Introduction: Understanding Turkish Fintech Law

Türkiye has developed one of the most active financial technology markets in its region. Digital payment platforms, electronic money institutions, mobile wallets, open banking services, digital banks, payment orchestration businesses, crypto-asset platforms and technology companies providing financial infrastructure increasingly form part of the Turkish financial ecosystem.

However, establishing a fintech company in Türkiye requires much more than forming a company and developing a mobile application.

Turkish Fintech Law is based on a multi-layered regulatory structure involving financial licensing, payment services regulation, banking law, capital markets law, anti-money laundering legislation, consumer law, data protection rules, information systems requirements and cybersecurity obligations.

There is no single statute titled the “Fintech Law” in Türkiye. Instead, the applicable legal regime depends primarily on the economic function performed by the relevant business model.

For example, a company transferring funds may fall under the payment services legislation; a company issuing stored monetary value may qualify as an electronic money institution; a digital bank will be governed by banking legislation; and a crypto-asset trading platform is subject to the Capital Markets Law and regulations issued by the Capital Markets Board of Türkiye.

For this reason, the first legal question for any fintech investment in Türkiye should normally be:

What regulated financial activity does the proposed business model actually perform?

The answer determines whether a regulatory licence is required and, if so, which Turkish regulatory authority will supervise the business.

As of 2026, the Central Bank of the Republic of Türkiye (“CBRT”) continues to regulate and supervise payment services, payment institutions and electronic money institutions primarily under Law No. 6493 and the related secondary regulations.

This guide explains the principal rules governing fintech businesses operating or planning to operate in Türkiye.

1. Main Regulators Under Turkish Fintech Law

Fintech regulation in Türkiye is divided between several authorities rather than being concentrated in one regulator.

The most important institutions are:

Central Bank of the Republic of Türkiye – CBRT

The CBRT is the principal regulatory authority for:

• payment institutions;
• electronic money institutions;
• payment services;
• payment systems;
• digital wallets falling within regulated payment activities;
• payment initiation services;
• account information services;
• payment infrastructure and certain information systems requirements.

Law No. 6493 constitutes the central legislative framework governing these activities. The CBRT also maintains public lists showing authorised payment institutions and electronic money institutions and the scope of the services they are permitted to provide.

Banking Regulation and Supervision Agency – BRSA

The Banking Regulation and Supervision Agency (“BRSA” or “BDDK”) regulates the banking sector under Banking Law No. 5411.

Its jurisdiction is particularly important for fintech companies involved in:

• digital banking;
• banking-as-a-service structures;
• financing companies;
• consumer lending;
• bank partnerships;
• card-related regulated activities;
• embedded banking structures.

The BRSA regulatory framework expressly includes the Regulation on the Operating Principles of Digital Banks and Banking as a Service Model. The relevant banking legislation also includes Banking Law No. 5411 and Bank Cards and Credit Cards Law No. 5464.

Capital Markets Board of Türkiye – CMB

The Capital Markets Board of Türkiye (“CMB” or “SPK”) regulates fintech activities connected with capital markets.

This has become particularly important following the introduction of the Turkish crypto-asset regulatory framework.

Crypto-asset service providers were brought under the regulatory and supervisory authority of the CMB through Law No. 7518, which amended Capital Markets Law No. 6362 and entered into force in July 2024.

The CMB also regulates crowdfunding platforms and other technology-based capital market activities.

Financial Crimes Investigation Board – MASAK

The Financial Crimes Investigation Board (“MASAK”) supervises compliance with Turkish anti-money laundering and counter-terrorist financing rules.

Fintech businesses may therefore have obligations concerning:

• customer identification;
• Know Your Customer procedures;
• beneficial ownership;
• suspicious transaction reporting;
• enhanced customer due diligence;
• politically exposed persons;
• transaction monitoring;
• record keeping;
• compliance programmes.

The regulatory obligations are especially significant for payment institutions, electronic money institutions and crypto-asset service providers.

Turkish Data Protection Authority

Fintech companies processing personal data are also subject to Law No. 6698 on the Protection of Personal Data (“KVKK”).

