{"id":2791,"date":"2025-12-11T10:44:18","date_gmt":"2025-12-11T07:44:18","guid":{"rendered":"https:\/\/workon.com.tr\/en\/?p=2791"},"modified":"2026-09-26T13:48:17","modified_gmt":"2026-09-26T10:48:17","slug":"fintech-regulation-turkey-complete-guide","status":"publish","type":"post","link":"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/","title":{"rendered":"Fintech Regulation in Turkey: 2026 Regulatory Map"},"content":{"rendered":"<p><strong>Fintech regulation Turkey<\/strong> is not one licence or one regulator. The correct framework depends on <strong>what the product actually does<\/strong>: payments and electronic money are centred on the Central Bank of the Republic of T\u00fcrkiye (TCMB); banks and digital banks are regulated by BDDK; capital-markets and crowdfunding activities fall under SPK; crypto-asset service providers are now within SPK&#8217;s capital-markets framework; AML\/CFT obligations are administered by MASAK for businesses that fall within the obliged-party rules; and personal-data processing is also subject to KVKK and sector-specific information-systems rules.<\/p>\n<p>The safest 2026 sequence is: <strong>define the money\/data flow \u2192 classify the regulated activity \u2192 identify the competent regulator \u2192 test whether an operating licence\/authorisation is required \u2192 design the company\/capital\/governance\/technology around that licence \u2192 build AML, consumer, security and data compliance \u2192 launch only within the authorised scope<\/strong>.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_75 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#Quick_Answer_Which_Regulator_Applies_to_Your_Fintech_Model\" >Quick Answer: Which Regulator Applies to Your Fintech Model?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#1_Payments_and_Electronic_Money_TCMB_Is_the_Regulator\" >1. Payments and Electronic Money: TCMB Is the Regulator<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#2_Payment_Institution_vs_Electronic-Money_Institution\" >2. Payment Institution vs Electronic-Money Institution<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#3_Supervision_Is_Active_Not_Just_a_Registration_Formality\" >3. Supervision Is Active, Not Just a Registration Formality<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#4_Open_Banking_Is_Part_of_the_Regulated_Payments_Framework\" >4. Open Banking Is Part of the Regulated Payments Framework<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#5_Digital_Banks_and_Banking-as-a-Service_BDDK_Not_TCMB_Payment_Licensing\" >5. Digital Banks and Banking-as-a-Service: BDDK, Not TCMB Payment Licensing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#6_Crowdfunding_and_Investment_Platforms_SPK_Boundary\" >6. Crowdfunding and Investment Platforms: SPK Boundary<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#7_Crypto-Asset_Services_SPK_Rules_and_the_2026_Transition_Matter\" >7. Crypto-Asset Services: SPK Rules and the 2026 Transition Matter<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#8_AMLKYC_First_Ask_Whether_You_Are_a_MASAK_%E2%80%9CObliged_Party%E2%80%9D\" >8. AML\/KYC: First Ask Whether You Are a MASAK \u201cObliged Party\u201d<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#9_KYC_Is_Not_%E2%80%9CCollect_Passport_Selfie_for_Everyone%E2%80%9D\" >9. KYC Is Not \u201cCollect Passport + Selfie for Everyone\u201d<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#10_KVKK_Do_Not_Use_a_Blanket_%E2%80%9CAll_Financial_Data_Must_Stay_in_Turkey%E2%80%9D_Rule\" >10. KVKK: Do Not Use a Blanket \u201cAll Financial Data Must Stay in Turkey\u201d Rule<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#11_Information_Systems_and_Cybersecurity_Are_Licence_Architecture\" >11. Information Systems and Cybersecurity Are Licence Architecture<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#12_Consumer_Protection_and_Safeguarding_Depend_on_the_Product\" >12. Consumer Protection and Safeguarding Depend on the Product<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#13_Foreign_Investors_Equal_Treatment_Does_Not_Waive_Financial-Regulatory_Approval\" >13. Foreign Investors: Equal Treatment Does Not Waive Financial-Regulatory Approval<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#14_Company_Formation_Must_Follow_Regulatory_Classification\" >14. Company Formation Must Follow Regulatory Classification<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#15_Licence_vs_Technology_Vendor_A_Critical_Boundary\" >15. Licence vs Technology Vendor: A Critical Boundary<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#16_Regulatory_Map_Before_Launch\" >16. Regulatory Map Before Launch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#17_What_Workon_Can_Coordinate\" >17. What Workon Can Coordinate<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#Key_Takeaways\" >Key Takeaways<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/workon.com.tr\/en\/fintech-regulation-turkey-complete-guide\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Quick_Answer_Which_Regulator_Applies_to_Your_Fintech_Model\"><\/span>Quick Answer: Which Regulator Applies to Your Fintech Model?