Who this practice is for
Financial work in Türkiye is split across four regulators, and the first mistake foreign firms make is dealing with the wrong one. We act for clients on each side of that map:
- Foreign banks and lenders financing Turkish borrowers, taking security over Turkish assets, or studying a Turkish branch or representative office.
- Fintechs and payment service providers that want to offer payments, wallets or e-money to Turkish users and need a Central Bank licence.
- Crypto-asset firms (exchanges and custodians) now brought inside the capital-markets regime and supervised by the Capital Markets Board.
- Institutional investors and acquirers buying into a Turkish bank, payment firm or fintech, where the deal will not close without regulatory approval.
If you are still deciding which Turkish entity should hold the licence, start with setting up the licensed Turkish entity that will hold a payment or e-money licence so the corporate and regulatory plans line up from day one.
The Turkish legal framework and who regulates what
There is no single "financial regulator" in Türkiye. Authority is divided by activity, and each statute sits with its own supervisor. Knowing which one applies to you decides everything that follows.
| Activity | Main statute | Regulator |
|---|---|---|
| Banking (deposit, credit) | Law No. 5411 | BDDK |
| Payments / e-money | Law No. 6493 | TCMB / CBRT |
| Crypto-asset services | Law No. 6362 (am. 7518) | SPK / CMB |
| FX and capital movements | Decree No. 32 | Ministry of Treasury / TCMB |
| Anti-money-laundering | Law No. 5549 | MASAK |
Lending and secured finance under Turkish law
Lending into Türkiye is straightforward; making your security enforceable is where files go wrong. A loan agreement can be governed by foreign law, but security over Turkish assets is created and perfected under Turkish law, in Turkish form, at Turkish registries.
We document and perfect the security package foreign lenders actually use:
- Mortgage (ipotek) over Turkish real estate, registered at the Land Registry under the Turkish Civil Code No. 4721.
- Pledge over shares, receivables and movable assets, including the commercial-enterprise pledge regime under Law No. 6750 for movable collateral.
- Assignment of receivables and bank accounts under the Turkish Code of Obligations No. 6098.
- Guarantees and suretyship — and here the form rules bite, because a personal suretyship (kefalet) must meet strict written conditions under Law No. 6098 or it is void.
For the underlying documents, see drafting loan, security and finance documentation under Turkish law. When a borrower defaults, recovery runs through enforcing security and recovering debt through Turkish execution proceedings under the Execution and Bankruptcy Law No. 2004.
Foreign-exchange and capital-movement rules (Decree No. 32)
Türkiye does not have free FX lending. Whether a Turkish resident may borrow in foreign currency, and whether a loan must be priced and repaid in lira, is controlled by Decree No. 32 and its communiqués. Get this wrong and the loan can be re-characterised or attract penalties.
We structure cross-border facilities, advise on permitted FX-indexation, and check that repayment, fees and security all sit inside Decree No. 32. For investors moving capital in to buy a regulated target, this dovetails with acquiring or investing in a Turkish bank, PSP or fintech (share deals, regulatory approvals).
Payment services and e-money licensing (Law No. 6493)
If you want to provide payments, digital wallets, money remittance or electronic money to users in Türkiye, you almost certainly need a licence as a payment institution or an electronic-money institution under Law No. 6493 — granted by the Central Bank (TCMB), not the BDDK.
The application is substantial. You must incorporate a qualifying Turkish company, demonstrate paid-in capital at the regulator-set minimum, show fit-and-proper shareholders and managers, and submit business plans, internal-control, risk and AML frameworks, and IT and information-security documentation that meet the Central Bank's secondary regulation.
The corporate vehicle that holds the licence is built first — see setting up the licensed Turkish entity that will hold a payment or e-money licence.
Fintech, PSP and open-banking compliance
The licence is the start, not the finish. Payment and e-money institutions in Türkiye carry continuing obligations that the Central Bank actively supervises, and many fintech models depend on relationships that themselves need regulatory clearance.
- Open banking and API access through the Central Bank's payment-services infrastructure, with the data-sharing and security rules that come with it.
- Banking-as-a-service and agent models, where a licensed institution stands behind an unlicensed partner — the allocation of regulatory responsibility has to be precise.
- Outsourcing and cloud arrangements, which trigger notification and control requirements under the secondary regulation to Law No. 6493.
- Ongoing reporting, audit and governance, plus change-of-control approval whenever significant shareholdings move.
Crypto-asset and digital-asset regulation (Law No. 7518)
Türkiye moved crypto out of a legal grey zone in 2024. Law No. 7518 amended Capital Markets Law No. 6362 to bring crypto-asset service providers — exchanges and custodians — under a licensing and supervision regime run by the Capital Markets Board (SPK/CMB), with detailed secondary regulation issued in 2025.
