Introduction: Regulatory Enforcement Is Becoming a Central Fintech Risk in Türkiye

For many fintech founders, regulatory strategy initially focuses on obtaining a licence.

The questions are usually:

• Which licence is required?
• How much capital is necessary?
• How long does authorisation take?
• Which regulator has jurisdiction?

However, receiving a financial licence is only the beginning of the regulatory relationship.

Once a fintech enters the regulated financial sector, its business can become subject to continuing:

• reporting;
• monitoring;
• inspections;
• information requests;
• on-site examinations;
• technology audits;
• AML reviews;
• enforcement proceedings.

Türkiye’s financial regulators have become increasingly active in these areas.

This is particularly visible in the payment and electronic money sector.

The Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) reported that its supervision of payment and electronic money institutions during 2025 resulted in:

• 7 operating licences being revoked;
• 14 operating licences being temporarily suspended;
• 12 institutions becoming subject to CBRT permission before dividend distribution;
• 72 institutions receiving administrative fines totalling TRY 373,243,560.30;
• 29 institutions receiving warnings;
• referrals concerning 331 suspected unauthorised payment-service cases to prosecutors and/or courts.

The contrast with 2024 is significant. In 2024, the CBRT had imposed approximately TRY 160.3 million in administrative fines on 55 institutions and had conducted more than 280 technical investigations concerning suspected unauthorised payment service providers.

Capital-markets enforcement also intensified.

The Capital Markets Board of Türkiye (“CMB” or “SPK”) reported that its 2025 investigations, surveillance and inspections resulted in 481 criminal complaints, eight criminal notifications and 208 trading bans, affecting 697 persons in total.

Across the SPK’s areas of responsibility, 312 administrative fine decisions in 2025 amounted to approximately TRY 2.71 billion.

Crypto businesses have also entered this enforcement environment following the 2024 expansion of the Capital Markets Law. The SPK reported that it conducted 11 inspections concerning unauthorised crypto asset service provider activity during 2025.

These developments demonstrate an important principle:

Fintech regulation in Türkiye is no longer primarily about obtaining authorisation. It is increasingly about proving continuous compliance after authorisation.

A regulatory investigation can affect much more than financial penalties.

Possible consequences can include:

• warnings;
• remediation orders;
• operational restrictions;
• administrative fines;
• dividend restrictions;
• transaction limits;
• licence suspension;
• licence revocation;
• access blocking;
• criminal referrals;
• judicial investigations.

This guide explains how fintech regulatory investigations operate in Türkiye and how businesses should prepare for enforcement by the CBRT, BRSA, CMB and MASAK.

1. Who Regulates Fintech Companies in Turkey?

There is no single Turkish “Fintech Authority.”

Jurisdiction depends on the regulated activity.

The principal authorities are:

CBRT – Central Bank of the Republic of Türkiye

Primarily responsible for:

• payment institutions;
• electronic money institutions;
• payment services;
• electronic money;
• open banking payment services.

The CBRT expressly confirms that authorisation, oversight and supervision of payment and electronic money institutions fall within its responsibility.

BRSA – Banking Regulation and Supervision Agency

The BRSA, commonly referred to by its Turkish abbreviation BDDK, regulates and supervises institutions including:

• banks;
• financing companies;
• factoring companies;
• financial leasing companies;
• certain other non-bank financial institutions.

Its supervision combines continuous off-site surveillance with on-site inspection and risk-based analysis.

CMB – Capital Markets Board of Türkiye

The CMB, commonly referred to as SPK, supervises:

• securities markets;
• investment institutions;
• portfolio management;
• crowdfunding;
• capital-market issuers;
• crypto asset service providers.

The Board can use regulatory decisions, administrative sanctions and various enforcement measures to protect investors and market integrity.

MASAK – Financial Crimes Investigation Board

MASAK is responsible primarily for Türkiye’s anti-money laundering and counter-terrorist-financing regime.

Its authority extends across numerous financial institutions, including:

• banks;
• financing companies;
• payment institutions;
• electronic money institutions;
• capital-market institutions;
• crypto asset service providers.

Payment institutions, electronic money institutions and crypto asset service providers are among the institutions required to establish formal AML compliance programmes, subject to specified exceptions for certain narrowly licensed payment institutions.

2. A Fintech Can Face More Than One Regulator at the Same Time

The division of regulatory responsibilities does not mean every investigation involves only one authority.

Consider an electronic money institution.

Its operations can simultaneously involve:

CBRT

for payment and electronic money regulation;

MASAK

for AML/KYC;

KVKK Authority

for personal data;

and potentially

prosecutors

where facts raise suspicion of criminal activity.

A crypto platform may simultaneously face:

• SPK supervision;
• MASAK AML review;
• judicial investigation.

A bank may face:

• BDDK supervision;
• MASAK requirements;
• CBRT rules applicable to specific payment matters.

