Fintech Lawyer in Istanbul, Turkey

What Is Fintech Law in Turkey?

There is no single Turkish statute called “Fintech Law.”

Instead, fintech businesses can find themselves at the intersection of several areas of law.

 

Depending on the product, these may include:

​

• payment-services legislation;

• electronic-money regulation;

• banking law;

• capital-markets law;

• crypto-asset regulation;

• anti-money-laundering requirements;

• personal-data protection;

• consumer protection;

• electronic-commerce law;

• commercial and corporate law;

• information-technology law;

• cybersecurity requirements;

• intellectual-property law;

• competition law;

• employment law;

• tax considerations; and

• contractual and dispute-resolution rules.

 

This makes fintech legal advice different from ordinary technology advice.

 

A software company can usually begin by asking what it wants its software to do. A fintech company also has to ask what legal consequences arise from allowing the software to move money, initiate payments, access financial information, hold value, connect customers with financial institutions or provide financial services.

The TCMB's payment-services framework is an important starting point for businesses examining payment and electronic-money activities in Türkiye.

​

Fintech Regulation in Türkiye: Start With the Business Model

A useful fintech legal review does not begin by asking, “Which licence should we apply for?”

 

It begins by understanding the product.

 

Consider a business that wants to launch a mobile application through which customers can transfer money, pay merchants and manage balances.

 

At first glance, that may sound like one product. Legally, however, several different questions immediately arise:

​

• Who receives the customer's money?

• Who holds the money?

• Is electronic money being issued?

• Who executes the payment?

• Who is the customer's contractual counterparty?

• Is the business itself providing a regulated service?

• Is a bank or payment institution involved?

• What information is accessed?

• Is the service connected to another payment account?

• What happens when a transaction fails?

• Who bears responsibility for fraud?

• Where is customer data stored?

• Are third-party technology providers involved?

 

These questions can materially change the legal analysis.

 

For that reason, a regulatory-perimeter assessment is often one of the most useful first steps for a new fintech venture.

​

A Practical Fintech Business-Model Review

The legal review may examine:

​

1. The customer journey

What happens from registration through authentication, payment, settlement and account closure?

​

2. The movement of funds

Where does money enter the system, where is it held and where does it go?

​

3. The technology

Which entity operates the platform, APIs, application, infrastructure and other critical systems?

​

4. The contractual structure

Who contracts with the customer, merchant, bank, payment institution and technology provider?

​

5. The regulated function

Which entity actually performs the financial activity?

​

6. The data flow

What personal, financial and transaction data is collected, shared, processed and transferred?

​

7. The geographical scope

Is the service limited to Türkiye or does it involve customers, infrastructure or service providers abroad?

​

This kind of analysis can prevent a common problem: building a product first and discovering its regulatory structure afterwards.

​

Payment Services Law in Turkey

Law No. 6493

Law No. 6493 established the principal legal framework for payment services, payment institutions and electronic-money institutions in Türkiye.

​

The TCMB explains that the legislation defines concepts including payment services, payment institutions and electronic-money institutions and establishes the regulatory framework applicable to the sector.

​

The regulatory framework is supported by secondary legislation, including the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, published in the Official Gazette.

 

The Official Gazette's text of the regulation provides the detailed regulatory framework concerning authorisation and activities of payment and electronic-money institutions, payment services and electronic-money issuance.

 

The current framework should always be checked against subsequent amendments. For example, the Official Gazette recorded further amendments to the payment-services and electronic-money framework on 4 September 2026, including changes concerning payment-service providers' information systems and data-sharing services.

 

This is one reason fintech legal work needs to remain current. A legal structure that made sense when a product was launched may need to be revisited as the regulatory framework develops.

​

Payment Institutions in Türkiye

A fintech business providing regulated payment services may fall within the payment-institution framework.

​

The TCMB publishes information concerning authorised payment institutions and the scope of their operating licences.

