Fintech, Payments
and Crypto Assets

Legal Design of the Fintech Business Model

The product’s target users, revenue model, flow of funds, data flow, technical architecture, contracting parties and outsourced services are examined together. Which activity the venture will carry out itself and which function it will run through a bank or licensed institution is put in writing. Separating, before development begins, the functions that require a permit from those that can be set up through a licensed business counterpart reduces the risk of later halting the product, redoing the integration or encountering legal uncertainty in the investment process.

Regulatory Environment and Map of Competent Authorities

The activity is classified with respect to the TCMB, SPK, BDDK, MASAK, KVKK, the Ministry of Trade, the Competition Authority and, where applicable, foreign regulators. For each authority, the permit, notification, reporting, review and sanction headings are shown in a separate table. Because a permit or registration obtained from one authority does not automatically remove obligations arising under other legislation, the multi-layered map of authority is turned into a decision document that the board of directors can understand.

Review of the Need for a Permit and the Activity Boundary

Whether functions such as operating a payment account, money transfer, payment order initiation, providing account information, issuing or accepting a payment instrument, intermediating bill payments, mobile payment, issuing electronic money, operating a crypto platform or custody require a permit is determined. The conditions of the technical service exception, commercial agent, limited network or other out-of-scope structures are examined against the specific flow; an exception is not assumed on the basis of the product name.

Registration Stage for Payment and Electronic Money Institutions

The company type, articles of association, shareholding, qualified shares, financial strength, management structure and the current forms to be submitted before registration are prepared as a whole. The documents that must be submitted to the TCMB before registration of a trade name bearing the phrase payment institution or electronic money institution, the application fee and the preliminary review arrangement are managed. Conditions concerning shareholders and managers and statements on the source of funds are checked; inconsistencies between the official form and in-house documents are resolved.

TCMB Background Check, Final Approval and Scope of Services

In the background check and final approval applications following the registration stage, the current time periods and the information and documents in the annexes of the Regulation are taken as the basis. It is shown that the organization, personnel, systems, processes, contracts, security controls and business continuity are ready for operation. For each payment service requested, the product flow and technical function are explained separately. After the activity permit, it is ensured that only the permitted services are offered and that the need to extend the scope for a new product is examined in advance.

Classification of Payment Services under Law No. 6493

Deposits to and withdrawals from a payment account, fund transfer, issuance or acceptance of a payment instrument, money transfer, mobile payment, payment order initiation and account information services are classified transaction by transaction. A product may include more than one payment service at the same time. By examining the user screen, the background bank connection and the transfer of funds to the final recipient together, the conformity between the license scope and the actual activity is reported.

Electronic Money Issuance, Balance and Repayment Structure

Whether the monetary value that is stored electronically upon receipt of funds and is also accepted by persons other than the issuer qualifies as electronic money is assessed. The matching of the issued value with the funds received, the usage network, the safeguarding account, repayment, unused balance, fees, statute-of-limitations claims and customer information are arranged. For models such as loyalty points, closed-loop value or in-game units, the economic function and acceptance environment, rather than the name, are decisive.

Digital Wallet and Stored Payment Instrument Models

The functions of the digital wallet within the scope of Article 4/A of the Regulation, issuance of a payment instrument and, where necessary, other payment service or electronic money authorities are examined together. The technical-storage-only exception is assessed with all its conditions, including a direct relationship with the customer and being the visible face of the service. The processes of loading money into the wallet, device change, authentication, transaction limit, lost device, unauthorized use, balance refund and account closure are matched to the legal text and the user interface.

Protection of Customer Funds and Account Segregation

The separation of payment funds and funds collected against electronic money issuance from the company’s assets, safeguarding accounts, end-of-day reconciliation, access authority, attachment/bankruptcy risk and refund processes are examined. It is ensured that the bank account name, accounting entry and operational flow show the same legal purpose. The escalation and management notification to be applied in the event of a delay of funds at a third party or incomplete reconciliation are put in writing.

