Embedded finance puts payments, accounts, cards or credit inside a product whose main business is something else: a marketplace wallet, a payroll app, a checkout with instalments. Banking-as-a-Service (BaaS) is the plumbing: a licensed institution exposes its services through APIs so a brand can offer them to its own users. Turkish law has no single “BaaS licence”. Each regulated step belongs to a specific licence holder, so every launch turns on two questions: who holds the licence for this step, and in what capacity does the platform stand next to it? Below is the map as of October 2026.
Who must hold the licence
Three activities are reserved, each with a criminal sanction.
- Payment services and e-money. Only banks, e-money institutions, payment institutions and PTT are payment service providers, and no one else may provide payment services (Law No. 6493 Art. 13). E-money may be issued only by banks, PTT and licensed e-money institutions (Art. 18(1)). Acting like a payment or e-money institution without a permit carries one to three years’ imprisonment (Art. 28(1)).
- Deposits. Only credit institutions and those authorised under special laws may accept deposits or participation funds as a business, or use wording suggesting they do (Banking Law No. 5411 Art. 60). Unlicensed deposit-taking carries three to five years’ imprisonment (Art. 150).
- Lending. Payment and e-money institutions may not lend (Law No. 6493 Arts. 14(4) and 20(4)), and the TCMB Regulation adds that amounts they intermediate may not be split into instalments (Art. 16(1)). Credit sits with banks (Law No. 5411 Art. 4) and with financing companies licensed by the BDDK Board (Law No. 6361 Art. 4); unlicensed financing carries two to five years’ imprisonment (Art. 46).
The agent and outsourcing routes under the TCMB Regulation
The TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (RG 1.12.2021/31676) offers two routes. The first is the agent (temsilci), defined as a person “acting in the name and on behalf of the institution” (Art. 3(1)(tt)). Under Article 18:
- agents may work over electronic or physical channels, under a written contract, after document checks and a risk assessment (Art. 18(1), (12), (13));
- the agent is notified within 15 business days of signing to the Association of Payment and E-Money Institutions (TÖDEB), not to TCMB, and entered in its public list; unregistered agents may not be used (Art. 18(2), (4));
- no other form of authorising third parties is allowed, and sub-agents are prohibited (Art. 18(1), (6));
- the institution answers for the agent and cannot escape liability by showing it chose the agent with care; customers must be told clearly that the agent acts for the institution (Art. 18(8), (9));
- an e-money institution’s agent may not issue e-money (Art. 18(7)).
The second route is outsourcing (dış hizmet alımı, Art. 21). Payment services and e-money issuance themselves cannot be outsourced (Art. 21(1)); IT, marketing, advertising, ERP, accounting and call centre work can be, under a written contract (Art. 21(2)). Outsourcing may not create the impression that a non-licensed company provides the service (Art. 21(4)) and does not reduce the institution’s liability to customers (Art. 21(10)). The boundary is fund flow: marketing outsourcing is not treated as agency “provided that the outsourced company does not intermediate fund transfers in any way” (Art. 18(1)). A referral partner that never touches money is an outsourcing provider; once funds pass through the platform, it must be a registered agent or licensed itself.
Bank partnerships and service model banking
With a bank partner, the platform is usually a support service provider (destek hizmeti kuruluşu): a firm performing bank activities other than deposit-taking and lending on the bank’s behalf, or assisting the bank (Law No. 5411 Art. 3). The bank needs a written risk report first (Art. 35). The Regulation on Banks’ Procurement of Support Services (RG 5.11.2011/28106) bars handing over credit assessment and decisions, and deposit-taking including its marketing (Art. 4(1)(b), (ç)), and contracts must accept BDDK audit (Art. 7).