​

The regulatory analysis should not stop at the question of whether a company has a payment licence.

​

It should also examine what the licence covers.

​

A business may need to consider:

​

• the specific payment service it intends to provide;

• the scope of the proposed activity;

• the corporate entity carrying out the activity;

• ownership and management;

• operational arrangements;

• information systems;

• internal controls;

• risk management;

• outsourcing;

• customer agreements;

• merchant arrangements;

• safeguarding and settlement arrangements;

• reporting;

• complaints; and

• continuing regulatory obligations.

 

The TCMB's official list of payment institutions can also be used to check the institutions currently listed by the regulator and the scope of their operating licences.

​

Electronic Money Institutions in Turkey

Electronic money is another important part of the Turkish fintech ecosystem.

The TCMB states that electronic-money institutions are authorised to issue electronic money under Article 18 of Law No. 6493 and may provide specified payment services under Article 12, according to the scope of their authorisation.

The distinction matters because a product that looks like a “wallet” from a customer's perspective may involve a much more detailed regulatory analysis behind the scenes.

​

A digital product may need to be examined for:

​

• electronic-money issuance;

• payment services;

• customer funds;

• payment accounts;

• transaction execution;

• redemption;

• contractual terms;

• security;

• risk management;

• outsourcing;

• customer complaints;

• reporting; and

• regulatory compliance.

 

The TCMB's official electronic-money institution information provides the regulator's current list and licensing information.

​

Does a Fintech Company Need a Licence in Turkey?

Not necessarily.

​

There is no universal “fintech licence” that applies to every company using financial technology.

 

The answer depends on what the business actually does.

 

A company may be:

​

• a regulated payment institution;

• an electronic-money institution;

• a technology provider to a regulated institution;

• a software or infrastructure provider;

• part of a regulated partnership;

• an entity providing services outside the regulated perimeter; or

• subject to another financial regulatory framework.

 

The question should therefore be framed more precisely:

 

 

Does the proposed activity constitute a regulated financial or payment activity, and if so, which entity must be authorised to perform it?

 

 

That distinction can be crucial for startups.

​

Payment Licence Exemptions and Regulatory Perimeter

Fintech founders sometimes begin with the assumption that their product either clearly needs a licence or clearly does not.

​

Reality can be more nuanced.

 

The legal analysis may need to consider whether:

​

• the activity falls within a regulated payment service;

• an exclusion or exemption applies;

• another regulated institution performs the relevant function;

• the fintech company is acting as a technology provider;

• the proposed structure changes depending on who receives or controls funds;

• the product needs to be redesigned; or

• a regulatory permission is required before launch.

 

The objective should not be to find a label that makes regulation disappear.

​

The objective is to make sure the commercial model, contractual model and regulatory model actually match.

​

Open Banking and Account Information Services

Open banking has become an important part of financial technology in Türkiye.

 

The Turkish payment-services framework includes payment initiation services and account-information services, creating a regulatory environment for technology businesses that interact with customers' payment accounts and financial information.

​

The legal questions can include:

​

• customer consent;

• authentication;

• API access;

• payment initiation;

• account information;

• data security;

• liability;

• customer contracts;

• third-party providers;

• transaction records; and

• data protection.

​

The TCMB has continued to expand open-banking functionality. Its 2026 announcement describes developments including additional account-information functionality, card information and transaction services, scheduled payment-order initiation and recurring payment-order initiation.

 

The TCMB's official open-banking and payment-services materials should therefore be reviewed by businesses developing open-banking products.

​

Digital Wallets and Mobile Payment Platforms

A digital wallet can be legally simple or surprisingly complex.

​

Everything depends on what the wallet actually allows a customer to do.

 

For example, the wallet might:

​

• store payment credentials;

• hold electronic money;

• initiate payments;

• receive payments;

• transfer funds;

• pay merchants;

• connect to bank accounts;

• facilitate online purchases; or

• operate as part of a broader digital platform.

