In Türkiye, the law rather than the technology decides which fintech models can launch. Almost every 2026-2027 trend meets an activity reserved to a licence holder or an outright ban. The rules keep moving: FAST’s limit rose to TRY 300,000 on 26 August 2026 and TCMB added biometric remote identification on 4 September 2026. Below, sixteen trends (eight B2B, eight B2C) are mapped to the legal question, the key Turkish and EU rule and our detailed article, as of October 2026.
Business and institutional finance (B2B): eight trends
| Trend | The legal question | Key Turkish rule | Key EU rule | Our article |
|---|---|---|---|---|
| 1. Tokenised money and RWA (tokenised deposits, stablecoins, wholesale CBDC) | Can the token be used to pay, and what right does it represent? | TCMB crypto payments Regulation Arts. 3(2), 4(2); Law No. 6362 Arts. 3(1)(bb), 35/B | MiCA Arts. 48-50 (e-money tokens) | Tokenised money; RWA tokenisation |
| 2. Programmable treasury (conditional payments, 24/7 collateral) | Is a coded condition enforceable, and who may hold funds meanwhile? | Code of Obligations Arts. 170, 175; Law No. 6493 Arts. 10, 14(3); TCMB Payment Services Regulation Art. 34 | Settlement Finality Directive 98/26/EC; Financial Collateral Directive 2002/47/EC | Programmable treasury |
| 3. AI-driven operations (KYC/AML, credit, back office) | Can a model decide, and who answers when it is wrong? | MASAK Compliance Programme Regulation Arts. 18(2), 19(1)(e); BDDK Support Services Regulation Art. 4(1)(b) | AI Act Annex III 5(b); AMLR Art. 76(5) | AI in KYC, AML and credit |
| 4. Banking-as-a-Service | Who holds the licence for each regulated step? | Law No. 6493 Arts. 13, 18; Banking Law Art. 60; Digital Banks Regulation Art. 13 | PSD2 Art. 11; CRD Art. 21c (inserted by CRD VI) | BaaS and embedded finance |
| 5. Cross-border payments (ISO 20022, G20 2027 targets) | Which licence, FX rule and data set applies to each corridor? | Law No. 6493 Art. 12(1)(ç); Measures Regulation Art. 24; Export Circular Temporary Art. 4 | Regulation (EU) 2023/1113 | Cross-border payments |
| 6. Open finance (PSD2 to PSD3 and FiDA) | Which data can be shared beyond payment accounts? | Law No. 6493 Art. 12(1)(f)-(g); Banking Law Art. 73(3) | PSR compromise text Arts. 35, 43; FiDA proposal COM(2023) 360 | Open finance and FiDA |
| 7. Resilience and post-quantum cryptography | Where must systems sit, and who governs ICT risk? | TCMB Information Systems Communiqué Art. 21(1); BDDK Information Systems Regulation Art. 25(1); Law No. 7545 Art. 7(1)(b) | DORA Arts. 28-30; Delegated Regulation 2024/1774 Art. 6(4) | DORA and post-quantum |
| 8. Climate fintech (EU ETS, CBAM, carbon credits, ESG data) | Who reports and pays for emissions, and what is a carbon token? | Climate Law No. 7552 Art. 9; ETS Regulation (RG 27.8.2026) | CBAM Regulation 2023/956 Arts. 4, 9 (as amended by Regulation 2025/2083); Directive 2024/825 | Climate fintech |
Consumer finance (B2C): eight trends
| Trend | The legal question | Key Turkish rule | Key EU rule | Our article |
|---|---|---|---|---|
| 1. Agentic commerce | When an AI agent pays, did the customer consent? | TCMB Payment Services Regulation Art. 52; Code of Obligations Arts. 40-47 | PSD2 Art. 64(2); AI Act Art. 50(1) | Agentic commerce |
| 2. Personalised finance with generative AI coaching | When does a chatbot become investment advice? | Law No. 6362 Arts. 37, 39, 109; SPK Communiqué III-37.1 Art. 45 | MiFID II Art. 4(1)(4); AI Act Art. 50(1) | GenAI finance assistants |
| 3. Embedded finance | Is the brand a referral partner, an agent or an unlicensed provider? | Law No. 6493 Arts. 13, 14(4), 20(4); TCMB Payment Services Regulation Arts. 18, 21 | PSD2 Arts. 19-20 | BaaS and embedded finance |
| 4. Instant and A2A payments (FAST, QR common interface) | Which QR format is mandatory, and can a transfer be reversed? | TR Karekod Regulation Art. 4(1); TCMB Payment Services Regulation Art. 64(1) | Instant Payments Regulation (EU) 2024/886 | FAST and TR Karekod |
| 5. Digital identity and wallets (biometrics, e-KYC) | Which remote identification route is lawful for which customer? | TCMB Payment Services Regulation Art. 41(4); MASAK Communiqué No. 19 Art. 4/C; KVKK Art. 6 | eIDAS 2 Art. 5f(2); AMLR Art. 22(6) | Digital identity and e-KYC |
| 6. Access to tokenised assets (tokenised funds, fractional ownership) | Which regime governs the right a retail token gives? | Law No. 6362 Arts. 13(1), 109(1); Civil Code Art. 705 | MiCA Art. 2(4); DLT Pilot Regime (EU) 2022/858 | Tokenised funds; Tokenised money |
| 7. Credit scoring with alternative data | Can an applicant challenge the model, and is it high-risk? | KVKK Art. 11(1)(g); BDDK Support Services Regulation Art. 4(1)(b) | AI Act Annex III 5(b), Art. 27 | AI credit scoring |
| 8. AI-enabled fraud (deepfakes, payment fraud, cybersecurity) | Who bears the loss when a customer is deceived? | TCMB Payment Services Regulation Arts. 52, 54, 69; Penal Code Art. 158(4) | PSR compromise text Art. 59; AI Act Art. 50(4) | Deepfake and APP fraud |
Licence perimeter: the regulated step decides, not the product
Only banks, e-money institutions, payment institutions and PTT may provide payment services (Law No. 6493 Art. 13), and acting like a payment or e-money institution without a TCMB permit carries one to three years’ imprisonment (Art. 28(1)). Deposit-taking is reserved to credit institutions (Banking Law No. 5411 Art. 60). Payment and e-money institutions may not lend (Law No. 6493 Arts. 14(4), 20(4)). Investment services and crypto-asset services need an SPK permit (Law No. 6362 Arts. 39, 35/B); an unlicensed crypto-asset service provider faces three to five years’ imprisonment (Art. 109/A).