Therefore:

A fintech regulatory incident should never be analysed only through the perspective of the regulator that first sent the letter.

The underlying facts may migrate between institutions.

3. What Can Trigger a Regulatory Investigation?

A fintech investigation does not necessarily begin with an inspector arriving at company headquarters.

Regulatory scrutiny can begin in numerous ways.

Common triggers include:

• periodic regulatory reporting;
• unusual financial data;
• customer complaints;
• whistleblower reports;
• suspicious transaction patterns;
• information from another regulator;
• independent audit findings;
• cybersecurity incidents;
• press reports;
• judicial investigations;
• suspected unlicensed activities.

The CBRT expressly tells payment and e-money customers that complaints submitted through official channels can be taken into account during supervisory work concerning the relevant institution.

Likewise, the BDDK uses extensive ongoing reporting data, on-site inspection reports, independent audit findings, early-warning systems and information obtained from supervised institutions and other sources in its supervisory process.

A fintech therefore does not need to receive a formal “investigation opening notice” before regulatory risk exists.

4. Continuous Supervision Is Often More Important Than Formal Investigation

Financial regulation increasingly relies on data.

A regulator may detect a problem from:

• transaction volume;
• capital ratios;
• liquidity;
• complaints;
• suspicious merchants;
• unusual account flows;
• changes in shareholder structure;
• reporting inconsistencies.

The institution may therefore already be under regulatory scrutiny before management becomes aware that an issue has been identified.

The BDDK describes its supervisory approach as a combination of:

off-site surveillance

and

on-site supervision.

Its monitoring can include reporting data submitted daily, weekly, monthly, quarterly or annually, together with early-warning systems, stress testing, compliance analysis and previous inspection findings.

This is a useful lesson for the entire fintech sector:

The safest regulatory investigation is the one detected internally before the regulator detects it externally.

5. CBRT Investigations of Payment and Electronic Money Institutions

For payment and electronic money businesses, the CBRT is the primary regulator.

A CBRT review may concern issues such as:

• activities outside licence scope;
• customer fund safeguarding;
• electronic money issuance;
• merchant acquiring;
• payment accounts;
• lending prohibition;
• outsourcing;
• information systems;
• data localization;
• governance;
• capital and own funds.

The CBRT’s role is not limited to examining accounting records.

Modern payment supervision is increasingly connected with:

• technological infrastructure;
• transaction flows;
• customer accounts;
• merchants;
• AML-related operational weaknesses.

The 2025 enforcement results demonstrate the breadth of the regulatory response available.

6. CBRT Enforcement Can Escalate Gradually

Not every regulatory deficiency results immediately in licence revocation.

Depending on the seriousness of the issue, the regulatory response may escalate through several stages.

Possible consequences include:

Warning

The institution may be required to correct the deficiency.

Administrative Fine

Article 27 of Law No. 6493 provides the principal administrative sanction framework for non-compliance with CBRT regulations and decisions.

Administrative or Financial Measures

The CBRT may impose measures designed to protect the institution or payment ecosystem.

Restrictions

Certain transactions or corporate distributions may be limited.

Temporary Suspension

Specific activities or the entire operating licence may be suspended.

Licence Revocation

Serious or unresolved problems can ultimately result in loss of authorisation.

The CBRT’s 2025 enforcement statistics demonstrate that all of these tools are being used in practice rather than existing merely as theoretical legal powers.

7. CBRT Enforcement Is Becoming More Intensive

The increase from 2024 to 2025 is particularly notable.

In 2024:

• 55 institutions were fined;
• total fines were approximately TRY 160.3 million;
• one licence was suspended;
• one licence was revoked.

For 2025:

• 72 institutions were fined;
• total administrative fines increased to approximately TRY 373.2 million;
• 14 licences were suspended;
• seven licences were revoked.

These figures suggest that payment compliance should now be treated as a board-level enterprise risk.

It is no longer realistic for management to assume regulatory inspection is a remote possibility relevant only to problematic institutions.

8. Investigations Can Be Coordinated With Judicial Authorities

One of the most important lessons from recent enforcement practice is that administrative supervision and criminal investigations can operate in parallel.

In March 2025, the CBRT publicly explained that judicial authorities were investigating companies including Pay Fix, İninal and Aypara, while the CBRT had separately used its powers under Law No. 6493 to impose administrative and financial measures and suspend operating permissions.

Likewise, in May 2025, the CBRT announced that a court had appointed the Savings Deposit Insurance Fund as trustee to Papara Elektronik Para A.Ş. in a criminal investigation based on reports from the CBRT, MASAK and other authorities; the CBRT simultaneously announced temporary daily limits on payment transactions.

These examples concern procedural and regulatory actions and should not be treated as establishing criminal liability of any person.

They do, however, demonstrate an important structural point:

Regulatory investigations and criminal proceedings can develop simultaneously from the same underlying facts.