 

Each function can introduce different legal considerations.

 

A wallet project may require review of:

​

Customer terms

Customers should understand the service, fees, transaction rules, account restrictions and termination provisions.

​

Merchant arrangements

The business relationship between the wallet provider and merchants should be clearly documented.

​

Payment processing

The parties responsible for processing, settlement and customer support should be identified.

​

Fraud and unauthorised transactions

The contracts should allocate responsibility for security incidents, fraudulent transactions and disputed payments.

​

Data

The business should understand exactly which customer and transaction data it processes.

​

Third-party providers

Banks, payment institutions, processors, cloud providers and other technology suppliers may need carefully drafted contracts.

​

Competition law can also become relevant. In May 2026, the Turkish Competition Authority announced that an investigation concerning Mastercard and Visa concluded following commitments concerning, among other matters, digital-wallet visibility on e-commerce payment screens and certain payment-system practices.

 

The Turkish Competition Authority publishes decisions and sector-related developments relevant to businesses operating in digital markets and payment systems.

​

Crypto-Asset and Blockchain Regulation in Turkey

Crypto assets require a separate legal analysis from traditional payment services.

 

Türkiye introduced amendments to its capital-markets legislation concerning crypto-asset service providers through Law No. 7518, which entered into force in July 2024.

 

The Capital Markets Board of Türkiye (SPK) subsequently issued secondary regulations concerning the establishment, operating principles and capital adequacy of crypto-asset service providers in March 2025.

 

The SPK's official information on crypto-asset service providers should be consulted when analysing a crypto-related fintech structure.

 

This area can involve activities such as:

​

• crypto-asset trading;

• exchange services;

• custody;

• transfers;

• wallet-related functions;

• private-key custody or management;

• platform operation; and

• other services falling within the applicable statutory framework.

 

The SPK has specifically explained that activities involving the trading, exchange, transfer or custody of crypto assets and related private keys can fall within its regulatory framework.

​

One important practical point should not be overlooked.

​

The SPK's current “Faaliyette Bulunanlar Listesi” is a temporary public-information list. The SPK expressly states that appearing on that list does not itself mean that the entity has been authorised under the applicable legislation.

 

That distinction is important for investors, customers, counterparties and businesses conducting legal due diligence.

​

Fintech and Banking Law

Many fintech businesses do not intend to become banks.

​

Instead, they work with banks.

 

A technology company may provide:

​

• payment infrastructure;

• API services;

• transaction-processing technology;

• fraud-management tools;

• identity-verification technology;

• cloud services;

• software;

• financial-data tools;

• embedded-finance infrastructure; or

• customer-interface technology.

 

In these arrangements, the contract between the fintech company and the regulated financial institution becomes extremely important.

 

A well-drafted agreement can address:

​

• scope of services;

• service levels;

• availability;

• cybersecurity;

• incident response;

• data processing;

• confidentiality;

• audit rights;

• regulatory access;

• subcontracting;

• intellectual property;

• business continuity;

• liability;

• indemnities;

• insurance;

• termination; and

• transition arrangements.

 

The legal objective is not simply to protect one party.

 

It is to make the allocation of responsibilities clear enough that everyone knows what happens when the technology, transaction or relationship does not work as planned.

​

Fintech and Personal Data Protection — KVKK

Fintech businesses often process some of the most commercially sensitive information connected with their customers.

​

Depending on the product, this may include:

​

• identity information;

• contact information;

• account details;

• transaction records;

• financial information;

• device information;

• IP addresses;

• authentication information;

• fraud-related information;

• behavioural data; and

• information generated through use of the platform.

 

The Law No. 6698 on the Protection of Personal Data (KVKK) is therefore a central consideration for many fintech businesses.

 

The Personal Data Protection Authority (KVKK) publishes the legislation, decisions, guidance and other official materials relevant to data controllers and processors.

 

The official English text of the Personal Data Protection Law is also available through the Authority.