The data protection dimension of fintech regulation is especially important because fintech businesses commonly process identity information, financial information, payment records, device information and transaction histories.

The Turkish Data Protection Authority has published a dedicated good-practice guide addressing personal data protection in the payment and electronic money sector.

2. Payment Services Under Turkish Law

One of the most important pieces of legislation in Turkish Fintech Law is Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions.

Businesses should examine Law No. 6493 whenever their operations involve receiving, transferring or facilitating customer funds.

The legislation covers various types of payment services and establishes the regulatory foundations governing payment institutions and electronic money institutions.

Providing regulated payment services without the required authorisation can result in serious regulatory consequences.

The CBRT has expressly stated that payment services in Türkiye may only be provided where the licences required by the relevant legislation have been obtained.

This is important because fintech entrepreneurs frequently structure their companies as ordinary technology companies while their underlying operations may legally constitute payment services.

The legal classification of the business model therefore needs to be completed before commercial launch.

A fintech company should assess issues such as:

• whether it receives customer funds;
• whose account the money is held in;
• whether it transfers funds between parties;
• whether it provides merchant acquiring;
• whether customers maintain payment accounts;
• whether the application initiates payments from accounts maintained by another payment service provider;
• whether the application consolidates financial information from different payment accounts.

The substance of the service is generally more important than the commercial description used by the company.

Calling a product a “technology platform”, “financial marketplace” or “digital wallet” does not by itself remove it from financial regulation.

3. Payment Institution Licence in Türkiye

A company intending to provide regulated payment services in Türkiye may be required to obtain authorisation as a payment institution.

The exact licence required depends on the payment service to be performed.

The CBRT publishes the authorised payment institutions operating in Türkiye and identifies the payment services each institution has permission to provide.

A regulatory licence should therefore not be considered a general licence to conduct every possible financial activity.

The authorised scope of operations matters.

A payment institution considering a new product, API, wallet feature, merchant solution or cross-border payment service should determine whether the proposed service falls within its existing authorisation.

A material expansion into another regulated activity may require additional approval.

The licensing process generally requires regulatory examination of matters including corporate structure, shareholders, management, governance, financial strength, internal systems, business plans, risk controls, information systems and operational processes.

Capital and own-funds requirements are periodically updated. The CBRT published a further notice determining minimum own-funds amounts applicable to payment and electronic money institutions in January 2026.

Consequently, investors should verify the current financial thresholds at the time an application is filed rather than relying on historic figures contained in older publications.

4. Electronic Money Institutions in Türkiye

Electronic money is another major area of Turkish fintech regulation.

Electronic money institutions are authorised under Law No. 6493 and may issue electronic money subject to the applicable regulatory framework.

The CBRT confirms that electronic money institutions authorised under Article 18 of Law No. 6493 are entitled to issue electronic money, while the additional payment services that they may provide depend upon their respective authorisations.

Whether a business model constitutes electronic money depends on its legal and operational characteristics rather than simply whether it uses a digital wallet.

The legal analysis may include questions such as whether:

• monetary value is stored electronically;
• funds are received from users;
• value is issued against those funds;
• the stored value may subsequently be used for payment transactions;
• third-party merchants accept the value.

This distinction is important for wallet businesses, marketplace applications, loyalty ecosystems, prepaid products and embedded payment solutions.

Some closed-loop or limited-use structures may potentially receive different treatment depending on the exact circumstances, but relying upon an exemption without conducting a detailed regulatory assessment can create substantial risk.

5. Digital Wallet Regulation in Türkiye

The expression “digital wallet” covers numerous business models.

A wallet may merely display payment instruments, or it may store monetary value, initiate payment transactions, facilitate transfers or integrate multiple financial accounts.

Therefore, not every digital wallet is regulated in the same way.

The CBRT has introduced detailed rules relating to digital wallet services within the payment services regulatory structure and has continued to update compliance periods and relevant requirements. In March 2025, amendments also addressed compliance periods applicable to certain existing digital wallet services.

A fintech company planning to introduce a wallet should analyse the wallet’s functionality before launch.

A critical regulatory mistake is to design the product first and consider licensing only after customer acquisition begins.