Minimum Own Funds, Capital Adequacy and Professional Liability

The minimum own funds depending on the institution’s permit type and transaction volume, calculation, reporting and, where applicable, the obligation to carry professional liability insurance are monitored. Amounts that may be updated each year are not placed as exact figures in the permanent text on a web page; they are kept in a dated management compliance schedule. The effect on own funds of profit distribution, capital reduction, loss, related-party transactions or rapid growth is examined before a decision.

Open Banking, Account Information and Payment Order Initiation

In account information and payment order initiation services, the roles of the parties, the user’s request and transaction approval, strong authentication, access scope, withdrawal of approval, API security and record responsibility are determined. The Payment Services Data Sharing Services (ÖHVPS) standards are examined together with the contract and privacy texts. Adding to the product the card information and the future-dated and recurring payment orders introduced with ÖHVPS 2.0.0 is assessed separately in terms of permit scope and version change.

API, Data Sharing and Fintech Integration Agreements

In API agreements among banks, payment institutions, electronic money institutions, technology companies and corporate customers, service level, access authority, data fields, authentication, change notification, outage, error, records, audit, subcontractor, intellectual property rights, liability and exit plan are regulated. The version with which the technical documentation is bound to the contract and the effect of an API change on customer transactions are clearly determined.

FAST, TR Karekod and Instant Payment Models

In products linked to FAST, easy address (kolay adres), TR Karekod and card payment infrastructure, participant status, message flow, payment order, recipient verification, transaction limit, refund, reconciliation and operational responsibility are examined. Whether the QR code is static or dynamic, the merchant or person-to-person payment scenario and the risk of a fake QR code are added to the process design. BKM and TCMB technical principle versions are managed through contract annexes and the change calendar.

Merchant Acquiring, POS and Payment Acceptance

In physical or virtual POS, payment gateway, sub-merchant, marketplace payment and payment facilitation models, provisions on acceptance of the payment instrument, merchant onboarding, commission, hold, reserve, reconciliation, chargeback, refund and termination are prepared. Who allocates the terminal and who actually uses it is monitored. Controls on merchant identification, prohibited activity, transaction monitoring and not allowing a third party to use the terminal are built into both the contract and operations.

Cards, Prepaid Instruments and Issuance of Payment Instruments

In physical or virtual card, prepaid instrument, corporate expense card and single-use payment instrument models, provisions on issuer status, brand program, user authority, limit, fees, loading, lost/stolen, objection and closure are regulated. The division of roles among card scheme rules, Law No. 6493, the legislation on bank cards and credit cards, and consumer provisions is determined according to the specific model.

Mobile Payment and Intermediation in Bill Payment

In mobile payment approved through an electronic communication device and in models for intermediating bill payments, the type of service, user approval, limit, collection, cancellation, refund and the responsibilities of the parties are determined. The relationship among the telecom operator, payment institution, service provider and user is regulated in separate contractual layers. Current transaction limits and permit scope are managed from a dated compliance schedule rather than being embedded in fixed text.

Money Transfer, Domestic and Cross-Border Fund Transfers

The roles of the sender, recipient, intermediary institution, correspondent, foreign business counterpart and other parties in the payment chain are determined. Exchange rate, fee, deduction, processing time, missing information, wrong recipient, rejection of the transaction, recall, sanctions screening and error liability are set out in the contract. In models where the service must be provided together with a legal entity resident abroad, the TCMB permit, local regulation, data transfer and correspondent agreement are examined together.

Law of Payment and Securities Settlement Systems

For operators of payment systems or securities settlement systems, the establishment, activity, system rules, participant admission, collateral, settlement finality, business continuity, operational risk and oversight obligations are assessed. The consistency of participant agreements with the system rulebook is audited. In a critical change, a new type of participant or the use of outsourcing, the need for TCMB notification and permit is determined separately.

Digital Banking, Service Model Banking and Embedded Finance

The structure among a digital bank, service bank, interface provider, fintech company and end user is examined within the framework of BDDK regulations. Which legal entity provides the banking service, whether the customer clearly understands this, and the data accessed and the function undertaken by the interface provider are determined. In an embedded payment, account, credit or card product, it is ensured that brand appearance is not confused with the status of the legal service provider.

Outsourcing, Cloud, Software and Technology Procurement

In cloud, core payment infrastructure, authentication, fraud monitoring, call center, data center, software development and support services, whether outsourcing is permitted and which conditions apply is examined. Data location, access, sub-service provider, audit right, incident notification, continuity, source code, exit support and return of data are regulated. Transferring a critical function does not remove the institution’s regulatory responsibility.

Information Systems, Cybersecurity and Incident Management

Information asset inventory, access management, privileged accounts, logging, encryption, network security, secure software development, penetration testing, vulnerability management, backup, disaster recovery and incident response are matched to legal obligations. Whether a cyber incident requires notification to the TCMB, SPK, KVKK, MASAK, customers or other stakeholders is determined according to the type of incident. The technical review is carried out together with professional secrecy, data security, preservation of records and notification obligations. Technical testing and response are the responsibility of the relevant expert team.

Strong Authentication, Remote Customer Onboarding and E-Contracts

Remote identification, video call or suitable electronic methods, device binding, multi-factor authentication, additional control for risky transactions, electronic signature and durable medium processes are examined. It is explained that authentication and MASAK customer identification are not the same concept. Failed attempts, account takeover, SIM swap, device change and accessibility requirements are turned into a secure flow without unnecessarily restricting user rights.

KVKK, Financial Data and Transfer Abroad

A data processing inventory is prepared for customer onboarding, transaction monitoring, risk scoring, fraud prevention, call center, cookie, device fingerprint, biometrics and marketing processes. The roles of data controller and data processor, retention periods, data subject requests, breach management and the mechanism for transfer abroad are determined. A mandatory regulatory record and product analytics or marketing data are not combined under the same purpose.

Corporate Governance, Internal Control, Risk and Internal Audit

The responsibility of the board of directors, segregation of duties, internal control, risk management, internal audit, compliance, information security and business continuity functions are arranged appropriately for the scale of the institution. It is not considered sufficient for policy texts merely to exist in the file; the control owner, frequency, sampling, finding class, remediation period and management reporting are determined. Conflicts of interest and the risks of concentrating critical authority in one person are eliminated in the organization chart.

MASAK Compliance Program, Know-Your-Customer and Suspicious Transaction Reporting

Risk management, monitoring and control, compliance officer, training, internal audit, customer acceptance, beneficial owner, politically exposed person, high-risk country, sanctions list and suspicious transaction reporting processes are established according to the type of institution. Confidentiality of reporting is protected; communication with the customer is managed in a way that does not reveal the review. Risk indicators specific to payment, electronic money and crypto transactions are tied to scenario and case management records.

Economic Sanctions and Freezing of Assets

United Nations decisions, the asset freezing regime applied in Türkiye, country and product restrictions, and contractual foreign sanctions provisions are distinguished from one another. The scope of screening of customer, beneficial owner, recipient, sender, wallet and transactions is determined. Match, false match, holding the transaction, rejection, notification and recording steps are put in writing; the applicability of foreign sanctions clauses under Turkish law is examined separately. For listing decisions within the scope of MASAK General Communiqué Serial No. 34, the steps of announcement, match, urgent notification and postponement of the transaction are assessed separately.

TCMB Oversight, Reporting and Administrative Processes

Periodic reporting, independent audit, information requests, on-site inspection, response to findings, corrective action and board follow-up are carried out. A legal, finance and technology approval arrangement is established so that requested data is not sent to the authority without verifying its source and calculation method. For findings that give rise to the risk of an administrative fine, restriction of activity, temporary suspension or permit revocation, the time limit, authority, proportionality and judicial route are examined.

Framework Agreement, Pre-Contractual Information and Fee Transparency

The payment services framework agreement, one-off payment information, electronic money agreement, crypto asset customer agreement and corporate customer texts are prepared according to the relevant product. Fees, exchange rate, processing time, unique identifier, withdrawal of approval, communication, objection, termination and change notification are clearly regulated. Consistency is established among the information displayed in the user interface, the signed version and operational practice.

Unauthorized or Erroneous Payment Transactions and Refund Processes

Whether the customer authorized the transaction, the timing of notification, strong authentication, the gross negligence allegation, unique identifier, liability among service providers and refund timing are examined. Instead of automatic rejection, a review and reasoned response flow is established according to the type of transaction. The integrity of call records, device records, verification step, session, payment message and notification records is preserved.

Payment Fraud, Chargebacks and Merchant Disputes

Card-not-present transactions, account takeover, social engineering, fake merchant, friendly fraud allegation, delivery dispute and chargeback processes are managed. The card scheme time limit and the statutory time limit for applications are distinguished from each other. By examining the merchant agreement, order/delivery record, authentication, objection code, reserve and hold transactions, the allocation of responsibility among the payment institution, merchant and user is determined.

Administrative, Commercial, Consumer and Criminal Disputes

Administrative applications and annulment actions concerning TCMB or SPK actions; contract disputes among licensed institutions; and disputes concerning customer funds, unauthorized payments, chargebacks, crypto transfers, account restrictions, listing or custody are handled. In allegations of forgery, cybercrime, breach of trust, market-distorting transactions or activity without a permit, legal and technical records are examined together. Mediation, arbitration, litigation and, where the conditions exist, interim legal protection routes are selected according to the nature of the file.

Share Transfers, Mergers, Management Changes and Corporate Transactions

In licensed payment and electronic money institutions and crypto asset service providers, direct or indirect share transfers, change of control, mergers, demergers, amendments to the articles of association and appointments of critical managers are examined with respect to regulatory permit and notification. The closing conditions in the investment agreement are structured so as not to create an actual transfer of control without regulatory approval. During the review, the data room, shareholder suitability and source-of-funds documents are managed in stages.

Legal Classification of Crypto Assets and Tokens

The token’s economic right, manner of issuance, transferability, purpose of use, governance right, link to income or assets, buy-back promise and technical infrastructure are examined. Whether the product has the nature of a crypto asset, capital market instrument, electronic money, payment instrument, digital right or another contractual right is determined. The actual right offered to the investor and the economic structure, rather than the naming in the technical document, are taken as the basis.

Stable-Value Tokens, Asset Tokenization and NFT Models

In tokens linked to fiat currency, commodities, securities, real estate or other assets, the issuer, reserve, buy-back, ownership, custody and secondary transaction structure are examined. Calling a product a “unique digital asset” or an “NFT” does not by itself take the product outside regulation; serial production, divisibility, investment purpose and economic rights are assessed. The regulation of Türkiye and of the target country and the scope of MiCA are addressed in separate legal notes.

Crypto Platform Establishment and Activity Permit before the SPK

The joint-stock company structure, shareholders, capital, management, organization, internal systems, information systems, customer acceptance, and order and transaction infrastructure of the new platform are assessed. Applications for the establishment and activity permits are prepared separately according to the current form and annexes of each stage; it is not assumed that all preparations for activity are completed only at the establishment permit stage. The provisional list entry, establishment permit and activity permit are shown with the correct designations in investor, business counterpart and promotional texts.

Crypto Customer Agreements, Risk Disclosure and Promotion

In the platform or custody agreement, the service scope, order method, fees, custody, transfer, fork, airdrop, network update, error, access outage, account restriction, termination and dispute route are explained. It is ensured that the fact that crypto assets are not subject to investor compensation provisions and the risks specific to the asset are stated visibly. Promotional language, customer experience and referral campaigns that create an impression of returns or value appreciation are placed under legal review.

Crypto Asset Custody and Key Management

The hot, cold and multi-signature wallet structure and the processes of generating, storing, backing up, accessing, destroying and recovering private keys are examined. The separation of customer assets from the institution’s assets, on-chain and internal record reconciliation, transfer approval, personnel authority, third-party custody and incident response are regulated at the level of contracts and policies. Which institution actually provides the custody service is clearly communicated to the customer.

Customer Crypto Assets, Records, Reconciliation and Proof of Reserves

The separation of customer cash and crypto assets from the institution’s assets, ownership records, daily reconciliation, on-chain wallets, debt records and access authorities are examined. In independent audit and proof-of-reserves processes, the scope, data source, sampling, wallet verification, completeness of liabilities and limit on the use of the report are determined. Proof of reserves is not presented as a general statement of confidence replacing a financial statement audit or a solvency assessment.

Crypto Asset Transfers, the Travel Rule and Transfer Measures

The inclusion of sender and recipient information in the transfer message, missing information, transfers to another service provider, unhosted wallets, risky addresses, transfer waiting periods and limits are applied according to current SPK and MASAK regulations. A chain analysis result alone is not considered a definitive legal characterization; the risk indicator is assessed together with other customer and transaction data. The processes of rejecting, suspending, requesting additional information on a transaction and suspicious transaction reporting are kept distinct from one another.

Crypto Asset Listing and Delisting

The listing committee, technical and legal review, conflict of interest, link with the issuer/project team, distribution, liquidity, cyber risk, smart contract, market-distorting transactions and continuous monitoring criteria are prepared. A listing fee or commercial relationship should not overshadow the decision process. In the event of delisting, a proportionate transition plan is established for announcement, closing of orders, transfer, custody and return of customer assets.

Orders, Transactions, Price Formation and Market Integrity

Rules on order acceptance, priority, matching, cancellation, extraordinary price movement, market making, proprietary trading, employee trading and conflicts of interest are regulated. Monitoring scenarios are prepared for wash trading, fake orders, misleading appearance, account linkage and insider information risk. The authority, justification, notification to the customer and recording of a decision to halt or restrict trading are determined.

Cross-Border Fintech, MiCA, DORA and Foreign License Coordination

Where services are provided from Türkiye abroad or directed from abroad at users resident in Türkiye, the target country permit, local representation, consumer, payment, crypto, data, cyber resilience and sanctions rules are examined. For the EU, MiCA authorization, the consequences of the transition regime that ended on July 1, 2026, the travel rule and the scope of DORA are assessed activity by activity. Just as a foreign permit does not automatically confer a right to operate in Türkiye, a permit in Türkiye does not automatically create authority in another country.

Establishing a company as a “fintech” is not by itself subject to a special permit; however, if the function offered is in the nature of a payment service, electronic money issuance, banking service, crypto platform or custody activity, the relevant authority’s permit is required. The activity boundary should be examined before the product is developed.

A payment institution provides only the payment services it is permitted to provide. An electronic money institution may issue electronic money and may also provide payment services within its permit. The specific authority is understood not from the institution’s name but from the scope of the current activity permit published by the TCMB.

Some structures providing only technical services may fall outside the scope; however, not holding funds is not sufficient on its own. In particular, payment order initiation, account information and digital wallet functions are regulated separately. The relationship with the customer, being the visible face of the service, the contract and the actual function are examined together.

A digital wallet within the definition in Article 4/A of the Regulation requires the relevant payment service authorities. The technical-data-storage-only exception is assessed with all its conditions. Not holding a balance or storing card information does not by itself give a definitive answer; the flow of funds and transactions and the customer relationship should be viewed together.

The core services are providing account information and initiating payment orders. With ÖHVPS 2.0.0, card details and transactions and future-dated and recurring payment order features have also been made available. Not every API service is automatically open banking; the function and permit scope are assessed separately.

For payment and electronic money institutions, the registration preparation, background check and final approval stages are followed. The current conditions and annexes of Article 11 of the Regulation apply. Making an application or registration does not by itself confer authority to begin operations; the permit scope and the published decision are checked together.