​

Fintech Data-Protection Questions

A practical review should ask:

​

What data is being collected?

The business should know exactly what information its product collects.

​

Why is the data being processed?

The purpose should correspond to an appropriate legal basis.

​

Who receives the information?

This may include banks, payment providers, processors, cloud providers, group companies and other service providers.

​

How long is it retained?

Retention periods should be considered in light of legal, regulatory and operational requirements.

​

Is data transferred outside Türkiye?

This is particularly important for fintech companies using international cloud, analytics, software or infrastructure providers.

​

How are customers informed?

Privacy notices and other information duties should reflect the actual processing activities.

​

How are security incidents handled?

Security controls, contractual responsibilities and incident-response procedures should be considered together.

​

International Transfers of Fintech Data

Cross-border data flows are common in modern fintech.

A Turkish fintech may use:

​

• an international cloud provider;

• foreign software;

• overseas analytics;

• global fraud-prevention systems;

• foreign group companies;

• international customer-support systems; or

• other external infrastructure.

​

The KVKK regime governing international transfers has changed significantly.

 

Article 9 now provides a framework involving adequacy decisions, appropriate safeguards and other legally recognised mechanisms. The KVKK's official guidance on international transfers explains the current framework.

 

For fintech businesses, international data transfers should therefore be considered during technology procurement and contract negotiations rather than as an afterthought.

​

Fintech, AML and Compliance

Financial technology businesses can also encounter anti-money-laundering and counter-terrorist-financing requirements, depending on their activities and regulatory status.

​

Compliance structures may address:

​

• customer identification;

• customer due diligence;

• risk classification;

• transaction monitoring;

• suspicious transactions;

• recordkeeping;

• internal policies;

• compliance responsibilities;

• employee training; and

• reporting.

​

The applicable obligations depend on the entity, service and regulatory framework.

 

A fintech business should therefore identify its obligations from the applicable legislation and regulatory status rather than simply adopting a generic compliance package.

 

For businesses operating in regulated financial sectors, compliance should also be practical.

 

A policy sitting in a folder is not enough if the platform, employees and third-party providers operate differently.

​

Fintech Consumer Protection

Fintech products increasingly deal directly with individual consumers.

​

That makes customer-facing legal documents particularly important.

​

A customer should be able to understand:

​

• what service is being provided;

• who provides it;

• what fees apply;

• how transactions are authorised;

• what happens when a payment fails;

• how refunds work;

• how complaints are handled;

• when an account can be restricted;

• how an account can be closed; and

• what happens to the customer's money or data when the relationship ends.

 

Where a fintech product is integrated into an e-commerce platform, additional rules may also apply.

​

The Turkish Ministry of Trade's official e-commerce legislation page provides the principal legislation and secondary regulations concerning electronic commerce, including Law No. 6563 and the related regulations.

​

For fintech businesses operating within marketplaces or online commerce environments, this intersection between financial services and e-commerce should not be overlooked.

​

Fintech Contracts

A fintech business may rely on dozens of commercial relationships.

The contracts can be as important as the regulatory analysis.

​

Customer Agreements

These can address:

​

• account opening;

• payment instructions;

• fees;

• transaction limits;

• refunds;

• unauthorised transactions;

• suspension;

• termination;

• complaints;

• liability; and

• dispute resolution.

​

Merchant Agreements

Merchant contracts may cover:

​

• payment acceptance;

• settlement;

• fees;

• chargebacks;

• fraud;

• technical integration;

• refunds;

• data;

• service levels; and

• termination.

​

Bank and Payment-Provider Agreements

These can regulate:

​

• APIs;

• settlement;

• payment processing;

• account access;

• responsibilities;

• compliance;

• security;

• audit rights; and

• regulatory cooperation.

​

Technology Agreements

These may include:

​

• software development;

• SaaS;

• APIs;

• licensing;

• cloud services;

• hosting;

• maintenance;

• support; and

• outsourcing.