The preferable approach is the reverse: the regulatory classification should influence the technological architecture from the beginning.

6. Open Banking Law in Türkiye

Open banking has become one of the most developed areas of Turkish fintech regulation.

Law No. 6493 recognises two important open banking services:

Payment Initiation Services, and

Account Information Services.

These services were incorporated into Article 12 of Law No. 6493 and form the basis of Türkiye’s regulated payment-services data-sharing framework known as ÖHVPS.

The CBRT has explained that payment initiation and consolidated payment-account information services constitute payment services under Law No. 6493.

Türkiye also developed the “GEÇİT” infrastructure through the Interbank Card Center (“BKM”), enabling participants to provide standardised open banking services.

The framework creates opportunities for fintech companies offering:

• account aggregation;
• personal finance management;
• business cash-flow management;
• financial dashboards;
• payment initiation;
• financial comparison tools;
• accounting integrations;
• embedded finance products.

The ecosystem continues to develop.

On 17 March 2026, the CBRT announced version 2.0.0 of the ÖHVPS infrastructure. The new version expanded account information functionality, added card information and transaction features, and introduced support for future-dated and recurring payment initiation services.

This development demonstrates that open banking regulation in Türkiye is no longer merely theoretical. It is becoming part of the operational financial infrastructure.

7. Banking as a Service and Digital Banking in Türkiye

Türkiye has also established a specific framework for digital banks and Banking as a Service (“BaaS”).

The Regulation on the Operating Principles of Digital Banks and Banking as a Service Model, published in 2021, introduced rules governing branchless digital banking and service-model banking.

The BRSA describes the framework as establishing requirements for digital banks that provide services through electronic banking distribution channels and for banking services offered through fintech interfaces under a service-model structure.

This framework is particularly important for embedded-finance business models.

A fintech company may develop the customer interface and user experience while a regulated bank provides the underlying banking infrastructure.

However, such arrangements should not be treated merely as ordinary software outsourcing contracts.

Issues may arise regarding:

• responsibility toward the customer;
• remote identification;
• customer agreements;
• outsourcing;
• information security;
• data sharing;
• regulatory disclosures;
• API access;
• regulatory supervision.

Where service-model banking is used, the legal relationship between the service bank, interface provider and customer must be structured consistently with banking regulation.

8. Crypto Asset Regulation in Türkiye

Crypto regulation is now one of the most significant areas of Turkish Fintech Law.

Türkiye fundamentally changed its crypto regulatory regime in 2024.

Law No. 7518, which amended Capital Markets Law No. 6362, entered into force on 2 July 2024 and placed crypto-asset service providers under the regulatory and supervisory authority of the Capital Markets Board of Türkiye.

Activities including crypto-asset trading, exchange, transfer and custody may therefore fall within the regulated crypto-asset service provider framework.

The secondary regulatory framework was substantially completed on 13 March 2025, when the CMB published two major communiqués:

Communiqué III-35/B.1 on the Establishment and Operating Principles of Crypto Asset Service Providers, and

Communiqué III-35/B.2 on the Operating Procedures and Principles and Capital Adequacy of Crypto Asset Service Providers.

These regulations entered into force through publication in the Official Gazette No. 32840 on 13 March 2025.

The first communiqué addresses matters including:

• establishment;
• commencement of operations;
• shareholders and founders;
• management;
• personnel;
• internal control;
• internal audit;
• risk management;
• information systems;
• technological infrastructure;
• documentation and record keeping;
• independent audit;
• proof-of-reserves audits.

The second communiqué regulates matters including:

• services that crypto-asset service providers may offer;
• trading environments;
• custody;
• crypto transfers;
• listing;
• capital adequacy requirements.

This means that operating a crypto exchange in Türkiye has evolved from a relatively lightly regulated technology business into a heavily regulated financial activity.

Companies entering the Turkish crypto market should therefore conduct regulatory planning comparable to that required in other supervised financial sectors.

9. Being Listed by the CMB Does Not Necessarily Mean Being Fully Licensed

A particularly important issue for investors and customers is the distinction between being included in a regulatory list and obtaining final regulatory authorisation.

The CMB currently maintains a “List of Operating Entities” relating to crypto-asset service providers.

