The Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (“Payment Law”), aligning with the European Union Payment Services Directive (“PSD”), establishes the regulatory framework governing payments law in Turkey.

In addition to the Payment Law, the payments industry is regulated through the following secondary legislation:

• Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers;
• Regulation on the Generation and Use of TR QR Code in Payment Services;
• Regulation Prohibiting the Use of Crypto Assets in Payments;
• Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in Payment Services;

The Central Bank of the Republic of Turkey (“CBRT”) holds the authority as a main regulatory body within the payments ecosystem.

Payment institutions, electronic money institutions, banks and the Post and Telegraph Organization are allowed to function as payment service providers based on relevant licenses.

Payment service providers must secure an operating licence from CBRT. Operating licence is contingent upon satisfying the following conditions; i) company must be established as a joint stock company; ii) shareholders holding and controlling 10% or more of the shares must fulfil the same qualifications required for bank founders as per the Banking Law numbered 5411, iii) company shares must be issued in exchange for cash and in the form of registered shares, iv) paid in capital must at least be 2,000,000 TRY (1,000,000 TRY for utility bill payments intermediary services), v) Company must have a managemen, adequate personnel and technical equipment to carry out the transactions within the scope of the law, and to establish departments handling complaints and objections, vi) company must take necessary measures for the continuity of the activities, and for security and confidentiality of the user funds and information, vii) the company must have a transparent shareholding structure and organisational chart that will not hinder the supervision of the Banking Regulation and Supervision Agency (“BRSA”).

Payment cards emerge as the prevalent non-cash payment instrument in Turkey’s financial sector. To narrow it down further, according to December 2023 data from the Interbank Card Center’s (“BKM”), 117.7 million credit cards and 189.5 million debit cards, along with 90 million prepaid cards have been used in Turkey throughout 2023. Moreover, Turkey ranks as the 7th in credit card ownership globally, with 93,8 million credit cards according to the Sector Report released by the Payment and Electronic Money Institutions Association of Turkey’s (“TODEB”) in 2022. In terms of credit card transaction volume, Turkey stands at the 6th place on the global stage.

Mobile payment instruments and electronic money are also gaining significant prominence. Notably, a total of 71.7 billion TRY of electronic money was used in the first six months of 2022 according to TODEB. Between January and June 2022, virtual and physical POS services reached the largest share of 75% of the total transaction volume processed by payment and electronic money institutions.

Open banking is defined under the Regulation on the Information System of Banks and Electronic Banking Services effective as of July 1, 2020. Following the Regulation, in December 1, 2021, open banking services (payment initiation services and account information services) have been introduced through the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, and the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in Payment Services Area (collectively “Secondary Regulations”).

Open banking services can be provided by banks, e-money institutions, payment institutions and PTT through obtaining operating licences from the CBRT.

The Central Bank of Turkey is authorised to establish the principles and procedures regarding data sharing between payment service providers, thus laying the groundwork for open banking in Turkey.

CBRT started granting licenses to open banking companies and providing services through the GEÇİT (Open Banking Gateway) infrastructure as per their official announcement on December 1, 2022. On the same day with the announcement, six banks, who successfully completed tests and technical certification, have started to provide open banking services.

There are different approaches of other jurisdictions with regard to the data sharing activities between third party service providers and banks. For instance, with PSD2, the European Union mandates data sharing between third parties and banks, whereas in Singapore, policy and lawmakers left the decision to the open banking players and the market itself.

As with PSD2 in Europe, there are no mandatory provisions in Turkey requiring banks to share data with third party providers. However, the payments legislation in Turkey paves the way for open banking.

Law on the Protection of Personal Data (“LPPD”) is one of the main regulations in Turkey which must be carefully assessed in financial services, especially in the concept of open banking as it depends on processing of personal data. In addition to the personal data, open banking services may require certain types of customer data to be processed, which are classified as “sensitive data ” and “customer secrets” as per the Banking Law.

Personal data, sensitive data and customer secrets may likely overlap in various scenarios of financial services. In that sense certain sensitive data may be treated as personal data and vice versa. By this reason, careful examination of the legal characteristics and the distinction of data are crucial as it triggers diverse fields of the laws. This complexity requires robust compliance with BRSA regulations in terms of sensitive data and customer secrets based on their operation fields, as well as the compliance with LPPD to ensure safeguard of the personal data.