​

Data-Processing Agreements

These should reflect the actual data relationship between the parties rather than simply reproducing a generic template.

​

Fintech Startups and Company Formation in Turkey

The corporate structure of a fintech company deserves attention at an early stage.

 

The founders may need to consider:

​

• ownership;

• management;

• capital;

• shareholder rights;

• investment;

• intellectual-property ownership;

• employee participation;

• regulatory eligibility;

• future financing; and

• potential exit transactions.

​

A regulatory business model should fit the corporate structure.

​

If one entity owns the technology, another entity contracts with customers and a third entity performs the regulated function, the legal relationships between those entities should be clearly documented.

​

Kurucuk & Associates can coordinate fintech work with its company formation practice, commercial law practice, contract law practice and broader corporate work.

​

Fintech Investment and Venture Capital

Fintech companies often attract investment because of their technology, customer base, regulatory position or potential to scale.Investors may conduct legal due diligence into:

​

• company ownership;

• shareholder arrangements;

• licences and regulatory status;

• customer contracts;

• technology ownership;

• intellectual property;

• data protection;

• employment;

• material agreements;

• litigation;

• compliance; and

• relationships with regulated institutions.

 

For the fintech company, investment documentation may address:

​

• share transfers;

• capital increases;

• investor rights;

• voting;

• board representation;

• reserved matters;

• founder obligations;

• intellectual property;

• future financing; and

• exit arrangements.

 

Regulatory due diligence can be particularly important where the value of the business depends on a licence, regulatory permission or strategic relationship with a regulated institution.

​

Kurucuk & Associates can integrate fintech regulatory analysis into broader venture capital and mergers and acquisitions transactions.

​

Fintech Intellectual Property and Technology

A fintech company's most valuable asset may not be its physical infrastructure.

It may be its technology.

​

This can include:

​

• software;

• source code;

• APIs;

• databases;

• algorithms;

• user interfaces;

• trademarks;

• technical documentation;

• proprietary processes; and

• trade secrets.

 

The business should know who owns these assets.

 

That sounds straightforward until software has been developed by a mixture of:

​

• founders;

• employees;

• contractors;

• external developers;

• foreign development teams; and

• technology partners.

 

The contractual chain should be examined carefully.

 

The same applies where the fintech company does not own its core technology but uses it under a licence.

 

Kurucuk & Associates can coordinate fintech matters with Turkish IT law and intellectual-property law.

​

Fintech Cybersecurity and Operational Resilience

For a fintech company, cybersecurity is not simply an IT issue.

​

It can become a legal, contractual and regulatory issue as well.

​

Questions may include:

• Who is responsible for security?

• What happens after a cyber incident?

• Who must be notified?

• What information must be preserved?

• Which party bears the cost?

• Can the other party audit the systems?

• What happens if a critical supplier goes offline?

• How quickly must an incident be escalated?

• What happens to customer data?

• What happens if an API becomes unavailable?

 

Contracts with technology providers should allocate these responsibilities clearly.

 

The regulatory environment also continues to develop. The Official Gazette published amendments in September 2026 concerning payment and electronic-money institutions' information systems and payment-service providers' data-sharing services.

 

For businesses in this sector, technology governance and legal compliance therefore increasingly need to be considered together.

​

Fintech and Competition Law

Competition law can become relevant at several stages of a fintech business.

 

Potential issues include:

​

• exclusivity;

• access to payment infrastructure;

• platform rules;

• interoperability;

• pricing;

• discounts;

• access to data;

• merchant relationships;

• digital-wallet visibility;

• partnerships between banks and fintech businesses; and

• potentially restrictive contractual arrangements.

 

The Turkish Competition Authority's work in payment systems demonstrates why these questions should not be ignored.

​

In May 2026, the Authority announced commitments concerning Mastercard and Visa that included measures relating to digital-wallet visibility, incentive arrangements and certain interchange practices.