However, the CMB expressly warns that inclusion on the relevant transitional list does not by itself mean that the company has been authorised under the applicable legislation.

This distinction is extremely important in legal due diligence.

Investors acquiring a Turkish crypto company should not rely solely on the fact that its name appears on a CMB webpage.

The transaction should examine:

• the company’s precise regulatory status;
• applications filed with the CMB;
• deficiencies communicated by regulators;
• capital adequacy;
• custody arrangements;
• cybersecurity structure;
• proof-of-reserves obligations;
• shareholder qualifications;
• AML compliance;
• regulatory investigations.

10. Can Cryptocurrency Be Used for Payments in Türkiye?

Crypto trading and crypto payments should be distinguished under Turkish law.

The fact that crypto-asset service providers are now regulated under the Capital Markets Law does not mean cryptocurrency has become a generally permitted payment instrument.

The Regulation on the Disuse of Crypto Assets in Payments, issued by the CBRT in 2021, remains listed within the CBRT’s current payments regulatory framework.

Under the regulation, crypto assets cannot generally be used directly or indirectly for payments, and services designed for their use in payments are restricted. The regulation also imposes specific restrictions on payment institutions and electronic money institutions in relation to business models and fund transfers involving crypto platforms.

Therefore, a company operating legally as a crypto trading platform should not assume that crypto may consequently be integrated into an ordinary payment product.

Crypto regulation and payment regulation operate alongside each other.

11. AML and KYC Obligations for Fintech Companies

Anti-money laundering compliance is an essential component of Turkish Fintech Law.

Relevant fintech companies may be subject to the obligations arising primarily from Law No. 5549 on Prevention of Laundering Proceeds of Crime and MASAK regulations.

Depending on the regulated activity, a fintech company’s compliance framework may need to cover:

• customer identification;
• verification;
• beneficial owner identification;
• customer risk assessment;
• transaction monitoring;
• enhanced due diligence;
• suspicious transaction reporting;
• sanctions screening;
• politically exposed persons;
• retention of records;
• internal compliance procedures.

Crypto regulation has significantly increased the importance of these obligations.

MASAK updated its Crypto Asset Service Providers Guide in September 2025. The guidance addresses customer due diligence, remote identification, enhanced measures, the Travel Rule, crypto transfer limits and waiting periods, politically exposed persons, suspicious transaction reporting and compliance programmes.

Remote onboarding rules have also evolved.

A June 2025 amendment specifically regulated remote identity verification by crypto-asset service providers.

Furthermore, as of 27 June 2026, MASAK announced a further change enabling remote identification through passports for certain non-Turkish individuals and foreign representatives of companies registered with the trade registry, subject to the applicable conditions.

This development may be especially relevant to international fintech businesses seeking to onboard foreign customers in Türkiye.

12. Personal Data Protection and Fintech

A fintech company’s most valuable asset is often data.

At the same time, data is one of its largest regulatory risks.

Law No. 6698 on the Protection of Personal Data regulates the processing of personal data in Türkiye.

Fintech companies frequently process substantial volumes of:

• identity information;
• contact information;
• bank account information;
• payment history;
• transaction records;
• IP addresses;
• device information;
• behavioural data;
• authentication information;
• fraud indicators.

Compliance should therefore not be reduced to obtaining a privacy notice and consent checkbox.

Fintech companies should determine the appropriate legal basis for each processing activity, provide required disclosures, establish retention and deletion policies, implement data security measures and properly structure controller-processor relationships.

The Turkish Data Protection Authority has specifically published a good-practice guide for payment and electronic money institutions addressing the roles of data controllers and processors, processing conditions, transfers, security and sector-specific compliance considerations.

13. Cross-Border Personal Data Transfers

International fintech businesses frequently use global technology infrastructure.

Examples include:

• foreign cloud providers;
• global CRM systems;
• overseas fraud detection platforms;
• analytics providers;
• international customer support systems;
• group-company databases.

Consequently, cross-border data transfers require particular attention.

Türkiye substantially amended Article 9 of the Personal Data Protection Law in 2024.