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table>\n<thead>\n<tr>\n<th>Business model<\/th>\n<th>Primary regulatory owner<\/th>\n<th>First question<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Payment service \/ payment institution<\/strong><\/td>\n<td>TCMB<\/td>\n<td>Does the model provide one or more payment services defined in Law No. 6493?<\/td>\n<\/tr>\n<tr>\n<td><strong>Electronic money \/ wallet<\/strong><\/td>\n<td>TCMB<\/td>\n<td>Is the business issuing electronic money and\/or providing authorised payment services?<\/td>\n<\/tr>\n<tr>\n<td><strong>Payment initiation \/ account information \/ open-banking service<\/strong><\/td>\n<td>TCMB<\/td>\n<td>Does the model fall within the payment-service\/data-sharing services regulated under Law No. 6493 and secondary rules?<\/td>\n<\/tr>\n<tr>\n<td><strong>Bank \/ digital bank \/ Banking-as-a-Service bank<\/strong><\/td>\n<td>BDDK<\/td>\n<td>Does the model perform banking activity requiring a banking licence or operate under the Digital Banks\/BaaS Regulation?<\/td>\n<\/tr>\n<tr>\n<td><strong>Crowdfunding platform<\/strong><\/td>\n<td>SPK<\/td>\n<td>Does the platform conduct equity- or debt-based crowdfunding within the SPK framework?<\/td>\n<\/tr>\n<tr>\n<td><strong>Crypto-asset platform \/ custody<\/strong><\/td>\n<td>SPK<\/td>\n<td>Is the business a crypto-asset service provider subject to the 2024 law change and 2025 secondary communiqu\u00e9s?<\/td>\n<\/tr>\n<tr>\n<td><strong>Investment \/ brokerage \/ portfolio activity<\/strong><\/td>\n<td>SPK<\/td>\n<td>Does the product amount to a regulated capital-markets service rather than software only?<\/td>\n<\/tr>\n<tr>\n<td><strong>Pure B2B fintech software vendor<\/strong><\/td>\n<td>Depends on function<\/td>\n<td>Does the company merely supply technology, or does it itself hold funds, execute payments, intermediate investments or provide another regulated service?<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Do not start with the word \u201cfintech.\u201d Start with the regulated function.<\/strong> Two apps that look similar to a user can have very different legal status depending on who holds funds, who contracts with the customer, who executes the transaction and who carries regulatory responsibility.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"1_Payments_and_Electronic_Money_TCMB_Is_the_Regulator\"><\/span>1. Payments and Electronic Money: TCMB Is the Regulator<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Turkey&#8217;s payments framework is based on <strong>Law No. 6493<\/strong> and its secondary legislation. Since 1 January 2020, TCMB has been responsible for the regulation and supervision of payment services, payment service providers and electronic-money issuance.<\/p>\n<p>TCMB publishes separate live lists showing:<\/p>\n<ul>\n<li>authorised <strong>payment institutions<\/strong> and the exact Article 12 payment services each may provide;<\/li>\n<li>authorised <strong>electronic-money institutions<\/strong> and their payment-service scopes;<\/li>\n<li>institutions whose licences have been suspended or revoked.<\/li>\n<\/ul>\n<p>This scope-by-scope model is important: a company does not receive a generic \u201cfintech licence\u201d authorising every payment product.<\/p>\n<p>Official starting point: <a href=\"https:\/\/www.tcmb.gov.tr\/wps\/wcm\/connect\/EN\/TCMB%2BEN\/Main%2BMenu\/Core%2BFunctions\/Payment%2BServices\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>TCMB Payment Services<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"2_Payment_Institution_vs_Electronic-Money_Institution\"><\/span>2. Payment Institution vs Electronic-Money Institution<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Payment services and electronic-money issuance should not be treated as interchangeable.