On the other hand, proper consent management stays at the core of the regulatory compliance and enhanced user experience. For instance, customer secrets which are regulated in Banking Law are also naturally expected to involve personal data under the LPPD. Even when explicit consent is obtained in line with the LPPD, customer secrets shall not be disclosed or transferred without a customer request or instruction as per the Banking Law. In that sense, banks must build robust consent management to ensure that customers have been duly informed about the transfer and they provided their request, instruction and explicit consent where necessary.

Turkey has no regulatory sandboxes in place, however the much anticipated Istanbul Finance Center (“IFC”) has introduced the concept of the regulation testing environment for the payment systems hosted in IFC, which may be called a regulatory sandbox.

Istanbul Finance Center aims to stand as a global financial services hub and to provide training, mentoring, technical and technological infrastructures, networking and several other opportunities to the enterprises operating in the fields such as digital banking, asset management, payments, crypto-assets, insurance technologies, borrowing, capital markets and participation fintech.

IFC also hosts the offices of the CBRR, BRSA, Capital Markets Board of Turkey (“CMB”), Borsa Istanbul, among other important financial institutions such as banks and insurance companies.

Additionally, innovators and entrepreneurs enjoy several incentive programmes supported by organisations such as Scientific and Technological Research Council of Turkey (“TÜBİTAK”) and Small and Medium Enterprises Development Organisation (“KOSGEB”) as well as government bodies including the Ministry of Commerce and Ministry of Industry and Technology.

The Medium Term Program (2024-2026) (“MTP”) prepared by the Strategy and Budget Department of the Presidency of the Republic of Turkey, covers government strategies including macro policies, principles, government’s macroeconomic targets, revenue and expenditure forecasts for the next three years.

According to the MTP;

• The share of non-bank credit institutions in the financial sector will be increased.
• Activities will be carried out to make the digital Turkish Lira available and widespread.
• New products and services in green finance will be developed by increasing awareness of ESG criteria.
• The integration of the IFC into the international financial system will be strengthened, contributing to the deepening of financial markets.
• Within the scope of IFC, participation-based fintechs will be supported to create an innovative, inclusive and dynamic participation finance ecosystem.

Finally, tax incentives play a crucial part of the incentive schemes of the government and  will be detailed in the question 8 below.

Economic downturns may impact investments and access to funding in the fintech market. Turkey has experienced high inflation rates and volatility in the values of the Turkish Lira in recent years, yet aims to implement controlling measures as per the MTP and other governmental strategies to secure financial stability.

On a different note, Turkey has been on the Financial Action Task Force’s grey list since October, 2021. Initial consequence of being greylisted may manifest as a reputational setback in attracting foreign investment. This may cause Turkish companies to encounter several sanctions in cross-border trade, and supplementary measures such as enhanced due diligence performance and audits against them. In turn, this may result in a potential negative affect on the capital flow attracted to the country.

Istanbul Finance Center provides important tax incentives for fintechs that are granted participant certificate accordingly;

• Until 2031, 100% of the earnings derived from exportation of financial services carried out at the IFC may be deducted from the corporate income in determination of the corporate tax base. 75% rate shall be applied post 2031.
• Banking and Insurance Transactions Tax (BITT) may be exempted from transactions related to financial services exportation and the money received as proceeds from such transactions.
• Stamp tax and fee may be exempted from the transactions related to the activities and the documents issued thereof.
• Stamp tax and fee may be exempted from the documents and transactions regarding the leasing of immovable properties in the IFC.
• Income tax may be exempted from the actual net value of the monthly wage paid to the personnel of financial institutions with a participant certificate to IFC; i) on 60% for the personnel with at least five years of professional experience abroad, and ii) on 80% for the personnel with at least ten years of professional experience abroad. This exemption is applicable on the condition that such personnel have not been working in Turkey in the last three years before starting to work at a company based in IFC.
• 50% of the income generated from the sale of goods purchased from abroad without bringing them to Turkey, or from intermediation in the purchase and sale of goods abroad may be deducted from the corporate tax base provided that these activities stay within the scope of the participant’s activities conducted in IFC.