 

The official Turkish Competition Authority website is an important source for businesses monitoring decisions, investigations and competition developments affecting digital and financial markets.

​

Fintech and E-Commerce

Many fintech businesses operate inside or alongside online commerce.

​

A payment service might be integrated into:

​

• an online marketplace;

• a mobile application;

• a subscription platform;

• a social-commerce service;

• a delivery platform; or

• a digital services marketplace.

 

This can create an overlap between financial regulation and e-commerce law.

 

The Turkish Ministry of Trade identifies Law No. 6563 on the Regulation of Electronic Commerce and related secondary legislation as part of the Turkish e-commerce framework.

 

The Ministry of Trade's e-commerce legislation resources provide access to the applicable legislation and regulations.

 

For a fintech operating within an online marketplace, the legal review should consider the financial service and the wider commercial environment together.

​

Cross-Border Fintech Businesses

Türkiye can be part of a much larger international fintech structure.

​

A foreign fintech entering Türkiye may need to consider:

​

• Turkish corporate structure;

• regulatory status;

• local partners;

• customer agreements;

• payment arrangements;

• data protection;

• international data transfers;

• technology contracts;

• outsourcing;

• intellectual property;

• employment;

• tax; and

• dispute resolution.

 

A Turkish fintech expanding abroad faces the reverse challenge.

 

The business may need to comply with Turkish obligations while also understanding the regulatory framework of every country into which it expands.

 

This is why cross-border fintech projects benefit from a coordinated legal structure rather than separate documents prepared without reference to the wider business model.

​

Fintech Regulatory Due Diligence

Buying or investing in a fintech company requires a different kind of legal due diligence from an ordinary commercial acquisition.

​

A regulatory review may ask:

​

What does the company actually do?

The operational reality should be compared with the company's stated business model.

​

What regulatory permissions exist?

The scope and status of licenses or regulatory arrangements should be verified.

​

Which entity performs each activity?

The group structure should be mapped carefully.

​

Are the customer agreements appropriate?

The contracts should reflect the service actually provided.

​

Who owns the technology?

Critical software and intellectual property should be traced back to their legal owners.

​

How is data processed?

Data flows, vendors and international transfers should be reviewed.

​

What third parties are essential?

The failure of a bank, payment provider, cloud provider or other supplier could materially affect the business.

​

Are there regulatory or commercial disputes?

Existing and threatened disputes should be identified.

​

Could regulatory change affect the investment?

A business that is commercially successful today may need to adapt as the regulatory framework evolves.

​

Fintech Disputes in Turkey

Disputes can arise even where the underlying fintech structure is carefully designed.

​

Common examples may include:

​

• unauthorized payment disputes;

• customer complaints;

• merchant disputes;

• payment failures;

• refunds;

• chargebacks;

• technology outages;

• software disputes;

• intellectual-property disputes;

• shareholder disputes;

• regulatory proceedings;

• data-protection disputes; and

• contractual disagreements.

 

The appropriate response depends on the facts, the contracts, the applicable regulatory framework and the evidence available.

 

Kurucuk & Associates can assist with fintech-related litigation and dispute resolution, including disputes involving commercial contracts, technology and regulated financial activities.

​

How a Fintech Lawyer Can Help in Turkey

Fintech legal advice is most useful when it is connected to the way the business actually works.

​

Kurucuk & Associates can assist with matters including:

​

• Turkish fintech regulatory analysis;

• payment-services regulation;

• electronic-money regulation;

• payment institution structures;

• regulatory-perimeter assessments;

• payment license applications;

• regulatory exemptions and exclusions;

• open-banking projects;

• account-information services;

• payment-initiation services;

• digital wallets;

• fintech and bank partnerships;

• technology contracts;

• outsourcing arrangements;

• data-protection compliance;

• international data transfers;

• cybersecurity contracts;

• consumer-facing terms;

• corporate structuring;

• venture capital;

• mergers and acquisitions;

• crypto-asset regulatory matters;

• intellectual property;

• competition-law issues;

• compliance programs;

• cross-border fintech projects; and

• fintech disputes.