<\/p>\n<table>\n<thead>\n<tr>\n<th>Question<\/th>\n<th>Why it changes the route<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Will the company only provide specified payment services?<\/td>\n<td>A payment-institution authorisation may be the relevant route, with scope tied to the approved services.<\/td>\n<\/tr>\n<tr>\n<td>Will the company issue electronically stored monetary value against funds received?<\/td>\n<td>Electronic-money issuance brings the electronic-money-institution framework into the analysis.<\/td>\n<\/tr>\n<tr>\n<td>Will the company hold customer funds?<\/td>\n<td>Safeguarding, accounting, operational and regulatory design becomes central.<\/td>\n<\/tr>\n<tr>\n<td>Will the company provide acquiring, money transfer, payment initiation or account information?<\/td>\n<td>Each service must be mapped to the legal service definitions and the requested licence scope.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Capital, shareholding, governance, technical infrastructure and application requirements should be taken from the <strong>current licence route for the exact service<\/strong>. Do not reuse old internet tables with generic \u201cTRY 1m \/ 2m \/ 5m fintech capital\u201d figures.<\/p>\n<p>Once the proposed service has been classified within the payment or electronic-money framework, continue with the <a href=\"https:\/\/workon.com.tr\/en\/payment-electronic-money-license-turkey\/\" style=\"color:#000080;\"><strong>Payment &amp; E-Money Licence in Turkey guide<\/strong><\/a> for the applicant&#8217;s corporate, financial, technical and compliance file. For a business choosing a provider to accept card payments for its own sales, use the separate <a href=\"https:\/\/workon.com.tr\/en\/apply-for-a-virtual-pos-in-turkey\/\"><strong>Virtual POS merchant-application guide<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"3_Supervision_Is_Active_Not_Just_a_Registration_Formality\"><\/span>3. Supervision Is Active, Not Just a Registration Formality<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>TCMB&#8217;s January 2026 supervision release shows why an operating licence should not be viewed as a one-time setup document. Based on its 2025 supervision work, TCMB reported that <strong>7 institutions&#8217; operating licences were revoked and 14 were temporarily suspended<\/strong>, alongside other supervisory measures and administrative penalties.<\/p>\n<p>This is a dated enforcement indicator, not a prediction about any individual applicant. The practical lesson is that regulated fintechs need ongoing:<\/p>\n<ul>\n<li>licence-scope control;<\/li>\n<li>governance and internal controls;<\/li>\n<li>financial\/safeguarding compliance;<\/li>\n<li>information-systems and security controls;<\/li>\n<li>regulatory reporting;<\/li>\n<li>AML\/CFT compliance;<\/li>\n<li>consumer and complaints processes.<\/li>\n<\/ul>\n<p>Current TCMB authorisation status should be checked on the regulator&#8217;s live institution lists rather than through an old fintech directory.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"4_Open_Banking_Is_Part_of_the_Regulated_Payments_Framework\"><\/span>4. Open Banking Is Part of the Regulated Payments Framework<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Turkey&#8217;s open-banking\/data-sharing framework includes regulated <strong>payment initiation<\/strong> and <strong>account information<\/strong> services and TCMB&#8217;s payment-services data-sharing infrastructure\/guidance.<\/p>\n<p>A founder planning account aggregation or payment initiation should map:<\/p>\n<ul>\n<li>which party is the account servicing payment service provider;<\/li>\n<li>which party provides the regulated initiation\/information service;<\/li>\n<li>customer authentication\/consent mechanics;<\/li>\n<li>API\/data-sharing standards;<\/li>\n<li>security and incident controls;<\/li>\n<li>data minimisation and retention;<\/li>\n<li>whether the company itself needs authorisation or acts only as a technology supplier to an authorised institution.<\/li>\n<\/ul>\n<p>Do not treat \u201ccustomer consent\u201d alone as permission to access banking data outside the regulated technical and legal framework.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"5_Digital_Banks_and_Banking-as-a-Service_BDDK_Not_TCMB_Payment_Licensing\"><\/span>5. Digital Banks and Banking-as-a-Service: BDDK, Not TCMB Payment Licensing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A digital bank is still a <strong>bank<\/strong>. BDDK maintains the <strong>Regulation on the Operating Principles of Digital Banks and Banking as a Service Model<\/strong> within the Banking Law framework.