Additionally, TÜBİTAK, KOSGEB, and the Ministry of Commerce and the Ministry of Industry and Technology provide several incentive programmes.

Moreover, individual investment participants (“angel investors”) may enjoy a deduction from the income tax base of 75% of the value of their shares which are determined in accordance with the valuation provisions of the Tax Procedure Law numbered 213. 100% deduction rate applies for the individual investment participants that participate in companies whose projects have been supported as part of research, development and innovation programs determined by TÜBİTAK, KOSGEB and Ministry of Industry and Technology, within the past five years counting from the application date for tax incentive. The deduction may be provided up to 2.5 million TRY annually.

Finally, fintech companies operating in technology developments zones may enjoy certain tax exemptions and incentives related to social security payments.

Payment services including money remittance, online and cardless payments, payment processing, bill payments are one of the attractive areas for investment as they respond to customer demands. We expect to see an increasing trend in open banking services, banking as a service products and insurtech in the coming years.

Embedded finance, on the other hand, promises great solutions for both B2B and B2C, considering the evolving interests of the end-users in e-commerce and their seek for on-time financing without leaving the platform.

Turkey’s fintech industry consists of other industries including e-commerce companies, banking and telecommunications, beside startups. Angel investors, strategic investors, private equity funds and venture capitals are investing in fintech companies in early-stages. Mergers and acquisitions persist at a rapid pace.

Turkey is an exceptionally welcoming environment for fintechs and offers many advantageous innovative and financial incentives to encourage entrepreneurs and investors through regulating the field in a positive manner.

Country’s robust and speed banking and payment infrastructure highlights Turkey as one of the best destinations for fintechs to launch and build new business models. In recent years, banks, insurance companies and other financial institutions are showing a friendly approach to fintechs, through collaborating and financing them to create beneficial playgrounds together.

Moreover, the Turkish population shows keen adaptation and interest in new technologies, particularly evident in the widespread interest in crypto trading and investment.

As a last point, access to talent distinguishes Turkey, with a human capital that is composed of experienced executives with a strong risk management acumen, and a well-educated, open-minded younger generation embracing new technologies.

Foreigners seeking employment opportunities are allowed to work in Turkey through work permits. They can apply for work permits by themselves or by the support of their employers.

Istanbul Finance Center also provides income tax exemptions in favour of the staff depending on the duration of their professional experience abroad (please refer to Q8).

Additionally, people working in the field of science and technology are able to apply for a Turquoise Card and work in Turkey under more privileged conditions than the standard work permit offers.

However, there are certain prohibitions for foreigners to practise in certain professions, for instance dentistry, veterinary medicine, notary public, private security officer etc.

As to the quota systems, Turkey lacks a general immigration quota, however due to the growth in foreign population in some provinces in İstanbul, the Provincial Directorate of Migration Management of Istanbul Governorship announced a quota for foreign residency.

While talent is accessible in Turkey, there are various incentive strategies to attract talents to develop the country’s technology and science workforce environment. As specified above, Istanbul Finance Center and Turquoise Card provides opportunities to reach talents abroad.

Turkey has been witnessing brain drain in recent years. Skilled young people, especially those in the technology sector, are often seeking opportunities abroad. In response, the government is formulating initiatives to start reverse brain drain to attract and retain top tier talent domestically.

Intellectual property rights regulated in Turkey may classify in two main pillars; i) copyrights including scientific and literary work, musical work, work of fine arts, cinematographic work; and industrial property including patents, trademarks, designs, utility models and geographical indications.

Copyrights, although not mandatory to register except for certain exemptions, can be registered voluntarily. Copyright protection starts with its creation and lasts for seventy years post the author’s demise. Protection continues seventy years after the publicity, in cases where the copyright owner is a legal entity. Of particular interest to fintechs, software is considered an artistic work under Law numbered 5846 on Intellectual and Artistic Works, and therefore benefits from the copyright protection, instead of patent protection.

Patents warrant a twenty-year protection period following the date of the patent application, while, trademarks enjoy ten years of safeguard starting from the date of registration with the Turkish Patent and Trademark Institution.

Designs also require registration, and be guaranteed for five years starting from the registration date. Protection period is extendable for four additional five years, securing a total of twenty five years.

Utility models ensure a protection for ten years from the date of application.

Turkey has not particularly regulated cryptocurrencies as of January 2024. However, Turkey has been working on a modern crypto law for several years now, and the Minister of Finance and Treasury Mr. Şimşek has heralded that the crypto law would be enacted very soon.

Snapshot of the current legislative framework reveals that two major regulations are in place, each serving specific needs or concerns:

• In terms of anti-money laundering regulations: Crypto assets service providers (“CASPs”) are classified as obligated parties under the Regulation on Measures regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism (“Measures Regulation”).

CASPs are required to set up the appropriate mechanisms to prevent laundering proceeds of crime and financing of terrorism. In this regard, CAPSs must carry out active and ongoing know-your-customer (“KYC”) processes not only during the onboarding but also throughout the user’s lifecycle. Further to KYC requirements during the onboarding, it is worth noting that the Measures Regulation initially has been enacted in 2007, and followed by amendments to the provisions related to KYC in 2009, and finally CASPs are included within the scope of the Communique in 2021.

Since the Measures Regulation cannot respond to the needs in remote onboarding of users by the obligated parties, the Treasury and Finance Ministry has published the General Communique no. 5 on Simplified Measures related to KYC verifications. Communique no. 5 still does not address the remote user onboarding, however it simplifies the identity verification procedure and is applicable to companies exclusively operating in electronic environments, such as CASPs.

CASPs must also monitor transactions, check whether they are in compliance with the users’ risk profile, professional background, financial status, source of funds and profession. Additionally, CASPs must show utmost importance to the complex and extraordinary transactions and obtain sufficient information from users regarding the purpose of the transactions in these cases.

Documents, records and information related to users must be retained for the periods expressly stated in the Measured Communique, and be submitted to the Financial Crimes Investigation Board (“FCIB”) when requested.

CASPs must periodically report transactions above a certain threshold, and submit documentation and information to FCIB when requested. Although FCIB has been tasked to determine the abovementioned threshold, it has not yet been determined. Therefore, this provision does not find much application in practice.

• In terms of use of crypto assets in payments: CBRT has introduced a restrictive Regulation on the Use of Crypto Assets in Payments on April 30, 2021. Accordingly, the Regulation has prohibited;
• the use of crypto assets as a form of payment, or offering services involving such usage;
• payment service providers from developing business models enabling crypto assets to be used in the provision of payment services and electronic money issuance, or providing any services related to such business models; and
• payment and electronic money institutions from intermediating the fund transfers to the platforms offering trading, custody, transfer or supply services for crypto-assets, or fund transfers from these platforms.

On top of these dedicated regulations, general rules of law encompassing including but not limited to intellectual property, data protection, crowdfunding and tax are also applicable to cryptocurrencies and related business models.

Initial coin offerings (“ICOs”) have not been regulated in Turkey, yet.

Therefore, the Capital Markets Board’s capacity and power to take actions on token sales/ICOs under the current regulatory framework remains controversial.

CMB, in its Bulletin numbered 2018/47 (“Bulletin”) expressly stated that many of the “sales of cryptocurrencies” or “sales of tokens”, which are generally used to raise money using blockchain technology, fall outside the scope of the CMB’s regulation and oversight.

However, CMB also interprets that “sales of token”, which have similarities and differences to the public offerings and crowdfundings, must be assessed on a case-by-case basis to ensure proper understanding of the Board’s capacity to regulate and oversight such activities. In the same Bulletin CMB also warns investors not to rely on possible sales of crypto assets under the name of crowdfunding and reiterates its power to take measures against unregistered activities under the name of crowdfunding.

Token classification is not a consensus in legal and technical literature, yet the most common classification is divided into three groups: i) payment tokens, ii) utility tokens, and iii) security tokens. Note that two or three of them may be intertwined, which creates the fourth category iv) hybrid tokens.

Accurate determination of the token type is crucial, since the security tokens as a financial instrument may involve ICOs into CMB’s jurisdiction.

Finally, considering the Minister of Treasury and Finance’s recent statements, we expect Turkey’s most awaited crypto law to be enacted in 2024, and regulate token-based crowdfunding under the CMB’s jurisdiction.

Turkey aims to become an attractive international hub for blockchain projects, both those built in the country, and others born abroad and drawn into Turkey. The vision, support and awareness of blockchain clubs in Turkish universities to realize this goal is admirable.

Turkey’s blockchain ecosystem is seen focusing on asset management, crypto trading, custody services, NFT minting and marketplace services, real world asset tokenizations, as well as the digital identification projects.

BiLira is Turkey’s pioneering stablecoin pegged to the Turkish Lira, developed a platform offering crypto exchanges with an access to DeFi wallets.

TOGG, Turkey’s first electric smart car, partners with Ava Labs to develop fast and secure mobility services through smart contracts. TOGG also plans to use a digital asset wallet built on Avalanche blockchain integrated into its smart car.

NFT collections, especially the ones created by artists, have become a notable trend in recent years.

Football clubs have leveraged token projects to ensure revenue streams, fan satisfaction and engagement into clubs’ activities.

Artificial intelligence systems are extensively integrated into the financial sector across identity verification processes, transaction analysis, risk assessments, PEP and high risk user screenings and fraud detections to effectively combat financial crimes.

Moreover, artificial intelligence systems contribute to predicting customer needs, analyse market conditions, credit and risk scoring of customers in order for financial companies to determine their strategies.

Chatbots are here to stay as they help in managing customer relationships and ensuring speed communication. Robotic process automation also streamlines claim management processes and necessary documentation in the background, which is crucial particularly for insurance companies.

Insurtech is developing, with the help of an increasing awareness among insurtech startups, insurance companies, agencies and brokers.

We observe that insurtech innovation is heavily gaining momentum in the B2B space mostly, where insurtechs offer solutions that address insurance companies’ nuanced needs including claims processing, pricing, customer relations and risk assessments and measurements.

Moreover, embedded insurtech is also increasing with the development of e-commerce.

Prevention-focused insurtechs strategically enhance both the insurance industry and end-users by proactively mitigating potential risks. This proactive approach allows insurance companies to meet end-users’ demand more cost-efficiently. Simplest example could be the functions of smart cars which assess driver’s focus, reflexes and alertness to send timely warnings, aiming to prevent potential traffic accidents.

Fintechs’ influence are extending in various domains, actively in payments including money remittance, payment processing, mobile payments, virtual and physical POS solutions, prepaid cards, billing payments and open banking services.

“Fintechs seek to become banks, and banks seek to become fintechs” is a well-known point of view illustrating the transformative spirit in the financial sector.

In the early stages, banks did not attach much attention to integrated collaborations with fintechs. Initially overlooked, fintechs have now become much integrated with the incumbent financial institutions such as banks, as they are positioned in close contact with the end-users, understand user demands quite well, and shape their innovations to offer cost-efficient and fast solutions. Furthermore, banks are actively investing in fintechs.

Turkish banks had initiated digital transformation programs to enhance their technological infrastructure, improve customer experience, and stay competitive in the evolving financial sector.

Some banks in Turkey established their own innovation labs or research and development units dedicated to fintech space, and they are supporting organisations to enable fintech startups to receive mentorship and grow.

As to the crypto sector, Garanti Bank launched the Garanti Crypto Application, while Ak Investment, a subsidiary of Akbank acquired a crypto asset platform, Stablex, in December 2023.

Turkey has traditionally been welcoming and very adoptive of new technologies in the banking and financial system. In Turkey, disruptive innovations which rely on technologies such as smartphone apps, big data, algorithms, and machine learning have already changed the financial industry. The fact that they use online platforms, instead of legacy infrastructure and can offer better and more effective products and services at a lower cost than traditional lenders and financial service providers helped the majorly young population in Turkey. Especially services such as Peer-to-Peer Payment Systems, mobile remittances, micro investing, robo advisers, algorithmic credit scoring, digital banking, algorithmic lending and insurance comparisons are in full swing. Moreover, crypto services have been very popular in Turkey and crypto trading is far wider in Turkey than many other established economies in the world. Currently the financial service providers are preparing for crypto related licenses, market place lending, peer-to-peer lending, derivative transactions on cryptos, crypto crowd funding and security tokens. Banks are very fast to adopt such new technologies by partnering up with FinTech companies or developing the tech simply in-house