 

The precise scope of legal work depends on the business model, the parties involved and the regulatory framework applicable to the project.

​

A Practical Legal Roadmap for Launching a Fintech Business in Turkey

Launching a fintech product does not have to begin with hundreds of pages of legal documents.

​

A sensible first review can be organized around a few practical questions.

​

Step 1: Explain the Product

Describe what the customer can actually do.

​

Avoid starting with legal terminology. Explain the product as a customer would experience it.

​

Step 2: Map the Money

Identify:

​

• where funds originate;

• who receives them;

• where they are held;

• who moves them;

• who settles them; and

• where they ultimately go.

​

Step 3: Map the Data

Identify:

​

• what information is collected;

• where it is processed;

• who receives it;

• which suppliers have access;

• how long it is retained; and

• whether it leaves Türkiye.

​

Step 4: Identify the Regulatory Perimeter

Determine whether the business involves:

​

• payment services;

• electronic money;

• banking;

• capital-markets activity;

• crypto assets; or

• another regulated financial service.

​

Step 5: Decide Which Entity Performs Each Function

The corporate structure should correspond with the operational and regulatory structure.

​

Step 6: Build the Contractual Framework

Prepare the contracts needed for:

​

• customers;

• merchants;

• banks;

• payment institutions;

• technology providers;

• suppliers;

• employees; and

• investors.

​

Step 7: Review Data Protection

Make sure the product's actual data processing is reflected in the privacy and compliance framework.

​

Step 8: Address Technology and Security

Clarify:

​

• ownership;

• licensing;

• cybersecurity;

• service levels;

• incident response;

• business continuity; and

• third-party risks.

​

Step 9: Establish Compliance

Create procedures that people can actually follow.

​

Compliance should fit the platform rather than exist separately from it.

​

Step 10: Keep the Structure Under Review

Fintech regulation changes.

​

The legal review should therefore continue after launch.

​

Why Istanbul Is Important for Fintech Businesses

Istanbul brings together technology businesses, financial institutions, investors, entrepreneurs and international companies.

​

For a fintech business establishing itself in Istanbul, legal work can extend well beyond payment regulation.

 

The project may also require advice on:

​

• company formation;

• commercial agreements;

• banking and finance;

• technology;

• intellectual property;

• data protection;

• employment;

• competition;

• investment;

• mergers and acquisitions;

• tax; and

• dispute resolution.

 

That broader perspective can be particularly useful when the fintech company is not operating in isolation but is part of a wider corporate or international group.

​

Keeping Up With Turkish Fintech Regulation

Fintech law is not static.

​

Businesses should monitor developments from the authorities that regulate or influence their activities.

 

Useful official sources include:

​

• Central Bank of the Republic of Türkiye — Payment Services

• TCMB — Payment Institutions

• TCMB — Electronic Money Institutions

• Official Gazette of the Republic of Türkiye

• Capital Markets Board of Türkiye — Crypto-Asset Service Providers

• Capital Markets Board — Crypto-Asset Regulations

• Personal Data Protection Authority

• KVKK — Personal Data Protection Law

• KVKK — International Data Transfers

• Turkish Competition Authority

• Ministry of Trade — E-Commerce Legislation

• Ministry of Trade — E-Commerce Regulations

 

These official sources are especially useful because fintech businesses should work from the legislation and regulator publications that apply at the relevant time, rather than relying solely on older summaries of Turkish fintech law.

​

Frequently Asked Questions About Fintech Law in Turkey

​

Does every fintech company need a license in Turkey?

No. There is no single license covering every fintech business. The answer depends on the actual service, transaction structure, role of the company and applicable regulatory framework.

​

What law regulates payment services in Turkey?