The new regime introduced mechanisms comparable in structure to international data-transfer tools, including standard contracts and binding corporate rules.

Standard contractual clauses may now constitute an appropriate safeguard for qualifying international personal data transfers.

However, the relevant standard contract must be notified to the Turkish Data Protection Authority within five business days after signature.

For international fintech companies, this means global data architecture should be analysed before entering the Turkish market.

A platform may technically be accessible from Türkiye while its servers, analytics tools, fraud engines and customer support systems are located in several different jurisdictions.

Each data flow should therefore be mapped and legally assessed.

14. Information Systems and Cybersecurity

Financial regulation imposes requirements that may go beyond ordinary data protection law.

Payment and electronic money institutions are subject to detailed requirements regarding information systems, security, authentication, outsourcing and data-sharing services.

The CBRT’s information systems communiqué establishes rules governing the information systems used by payment and electronic money institutions and the data-sharing services used within payment services.

The regulatory framework addresses matters such as:

• strong authentication;
• security controls;
• outsourcing;
• audit trails;
• data security;
• information systems governance;
• open banking infrastructure.

Cloud architecture also requires careful analysis.

Under CBRT rules, the use of cloud services involving sensitive customer data, competitively sensitive data or personal information is subject to specific conditions. The CBRT has also issued guidance concerning community-cloud services for payment and electronic money institutions.

Consequently, a fintech company’s cloud decision is not merely an IT procurement decision.

It can be a regulatory decision.

15. Cross-Border Fintech Services

Foreign fintech companies frequently ask whether they may provide services to Turkish customers without establishing a licensed Turkish entity.

There is no universal answer.

The analysis depends on:

• the specific service;
• whether the activity constitutes a regulated payment, banking, investment or crypto service;
• where the service is technically and legally performed;
• whether Turkish residents are actively targeted;
• whether customer funds are handled;
• whether a Turkish regulated institution is involved.

Law No. 6493 and the CBRT regulatory framework also contemplate certain cooperation arrangements between Turkish payment service providers and foreign legal entities.

The CBRT publishes a list of cooperation arrangements authorised under Article 19 of the Payment Services Regulation.

Such structures require careful planning.

They should not be interpreted as creating a general passporting regime comparable to the European Economic Area.

A foreign licence does not automatically entitle a company to perform a regulated financial service in Türkiye.

16. Consumer Protection Rules

Fintech companies serving individuals must also consider Turkish consumer protection legislation.

Law No. 6502 on Consumer Protection and its secondary regulations can apply to financial services provided to consumers.

The Ministry of Trade currently lists the Regulation on Distance Contracts for Financial Services among the applicable secondary legislation under Law No. 6502.

The legislation is particularly relevant where financial products are marketed and contracted through websites or mobile applications.

Companies should therefore examine:

• pre-contractual disclosure obligations;
• transparency of fees;
• contractual terms;
• termination mechanisms;
• customer communications;
• distance contracting procedures;
• unfair contract terms;
• complaint processes.

A technically compliant fintech platform can still face consumer-law exposure if contractual disclosures or commercial practices are unlawful.

17. Crowdfunding in Türkiye

Crowdfunding is another area where technology and regulated finance intersect.

Equity-based and investment-related crowdfunding structures may fall within the jurisdiction of the Capital Markets Board.

The CMB’s Crowdfunding Communiqué No. III-35/A.2, published in 2021, remains part of the current CMB regulatory framework.

Fintech businesses considering crowdfunding should therefore distinguish between ordinary reward-based crowdfunding arrangements and structures where investors provide financing or receive investment rights.

The legal classification of the fundraising structure can determine whether capital markets regulation becomes applicable.

18. Fintech Mergers, Acquisitions and Investment Transactions

Regulatory due diligence is particularly important when acquiring or investing in a Turkish fintech company.

A standard corporate due diligence exercise is insufficient for a regulated fintech.

The investor should also examine:

Regulatory status.
Does the company possess the licences required for every service it currently provides?

Licence scope.
Does the licence cover the exact business model?

Shareholder approvals.
Would the contemplated investment or share transfer require regulatory approval?

AML compliance.
Has the company established adequate customer identification, transaction monitoring and suspicious transaction reporting systems?