9. Regulatory Reports Can Be Sent to Prosecutors

The CBRT expressly reported that supervisory reports prepared during 2025 were transmitted to relevant Chief Public Prosecutor’s Offices in ongoing investigations.

It also stated that findings indicating non-compliance were shared with other authorised public institutions.

This means statements made during a regulatory investigation should be prepared carefully.

A company should not assume:

“This is only an administrative inspection.”

Documents, transaction records and explanations supplied to the regulator may later become relevant in:

• criminal proceedings;
• MASAK analysis;
• other administrative investigations.

10. Unauthorised Payment Services Create Criminal Risk

The distinction between:

licensed institution violating a regulation

and

unlicensed business providing regulated payment services

is particularly important.

The CBRT confirms that providing payment services or issuing electronic money without the legally required authorisation can result in imprisonment and judicial fines under Article 28 of Law No. 6493. The legislation also provides for closure of business premises in specified circumstances.

The enforcement numbers are substantial.

In 2025, the CBRT made written applications to prosecutors and/or courts concerning 331 suspected unauthorised payment-service cases.

For payment startups operating near the regulatory perimeter, licence analysis is therefore not merely a compliance exercise.

It can become a criminal-law issue.

11. White-Label and Embedded Finance Models Can Attract Regulatory Attention

One common investigation scenario concerns a business claiming to be merely a technology provider while operationally performing regulated financial functions.

Regulators may examine:

• who contracts with customers;
• who receives funds;
• who controls accounts;
• who executes payment instructions;
• who makes regulated decisions.

The use of:

• white-label technology;
• APIs;
• sponsor institutions;
• embedded finance

does not automatically place the commercial company outside regulation.

Where the factual business model differs from contractual descriptions, regulators are likely to focus on economic reality.

12. BDDK Supervision: Banks and Non-Bank Lending Institutions

BDDK investigations operate within a different regulatory environment.

The Agency’s supervisory framework covers financial institutions such as:

• banks;
• financing companies;
• factoring companies;
• financial leasing companies;
• other supervised entities.

For fintech businesses, this is especially important in:

• digital banking;
• Banking as a Service;
• embedded lending;
• BNPL provided through regulated financing institutions.

The BDDK describes its supervision as consisting of two mutually reinforcing mechanisms:

on-site supervision

and

continuous surveillance.

13. What Does a BDDK Examination Review?

The BDDK states that on-site supervision can include examination of:

• assets and liabilities;
• capital;
• profitability;
• financial structure;
• risk management;
• internal controls;
• accounting compliance;
• legal compliance;
• information systems;
• corporate governance.

Importantly for fintech outsourcing and BaaS models, its supervisory scope can also extend to real and legal persons providing services to regulated institutions, limited to the services they provide.

This means an external fintech provider can become relevant to a banking investigation even though the provider itself is not a bank.

14. BDDK Uses Risk-Based Supervision

Not every institution receives identical supervisory intensity.

The BDDK states that supervision is risk based and can vary according to:

• risk profile;
• institution size;
• complexity;
• internal control quality;
• risk-management capability.

The Agency’s supervisory cycle includes:

1. ongoing monitoring;
2. risk assessment;
3. preparation of the inspection plan;
4. on-site inspection where necessary;
5. a results meeting;
6. preparation of supervisory reports;
7. transmission of findings for necessary regulatory action.

For fintech management, this means that weak internal governance can itself increase future supervisory intensity.

15. Early-Warning Signals Matter in Banking Supervision

The BDDK uses reporting sets and analytical tools to detect deterioration or non-compliance.

Its surveillance system includes:

• periodic reporting;
• ratios;
• early-warning systems;
• stress tests;
• scenario analysis;
• compliance monitoring.

A financing company experiencing rapid growth should therefore not focus only on statutory capital.

Regulators may also assess whether:

• governance scaled with the business;
• credit underwriting remains effective;
• technology remains reliable;
• risk controls remain proportionate.

Rapid growth can itself become a supervisory risk where controls do not grow at the same speed.

16. Unauthorised BDDK-Regulated Activity Can Also Become Criminal

Fintech founders should not assume that only unlicensed payment services create criminal exposure.

Different BDDK-supervised sectors have their own unauthorised-activity offences.

For example, BDDK states that conducting savings-financing activity without the required licence can result in:

• imprisonment from two to five years;
• judicial fines;
• closure of the relevant business premises in specified circumstances;
• potential regulatory liquidation.

The exact offence differs by financial activity.

The wider principle is consistent:

A fintech should determine the regulatory perimeter before accepting customer money or extending regulated financial products.

17. CMB/SPK Enforcement Now Includes Crypto Businesses

Following the 2024 reforms to Capital Markets Law No. 6362, crypto asset service providers entered the SPK’s supervisory perimeter.

This significantly changed crypto enforcement in Türkiye.

The SPK’s 2025 Annual Report states that 11 inspections concerning unauthorised crypto asset service provider activity were conducted during the year.