<\/p>\n<p>This is a different regulatory path from establishing a payment or electronic-money institution. If the business model involves accepting deposits\/participation funds, lending as a bank, or operating as a licensed digital bank, do not attempt to fit it into a Law No. 6493 payment-institution application.<\/p>\n<p>Official regulation list: <a href=\"https:\/\/www.bddk.org.tr\/Mevzuat\/Liste\/139\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>BDDK Banking Regulations<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"6_Crowdfunding_and_Investment_Platforms_SPK_Boundary\"><\/span>6. Crowdfunding and Investment Platforms: SPK Boundary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Equity- and debt-based crowdfunding sit within Turkey&#8217;s capital-markets regime. SPK&#8217;s current legislation includes the <strong>Crowdfunding Communiqu\u00e9 (III-35\/A.2)<\/strong>.<\/p>\n<p>A platform should not describe itself merely as a \u201cmarketplace connecting founders and investors\u201d if its actual activity falls within regulated crowdfunding or another investment-service category. Before launch, identify:<\/p>\n<ul>\n<li>who offers the investment instrument;<\/li>\n<li>who solicits\/invites investors;<\/li>\n<li>who operates the platform;<\/li>\n<li>how investor funds are handled;<\/li>\n<li>what disclosures and limits apply;<\/li>\n<li>whether SPK listing\/authorisation requirements are triggered.<\/li>\n<\/ul>\n<p>Official SPK legislation portal: <a href=\"https:\/\/mevzuat.spk.gov.tr\/\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>SPK Legislation System<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"7_Crypto-Asset_Services_SPK_Rules_and_the_2026_Transition_Matter\"><\/span>7. Crypto-Asset Services: SPK Rules and the 2026 Transition Matter<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Law No. 7518, published in July 2024, brought crypto-asset service providers within SPK&#8217;s regulatory and supervisory framework. In 2025, SPK published two major secondary communiqu\u00e9s:<\/p>\n<ul>\n<li><strong>III-35\/B.1<\/strong> \u2014 establishment, commencement of operations, shareholders\/transfers, management\/personnel, internal systems, information systems, records and audit;<\/li>\n<li><strong>III-35\/B.2<\/strong> \u2014 permitted services\/activities, trading environments, custody\/transfers, listing and capital adequacy.<\/li>\n<\/ul>\n<p>For 2026 due diligence, there is an additional transition point: SPK&#8217;s public <strong>\u201cFaaliyette Bulunanlar Listesi\u201d is a provisional list and expressly does not mean that every listed business has been authorised under the new framework<\/strong>. A founder, investor or counterparty should distinguish provisional-list status from establishment approval, operating permission and any final authorisation document required under the applicable rules.<\/p>\n<p>SPK also announced on <strong>26 March 2026<\/strong> that certain transition periods for platforms&#8217; custody agreements and for businesses on the provisional operating list to obtain authorisation documents would be set after SPK-authorised custody institutions begin providing custody services broadly. This makes current SPK status checks more important than relying on a 2025 article or an old provider list.<\/p>\n<p>Therefore, a crypto exchange or custody project should not be presented as an ordinary software company with only AML\/KVKK obligations, and a company&#8217;s appearance on a provisional SPK list should not be marketed as a completed operating authorisation.<\/p>\n<p>Official sources: <a href=\"https:\/\/spk.gov.tr\/duyurular\/basin-duyurulari\/2025\/kripto-varlik-hizmet-saglayicilarina-iliskin-iki-teblig-yayimlandi\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>SPK Crypto-Asset Service Provider Communiqu\u00e9s<\/strong><\/a> and <a href=\"https:\/\/spk.gov.tr\/kurumlar\/kripto-varlik-hizmet-saglayicilar\/faaliyette-bulunanlar-listesi\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>current SPK crypto-asset service-provider status list<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"8_AMLKYC_First_Ask_Whether_You_Are_a_MASAK_%E2%80%9CObliged_Party%E2%80%9D\"><\/span>8. AML\/KYC: First Ask Whether You Are a MASAK \u201cObliged Party\u201d<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>AML\/KYC is not one identical checklist for every company using financial technology. Under Law No. 5549 and secondary rules, specific financial institutions and other businesses are <strong>obliged parties<\/strong> with customer-identification, suspicious-transaction reporting, record\/information and\u2014in specified cases\u2014compliance-program obligations.