Data protection.
Are personal data processing and international data transfers lawful?

Technology infrastructure.
Does the system architecture comply with sector-specific information systems requirements?

Outsourcing arrangements.
Are cloud, technology and operational outsourcing agreements compliant?

Regulatory investigations.
Has the company been inspected, sanctioned or requested to correct deficiencies?

This is not merely theoretical risk.

The CBRT announced that its supervisory activities concerning payment and electronic money institutions during 2025 resulted, among other enforcement measures, in the cancellation of the operating licences of seven institutions.

The CBRT’s current regulatory pages also record numerous licence cancellations and scope changes during 2025 and 2026.

Fintech regulatory compliance therefore directly affects company valuation.

19. How to Establish a Fintech Company in Türkiye

For international entrepreneurs, a practical Turkish fintech establishment process can generally be divided into several stages.

The first stage is regulatory classification.

Before company formation and technology development, the proposed business model should be mapped against Turkish payment, banking, capital markets and crypto legislation.

The second stage is licensing analysis.

The founders should identify whether the activity requires authorisation from the CBRT, BRSA or CMB.

The third stage is corporate structuring.

The company’s shareholding structure, founders, managers and capital should be designed in accordance with regulatory eligibility requirements.

The fourth stage is compliance architecture.

AML/KYC, internal control, risk management, information security, personal data protection and outsourcing policies should be designed before operations begin.

The fifth stage is regulatory application.

Application documentation should be prepared consistently with the requirements of the competent authority.

For example, the CMB publishes specific application forms for establishment and operating licences for crypto-asset platforms and custody institutions and warns that incomplete or incorrectly formatted applications will not be processed.

The sixth stage is operational readiness.

Regulators increasingly expect applicants not merely to submit documents but to demonstrate functioning governance, infrastructure and compliance systems.

20. Common Legal Risks for Fintech Startups in Türkiye

One of the most common mistakes is assuming:

“We are a technology company, not a financial company.”

This argument does not determine regulatory status.

Regulators examine what the company actually does.

A technology company may become subject to financial regulation if its application performs functions legally classified as payment services, electronic money issuance, banking, investment services or crypto-asset services.

Another common mistake involves relying upon the licence of a business partner without properly allocating regulated activities.

Other risks include:

• collecting customer funds before obtaining authorisation;
• using third-party bank accounts to operate an unlicensed payment structure;
• expanding outside the scope of an existing licence;
• inadequate customer identification;
• insufficient AML monitoring;
• unlawful international data transfers;
• non-compliant outsourcing;
• misleading consumer disclosures;
• inadequate cybersecurity controls;
• introducing crypto functionality into a regulated payment product without analysing payment restrictions.

Regulatory analysis should therefore occur at product-design stage rather than after launch.

21. Why Fintech Companies Need Regulatory Legal Advice in Türkiye

Fintech regulation is fundamentally different from ordinary corporate law.

A fintech lawyer must understand both the legal documents and the underlying transaction flow.

For example, determining whether a payment licence is required may require understanding:

1. who receives the customer’s funds;
2. whose bank account holds those funds;
3. who gives the payment instruction;
4. who transfers the money;
5. who contracts with the merchant;
6. which entity controls the wallet;
7. whether value is stored;
8. whether the system initiates payments from another provider’s account.

A small change in the money flow can completely change the regulatory classification.

The legal structure, commercial agreements, APIs, payment flows and product architecture should therefore be developed together.

22. Turkish Fintech Law Compliance Checklist

Before launching a fintech product in Türkiye, businesses should verify at least the following:

Regulatory Classification: Has each service been classified under Turkish financial legislation?

Licensing: Does the company require CBRT, BRSA or CMB authorisation?

Corporate Requirements: Do shareholders, management and capital satisfy regulatory requirements?

AML/KYC: Are customer identification, risk monitoring and suspicious transaction procedures operational?

Data Protection: Is processing compliant with Law No. 6698?

International Data Transfers: Have appropriate mechanisms been established for foreign cloud and technology providers?

Information Security: Does the technological infrastructure comply with sector-specific rules?