This means crypto exchanges and custody providers should increasingly expect regulatory treatment similar in seriousness to other capital-markets institutions.

The “startup culture” of the crypto industry does not remove:

• governance requirements;
• audit;
• reporting;
• information-system obligations;
• AML requirements.

18. SPK Has a Broad Enforcement Toolkit

SPK enforcement is not limited to administrative fines.

Its 2025 Annual Report explains that available measures can include:

• blocking access to internet sites;
• closure of workplaces;
• licence revocation;
• trading bans;
• removal of signing authority;
• legal actions;
• interim injunction and attachment requests in appropriate cases;
• criminal complaints to prosecutors.

The regulator therefore has both:

administrative enforcement tools

and

routes into judicial enforcement.

19. SPK Enforcement Statistics Show Significant Activity

The SPK reported that 2025 supervision resulted in:

• 481 criminal complaints;
• 8 criminal notifications;
• 208 trading bans;
• 697 persons subject to these listed sanctions in total.

Across all SPK areas, administrative fines imposed during 2025 totalled approximately TRY 2.71 billion across 312 cases.

These figures relate to the SPK’s full capital-markets jurisdiction, not only fintech or crypto.

Nevertheless, they demonstrate the enforcement environment into which crypto asset service providers have now entered.

20. Unauthorised Crypto Activity Can Lead to Prosecutorial Referral

The SPK reported 62 written applications to prosecutors under Article 115 of the Capital Markets Law during 2025, together with eight criminal notifications.

Of the written applications:

• 34 concerned unauthorised capital-market activity;
• 10 concerned unauthorised crypto asset service provider activity;
• one concerned failure to provide information/documents and obstruction of supervision;
• the remainder concerned other capital-market offences.

This is particularly relevant to:

• foreign crypto exchanges;
• offshore platforms;
• businesses operating during licensing transition periods;
• crypto businesses incorrectly assuming that website accessibility equals authorisation.

21. Access Blocking Is an Important Crypto Enforcement Tool

Unauthorised online financial activity creates a specific digital enforcement problem:

A foreign platform may have:

• no Turkish office;
• no Turkish company;
• servers abroad.

Traditional corporate sanctions may therefore be insufficient.

The SPK has repeatedly used its statutory authority to pursue access blocking against internet sites identified as providing unauthorised crypto or capital-markets services to persons resident in Türkiye.

For offshore fintech companies, this makes Turkish regulatory risk materially relevant even where the corporate entity itself sits abroad.

22. Providing Information Is Itself a Regulatory Obligation

One of the most dangerous mistakes during an investigation is failing to cooperate with lawful information requests.

The SPK’s 2025 enforcement reporting expressly identifies a written application concerning:

failure to provide information/documents and obstruction of supervision.

Therefore, a company should not respond to a regulator by:

• deleting records;
• concealing documents;
• giving misleading information;
• unnecessarily delaying production.

An investigation about one issue can become a more serious investigation concerning obstruction.

23. MASAK Is Different From a Conventional Financial Regulator

MASAK should be understood differently from:

• CBRT;
• BDDK;
• SPK.

Its core focus is preventing:

• money laundering;
• terrorist financing;
• proliferation financing.

Therefore, MASAK enforcement concentrates heavily on:

• customer identification;
• beneficial ownership;
• suspicious transactions;
• monitoring;
• compliance programmes;
• record retention;
• information requests.

The AML investigation can coexist with a sector regulator’s investigation into the same company.

24. Who Is Subject to MASAK Compliance?

The current MASAK framework requires formal compliance programmes from institutions including:

• banks;
• financing, factoring and financial leasing companies;
• portfolio management companies;
• electronic money institutions;
• most payment institutions;
• crypto asset service providers.

The compliance programme includes:

• institutional policies and procedures;
• risk management;
• monitoring and control;
• compliance officer and compliance unit;
• training;
• internal audit.

An investigation may therefore focus not only on one suspicious transaction but on whether the institution’s entire AML governance system was adequate.

25. MASAK Inspectors Have Broad Information Powers

Article 11 of Law No. 5549 is particularly important.

MASAK may request inspections:

• individually; or
• under a broader supervisory programme.

Authorised inspectors can request from natural persons, legal persons, entities without legal personality and public institutions:

• information;
• documents;
• statutory books.

They may examine records and obtain written or oral information from relevant persons.

Therefore:

A MASAK inspection should be treated as a formal regulatory investigation from the first information request.

Responses should be:

• complete;
• accurate;
• documented;
• coordinated.

26. Suspicious Transaction Reporting Is a Central Investigation Area

Law No. 5549 requires obliged entities to notify MASAK where there is information, suspicion or reasonable grounds for suspicion that assets involved in an attempted or completed transaction:

• derive from unlawful activity; or
• are being used for unlawful purposes.

MASAK General Communiqué No. 13 states that suspicious transaction reports should generally be submitted no later than ten business days after the suspicion arises, and immediately where delay would be prejudicial.