<\/p>\n<p>MASAK&#8217;s current compliance materials expressly include payment and electronic-money institutions within key obliged-party obligations. The 2025 updated enhanced-measures guidance also addresses technology risks, risky countries, crypto relationships, payment\/e-money institutions and terminal services.<\/p>\n<p>A regulated fintech should design a <strong>risk-based<\/strong> AML programme around:<\/p>\n<ul>\n<li>customer\/beneficial-owner identification;<\/li>\n<li>risk classification;<\/li>\n<li>ongoing transaction monitoring;<\/li>\n<li>sanctions\/high-risk jurisdiction controls where applicable;<\/li>\n<li>suspicious transaction escalation\/reporting;<\/li>\n<li>prohibition on tipping-off;<\/li>\n<li>training, internal control, risk management and compliance officer\/program where the applicable rules require them;<\/li>\n<li>record retention and regulatory access.<\/li>\n<\/ul>\n<p>Official source: <a href=\"https:\/\/masak.hmb.gov.tr\/yukumlulukler\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>MASAK Obligations<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"9_KYC_Is_Not_%E2%80%9CCollect_Passport_Selfie_for_Everyone%E2%80%9D\"><\/span>9. KYC Is Not \u201cCollect Passport + Selfie for Everyone\u201d<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The correct identity-verification method depends on the regulated entity, customer type, transaction, remote-onboarding rules and sector-specific regulation.<\/p>\n<p>Before choosing an onboarding vendor, map:<\/p>\n<ul>\n<li>natural person vs legal entity;<\/li>\n<li>domestic vs foreign customer;<\/li>\n<li>beneficial ownership;<\/li>\n<li>face-to-face vs remote identity verification;<\/li>\n<li>document\/chip\/video\/liveness or other approved method where applicable;<\/li>\n<li>PEP\/high-risk controls;<\/li>\n<li>ongoing monitoring and refresh;<\/li>\n<li>data retention and evidence requirements.<\/li>\n<\/ul>\n<p>A vendor&#8217;s technical ability to scan an ID does not prove regulatory acceptance for the specific institution.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"10_KVKK_Do_Not_Use_a_Blanket_%E2%80%9CAll_Financial_Data_Must_Stay_in_Turkey%E2%80%9D_Rule\"><\/span>10. KVKK: Do Not Use a Blanket \u201cAll Financial Data Must Stay in Turkey\u201d Rule<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Fintech companies process personal and often sensitive financial\/behavioural data, so the Personal Data Protection Law (KVKK) is central. But a generic statement that <strong>all financial data must always be stored only on servers physically located in Turkey<\/strong> is too broad.<\/p>\n<p>Separate:<\/p>\n<ul>\n<li><strong>KVKK legal basis, transparency, security and data-subject rights;<\/strong><\/li>\n<li><strong>cross-border personal-data transfer rules<\/strong> under the amended Article 9 framework;<\/li>\n<li><strong>sector-specific information-system, outsourcing, primary\/secondary system or data-location rules<\/strong> that can apply to a regulated bank\/payment\/e-money\/capital-markets institution.<\/li>\n<\/ul>\n<p>KVKK Article 9 was materially amended in 2024 and now provides adequacy and appropriate-safeguard mechanisms for cross-border transfers, plus limited exceptional routes under the legal conditions.<\/p>\n<p>Official source: <a href=\"https:\/\/www.kvkk.gov.tr\/Icerik\/6649\/Personal-Data-Protection-Law\" target=\"_blank\" rel=\"noopener\" style=\"color:#000080;\"><strong>Personal Data Protection Law<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"11_Information_Systems_and_Cybersecurity_Are_Licence_Architecture\"><\/span>11. Information Systems and Cybersecurity Are Licence Architecture<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For regulated fintechs, cybersecurity is not a generic ISO checklist added after product launch. TCMB&#8217;s payment-services framework includes a dedicated communique on information systems of payment\/e-money institutions and payment-service data-sharing services. Banks and capital-markets\/crypto institutions have their own sector rules.