The BDDK Regulation on the Operating Principles of Digital Banks and Service Model Banking (RG 29.12.2021/31704, in force 1.1.2022) is Türkiye’s closest thing to a BaaS statute. In “service model banking”, customers use an interface provider’s app or web interface to connect directly to a service bank’s systems through open banking services and transact through that bank (Art. 3(1)(b), (jj)). Article 13 sets the rules:
- the service bank serves only interface providers resident in Türkiye; banks cannot be interface providers (Art. 13(1)-(2));
- the service bank decides on each service, including credit allocation, and books it on its balance sheet (Art. 13(3));
- the customer contracts with the service bank, which itself identifies remote customers (Art. 13(4));
- interface provider and bank are jointly and severally responsible for authentication and transaction security (Art. 13(5));
- the interface provider is the bank’s support service provider and needs BDDK Board permission, also for working with more than one service bank; this does not replace a TCMB licence for payment initiation or account information services (Art. 13(6), (10)).
At the other end, a digital bank is a branchless credit institution whose credit customers may only be financial consumers and SMEs (Arts. 3(1)(i), 5(1)); the published text sets minimum paid-in capital at TRY 1 billion, which the Board may raise (Art. 9).
Embedded lending, BNPL and white-label cards
Since payment and e-money institutions cannot lend, a checkout instalment button is usually credit from a bank or a financing company. A financing contract under Law No. 6361 is credit for a purchase paid directly to the seller, under a general contract between the financing company and the seller (Art. 39(1)-(2)). A service bank may also collect credit card applications through an interface provider (Digital Banks Regulation Art. 13(6)). See our BNPL article.
A white-label wallet in the platform’s colours is e-money issued by a licensed e-money institution: funds are not deposits (Law No. 6493 Art. 20(7)), no interest or benefit may be paid for holding them (Art. 20(5)), and the platform cannot itself issue e-money. Persons that only distribute and redeem e-money fall outside the agent article (Regulation Art. 18(23)). In the service model, a card issued for an interface provider must show the bank’s name and logo (Digital Banks Regulation Art. 13(8)(d)).
Which model fits: a decision table
| Model | Platform’s regulatory status | Who contracts with the customer | Main constraint |
|---|---|---|---|
| Referral / marketing | Outsourcing or support service provider | Licensed partner | No fund flow; no impression the platform provides the service |
| Agent (temsilci) | Registered agent of a payment or e-money institution (Art. 18) | Institution; agent acts in its name | TÖDEB registration; disclosure; no sub-agents or e-money issuance |
| White label wallet or card | Agent, outsourcer or distributor of the issuer, or bank interface provider | Issuer (e-money institution or bank) | Issuer visible; no interest on e-money; no bank-like wording |
| Service model banking | Interface provider with BDDK Board permission | Service bank | Bank decides and books; joint liability for security; data limits |
| Own licence | Payment or e-money institution (TCMB), financing company or bank (BDDK) | The platform itself | Capital, governance, safeguarding and supervision |
Customer data and disclosure
Payment and e-money institutions may not use bank-like wording (TCMB Regulation Art. 15(7)); interface providers may not suggest they are a bank or payment service provider (Digital Banks Regulation Art. 13(3)), and must tell customers they are not a bank, show the bank’s name and logo on their home page and give the bank’s complaint channels (Art. 13(8)(a)-(ç)).
On data, KVKK roles follow function: the controller sets purposes and means, a processor acts on its behalf (Law No. 6698 Art. 3(1)(ğ), (ı)), and they are jointly responsible for security measures (Art. 12(2)). Typically the licensed partner is controller for its regulated service; the platform processes onboarding data for it and controls its own user relationship. Bank secrecy sits on top: outside the exceptions listed in Article 73 (which include information obtained while providing support services to a bank, Art. 73(4)), customer secrets may not be shared with third parties without a customer request or instruction, “even if explicit consent is obtained” under KVKK (Law No. 5411 Art. 73(3)). Secret data passed to an interface provider may be processed only for its customer contract, a legal obligation or its rights, on systems in Türkiye (Digital Banks Regulation Art. 13(8)(e)-(f)); on the payment side, the systems an outsourcer uses to run payment transactions, and their backups, must also be in Türkiye (TCMB Communiqué on Information Systems Art. 21(2)).