An institution may therefore face enforcement where the regulator concludes that:

• suspicious activity was detected too late;
• escalation procedures were inadequate;
• reports were not filed;
• alerts were closed without adequate reasoning.

27. Tipping Off Can Create Criminal Liability

Once a suspicious transaction report has been made, confidentiality is essential.

Law No. 5549 prohibits disclosure of the existence of a suspicious transaction report to the transaction party or other unauthorised persons.

MASAK confirms that breach of the tipping-off prohibition, together with specified violations relating to information/document production and retention/production obligations, can result in:

• imprisonment from one to three years;
• a judicial fine of up to 5,000 days.

This means internal investigation teams should handle STR-related information on a strict need-to-know basis.

28. MASAK Administrative Fines Can Be Significant

Law No. 5549 provides administrative penalties for violations involving:

• customer identification;
• suspicious transaction reporting;
• continuing information requirements.

The statutory fixed amounts are subject to annual revaluation.

For banks, financing companies, payment institutions, electronic money institutions, capital-market institutions and other specified financial institutions, MASAK explains that the penalty mechanism is enhanced: the applicable statutory penalty is doubled and cannot be lower than 5% of the transaction amount for the relevant violation.

Therefore, repeated weaknesses across large numbers of transactions can become financially material.

29. AML Investigations Often Focus on Systems, Not Only Individual Transactions

A common mistake is responding to an AML investigation by explaining one customer file.

Regulators may instead ask:

“Why did your system permit this pattern across thousands of customers?”

MASAK can examine:

• risk classification;
• customer segmentation;
• transaction-monitoring scenarios;
• alert thresholds;
• escalation;
• internal audit;
• compliance officer independence.

Therefore, the institution should be capable of demonstrating that its compliance programme operates in practice rather than merely existing as a policy document.

30. Multi-Agency Investigations Are One of the Biggest Fintech Risks

The most serious investigations frequently involve more than one public authority.

For example, one transaction pattern may create:

CBRT Question

Was the payment institution operating lawfully?

MASAK Question

Were suspicious transactions adequately identified and reported?

Prosecutorial Question

Was a criminal offence committed?

The CBRT’s own 2025 report confirms that supervisory reports were transmitted to prosecutors and non-compliance findings were shared with other competent authorities.

A company’s investigation strategy must therefore anticipate parallel proceedings.

31. Regulatory and Criminal Defence Strategies Must Be Coordinated

Consider an internal payment flow.

A regulator asks:

“Why did the institution permit these transactions?”

The administrative explanation may influence:

• licence risk;
• AML exposure;
• criminal allegations.

A response drafted solely to minimise an administrative violation may unintentionally create damaging admissions for a parallel criminal proceeding.

For serious matters, fintech companies should therefore create a coordinated strategy involving:

• regulatory counsel;
• criminal counsel;
• compliance;
• senior management.

Consistency is essential.

32. What Should a Fintech Do When an Investigation Begins?

The first hours and days are extremely important.

The company should establish an investigation-response structure immediately.

Preserve Records

Suspend ordinary deletion policies affecting relevant:

• e-mails;
• transaction data;
• chat communications;
• system logs;
• KYC records.

Identify the Scope

Determine exactly:

• which regulator;
• which legal basis;
• which period;
• which product;
• which entities

are under review.

Establish a Response Team

The team can include:

• legal;
• compliance;
• internal audit;
• information security;
• finance;
• relevant business unit.

Centralise Communications

The institution should avoid different departments providing inconsistent explanations to the regulator.

33. Never Backdate or “Repair” Historical Compliance Files

One of the most dangerous reactions to an investigation is trying to make the historic file look better than it really was.

Examples include:

• backdating KYC approvals;
• generating retrospective committee minutes as if contemporaneous;
• deleting problematic messages;
• changing historic transaction explanations.

This can transform a manageable compliance deficiency into a credibility or obstruction issue.

The safer approach is:

preserve history → identify deficiency → remediate prospectively → explain accurately.

34. Internal Investigation Should Be Evidence-Based

Management should determine:

• what happened;
• when;
• who knew;
• which systems failed;
• whether the problem continues.

The review should use actual evidence:

• contracts;
• logs;
• transaction records;
• communications;
• system configurations.

The objective should not initially be to prove that management was correct.

It should be to establish the facts.

Regulators usually recognise the difference between:

an institution that identifies and fixes a genuine error

and

an institution that attempts to deny an obvious problem.

35. Remediation Can Be as Important as the Historical Breach

A company facing a regulatory issue should prepare a remediation plan.

Possible measures may include:

• changing customer onboarding;
• terminating high-risk merchants;
• modifying transaction-monitoring rules;
• correcting safeguarding calculations;
• increasing staffing;
• changing board reporting;
• improving information systems.

A credible remediation plan should identify:

problem → cause → corrective measure → responsible person → deadline → verification.

