaaS business, crypto exchange or other fintech company in Turkey, regulatory due diligence should therefore begin before the final price and transaction structure are agreed.

The most important principle is simple:

In a regulated fintech acquisition, the buyer is not merely acquiring shares—it is acquiring a regulated compliance history.

A strong licence, reliable AML framework, clean regulatory record, secure technology and properly protected customer assets can materially increase the quality and value of the target.

Conversely, a company with rapid revenue growth but unresolved regulatory deficiencies may carry liabilities far greater than those visible in its financial statements.

For this reason, regulatory due diligence should sit at the centre—not the edge—of every significant fintech M&A transaction in Türkiye.

Legal Disclaimer: This publication provides general information concerning fintech mergers, acquisitions and regulatory due diligence in Türkiye as of July 2026. It does not constitute legal, tax or investment advice. Regulatory approval requirements, merger-control thresholds, licensing rules and supervisory practices may change. Each transaction should be assessed individually based on the target’s activity, ownership structure, licences, transaction value, buyer identity and applicable legislation at the relevant time.