Turkey regulates fintech through four main authorities working under a shared legal framework: the Banking Regulation and Supervision Agency (BDDK/BRSA) for banks and digital banking, the Capital Markets Board (SPK/CMB) for capital markets and crypto assets, the Financial Crimes Investigation Board (MASAK) for anti-money-laundering compliance, and the Central Bank of the Republic of Turkey (TCMB) for payment systems and monetary policy. No single “Turkish PSD2” or unified fintech law exists — instead, several distinct laws layer together, each administered by the regulator with jurisdiction over that activity. For foreign investors and fintech founders evaluating Turkey, understanding how these pieces fit together is the essential first step.
The Four Regulators and What Each One Controls
| Regulator | Full name | Core jurisdiction |
|---|---|---|
| BDDK (BRSA) | Banking Regulation and Supervision Agency | Banks, digital-only banking licenses, credit institutions |
| SPK (CMB) | Capital Markets Board | Capital markets, crypto asset service providers, investment firms |
| MASAK | Financial Crimes Investigation Board | AML/KYC compliance, suspicious transaction reporting, sanctions screening |
| TCMB | Central Bank of the Republic of Turkey | Payment systems (FAST), open banking infrastructure, monetary policy, digital Turkish Lira |
These four bodies don’t operate in isolation — a single fintech product often falls under more than one regulator simultaneously. A crypto exchange, for example, needs an SPK license to operate, but is also treated as an obligated party under MASAK’s AML framework, and if it offers payment features, TCMB regulations on crypto payments apply as well.
The Core Legal Framework
Turkey’s fintech regulation rests on several distinct laws rather than one comprehensive statute:
- Banking Law No. 5411: The foundational law governing banks and BDDK’s supervisory authority, including the licensing framework digital-only banks operate under.
- Law No. 6493 (Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions Law): The primary law for payment institutions and e-money institutions, with TCMB and BDDK issuing secondary regulations under its authority — this is the legal basis for open banking and payment licensing.
- Capital Markets Law No. 6362, as amended by Law No. 7518 (2024): Gives crypto assets formal legal recognition and creates the Crypto Asset Service Provider (KVHS) license category under SPK.
- Law No. 5549: The foundational AML law that gives MASAK its authority over obligated financial institutions, including banks, payment institutions, and crypto platforms.
- Law No. 6698 (KVKK): Turkey’s data protection law, closely modeled on the EU’s GDPR, which applies to any fintech handling personal financial data.
Licensing Pathways for Fintech Companies
The license a fintech company needs in Turkey depends entirely on what it does:
- Digital banking: Requires a full banking license from BDDK, with capital and governance requirements broadly aligned with those for traditional banks, though BDDK has issued specific provisions addressing branch-free digital banks.
- Payments and e-money: Requires a Payment Institution or Electronic Money Institution license under Law No. 6493, issued by BDDK, with technical infrastructure requirements and TCMB oversight for participation in national payment rails like FAST.
- Crypto asset services: Requires a Crypto Asset Service Provider (KVHS) license from SPK under Law No. 7518, plus mandatory integration with MKK’s KVMKS central registry system and MASAK AML compliance.
- Investment and wealthtech: Falls under SPK’s broader capital markets licensing regime, with specific requirements depending on whether the company provides investment advice, portfolio management, or brokerage-adjacent services.
Recent Developments Shaping the Regulatory Environment
Turkey’s fintech regulatory environment has moved into a more structured, supervision-heavy phase heading into 2026, which foreign investors should read as a market maturity signal rather than a warning sign:
- SPK established a dedicated Financial Technologies Department (Finansal Teknolojiler Dairesi), reflecting growing institutional focus on fintech and crypto within the capital markets regulator, rather than treating these as a peripheral concern.
- TCMB temporarily suspended the operating licenses of several payment and e-money institutions in October 2025, and license revocations affecting some providers followed — part of a broader tightening of governance, internal control, and compliance expectations across the sector. Industry commentary heading into 2026 frames this shift as fintechs needing to move from “we built the product” to “we built the institution,” with regulatory compliance treated as core institutional design rather than an afterthought.
- A coordinated multi-agency supervision framework was introduced under Presidential Circular No. 2025/18, bringing MASAK, TCMB, BDDK, the telecommunications regulator (BTK), and security units together under a shared action plan targeting illegal betting and gambling — with POS infrastructure, agent networks, and digital wallets brought under closer joint scrutiny for transparency and public safety purposes.
- TCMB’s Digital Turkish Lira project continued advancing through its second phase, with reported progress on programmable payments, offline transaction capability, and interoperability testing with other countries’ digital currency systems.
What This Means for Foreign Investors
Two takeaways matter most for anyone assessing Turkey from outside the country:
First, the licensing bar is real but navigable. Turkey does not offer a lightweight registration regime for fintechs the way some jurisdictions do — banking, payment, and crypto licenses all involve capital adequacy requirements, governance standards, and technical infrastructure review (in the case of crypto platforms, by TÜBİTAK). This makes market entry slower than in more permissive regimes, but it also means licensed competitors face the same bar, and consumer and institutional trust in licensed providers tends to be correspondingly higher.
Second, supervision is intensifying, which changes what “compliant” means in practice. The wave of license suspensions and revocations in late 2025, combined with SPK’s new dedicated fintech department, signals that Turkish regulators are moving from initial licensing toward active, ongoing supervision. A foreign fintech entering Turkey today should plan for compliance and governance infrastructure as a core product requirement from day one — not something to build only once regulators ask questions.
Frequently Asked Questions
Is there a single fintech law in Turkey, like the EU’s PSD2? No. Turkey regulates fintech through several distinct laws — the Banking Law, Law No. 6493 for payments, Capital Markets Law as amended by Law No. 7518 for crypto, and Law No. 5549 for AML — each administered by the relevant regulator, rather than one unified fintech statute.
Which regulator do I need to talk to first as a foreign fintech founder? It depends on your product. Digital banking and payment institutions fall primarily under BDDK; crypto and investment products fall under SPK; and any product handling customer funds will also need to address MASAK’s AML requirements regardless of which primary regulator applies.
Has Turkey’s fintech regulation gotten stricter recently? Yes. Late 2025 saw temporary license suspensions and revocations for some payment and e-money institutions, alongside SPK’s creation of a dedicated Financial Technologies Department — both signals of a shift toward more active ongoing supervision rather than one-time licensing checks.
Does Turkey have an open banking framework? Yes, built primarily on Law No. 6493, with TCMB leading API standardization following the transfer of relevant authority from BDDK, enabling licensed third parties to access account data and initiate payments with customer consent.
Is Turkey’s regulatory environment fintech-friendly for foreign investors? Turkey combines a genuine, testable licensing pathway with increasingly active supervision — a market structure that rewards companies that treat compliance as core infrastructure rather than an afterthought, and that has continued attracting record early-stage investment (a reported $220 million across 42 rounds in 2025) despite the more demanding regulatory bar.
This article is provided for informational purposes and does not constitute legal advice; foreign investors should consult qualified Turkish legal counsel before entering the market. For more on Turkey’s fintech regulatory landscape, explore our Regtech & Compliance section.