This creates a measurable compliance programme rather than a general promise to “improve controls.”

36. Board Oversight Is Critical

Serious regulatory investigations should generally reach the board.

The board should understand:

• allegations;
• regulatory exposure;
• financial exposure;
• remediation;
• licence implications.

This is especially important where the investigation concerns:

• systemic AML weakness;
• safeguarding;
• governance;
• cybersecurity;
• activities outside licence scope.

Senior management should not hide material regulatory correspondence from directors.

37. Customer Funds Must Remain a Priority

An investigation can create uncertainty among customers.

Payment and electronic money institutions should pay particular attention to protected customer funds.

The CBRT emphasised during the 2025 Papara process that user funds at payment and electronic money institutions are safeguarded through protection accounts under Article 22 of Law No. 6493.

Therefore, investigation-response planning should distinguish:

company liquidity

from

protected customer/payment funds.

Customer funds should never be used to finance the company’s regulatory defence or operating shortfall.

38. Licence Suspension Creates Business Continuity Risk

Fintech companies should prepare for the possibility that a regulator may restrict activities before the full investigation is concluded.

A licence suspension can affect:

• payments;
• wallet use;
• merchant settlement;
• new customer onboarding.

Recent CBRT enforcement confirms that temporary suspension is a genuine supervisory tool.

Business continuity planning should therefore consider:

• customer communication;
• safeguarding;
• settlement;
• regulatory reporting;
• partner communication.

39. Regulatory Decisions Can Be Challenged in Court

Administrative enforcement does not mean regulatory decisions are beyond judicial review.

Companies can challenge qualifying administrative acts through the Turkish administrative court system.

The current CBRT electronic money register itself provides a contemporary example: it notes that an administrative court issued a temporary stay concerning part of a 2026 suspension decision affecting an electronic money institution pending further judicial consideration.

This illustrates a broader point:

Regulatory defence may continue after the regulator has issued its decision.

However, litigation strategy should be evaluated separately from immediate regulatory remediation.

40. Challenging the Regulator Does Not Replace Compliance

A company may believe the regulator’s decision is legally incorrect.

It can pursue judicial remedies where available.

But management should still evaluate:

• operational compliance;
• customer protection;
• continuity.

An aggressive litigation strategy combined with refusal to correct genuine weaknesses can increase regulatory tension.

Legal challenge and remediation are not mutually exclusive.

41. Common Fintech Investigation Mistakes

Mistake 1: “This Is Only a Routine Information Request”

Some major investigations begin with apparently routine questions.

Mistake 2: “The Regulator Will Only Review the Documents Requested”

The initial issue can expand when further non-compliance is discovered.

Mistake 3: “We Can Fix Old Documents Before Sending Them”

Historical records should not be falsified or backdated.

Mistake 4: “MASAK Is Only Interested in Money Laundering Convictions”

MASAK also supervises compliance systems, KYC, STR, monitoring and record obligations.

Mistake 5: “A CBRT Fine Is the Worst Possible Outcome”

CBRT enforcement can include suspension and licence revocation, and serious matters can be referred to prosecutors.

Mistake 6: “Our Foreign Crypto Platform Is Outside Turkish Enforcement”

SPK can pursue unauthorised online activity targeting Türkiye and seek access blocking.

Mistake 7: “Our Outsourcing Provider Caused the Problem, So We Are Not Responsible”

Regulated institutions generally remain responsible for regulatory functions even where technology or operations are outsourced.

Mistake 8: “Only the Compliance Department Needs to Know”

Serious regulatory matters require coordinated legal, compliance, technology and management involvement.

Practical Fintech Regulatory Investigation Checklist

When a Turkish fintech receives an inquiry from CBRT, BDDK, SPK or MASAK, management should consider the following.

Identify the Authority

Which regulator initiated the inquiry?

Determine Legal Basis

Payment, banking, securities, crypto or AML law?

Determine Scope

Which products, transactions and period are covered?

Preserve Evidence

Suspend destruction of relevant documents and logs.

Appoint Investigation Counsel

Create a coordinated legal-response structure.

Establish One Communication Channel

Avoid inconsistent regulatory responses.

Review Licence Scope

Could the investigation concern unauthorised activity?

Review Customer Funds

Confirm safeguarding and reconciliation.

Conduct Internal Fact Finding

Understand the issue before responding.

Review AML Implications

Could the same facts require STR or MASAK action?

Consider Criminal Exposure

Could reports be transmitted to prosecutors?

Identify Other Regulators

Is a multi-agency investigation likely?

Prepare Remediation

Correct continuing problems promptly.

Inform the Board

Material regulatory issues require governance oversight.

Review Public Communications

Avoid misleading statements.

Prepare Continuity Plans

What if operations are temporarily restricted?

Evaluate Judicial Remedies

Consider administrative litigation where appropriate.