Consumer Contracts: Are mobile and online agreements compliant with consumer legislation?

Outsourcing: Are service-provider and cloud agreements structured in accordance with regulatory requirements?

Licence Scope: Does the current authorisation cover every new feature being introduced?

Crypto Exposure: Has the business analysed both CMB crypto regulations and CBRT payment restrictions?

Frequently Asked Questions About Turkish Fintech Law

Is fintech regulated in Türkiye?

Yes. Fintech activities are regulated through several legislative regimes including Law No. 6493, Banking Law No. 5411, Capital Markets Law No. 6362, Law No. 5549 on anti-money laundering and Law No. 6698 on personal data protection.

The applicable legislation depends upon the company’s business model.

Which authority regulates fintech companies in Türkiye?

There is no single fintech regulator.

The CBRT regulates payment and electronic money institutions; the BRSA regulates banking and digital banking; the CMB regulates capital markets and crypto-asset service providers; MASAK supervises AML obligations; and the Turkish Data Protection Authority supervises personal data processing.

Do payment companies need a licence in Türkiye?

Companies performing regulated payment services generally require appropriate authorisation.

The exact licence depends upon the services performed.

Can a foreign fintech company operate in Türkiye?

Possibly, but a foreign licence does not automatically authorise regulated financial services in Türkiye.

The proposed business model should be assessed under Turkish law before services are offered to Turkish customers.

Are cryptocurrencies legal in Türkiye?

Crypto-asset trading is subject to a regulatory regime under Capital Markets Law No. 6362 and CMB regulations.

However, crypto assets remain subject to separate restrictions concerning their use as payment instruments.

Are Turkish crypto exchanges regulated?

Yes.

Following the 2024 amendments to the Capital Markets Law and the secondary regulations published in March 2025, crypto-asset service providers are subject to detailed regulatory requirements under the supervision of the CMB.

Is open banking legal in Türkiye?

Yes.

Payment initiation and account information services are regulated payment services under Law No. 6493, and Türkiye operates an open banking infrastructure through ÖHVPS and GEÇİT. The system received significant additional functionality through the ÖHVPS 2.0.0 update announced by the CBRT in March 2026.

Can a fintech company use foreign cloud services?

The answer depends upon the regulated activity, type of data and proposed infrastructure.

Payment and electronic money institutions are subject to specific information systems and outsourcing requirements in addition to general personal data protection legislation. International data transfers must also comply with Article 9 of Law No. 6698.

Conclusion: The Future of Fintech Regulation in Türkiye

Turkish Fintech Law has developed rapidly from a primarily payment-focused regulatory environment into a sophisticated framework covering electronic money, open banking, digital banking, service-model banking, crypto assets, remote customer onboarding, AML compliance, data protection and financial technology infrastructure.

The regulatory direction is clear.

Financial innovation remains possible, but companies handling money, financial data or investment assets are increasingly expected to operate within a licensed and supervised environment.

The changes introduced between 2024 and 2026 demonstrate this development particularly clearly.

Crypto-asset service providers were placed under CMB supervision, comprehensive secondary crypto regulations entered into force in March 2025, open banking functionality expanded again in March 2026, and Turkish data-transfer and remote-identification regimes have continued to evolve.

For fintech founders and international investors, the most important principle is therefore to obtain regulatory classification before launching the product.

A properly structured fintech project should consider corporate formation, licence requirements, customer fund flows, AML/KYC procedures, personal data processing, cross-border transfers, information systems, cloud infrastructure, consumer agreements and regulatory reporting as parts of a single compliance architecture.

Businesses intending to establish a payment institution, electronic money institution, digital wallet, open banking platform, crypto-asset service provider, embedded finance business or other fintech company in Türkiye should conduct a comprehensive Turkish regulatory assessment before entering the market.

Early legal planning can prevent the most expensive fintech problem of all: developing a commercially successful product that cannot legally be operated under its existing structure.

Legal Disclaimer: This article provides general information regarding Turkish Fintech Law and the regulatory framework in force as of July 2026. It does not constitute legal advice. Licensing requirements and regulatory obligations should be assessed separately according to the specific business model, transaction flow, corporate structure and services of each fintech company.