Payment services and electronic money are principally governed by Law No. 6493 and related secondary legislation. The TCMB currently regulates and supervises payment services, payment institutions and electronic-money institutions.

​

Who regulates payment institutions in Turkey?

The Central Bank of the Republic of Türkiye is the relevant regulator and supervisor for payment services, payment institutions and electronic-money institutions under the current framework.

​

What is the difference between a payment institution and an electronic-money institution?

They are distinct regulatory categories. Electronic-money institutions have authority to issue electronic money and may provide specified payment services within the scope of their operating licenses.

​

Can a technology company provide services to a bank without becoming a payment institution?

Potentially, yes, depending on the actual activity and structure. The fact that a company describes itself as a technology provider does not by itself determine the legal classification. The functions performed by each party should be analyzed.

​

Is open banking regulated in Turkey?

Yes. Payment initiation and account-information services fall within the Turkish payment-services framework, and the TCMB continues to develop the country's open-banking infrastructure.

​

Are digital wallets regulated?

The answer depends on what the wallet does. A wallet that merely stores payment information may raise different questions from a product that holds value, issues electronic money, initiates payments or provides other regulated services.

​

Are crypto-asset businesses regulated in Turkey?

Yes. Türkiye brought crypto-asset service providers within the capital-markets regulatory framework through Law No. 7518, followed by secondary regulations issued by the SPK in 2025.

​

Does appearing on the SPK crypto-asset list mean that a company is authorized?

Not necessarily. The SPK expressly states that inclusion on its temporary “Faaliyette Bulunanlar Listesi” does not mean that the listed entity has been authorised under the applicable legislation.

​

Does KVKK apply to fintech businesses?

Fintech businesses processing personal data can be subject to the KVKK. The obligations may include lawful processing, transparency, security, data-subject rights and rules governing international transfers.

​

Can a Turkish fintech transfer customer data abroad?

Potentially, but international transfers must be assessed under the applicable Article 9 framework and the relevant safeguards or other lawful mechanisms. The current rules should be reviewed before transferring data to foreign service providers.

​

Can a foreign fintech enter the Turkish market?

A foreign fintech may be able to establish or provide services in Türkiye, but the appropriate structure depends on its activities, regulatory status, customer model, corporate arrangements and cross-border operations.

​

Can a fintech business operate through a licensed partner?

It may be possible in some structures, but partnering with a licensed institution does not automatically eliminate regulatory considerations. The actual functions, contracts, funds flow and responsibilities of each party need to be examined.

​

What should a fintech startup do before launching in Turkey?

It should understand its product, map the movement of funds and data, identify potentially regulated activities, determine the appropriate entity and regulatory structure, prepare its contracts, address data protection and security, and establish an appropriate compliance framework.

​

Does fintech law only concern payment companies?

No. Fintech legal work can involve payment institutions, electronic-money institutions, banks, technology providers, digital wallets, open-banking businesses, crypto-asset businesses, financial infrastructure providers, online marketplaces and other companies whose technology interacts with financial services.

​

Fintech Lawyer in Istanbul, Turkey

A fintech business may begin with a simple idea: make payments easier, build a better wallet, connect customers with financial information, create a new financial platform or bring an existing financial service into a digital environment.

​

The legal structure behind that idea can be much more complicated.

The important thing is to understand that complexity early.

​

At Kurucuk & Associates, fintech legal work can be approached from the actual operation of the business: what the product does, who provides each service, how funds move, how data is processed, which regulatory rules apply and how the contractual structure supports the business.

​

This can include work concerning payment services, electronic money, payment institutions, digital wallets, open banking, crypto assets, financial technology agreements, data protection, technology, investment, competition, compliance and fintech disputes.

 

For businesses establishing, operating or expanding in Istanbul and elsewhere in Türkiye, a practical fintech legal strategy should be capable of supporting both the regulatory requirements and the commercial reality of the business.