We advise on whether your model needs CMB authorisation, prepare and run the licence file, and align custody, customer-asset segregation and AML onboarding with the rules. Two current guides set out the landscape: how Türkiye regulates crypto assets under Law No. 7518 and CMB licensing for crypto platforms.
AML, sanctions and KVKK data compliance
Every regulated financial firm in Türkiye is also an AML obliged person, and for cross-border groups, sanctions and data-protection exposure usually travels alongside the licence.
- AML/CFT programmes — KYC, transaction monitoring, screening and MASAK reporting calibrated to your product.
- Sanctions exposure — how Turkish rules interact with the EU, UK and US measures a global group must also respect.
- KVKK data compliance — lawful basis, cross-border transfer and breach handling for financial data under Law No. 6698.
For data obligations specifically, our note on GDPR and KVKK compliance for companies operating in Türkiye is a useful starting point.
Cross-border mechanics for foreign clients
You do not need to be in Türkiye for most of this. Banking and finance files run heavily on documents, and we are set up to handle them remotely for foreign clients and head offices.
- Power of attorney — a notarised and apostilled PoA lets us incorporate, file licence applications, sign before notaries and register security on your behalf.
- Apostille and legalisation — corporate documents, board resolutions and signatory authorities executed abroad are recognised once apostilled (or consular-legalised for non-Convention states).
- Sworn translation — filings and security documents are submitted in Turkish; we manage certified translation so meaning is not lost at the registry.
Risks and common mistakes
The recurring failures in Turkish financial work are predictable, and all of them are avoidable with advice taken early:
- Unlicensed activity — onboarding Turkish users for payments, e-money or crypto before authorisation, exposing the firm and its executives to penalties.
- Filing with the wrong regulator — taking a payment licence to the BDDK instead of the TCMB, or treating a crypto model as outside CMB scope.
- Invalid security — a guarantee or pledge that fails the form rules of Law No. 6098, discovered only on enforcement.
- FX-rule breaches — lending in foreign currency to a resident who does not qualify under Decree No. 32.
- Sanctions and AML gaps — onboarding without screening that satisfies both MASAK and the firm's home-country obligations.
Why instruct a Turkish banking and finance lawyer
Cross-border financial deals fail at the local layer — the registry that rejects a pledge, the regulator that wants a document your home counsel never heard of, the FX rule that re-prices a loan. A Turkish lawyer closes that gap.
We give you English-language advice with Turkish-law substance: we tell you which regulator applies, what the current capital and eligibility figures are at the time you file, and how to make your security actually enforceable here. We sit between your head office, your home counsel and the Turkish regulator so the file moves as one. And we are clear about what is settled and what is changing — fintech and crypto rules in Türkiye are young and move quickly, so we verify currency-sensitive points before you rely on them.
How to start with Lexin Legal
Begin with a scoping conversation. Tell us what you want to do in Türkiye — lend, license, launch a payment or crypto product, or acquire a regulated target — and we will map the regulator, the statute and the realistic timeline before you commit.
From there we set up the licensed entity if needed (company formation in Türkiye), take a power of attorney so we can act for you remotely, and run the application, drafting and filings. You can reach us through the consultation card on this page to talk to a Turkish finance lawyer.
How we work with you
Scoping call and regulatory assessment
We start by mapping your plan to the right regime and regulator — banking (BDDK), payments and e-money (TCMB), crypto (CMB) or cross-border lending under Decree No. 32 — and flag the licensing or compliance triggers up front.
Licensing and structuring roadmap
You receive a written roadmap: the entity to use, the licence required, the current capital and eligibility position, the documents needed, and a realistic timeline with the key regulatory gates.
Power of attorney and document collection
We prepare a tailored PoA and a checklist of corporate documents to be apostilled abroad, then arrange certified Turkish translations so nothing is rejected at filing.
Application, drafting and regulator filings
We draft the licence file, loan and security documents, or deal papers, and submit the application to the Central Bank, CMB or BDDK, or perfect security at the relevant registry.
Negotiation with the regulator and counterparties
We respond to regulator queries and information requests and negotiate finance and deal terms with banks, borrowers or sellers, keeping your home counsel aligned throughout.
Closing, registration and security perfection
We complete the transaction or authorisation — registering the mortgage or pledge, recording share transfers, and confirming the licence or approval is in place before you go live.
Ongoing compliance and regulatory support
After closing we support continuing obligations — reporting, change-of-control approvals, AML and KVKK upkeep, and renewals — so the licence stays in good standing.