Frequently Asked Questions About Fintech Regulatory Investigations in Turkey

Who investigates payment institutions in Turkey?

The CBRT is responsible for authorising, supervising and overseeing payment institutions and electronic money institutions.

Can the CBRT suspend a payment institution licence?

Yes. Temporary licence suspensions are used in practice. In 2025, the CBRT reported 14 operating licence suspensions.

Can the CBRT revoke a licence?

Yes. The CBRT reported seven licence revocations resulting from 2025 supervision.

How much did the CBRT fine payment and e-money institutions in 2025?

Administrative fines against 72 institutions totalled TRY 373,243,560.30.

Can unlicensed payment activity lead to criminal proceedings?

Yes. Article 28 of Law No. 6493 provides criminal sanctions for unauthorised payment/e-money activity, and the CBRT made referrals concerning 331 suspected unauthorised cases in 2025.

Does BDDK supervise fintech companies?

It depends on the activity. BDDK supervises banks and several non-bank financial institution categories, including financing companies. Its supervision can also extend to providers supplying services to supervised institutions within the scope of those services.

How does BDDK detect regulatory problems?

Its framework uses periodic regulatory reporting, on-site supervision, independent audit reports, ratios, early-warning systems, stress testing and other supervisory information.

Does SPK investigate crypto businesses?

Yes. Crypto asset service provider supervision entered the SPK’s jurisdiction following the 2024 reforms. The SPK reported 11 inspections concerning unauthorised crypto service provider activity during 2025.

Can SPK block crypto websites?

SPK has used statutory access-blocking procedures against websites identified as providing unauthorised crypto asset services to Turkish residents.

How many criminal complaints did SPK make in 2025?

Its 2025 Annual Report records 481 criminal complaints within its wider supervision and enforcement activities.

Were any criminal referrals specifically related to crypto?

Yes. Of the 62 written applications reported under Article 115 for 2025, ten concerned unauthorised crypto asset service provider activity.

Can MASAK request company documents?

Yes. Under Article 11 of Law No. 5549, authorised inspectors can request information, documents and statutory books and examine records and obtain written or oral information.

Are payment institutions subject to MASAK?

Yes. Most payment institutions and all electronic money institutions are included in the formal compliance-programme framework, subject to specified exceptions for certain narrowly licensed payment institutions.

Are crypto companies subject to MASAK compliance programmes?

Yes. Crypto asset service providers were expressly added to the compliance-programme framework.

How quickly must suspicious transactions be reported?

MASAK General Communiqué No. 13 provides that suspicious transactions should generally be reported within ten business days after suspicion arises and immediately in urgent circumstances.

Can a company tell the customer that an STR was filed?

No. The suspicious transaction reporting framework includes a tipping-off prohibition.

Can tipping off result in imprisonment?

Yes. MASAK states that violations of specified confidentiality, information/document and retention obligations can lead to imprisonment from one to three years and judicial fines of up to 5,000 days.

Can a regulator send its findings to prosecutors?

Yes. The CBRT expressly reported transmitting supervisory reports to prosecutors during 2025, and SPK also makes formal applications and criminal notifications where its investigations identify possible offences.

Can regulatory sanctions be challenged?

Administrative measures can be subject to judicial review under Turkish administrative law. Current CBRT public records themselves show an example of interim administrative-court review concerning a 2026 suspension decision.

Conclusion: How Should Fintech Companies Prepare for Regulatory Enforcement in Turkey?

The Turkish fintech market has entered a new stage of regulatory maturity.

The central question is no longer simply:

“Can we obtain a licence?”

A more important long-term question is:

“Can we operate in a way that survives regulatory supervision?”

Recent CBRT enforcement demonstrates the importance of this distinction.

During 2025, payment and electronic money supervision resulted in:

• seven licence revocations;
• fourteen temporary licence suspensions;
• twelve dividend restrictions;
• TRY 373.2 million in administrative fines;
• 331 suspected unauthorised-payment cases being referred to prosecutors and/or courts.

These are not theoretical powers.

They are active enforcement tools.

CBRT-regulated institutions should therefore treat compliance concerning:

• licence scope;
• safeguarding;
• information systems;
• outsourcing;
• customer accounts;
• electronic money;
• lending restrictions

as matters capable of affecting the continued existence of the licence.

The BDDK environment follows a similarly continuous model.

Bank supervision is not based solely on occasional inspections.

The regulator uses recurring reporting, risk assessment, early-warning analytics, stress testing and on-site review to identify weaknesses.

For fintech companies providing technology to banks, this is particularly important because BDDK supervision can extend to persons providing services to supervised institutions within the scope of those services.

A BaaS provider or critical fintech vendor therefore cannot assume:

“We do not hold a banking licence, so BDDK supervision is irrelevant to us.”

The relationship with a regulated bank can create its own supervisory exposure.

Crypto companies face the most rapidly developing regulatory environment.