EU customers and open questions
A Turkish licence does not travel. Under PSD2 (Directive (EU) 2015/2366), only a legal person established in a Member State can be authorised as a payment institution (Art. 11(1)); agents are registered before they start (Art. 19(1)-(2)), and the institution remains “fully liable” for them (Art. 20(2)). Deposit-taking is reserved to credit institutions (Directive 2013/36/EU Art. 9(1)), and from 11 January 2027 CRD VI requires Member States to make third-country undertakings set up an authorised branch in a Member State before taking deposits there (and, for bank-like firms, lending or giving guarantees), subject to exemptions such as reverse solicitation (Directive 2013/36/EU Art. 21c, inserted by Directive (EU) 2024/1619 and applicable under its Art. 2(1)).
Open in Türkiye: with no general BaaS status, a platform’s position turns on fund flow and on who decides; the Board may set additional conditions for interface providers (Art. 13(6)); and embedded insurance sits outside the regimes above.
Where to start
- Draw the fund flow per feature: does money ever touch the platform?
- Pick the capacity per feature: referral, agent, interface provider or own licence. Do not mix them in one contract.
- For agents: confirm TÖDEB registration, disclosure wording and the partner’s monitoring requirements before launch.
- For bank partnerships: check whether the bank needs BDDK permission for you as interface provider, and map Article 73 data limits.
- Audit app copy and card design for bank-like wording, and write the KVKK role map with Türkiye hosting where required.
More in our fintech law hub; the own-licence route is on our payment and e-money licence page.
Can a fintech offer bank accounts without a banking licence?
Not as its own product: deposit-taking is reserved to credit institutions (Law No. 5411 Art. 60). With BDDK Board permission it can act as interface provider for a service bank, but the customer contracts with the bank and the accounts sit on the bank’s balance sheet.
Is a referral partner of a payment institution an agent?
Not if it only markets and never intermediates fund transfers; that is outsourcing (TCMB Regulation Arts. 18(1), 21). Once funds pass through it, it must be a registered agent or licensed itself.
Who is liable to the customer when an agent makes a mistake?
Both. The agent’s own responsibility does not remove the institution’s, and the institution cannot escape by showing it chose the agent carefully (TCMB Regulation Art. 18(9)).
Sources. Law No. 6493 (RG 27.6.2013/28690), Arts. 13, 14, 18, 20, 28; TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (RG 1.12.2021/31676, consolidated), Arts. 3, 15, 16, 18, 21; TCMB Communiqué on Information Systems (RG 1.12.2021/31676), Art. 21; Banking Law No. 5411 (RG 1.11.2005/25983 bis), Arts. 3, 4, 35, 60, 73, 150; Regulation on Banks’ Procurement of Support Services (RG 5.11.2011/28106), Arts. 4, 7; Regulation on the Operating Principles of Digital Banks and Service Model Banking (RG 29.12.2021/31704), Arts. 3, 5, 9, 13; Law No. 6361 (RG 13.12.2012/28496), Arts. 4, 39, 46; Law No. 6698 (KVKK) (RG 7.4.2016/29677), Arts. 3, 12; Directive (EU) 2015/2366 (PSD2), Arts. 11, 19, 20; Directive 2013/36/EU, Art. 9; Directive (EU) 2024/1619 (CRD VI), Arts. 1(9), 2(1).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Agentic Commerce in Türkiye: When an AI Agent Pays, Who Consented?
October 25, 2026Hybrid Work Is Now in Turkey's Remote Working Regulation: Office and Remote Days Must Be Written into the Employment Contract (Official Gazette 25.09.2026)
October 25, 2026In-App Purchases and Refunds in Türkiye: The Digital-Content Exception, Pre-Contract Information and the Child Who Bought Gems
October 21, 2026Deepfakes, Impersonation and APP Fraud in Türkiye: Who Bears the Loss?
October 20, 2026Open Banking in Türkiye: A Practical Legal Guide for Fintechs (2026)
October 18, 2026Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Related Practice Areas
Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →