An e-commerce startup added a “buy now, pay in three installments” option at checkout to lift cart conversion. The team thought of it as a simple payment feature. But a structure that grants the user a deferral and collects later was, legally, a financing/credit transaction — and to offer that function you must either work with a licensed institution or obtain a license yourself. The problem wasn’t a bad product; it was that something assumed to be a “feature” was actually a regulated financial service.
Buy Now, Pay Later (BNPL) is a fast-growing model in Turkey. But its apparent simplicity is misleading: any structure that grants the user credit/deferral falls within financial regulation. In this piece, we cover which framework governs a BNPL product in Turkey and what founders need to watch.
What Is BNPL Legally? Not a “Payment,” a “Financing”
The key distinction: BNPL offers the user the ability to defer payment at the moment of purchase — effectively a short-term credit/financing. Under Turkish law, the actors that may offer this function are limited: banks, special finance institutions, and finance companies. In practice BNPL is mostly provided through finance companies and is subject to Law No. 6361 on Financial Leasing, Factoring, Financing and Savings Finance Companies and the regulations on their establishment and operation.
License: Do It Yourself, or Work With a Licensed Party
An undertaking wanting to offer BNPL has two paths: (1) become a finance company itself by obtaining establishment and operating approval from the BDDK — which means heavy capital and compliance burdens; or (2) partner with a licensed institution and provide the technical/interface layer. For most startups the second path is more realistic, but even then the contractual allocation of responsibility — who is the “lender,” and who bears the obligations toward the consumer — must be set up clearly.
Consumer-Credit Rules and Maturity Limits
When BNPL is consumer financing, the protective provisions of consumer-credit legislation apply: pre-contract disclosure, contract form, right of withdrawal, and early repayment. The BDDK also sets maturity limits on consumer credit, and the regulator periodically tightens the credit-card and consumer-finance space in coordinated steps. A BNPL product’s maturity structure must comply with these limits.
The KVKK and Credit-Scoring Intersection
At the heart of BNPL is scoring that instantly assesses whether the user will pay — and that is personal data processing itself. An automated decision (e.g., an instant rejection) can trigger the data subject’s right to object and to human intervention under KVKK art. 11(1)(g). Any team building BNPL must build the data-protection side as carefully as the financial-licensing side, from the start.
A Checklist for Fintech Founders
- Name the function correctly — does the product really offer a deferral/credit? If so, a “payment feature” framing isn’t enough.
- Choose the license path — will you obtain a license yourself, or work with a licensed finance company?
- Write the allocation of responsibility — who is the “lender,” who is liable to the consumer, who carries the non-payment risk?
- Consumer protection — comply with pre-contract disclosure, contract, withdrawal, and maturity limits.
- Data protection — a lawful basis for scoring, the right to object to automated decisions, and a privacy notice.
Build the Framework Before You Scale
BNPL is a powerful conversion tool; but treated as “just a payment button,” it means unknowingly offering a regulated financial service. The good news: built right from the start, BNPL is both compliant and scalable. Put the licensing, consumer-protection, and data-protection layers in place before scaling the product — fixing it later is always more expensive.
Building a BNPL product? Let’s set up the licensing, contract, and data-protection framework together. Schedule a call →
Frequently Asked Questions
Is BNPL a “payment” or a “loan” legally?
Because it grants the user a deferral, it is effectively short-term financing/credit; a “payment feature” framing isn’t enough.
Do I need a license to offer BNPL?
Either obtain a finance-company license from the BDDK, or partner with a licensed institution (Law No. 6361).
What about KVKK?
Scoring processes personal data; a user who is auto-rejected gains the right to object and to human intervention.
Sources
- Law No. 6361 on Financial Leasing, Factoring, Financing and Savings Finance Companies: https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6361.pdf
- BDDK — Legislation: https://www.bddk.org.tr/Mevzuat
- Law No. 6698 on the Protection of Personal Data (art. 11): https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf
Model vs. characterisation — where each BNPL variant lands
| BNPL model | Likely Turkish characterisation | Gatekeeper |
|---|---|---|
| Merchant-funded instalments (you never touch credit) | Deferred payment by the seller — outside consumer-credit licensing | Consumer-law disclosure + e-commerce rules |
| Platform pays merchant, collects from shopper | Consumer lending in substance | BDDK perimeter — financing-company licence territory |
| Bank/financing-company partner behind your checkout | Regulated credit by the partner; you are the channel | Partner’s licence + your agency and marketing compliance |
| Wallet balance + instalment hybrid | E-money plus credit — two regimes stacked | TCMB (e-money) + BDDK (credit) simultaneously |
Is “no interest, only fees” a way out of credit rules?
No — Turkish characterisation looks at economic substance; fees charged to the shopper for deferral function as finance cost, and consumer-protection rules on late fees and disclosures reach them regardless of the label.
What kills BNPL partnerships in diligence?
Marketing that promises “credit” outcomes the unlicensed platform legally cannot give, and collection practices that ignore consumer-protection limits — both are findable from the public site in an afternoon.
This week’s homework
Map your money flow on one page: who funds, who bears default, who collects. The row you land in above is not a drafting choice — it is dictated by that map.
This article is for general information only and does not constitute legal advice. For a specific situation, please consult Vircon Legal.
Author
More from Vircon Insights
Notification Comes Earlier Than You Think: Turkey's New Merger-Control Thresholds and the Tech Exception
July 2, 2026The Token Is Easy, the Law Is Hard: Real-World Asset Tokenization (RWA) and Turkey
July 9, 2026Your Server Is in Turkey, Your Customer Is in Europe: How the EU AI Act Binds a Turkish Startup
July 10, 2026Read It Before You Sign: A Founder's Guide to the Term Sheet
July 6, 2026You Are the Assistant: Generative AI at Work and KVKK
July 1, 2026When a Startup Dies: The Law of Winding Down
June 18, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →