Can Foreigners Establish a Payment Institution or E-Money Institution in Turkey? 2026 — Law No. 6493 and CBRT Permission: Capital and Minimum Own Funds, Founder Requirements, 10-20-33-50% Share Permission, Cross-Border Fintech Cooperation, Safeguarding and the Penalty for Unlicensed Activity

Turkish version (Türkçe sürüm): Yabancılar Türkiye’de Ödeme Kuruluşu veya Elektronik Para Kuruluşu Kurabilir mi?

A foreign investor or a fintech company abroad may establish a payment institution or an electronic money (e-money) institution in Turkey, or buy shares in an existing one. Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions places no limit on foreign ownership; however, every activity in this field requires the permission of the Central Bank of the Republic of Turkey (CBRT), which has been the licensing and supervisory authority since 1 January 2020. The institution is incorporated as a joint stock company, its shares are registered and issued against cash, and persons holding 10% or more of the capital and those holding control must meet the qualifications required of bank founders. The statutory minimum paid-in capital is TRY 1 million or 2 million for payment institutions and TRY 5 million for e-money institutions; however, since 30 June 2026 the minimum own funds that must be maintained at all times have been raised to TRY 20 million, 40 million and 105 million. In an existing institution, share acquisitions at the 10%, 20%, 33% and 50% thresholds require CBRT permission, and unauthorised transfers cannot be entered in the share ledger. A foreign company without a Turkish licence may not provide payment services to users in Turkey; unlicensed activity is an offence punishable by one to three years’ imprisonment. This guide explains, with reference to the legislation, who may provide payment services, the foreign investor’s establishment and share acquisition processes, capital and own funds requirements, the CBRT application, cooperation with fintech companies abroad, safeguarding of customer funds, information systems, ongoing obligations and sanctions.

Who may provide payment services in Turkey?

Payment services and e-money form a closed field governed by Law No. 6493. Under the Law, banks within the scope of Law No. 5411, e-money institutions, payment institutions and Posta ve Telgraf Teşkilatı Anonim Şirketi (PTT) are payment service providers, and persons other than banks and payment service providers may not provide payment services (Law No. 6493, Art. 13(1)-(2)). E-money issuance is narrower still: persons other than banks, PTT and e-money institutions granted permission to issue e-money under the Law are prohibited from issuing e-money (Art. 18(1)). The ways for a foreign fintech company to operate in this field in Turkey are therefore to establish a licensed institution in Turkey, to acquire shares in a licensed institution, or to use the limited cooperation model described below.

The Law defines a payment institution as a legal entity authorised under the Law to provide and carry out payment services, and an e-money institution as a legal entity authorised under the Law to issue e-money (Art. 3). E-money is monetary value issued against funds accepted by the issuer, stored electronically, used to carry out payment transactions and also accepted as a means of payment by persons other than the issuer. A payment institution may not issue e-money; an e-money institution, being one of the payment service providers, may provide payment services in addition to issuing e-money (Law No. 6493, Arts. 13(1)(b) and 18(1)).

The main framework for this field is the Law and the CBRT’s Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (Official Gazette of 1 December 2021, No. 31676; the “Regulation”). The Regulation has been amended many times since 2023, most recently on 4 September 2026. A summary of the licensing process and general obligations of payment and e-money institutions is on our page Ödeme ve Elektronik Para Kuruluşları: TCMB Faaliyet İzni (in Turkish); this guide covers the subject in detail from the foreign investor’s perspective.

Is there a limit on foreign ownership?

No. Neither Articles 14 and 18 of Law No. 6493, which set out the establishment requirements, nor the Regulation impose any requirement as to the nationality or place of residence of founders or shareholders, a foreign-capital ratio or reciprocity. On the contrary, the Regulation expressly provides for foreign shareholders: notarised copies of the identity documents or passports of foreign natural persons are required (Regulation, Art. 11(4)(o)); additional documents are required where shareholders are banks or financial institutions established abroad (Art. 11(14)); and similar additional documents are required where the acquirer of shares is a bank or financial institution established abroad (Art. 12(3)). This framework is also consistent with the general rule that, unless otherwise provided by international agreements and special laws, foreign investors are subject to equal treatment with domestic investors (Foreign Direct Investment Law No. 4875, Art. 3(a)).

The absence of a nationality limit does not mean the requirements are light. Persons holding 10% or more of the capital and those holding control must meet the qualifications required of bank founders under Banking Law No. 5411 (Law No. 6493, Art. 14(2)(b)); these include financial strength, reputation, integrity, the absence of convictions for certain offences and a transparent shareholding structure. The company must also have a transparent and clear shareholding structure and organisation chart that will not prevent CBRT supervision (Art. 14(2)(f)). For a foreign investor, this means documenting the ownership chain abroad up to the ultimate natural persons; the Regulation provides that indirect shareholding is traced until natural persons are reached (Art. 13). The requirements for bank founders are explained in our guide Can Foreigners Establish a Bank or Buy Into a Bank in Turkey?

Establishment requirements: joint stock company, capital and trade name

A payment institution may operate only with CBRT permission (Law No. 6493, Art. 14(1)). The main requirements listed in the Law are: incorporation as a joint stock company; persons holding 10% or more of the capital and those holding control meeting the qualifications required of bank founders; shares issued against cash and all registered; paid-in capital, in cash and free of any sham, of at least one million Turkish lira for payment institutions acting as intermediaries for bill payments and at least two million Turkish lira for other payment institutions; adequate management, staff, technical equipment and complaint units; measures for the security and confidentiality of funds and information; and a transparent shareholding structure (Art. 14(2)). An e-money institution may likewise operate only with CBRT permission and must have paid-in capital of at least five million Turkish lira (Arts. 18(2) and 18(3)(ç)).

The Regulation repeats these amounts and adds further requirements. The company’s trade name must include terms showing that it is a payment institution or an e-money institution (Regulation, Art. 11(1)). For institutions providing only the service of presenting consolidated information on payment accounts online, the requirements that shares be issued against cash and all be registered, and the minimum capital requirement, do not apply (Law No. 6493, Art. 14/A). Funds received by payment and e-money institutions in connection with payment services are not treated as deposits, participation funds or e-money (Art. 14(3)); collecting deposits and participation funds is an activity reserved to banks.

Minimum own funds: TRY 20, 40 and 105 million

The capital amounts in the Law are only the floor at the time of establishment. In practice, what matters is the minimum own funds that institutions must maintain at all times throughout their operations. These amounts are set by the CBRT by communiqué on the basis of the Regulation’s provision on the minimum own funds obligation. Under the Communiqué on Redetermining the Minimum Own Funds Amounts of Payment and Electronic Money Institutions (Official Gazette of 31 January 2026, No. 33154), the amounts were set at TRY 20 million for payment institutions acting as intermediaries for bill payments, TRY 40 million for other payment institutions and TRY 105 million for e-money institutions; the Communiqué entered into force on 30 June 2026. The previous amounts were TRY 15 million, 30 million and 80 million respectively.

In preparing the business plan, a foreign investor should work from this own funds level that must be maintained throughout the activity, not from the capital paid in on establishment. As the own funds amounts are increased over time, the agreement between shareholders should also regulate who will take part in future capital increases and in what proportion. Capital commitments and deadlock rules between shareholders are explained in our guide Shareholders’ Agreements in Turkey.

The CBRT application: a two-stage process

The operating permission application is handled under Article 11 of the Regulation. The process consists of two steps, a background review stage and a final approval stage, and applications are delivered by hand to the CBRT head office (Regulation, Art. 11(3)). An application fee of five hundred thousand Turkish lira is paid on application; the licence fee of one million Turkish lira is paid within ten days of starting operations (Arts. 11(1) and 11(16)). If deficiencies at the notification stage are not remedied within three months, the application is deemed not to have been made; the background review application must be filed within six months of service of the CBRT’s acknowledgement of receipt (Art. 11(1)). If the background review is positive, an application for the final approval stage is made to the CBRT within one hundred and twenty days, and the CBRT may extend this period by up to sixty days (Art. 11(8)). If deficiencies in the application are not remedied within six months of notification, the operating permission application becomes invalid (Art. 11(15)). The Regulation sets no deadline for the CBRT to decide on the application; the business plan should therefore allow ample time for the permission.

Time limits continue to run after permission is granted. Failing to start operations within one year after the operating permission is granted is one of the cases in which the CBRT may revoke the permission (Law No. 6493, Art. 16(1)(a); Art. 19 for e-money institutions). Payment and e-money institutions must apply for membership of the Payment and Electronic Money Institutions Association of Turkey (TÖDEB), a professional body in the nature of a public institution, within one month of obtaining their operating permission (Law No. 6493, Additional Art. 1).

Founders and qualifying shareholders

In an establishment application, the CBRT examines not only the company but also the people behind it. Persons holding 10% or more of the capital and those holding control must meet the qualifications required of bank founders (Law No. 6493, Art. 14(2)(b)). Under the Regulation, qualifying shareholders and those holding control give written undertakings that the capital is met from their own resources, in cash and free of any sham, and that they have not been declared bankrupt or entered into concordat; a bankruptcy and concordat certificate from the trade registry and a credit score document are also submitted; legal entities submit balance sheets and income statements for the last three years approved by a sworn financial adviser or independently audited (Regulation, Art. 11(4)). Indirect shareholding is traced until natural persons are reached (Art. 13).

Additional documents are provided for foreign shareholders. Notarised copies of the identity documents or passports of foreign natural persons are required (Art. 11(4)(o)). Where shareholders are banks or financial institutions established abroad, a resolution of the competent body on operating in Turkey, the consolidated independent audit report for the last year and a document from the competent supervisory authority stating that their activities are not prohibited or restricted are required; if these documents cannot be obtained, the declaration annexed to the Regulation is submitted (Art. 11(14)). For documents issued abroad, an apostille or consular legalisation and a notarised Turkish translation should be prepared.

The company’s management is also subject to separate requirements. The Regulation contains separate provisions on the board of directors and corporate governance, the general manager, internal control and risk management (Regulation, Arts. 23, 24, 26 and 27); the education and experience requirements for board members and the general manager should be checked against these provisions before applying. The Turkish Commercial Code imposes no nationality or residence requirement on board members; however, a foreign manager who will actually work in Turkey needs a work permit. This is explained in our guide Can a Foreigner Be a Board Member or Manager of a Turkish Company?

Buying into an existing institution: share acquisition permission

Foreign investors often enter Turkey by buying an existing payment or e-money institution. In that case Article 25 of Law No. 6493 applies: acquisitions of shares representing, directly or indirectly, 10% or more of the capital, or acquisitions as a result of which a shareholder’s direct or indirect holding exceeds 10%, 20%, 33% or 50% of the capital, and transfers as a result of which a shareholder’s holding falls below these levels, require CBRT permission (Art. 25(1)). The creation and transfer of shares carrying the privilege of nominating board members, and a change of control of a legal entity holding more than 10% of the institution, also require permission (Art. 25(2)-(3)). Acquirers of shares must meet the qualifications required of bank founders (Art. 25(4)).

The consequences of an unauthorised transfer are serious: share transfers made without the required permission cannot be entered in the share ledger, and entries made in breach of this rule are void (Art. 25(5)). Under the Regulation, if it is found that unauthorised shareholders have exercised voting rights at the general assembly, the CBRT asks the board of directors to initiate the necessary proceedings for the annulment of the resolutions under the Turkish Commercial Code (Regulation, Art. 12(9)). Share acquisitions and transfers between companies of the same group that do not change the ultimate shareholders’ direct or indirect percentage in the institution do not require permission; they are notified to the CBRT within ten working days of the institution learning of them. If the CBRT decides that such an intra-group transfer undermines the requirement of a transparent shareholding structure, it may require the transaction to be stopped or, if completed, reversed (Art. 12(12)).

Indirect shareholding is, as a rule, calculated by multiplying the participation percentages; however, in determining the indirect shareholding of legal entities, their own shares and the shares of the companies they control are counted together (Regulation, Art. 13). For example, if a company in which a foreign company holds 40% without control buys 30% of a payment institution in Turkey, the indirect holding is 12%, and permission is required because the 10% threshold is exceeded. If the intermediate company is controlled, for example through a 60% holding, all 30% is taken into account because the shares of the controlled company are counted together. In any event, the intermediate company’s own acquisition also requires permission. Sales at parent-company level abroad may therefore also require CBRT permission in respect of the payment institution in Turkey. CBRT permission should be made a condition to closing in the share purchase agreement; if turnover thresholds are exceeded, Competition Board approval should also be considered. A general map of approvals required in an acquisition is in our guide Buying a Turkish Company as a Foreign Investor: Which Approvals Do You Need?

Can a fintech company abroad serve Turkey?

A payment institution licensed abroad may not provide services directly to users in Turkey on the basis of that licence. Persons other than banks and payment service providers may not provide payment services (Law No. 6493, Art. 13(2)); the Law contains no provision allowing a foreign institution to provide payment services in Turkey on the basis of its home-country licence or by opening a branch or representative office. Natural persons, and officers of legal entities, who operate as a payment institution or e-money institution in this field without permission are punishable by one to three years’ imprisonment and a judicial fine of up to five thousand days (Art. 28(1)). By its instruction of 5 February 2021, the CBRT also stated that certain foreign firms were providing payment services in Turkey without permission and asked payment and e-money institutions not to provide services to firms operating, or suspected of operating, in this way.

For cross-border payments, the Regulation provides a narrow cooperation model. A licensed institution in Turkey may cooperate with legal entities resident abroad that have obtained CBRT permission; this cooperation is limited to payment services in which at least one of the payer or the payee is abroad (Regulation, Art. 19(1)). The foreign entity must be authorised by the competent authorities of its home country to provide payment services or issue e-money (Art. 19(4)). The foreign entity may not use its brand and logos in a way that creates the impression that it holds an operating permission in Turkey and may not set up a website targeting customers resident in Turkey (Art. 19(2)). The cooperations permitted on this basis are published on the CBRT website; as of October 2026 the list includes four cooperations: Lidio with Global Collect Services B.V. and dLocal Limited, and Moka United with TransferGo Lithuania UAB and Wise Payments Ltd.

Safeguarding customer funds

The most sensitive obligation of payment and e-money institutions is protecting the money they receive from customers. Funds received by payment and e-money institutions in connection with payment services are not treated as deposits, participation funds or e-money (Law No. 6493, Art. 14(3)). An e-money institution must transfer the funds it collects against the issuance of e-money to a separate account to be opened with banks as defined in Law No. 5411 (Art. 20(3)). The accounts in which funds are held, the timing and the manner in which they are kept are regulated in detail in the Regulation.

The CBRT reorganised these rules in 2026 (Official Gazette of 19 March 2026, No. 33201). Under the amendment, the end-of-day balance of the e-money safeguarding account is calculated as of 16:30 on full business days and 12:00 on half business days, and funds received against the issuance of e-money may not be used as collateral by the institution (Regulation, Art. 35). Balances in safeguarding accounts may be invested through an investment account opened with the banks holding the safeguarding accounts, using only low-risk and liquid assets (Regulation, Art. 36/A). A foreign investor’s intra-group cash management should not be structured to cover the customer funds of the institution in Turkey; these funds must be kept separate from the institution’s own assets and from group companies’ accounts.

Information systems and independent audit

In the payments field, technical infrastructure is as decisive as the legal requirements. The Law lists taking the necessary measures for the security and confidentiality of funds and information as an establishment requirement (Law No. 6493, Art. 14(2)(e)). The details are set out in the Communiqué on the Information Systems of Payment and Electronic Money Institutions and the Data Sharing Services of Payment Service Providers in the Field of Payment Services (Official Gazette of 1 December 2021; last amended 4 September 2026; the “Information Systems Communiqué”). Under the Communiqué, institutions have vulnerability scans carried out at least six times a year and penetration tests at least once a year; their information systems are audited by independent audit firms authorised by the Public Oversight, Accounting and Auditing Standards Authority and included in the list of the Banking Regulation and Supervision Agency (BRSA) of independent audit firms authorised to carry out information systems audits at banks (Communiqué, Arts. 3(1)(e) and 28).

For a foreign investor, the most important issue is where the systems are kept. The Communiqué requires institutions to keep their primary and secondary systems and data backup centres in Turkey; the same rule applies to systems and backups used through outsourcing (Communiqué, Art. 21). Cloud computing services may be used only if they are established in Turkey and subject to the conditions in the Communiqué (Communiqué, Art. 16(7)). Connecting the group’s central payment platform abroad directly to the institution in Turkey is therefore often not enough; a separate infrastructure in Turkey, or work with a local outsourcing provider, is required. This requirement should be reflected in the business plan and budget before applying.

Ongoing obligations: MASAK, TÖDEB, tax and the crypto ban

After obtaining the operating permission, the institution is subject to a series of ongoing obligations. Payment institutions and e-money institutions are obliged parties under the legislation on the prevention of money laundering and terrorist financing (Regulation on Measures for the Prevention of Laundering Proceeds of Crime and the Financing of Terrorism, Art. 4(1)(e)); customer due diligence, suspicious transaction reporting, record-keeping and compliance programme obligations apply. In 2026, the CBRT also updated the rules on remote customer onboarding and provided for biometric methods or identity documents with electronic identity verification capability in remote identification (Official Gazette of 4 September 2026). MASAK (Financial Crimes Investigation Board) obligations and account freezes are explained on our page MASAK Rehberi (in Turkish).

Institutions must become members of TÖDEB (Law No. 6493, Additional Art. 1). For tax purposes, under General Communiqué on Expenditure Taxes (Serial No. 91), payment services are treated as banking transactions and services, so e-money and payment institutions become liable for banking and insurance transactions tax (BITT) as “bankers”. As for crypto assets, there is an express ban: payment and e-money institutions may not act as intermediaries for platforms providing trading, custody, transfer or issuance services for crypto assets, or for fund transfers from such platforms (Regulation on the Disuse of Crypto Assets in Payments, Art. 4(2), Official Gazette of 16 April 2021). A foreign investor wishing to operate in the crypto field should assess that business model separately, outside the payment institution structure.

Revocation, administrative fines and the offence of unlicensed activity

The CBRT may revoke the operating permission granted to a payment institution in the cases listed in the Law; these include failing to start operations within one year after permission, waiving the permission and obtaining the permission through false statements and documents (Law No. 6493, Art. 16(1)); this provision also applies to e-money institutions (Art. 19). The CBRT is authorised to grant a reasonable period not exceeding six months to remedy breaches it identifies, to suspend the operating permission temporarily and to revoke it if the measures are not taken within the period set (Art. 21(8)). For breaches of the Law, the CBRT Executive Committee imposes administrative fines from forty thousand to nine hundred thousand Turkish lira; if a benefit was obtained or damage caused through the breach, the fine may not be less than twice that amount (Art. 27(1)). These amounts in the Law are increased each year by the revaluation rate under Article 17(7) of the Misdemeanours Law.

Unlicensed activity, on the other hand, is a criminal offence. Natural persons, and officers of legal entities, who operate as a system operator, payment institution or e-money institution without obtaining the permissions required under the Law are punishable by one to three years’ imprisonment and a judicial fine of up to five thousand days (Art. 28(1)). The same penalty applies to anyone who, without permission, creates the impression in a trade name, announcements or advertisements of operating as one of these institutions (Art. 28(2)); the place of business may be closed for two to six months, and permanently in the event of a repeat offence (Art. 28(3)).

The CBRT uses these powers actively. According to the CBRT’s published results of supervision and inspection for 2025, the operating permissions of 7 institutions were revoked, those of 14 institutions were temporarily suspended, administrative fines totalling TRY 373,243,560.30 were imposed on 72 institutions, and 331 files were referred to prosecutors or courts. In 2026, too, the operating permissions of more than one institution were revoked by decisions published in the Official Gazette. A foreign investor buying an existing institution should therefore review CBRT inspection reports, administrative fines and MASAK proceedings in detail. Revocation of permission, trusteeship and MASAK measures are explained in our article Ödeme ve Elektronik Para Kuruluşunda MASAK, Kayyım ve İzin İptali (in Turkish).

Checklist

Common mistakes

• Serving users in Turkey under a home-country licence. A person without a Turkish licence may not provide payment services; unlicensed activity is an offence punishable by one to three years’ imprisonment (Law No. 6493, Arts. 13(2) and 28(1)).
• Treating the statutory capital as sufficient. TRY 1, 2 or 5 million is only the floor at establishment; since 30 June 2026 the own funds to be maintained at all times have been TRY 20, 40 or 105 million.
• Dismissing a sale at parent-company level abroad. Indirect shareholding is calculated by multiplying participation percentages, and the shares of controlled companies are taken into account together; a change at parent-company level may also require CBRT permission.
• Not making the share purchase agreement subject to CBRT permission. Unauthorised transfers cannot be entered in the share ledger, and contrary entries are void (Law No. 6493, Art. 25(5)).
• Running the group platform from abroad. The Information Systems Communiqué requires primary and secondary systems and backups to be kept in Turkey (Communiqué, Art. 21).
• Including customer funds in group cash management. Funds received against e-money are kept in a separate account at banks and may not be used as collateral.
• Working with crypto platforms. Payment and e-money institutions may not act as intermediaries for crypto platforms or for fund transfers from them.
• Delaying the start of operations. Failing to start operations within one year after permission is a ground for revocation (Law No. 6493, Art. 16(1)(a)).

Frequently asked questions

Can foreigners establish a payment institution in Turkey?

Yes. Law No. 6493 and the CBRT Regulation impose no nationality, residence, foreign-capital ratio or reciprocity requirement on foreign shareholders. The institution is incorporated as a joint stock company and obtains an operating permission from the CBRT; persons holding 10% or more of the capital and those holding control must meet the qualifications required of bank founders (Law No. 6493, Art. 14).

What is the difference between a payment institution and an e-money institution?

A payment institution provides payment services such as money transfers, issuing or acquiring payment instruments, bill payments and payment initiation; it may not issue e-money. E-money issuance is open only to banks, PTT and e-money institutions licensed by the CBRT (Law No. 6493, Art. 18(1)).

How much capital is needed to establish a payment institution?

Under the Law, paid-in capital, in cash and free of any sham, must be at least TRY 1 million for payment institutions acting as intermediaries for bill payments, at least TRY 2 million for other payment institutions and at least TRY 5 million for e-money institutions (Law No. 6493, Arts. 14(2)(ç) and 18(3)(ç)). There is no minimum capital requirement for institutions providing only the account information service (Art. 14/A).

What are the minimum own funds?

Under the CBRT Communiqué of 31 January 2026, from 30 June 2026 the minimum own funds are TRY 20 million for payment institutions acting as intermediaries for bill payments, TRY 40 million for other payment institutions and TRY 105 million for e-money institutions. The previous amounts were TRY 15, 30 and 80 million.

How is the CBRT application made?

The application has two stages, a background review and final approval, and is delivered by hand to the CBRT head office (Regulation, Art. 11(3)). If the background review is positive, an application for final approval is made within 120 days; the CBRT may extend this period by up to 60 days. If deficiencies are not remedied within six months, the application becomes invalid.

How much are the application and licence fees?

Under the Regulation, the application fee is TRY 500,000; the licence fee of TRY 1,000,000 is paid within ten days of starting operations (Regulation, Arts. 11(1) and 11(16)).

Which documents are required from foreign founders?

Qualifying shareholders give an undertaking that the capital is met from their own resources and in cash; notarised copies of the identity documents or passports of foreign natural persons are required. If a shareholder is a bank or financial institution abroad, a resolution of the competent body, the consolidated independent audit report for the last year and a document from the home supervisory authority, or a declaration, are submitted (Regulation, Arts. 11(4) and 11(14)).

Is permission needed to buy shares in an existing payment institution?

Yes. Acquisitions that, directly or indirectly, reach 10% of the capital or exceed 10%, 20%, 33% or 50%, and transfers falling below these levels, require CBRT permission. Shares carrying the privilege of nominating board members and a change of control of a legal entity holding more than 10% also require permission (Law No. 6493, Art. 25).

What happens if shares are transferred without permission?

Share transfers made without the required permission cannot be entered in the share ledger, and contrary entries are void (Law No. 6493, Art. 25(5)). If it is found that unauthorised shareholders have voted at the general assembly, the CBRT asks the board of directors to initiate the necessary proceedings for the annulment of the resolutions under the Turkish Commercial Code (Regulation, Art. 12(9)).

How is indirect shareholding calculated?

Indirect shareholding is, as a rule, calculated by multiplying the participation percentages; however, the shares of companies controlled by a legal entity are counted together with its own shares (Regulation, Art. 13). For example, a foreign company that acquires 30% of a payment institution through a company in which it holds 40% without control has an indirect holding of 12%, and CBRT permission is required because the 10% threshold is exceeded.

Can a payment company licensed abroad serve customers in Turkey?

No. Persons other than banks and payment service providers may not provide payment services in Turkey (Law No. 6493, Art. 13(2)); the Law contains no provision allowing services under a home-country licence or through a branch or representative office. Unlicensed activity is punishable by one to three years’ imprisonment and a judicial fine of up to five thousand days (Art. 28(1)).

Can a foreign payment company cooperate with an institution in Turkey?

Yes, but only to a limited extent. A licensed institution in Turkey may cooperate with legal entities resident abroad that have obtained CBRT permission, only for payment services in which at least one of the payer or the payee is abroad; the foreign entity may not set up a website targeting customers in Turkey or create the impression of being licensed in Turkey (Regulation, Art. 19).

How are customer funds safeguarded?

An e-money institution must transfer the funds it collects against e-money to a separate account to be opened with banks (Law No. 6493, Art. 20(3)). Under the 2026 amendment, these funds may not be used as collateral, and safeguarding account balances may be invested only in low-risk and liquid assets (Regulation, Arts. 35 and 36/A).

Must a payment institution’s servers be in Turkey?

Under the Information Systems Communiqué, institutions must keep their primary and secondary systems and data backup centres in Turkey; the same rule applies to systems used through outsourcing (Communiqué, Art. 21). Institutions have vulnerability scans carried out at least six times a year and penetration tests at least once a year.

Can payment institutions act as intermediaries for crypto transactions?

No. Payment and e-money institutions may not act as intermediaries for platforms providing trading, custody, transfer or issuance services for crypto assets, or for fund transfers from such platforms (Regulation on the Disuse of Crypto Assets in Payments, Art. 4(2)).

Which sanctions can the CBRT apply?

The CBRT may revoke the operating permission, grant up to six months to remedy breaches and suspend the permission temporarily (Law No. 6493, Arts. 16 and 21(8)). Administrative fines of TRY 40,000 to 900,000 are also imposed (Art. 27(1)). In 2025, the permissions of 7 institutions were revoked and administrative fines totalling more than TRY 373 million were imposed on 72 institutions.

Related guides

• Legal Guide for Foreign Investors in Turkey — company, stock exchange, mining, energy, real estate, tax and arbitration
• Can Foreigners Establish a Bank or Buy Into a Bank in Turkey? — bank founder requirements and BRSA permissions
• Buying a Turkish Company as a Foreign Investor: Which Approvals Do You Need? — Competition Board and sector approvals
• Can a Foreigner Be a Board Member or Manager of a Turkish Company? — foreign managers and work permits
• Shareholders’ Agreements in Turkey — capital commitments, vetoes and deadlock
• Company Formation in Turkey for Foreigners — capital, documents and formation
• Ödeme ve Elektronik Para Kuruluşları: TCMB Faaliyet İzni ve Yükümlülükler — summary of the licensing process (in Turkish)
• MASAK Rehberi — MASAK obligations, account freezes and compliance (in Turkish)
• Ödeme ve Elektronik Para Kuruluşunda MASAK, Kayyım ve İzin İptali — what to do in a crisis (in Turkish)
• Can a Foreign Crypto Exchange Set Up a Platform in Turkey or Buy Into a Turkish Platform? — CMB permission and share acquisition rules for crypto asset platforms
• Yabancılar Türkiye’de Ödeme Kuruluşu veya Elektronik Para Kuruluşu Kurabilir mi? — Turkish version of this article