<\/p>\n<p>During architecture design, identify:<\/p>\n<ul>\n<li>critical systems and service continuity;<\/li>\n<li>authentication and transaction security;<\/li>\n<li>privileged access;<\/li>\n<li>encryption\/key management;<\/li>\n<li>logging and traceability;<\/li>\n<li>penetration\/vulnerability controls;<\/li>\n<li>outsourcing\/cloud\/vendor requirements;<\/li>\n<li>incident response and regulator notification;<\/li>\n<li>business continuity\/disaster recovery;<\/li>\n<li>independent audit requirements where applicable.<\/li>\n<\/ul>\n<p>Do this before committing to a cloud\/vendor stack that may conflict with the chosen licence.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"12_Consumer_Protection_and_Safeguarding_Depend_on_the_Product\"><\/span>12. Consumer Protection and Safeguarding Depend on the Product<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Payment\/e-money, banking, investment and crypto products have different customer-asset and disclosure mechanics. A regulated company should map:<\/p>\n<ul>\n<li>whether it holds customer money\/assets;<\/li>\n<li>how funds\/assets are safeguarded or custodied;<\/li>\n<li>fees and pre-contract information;<\/li>\n<li>complaints and dispute handling;<\/li>\n<li>unauthorised\/fraudulent transaction rules;<\/li>\n<li>refund\/cancellation mechanics;<\/li>\n<li>customer communications and advertising claims;<\/li>\n<li>service interruption\/business continuity.<\/li>\n<\/ul>\n<p>Do not use \u201cour funds are insured\u201d or \u201ccustomer money is guaranteed\u201d unless the exact statutory protection mechanism truly applies.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"13_Foreign_Investors_Equal_Treatment_Does_Not_Waive_Financial-Regulatory_Approval\"><\/span>13. Foreign Investors: Equal Treatment Does Not Waive Financial-Regulatory Approval<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Turkey&#8217;s general FDI framework is based on equal treatment, but regulated financial businesses are still subject to sector-specific rules on founders\/shareholders, qualified holdings, management, capital, corporate form and regulatory approval.<\/p>\n<p>Therefore, do not publish either of these blanket claims:<\/p>\n<ul>\n<li>\u201cForeign investors cannot own a Turkish fintech.\u201d<\/li>\n<li>\u201cForeign investors can always own 100% of every Turkish regulated financial institution without additional approval.\u201d<\/li>\n<\/ul>\n<p>Test the selected licence and shareholder structure under the current sector rules before incorporation or acquisition.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"14_Company_Formation_Must_Follow_Regulatory_Classification\"><\/span>14. Company Formation Must Follow Regulatory Classification<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>An ordinary software startup can often be incorporated with a broad technology activity. A regulated payment, e-money, bank, crowdfunding or crypto business may require a specific legal form, minimum capital, shareholder suitability, governance, purpose clause and pre-licence structure.<\/p>\n<p>Before MERSIS filing:<\/p>\n<ol>\n<li>draw the customer\/fund\/data flow;<\/li>\n<li>classify the regulated service;<\/li>\n<li>confirm the regulator and licence type;<\/li>\n<li>confirm corporate form and capital;<\/li>\n<li>screen shareholders\/managers;<\/li>\n<li>design governance\/internal functions;<\/li>\n<li>validate technology\/security architecture;<\/li>\n<li>then draft the company purpose and formation file.<\/li>\n<\/ol>\n<p>For the general corporate layer, see <a href=\"https:\/\/workon.com.tr\/en\/company-formation-in-turkey\/\" style=\"color:#000080;\"><strong>Company Formation in Turkey: 2026 Guide<\/strong><\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"15_Licence_vs_Technology_Vendor_A_Critical_Boundary\"><\/span>15. Licence vs Technology Vendor: A Critical Boundary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A SaaS vendor can sell fraud detection, onboarding, ledger, payment orchestration or banking middleware without necessarily becoming the regulated financial institution. The boundary can change if the vendor itself:<\/p>\n<ul>\n<li>contracts with end customers for the regulated service;<\/li>\n<li>holds or controls customer funds\/assets;<\/li>\n<li>executes or initiates regulated transactions in its own regulatory capacity;<\/li>\n<li>provides regulated investment\/financial intermediation;<\/li>\n<li>assumes responsibilities reserved for a licensed institution.<\/li>\n<\/ul>\n<p>Contract wording alone cannot change the substance of the activity. Map the real operational role.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"16_Regulatory_Map_Before_Launch\"><\/span>16. Regulatory Map Before Launch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<table>\n<thead>\n<tr>\n<th>Question<\/th>\n<th>If yes, investigate<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Do we move money for customers?<\/td>\n<td>TCMB \/ Law No. 6493 payment-service classification.<\/td>\n<\/tr>\n<tr>\n<td>Do we issue stored monetary value?<\/td>\n<td>TCMB electronic-money framework.<\/td>\n<\/tr>\n<tr>\n<td>Do we accept deposits or operate as a bank?<\/td>\n<td>BDDK Banking Law \/ digital-bank rules.<\/td>\n<\/tr>\n<tr>\n<td>Do we intermediate investment\/crowdfunding?<\/td>\n<td>SPK capital-markets rules.<\/td>\n<\/tr>\n<tr>\n<td>Do we operate crypto trading\/custody?<\/td>\n<td>SPK crypto-asset service-provider rules.<\/td>\n<\/tr>\n<tr>\n<td>Are we a MASAK obliged party?<\/td>\n<td>AML\/KYC, STR, compliance programme and sector guidance.<\/td>\n<\/tr>\n<tr>\n<td>Do we process\/share personal data?<\/td>\n<td>KVKK plus sector-specific IT\/data rules.<\/td>\n<\/tr>\n<tr>\n<td>Do we outsource critical systems?<\/td>\n<td>Regulator-specific outsourcing\/cloud\/information-system rules.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><span class=\"ez-toc-section\" id=\"17_What_Workon_Can_Coordinate\"><\/span>17. What Workon Can Coordinate<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Workon can coordinate Turkish company-formation readiness, foreign shareholder documents, registered-address\/workspace, bank-account application support and the operational handoff to appropriately qualified fintech regulatory, legal, AML, cybersecurity and tax professionals. The competent regulators and appropriately licensed or qualified professionals retain responsibility for financial-services authorisations, regulated services, MASAK compliance functions and professional opinions.<\/p>\n<p><strong>Last reviewed: 17 September 2026.<\/strong><\/p>\n<div id=\"attachment_1964\" style=\"width: 1882px\" class=\"wp-caption alignnone\"><a href=\"https:\/\/workon.com.tr\/en\/company-registration\/\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-1964\" class=\"size-full wp-image-1964\" src=\"https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner.webp\" alt=\"Workon fintech company registration and regulatory readiness coordination Turkey\" width=\"1872\" height=\"480\" srcset=\"https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner.webp 1872w, https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner-300x77.webp 300w, https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner-1024x263.webp 1024w, https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner-768x197.webp 768w, https:\/\/workon.com.tr\/en\/wp-content\/uploads\/sites\/3\/2025\/09\/workon-company-formation-banner-1536x394.webp 1536w\" sizes=\"auto, (max-width: 1872px) 100vw, 1872px\" \/><\/a><p id=\"caption-attachment-1964\" class=\"wp-caption-text\"><em>For a regulated fintech, classify the licence before finalising the Turkish company structure and technical stack.<\/em><\/p><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Key_Takeaways\"><\/span>Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>There is no universal fintech licence or single fintech regulator in Turkey.<\/li>\n<li>TCMB regulates payment services, payment institutions and electronic-money institutions under Law No. 6493.<\/li>\n<li>BDDK owns banking and digital-bank\/BaaS regulation.<\/li>\n<li>SPK owns capital-markets\/crowdfunding and now regulates crypto-asset service providers under the updated capital-markets framework.<\/li>\n<li>AML\/KYC obligations depend on whether the business is an obliged party and on its regulated model; use MASAK&#8217;s risk-based rules.<\/li>\n<li>KVKK does not by itself create a blanket rule that every piece of financial data must stay on Turkish servers; sector-specific IT rules must be checked separately.<\/li>\n<li>Foreign-investor equal treatment does not remove financial-sector shareholder, capital, governance or approval requirements.<\/li>\n<li>Classify the service before incorporating or choosing the technology stack.