The new product should be consistent with the services in the existing activity permit, the institution’s articles of association, information systems and business plan. If a new payment service, a digital wallet function or a significant outsourcing is involved, the need for a permit, scope extension or notification is examined in advance.

Payment funds and funds received for issuing electronic money are not company resources that the institution may use freely. The safeguarding, segregation and refund rules in the relevant legislation apply. The accounting and bank account structure should show this distinction.

No. The capital required for establishment and activity and the continuing own funds obligation may not be the same concept; the amounts may be updated periodically. The regulation in force of the TCMB or SPK on the date of the transaction and the calculation method should be verified.

A foreign license does not by itself confer authority to operate in Türkiye. Targeting of users resident in Türkiye, flow of funds, local business counterpart, data, promotion and contract structure are examined. Some models in which services are provided jointly may also be subject to a TCMB permit.

No. The TCMB Regulation prohibits using crypto assets in payments, directly or indirectly, and offering services for that purpose. There is also a separate prohibition on payment/e-money institutions intermediating fund transfers to and from crypto platforms. Buying and selling crypto and paying for goods or services in crypto are not the same transaction.

No. The SPK expressly states that the provisional list does not mean authorization. The establishment permit, the activity permit and the list status during the transition period should be checked separately.

A structure that complies with the establishment and activity conditions in Communiqués III-35/B.1 and III-35/B.2 is built, and an application is filed with the SPK using the current form and annexes. The company, shareholding, capital, management, internal system, technology, custody, contract and operations files are prepared together.

The custody arrangement is determined according to the service offered, the permit obtained, SPK provisions and the structure of the relevant custody institution. It should be clear who holds the private key and the power of disposal; customer assets should be separated from the institution’s assets and regular reconciliation should be performed.

Cash and crypto assets belonging to the customer are separate from the institution’s assets; there is statutory protection against their attachment, pledge or inclusion in the bankruptcy estate for the institution’s debts. This does not mean immunity in every case with respect to the customer’s own debt or specific judicial/administrative measures. The account, ownership and custody record are examined separately.

A listing decision should be based on written criteria, technical and legal review, a conflict-of-interest check and continuous monitoring. Listing should not be done solely on commercial demand without evaluating the token’s nature, project team, distribution, liquidity, smart contract and market risk.

It refers to transmitting certain sender and recipient information securely with the transfer and applying controls to transactions with missing information. In Türkiye, SPK and MASAK regulations apply together according to transaction type, limit, time and counterparty service provider.

Not every personal wallet transfer is absolutely prohibited. Identity, address ownership, risk, amount, waiting period and additional measures are assessed according to the current regulation. The institution should have a written risk policy and record arrangements.

No. Know-your-customer, beneficial owner, risk rating, enhanced measures, monitoring, compliance program, training, internal audit, providing information and documents, retention and submission, and reporting confidentiality are also parts of the compliance system.

No. Verification of the identity document and the person, liveness, communication, risk controls, records, verification from an official data source and the conclusion of the contract are addressed together. Both the sector legislation and MASAK provisions should be examined.

A name such as “stable token” does not confer a definitive legal nature. Pegging to fiat currency, funds against issuance, right of repayment, acceptance environment, transfer and purpose of use are examined. The law of Türkiye and the regulation of the target country require separate assessment.

No. EU authorization does not by itself confer the right to operate in Türkiye. The rules on targeting and permits in Türkiye apply separately. In the EU, because the MiCA transition period ended on July 1, 2026, the current authority of the legal entity providing the service should be checked.

A brief description of the product, target users, a diagram of the flow of funds or crypto, the existing permit/business counterpart, target countries and a summary of the matter to be reviewed are sufficient. Detailed company and system records are obtained in stages after engagement and once the secure sharing method has been determined.

Time limits are determined immediately; the relevant product and transaction version are preserved; the official letter, contract, customer notification, payment or crypto record and internal decisions are brought together. Before any statement is made, the meaning of the records is verified jointly by the legal, compliance and technical teams.