Following the inclusion of crypto asset service providers within the Capital Markets Law framework, SPK supervision is now becoming a permanent feature of the industry.

The regulator reported 11 inspections into unauthorised crypto asset service activity during 2025.

Ten of SPK’s formal written applications to prosecutors during the year specifically concerned unauthorised crypto asset service provision.

SPK enforcement can also involve:

• administrative fines;
• access blocking;
• trading restrictions;
• licence measures;
• criminal complaints.

The Board reported 481 criminal complaints and 208 trading bans across its wider supervisory jurisdiction during 2025.

For foreign crypto businesses, online delivery is therefore not necessarily an enforcement shield.

A website or application targeting Turkish residents can attract Turkish regulatory scrutiny even where the legal entity is incorporated abroad.

MASAK creates the fourth major pillar of fintech enforcement.

Its supervision is different because it focuses on the financial-crime architecture of the institution.

The key questions are not merely:

“Was the transaction legally authorised?”

but also:

“Did the institution understand who the customer was?”

“Did it identify unusual behaviour?”

“Was suspicion escalated?”

“Was a suspicious transaction report filed on time?”

“Did the compliance programme genuinely work?”

Payment institutions, electronic money institutions, regulated lenders, capital-market institutions and crypto providers therefore need functioning AML systems—not merely AML manuals.

Article 11 of Law No. 5549 gives inspectors substantial authority to request and inspect information, documentation, statutory records and to obtain written or oral explanations.

The most important strategic lesson is the possibility of multi-agency enforcement.

A payment company’s weak merchant controls might begin as a CBRT compliance matter.

The same facts could reveal suspicious transaction reporting deficiencies.

MASAK may then become relevant.

If evidence indicates criminal conduct, prosecutors may enter the process.

The CBRT has expressly confirmed that supervisory reports and findings were provided to prosecutors and other competent authorities in 2025.

Accordingly:

Regulatory silos should not produce defence silos.

The institution should create one coherent factual record.

Regulatory counsel should understand criminal exposure.

Criminal counsel should understand licensing consequences.

Compliance officers should understand what documents have been preserved.

Senior management should understand what has been communicated externally.

A second important lesson is that credibility matters.

Financial regulators have access to:

• transaction records;
• reporting data;
• banking information;
• system logs;
• information from other authorities.

An institution should therefore never attempt to solve an investigation by creating a retrospective paper trail inconsistent with the real historical record.

A missing control is a compliance problem.

A fabricated control can become something much more serious.

The stronger strategy is:

identify the deficiency → preserve evidence → understand root cause → correct the deficiency → document remediation accurately.

A third lesson is the importance of regulatory readiness.

A fintech should maintain an investigation-response framework before receiving an investigation letter.

That framework should identify:

• regulatory contacts;
• legal counsel;
• document preservation procedures;
• escalation rules;
• board notification thresholds;
• regulatory response approval.

Senior personnel should understand who is authorised to speak for the institution.

Compliance teams should know where relevant records are stored.

Technology teams should be able to preserve system logs quickly.

The fourth lesson is that regulatory investigations are increasingly connected with operational resilience.

A licence suspension or regulatory restriction can affect thousands or millions of users immediately.

Recent CBRT practice confirms that temporary suspension is a real regulatory tool.

Fintech institutions therefore need contingency planning addressing:

• customer access;
• merchant settlement;
• safeguarded funds;
• complaints;
• public communications.

Finally, companies should remember that regulatory action is itself subject to law.

Administrative enforcement measures may be challenged before the competent courts where legal grounds exist.

The CBRT’s current register even records a 2026 administrative-court stay concerning part of a temporary licence suspension while judicial review continued.

However, litigation should not become a substitute for compliance.

A company may challenge a regulator’s interpretation while simultaneously correcting operational weaknesses.

The recommended investigation-response sequence for Turkish fintech companies is therefore:

preserve records → identify regulator and legal basis → create investigation team → map facts → identify parallel AML/criminal exposure → respond accurately → remediate continuing problems → inform board → protect customers → prepare operational contingency → assess judicial remedies.

The central principle can ultimately be expressed as follows:

In the Turkish fintech sector, regulatory compliance must be designed not only to obtain the licence but to defend the licence when the regulator begins asking questions.

A business that can answer those questions with:

• complete records;
• transparent governance;
• documented controls;
• credible remediation

will be in a fundamentally stronger position than an institution that begins building its compliance framework only after an investigation has already started.

Legal Disclaimer: This publication provides general information regarding fintech regulatory investigations and enforcement in Türkiye as of July 2026. It does not constitute legal, criminal defence, financial or regulatory advice. The powers and procedures applicable to an investigation depend on the relevant institution, regulated activity, legal basis, investigation stage and potential parallel administrative or criminal proceedings. Companies facing an actual CBRT, BDDK, SPK, MASAK or prosecutorial investigation should obtain case-specific Turkish legal advice immediately and preserve all potentially relevant information and records.