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>[clicksus-faqpage]<\/p>\n<p><em><strong>Important:<\/strong> This guide provides general information on fintech regulation in T\u00fcrkiye and is not legal, financial-regulatory, investment, AML, cybersecurity or data-protection advice. Licence scope, capital, ownership, governance, information-system, AML and data requirements depend on the exact business model and current TCMB, BDDK, SPK, MASAK and KVKK rules. Confirm the proposed model with the competent regulator and appropriately licensed\/qualified professionals before incorporating, raising capital, building regulated infrastructure or serving customers. Workon coordinates business setup and operational readiness but does not issue financial-services licences or provide regulated financial services.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fintech regulation Turkey is not one licence or one regulator. The correct framework depends on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2867,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","clicksus-faqpage":{"Sorular":[{"Soru":"Is there one fintech licence or one fintech regulator in Turkey?","Cevap":"No. The regulator depends on the actual function: TCMB for payment and e-money services, BDDK for banking and digital banking, SPK for capital-markets, crowdfunding and crypto-asset service providers, MASAK for AML\/CFT obligations where the business is an obliged party, plus KVKK and sector-specific information-systems rules for data and technology."},{"Soru":"How should a fintech founder decide whether a licence is needed?","Cevap":"Map the real customer, money and data flows first, then classify the regulated activity, identify the competent regulator and test whether operating authorisation is required. The company form, capital, governance and technology should be designed around that classification rather than around a generic fintech label."},{"Soru":"Does every fintech software company need a payment or e-money licence?","Cevap":"No. A pure B2B technology vendor may remain outside the licensed-provider role, while a company that itself holds or controls customer funds, executes regulated payments, issues electronic money, intermediates investments or provides another regulated service can enter a licensing perimeter. Contract labels do not override the real function."},{"Soru":"Can a foreign investor own a regulated fintech company in Turkey?","Cevap":"Foreign investment is generally permitted, but equal treatment does not remove sector-specific shareholder suitability, qualified-holding, capital, governance or regulatory approval requirements. The exact ownership route must be checked under the selected licence regime."},{"Soru":"Does KVKK require every piece of financial data to be stored only in Turkey?","Cevap":"No blanket rule should be stated that broadly. KVKK cross-border transfer rules and the amended Article 9 framework must be analysed separately from sector-specific information-system, outsourcing or data-location requirements that may apply to regulated banks, payment institutions or capital-markets firms."},{"Soru":"Does appearing on an SPK crypto-service-provider list mean a company has full final authorisation?","Cevap":"Not necessarily. The article notes that SPK's public provisional operating list is not itself proof that every listed business has completed all authorisation steps under the updated framework. Current SPK status and the exact approval stage should be verified before relying on a provider."}],"Ayarlar":{"mikridata_aktif":true}},"_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_focuskw":"","rank_math_title":"Fintech Regulation Turkey | 2026 Regulatory Guide","rank_math_description":"Map Turkey's 2026 fintech rules by business model: TCMB payments\/e-money, BDDK digital banking, SPK crowdfunding\/crypto, MASAK AML and KVKK data compliance.","rank_math_focus_keyword":"fintech regulation Turkey"},"categories":[2],"tags":[],"class_list":["post-2791","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"_links":{"self":[{"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/posts\/2791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/comments?post=2791"}],"version-history":[{"count":5,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/posts\/2791\/revisions"}],"predecessor-version":[{"id":6628,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/posts\/2791\/revisions\/6628"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/media\/2867"}],"wp:attachment":[{"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/media?parent=2791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/categories?post=2791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/workon.com.tr\/en\/wp-json\/wp\/v2\/tags?post=2791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}