Banking, finance and fintech in Türkiye: common questions
Which regulator licenses payment and e-money institutions in Türkiye?
Payment institutions and electronic-money institutions are licensed and supervised by the Central Bank of the Republic of Türkiye (TCMB/CBRT) under Law No. 6493. Since the 2020 reform under Law No. 7192, this authority moved from the BDDK to the Central Bank, so applications now go to the TCMB, not the BDDK.
Who regulates crypto exchanges and custodians in Türkiye?
Crypto-asset service providers are regulated under Capital Markets Law No. 6362, as amended by Law No. 7518 (in force July 2024), and are licensed and supervised by the Capital Markets Board (SPK/CMB). Detailed secondary regulation was issued in 2025. They are also AML obliged persons under MASAK.
Do I need a licence to offer payments or a wallet to users in Türkiye?
In most cases yes. Providing payment services, money remittance, digital wallets or electronic money to Turkish users generally requires authorisation as a payment institution or e-money institution under Law No. 6493. Onboarding Turkish users before you are licensed is treated as unlicensed activity and can attract penalties for the firm and its executives.
How much paid-in capital does a payment or e-money licence need?
Law No. 6493 sets a minimum paid-in capital for payment institutions and e-money institutions, and the figure is increased from time to time by regulation. Because the current amount changes, we confirm the exact minimum that applies at the date of your application rather than relying on an older figure.
Can a foreign company own a Turkish payment institution or fintech?
Yes. Foreign ownership is permitted, but shareholders and managers must satisfy fit-and-proper requirements, and significant shareholdings and changes of control need regulatory approval. We structure the holding so the licence application and any later transfer both clear the regulator.
Can a Turkish resident borrow in foreign currency?
Foreign-currency and FX-indexed lending to Turkish residents is restricted by Decree No. 32, with eligibility generally tied to the borrower's foreign-currency income and outstanding FX-loan balance. The thresholds change by regulation, so we check a borrower's current eligibility before any FX facility is signed.
What security can a foreign lender take over Turkish assets?
Common security includes a mortgage (ipotek) over real estate under the Civil Code No. 4721, pledges over shares, receivables and movables (including the commercial-enterprise pledge under Law No. 6750), assignment of receivables under the Code of Obligations No. 6098, and guarantees or suretyships. Security over Turkish assets is created and perfected under Turkish law even if the loan is governed by foreign law.
Why might a guarantee or suretyship be unenforceable in Türkiye?
A personal suretyship (kefalet) must meet strict written conditions under the Code of Obligations No. 6098 — including the maximum amount, the date and, where required, the spouse's consent. A suretyship that omits these can be void, so the form has to be correct when it is signed, not fixed later.
Do I have to be in Türkiye to set up or license a financial firm?
No. Most steps — incorporating the entity, filing the licence application, signing before a notary and registering security — can be handled by us under a notarised, apostilled power of attorney, so you and your head office can stay abroad.
What AML obligations apply to financial firms in Türkiye?
Banks, payment and e-money institutions and crypto-asset service providers are obliged persons under Law No. 5549 and owe customer-identification, monitoring and suspicious-transaction-reporting duties to MASAK, the Financial Crimes Investigation Board. We build AML/CFT programmes calibrated to your product and onboarding flow.
How long does a payment or crypto licence take in Türkiye?
Timelines depend on the completeness of the file, the regulator's queries and how quickly fit-and-proper and IT documentation can be produced. We give you a realistic estimate in the scoping stage and keep the application moving by responding promptly to regulator information requests.
Who licenses and supervises banks in Türkiye?
Banks are licensed and supervised by the BDDK (Banking Regulation and Supervision Agency) under Banking Law No. 5411. This is separate from the Central Bank's role over payment and e-money institutions and the Capital Markets Board's role over crypto, which is why identifying the correct regulator at the outset matters.
Can you help acquire or invest in a Turkish bank, PSP or fintech?
Yes. We handle share deals and investments in regulated Turkish targets, including the change-of-control and fit-and-proper approvals the deal needs to close. This sits alongside our corporate and M&A work on regulatory approvals and deal structuring.
Do data-protection rules apply to financial and fintech firms?
Yes. Processing customer data is governed by the Personal Data Protection Law No. 6698 (KVKK), covering lawful basis, cross-border transfer and breach handling, on top of sector rules. For regulated financial firms, KVKK compliance runs in parallel with AML and licensing obligations.
How do I start working with Lexin Legal on a finance matter?
Begin with a scoping call. Tell us whether you want to lend, license, launch a payment or crypto product, or acquire a regulated target, and we map the regulator, statute and timeline before you commit. You can reach us through the consultation card on this page.