On top sits a ban with no licence route: crypto assets “shall not be used directly or indirectly in payments” (TCMB Regulation of 16 April 2021, Art. 3(2)), and payment and e-money institutions may not intermediate transfers to or from crypto platforms (Art. 4(2)). That rules out a stablecoin cash leg or a crypto checkout today. For tokenised assets, ask first what right the token represents: a token changing hands does not transfer real-estate title (Civil Code Art. 705).
AI governance: a named person still decides
Compliance unit staff may evaluate alerts but cannot decide whether to report to MASAK (Compliance Programme Regulation Art. 18(2)); the compliance officer decides (Art. 19(1)(e)). Banks cannot outsource credit assessment or the credit decision (BDDK Support Services Regulation Art. 4(1)(b)). A person may object to an adverse outcome produced exclusively by automated analysis (KVKK Art. 11(1)(g)). Directive recommendations on capital markets instruments to a particular person are investment advice (SPK Communiqué III-37.1 Art. 45), whatever the disclaimer says. Since 1 August 2026, ads must disclose AI use that materially affects consumers’ economic behaviour (Commercial Advertising Regulation Art. 18(8)).
For EU users, the AI Act’s Article 50 transparency duties apply from 2 August 2026; providers of generative systems already on the market have until 2 December 2026 for the Article 50(2) marking duty. The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the high-risk rules for credit scoring of individuals to 2 December 2027, including a fundamental rights impact assessment for deployers (Art. 27).
Data sharing: payment accounts are open, the rest is not
Turkish open banking stops at payment accounts: payment initiation and consolidated account information under Law No. 6493 Art. 12(1)(f)-(g), run through BKM’s data-sharing services (ÖHVPS; card data added on 17 March 2026). Beyond that, bank customer secrets cannot be shared with third parties without the customer’s request or instruction, “even if” KVKK explicit consent is obtained (Banking Law Art. 73(3)), and KVKK Article 11 contains no portability right. In the EU, FiDA is still a proposal; the PSR’s final compromise text is dated 17 April 2026, and formal adoption is pending. The Medium-Term Programme 2027-2029 targets completing KVKK alignment with the GDPR in the third quarter of 2027.
Fraud liability: authorised or unauthorised decides who pays
A payment is authorised once the payer consents to it (TCMB Payment Services Regulation Art. 52(2)); one not approved by the agreed method is unauthorised (Art. 52(3)). For unauthorised payments the provider must prove authorisation (Art. 54(2)), and the payer bears at most TRY 250 for the 24 hours before notification, unless it acted fraudulently or with intent or gross negligence (Art. 54(4)-(5)); with non-consumer customers, these protections can be varied by contract (Art. 72). When a deceived customer gives the instruction, the payment is authorised: a payment to the IBAN given is deemed correctly executed (Art. 69), and no Turkish rule we have found grants an automatic refund. A FAST order cannot be revoked once the payer’s provider has received it, unless agreed (Art. 64(1)). Since 31 July 2026, Article 158(4) of the Penal Code halves the penalty where a participant only handed over cards or account access tools. The EU PSR compromise text adds a consumer refund for bank impersonation fraud (Art. 59); it is not yet adopted.
Key dates, 2026-2028
| Date | What happens | Article |
|---|---|---|
| 7 Oct 2026 | Verified originator data for wire transfers from TL 30,000 | Cross-border |
| 24 Dec 2026 (our calculation) | EU Member States must provide a European Digital Identity Wallet | e-KYC |
| 11 Jan 2027 | CRD VI: third-country firms need an authorised branch to take deposits in a Member State (exemptions apply) | BaaS |
| 18 Jan 2027 (latest) | US GENIUS Act takes effect | Tokenised money |
| 31 Jan 2027 | Mandatory sale of at least 35% of export proceeds runs to this date | Cross-border |
| 2027 system year | Turkish ETS price mechanism starts | Climate |
| 9 Apr 2027 | Euro-area payment and e-money institutions offer instant euro transfers | FAST |
| 10 Jul 2027 | EU AMLR applies | AI operations |
| 30 Sep 2027 | First CBAM declarations and certificate surrender for 2026 imports | Climate |
| 2 Dec 2027 | AI Act high-risk rules for Annex III systems, including credit scoring | Credit scoring |
| 24 Dec 2027 (our calculation) | Private relying parties that must use strong user authentication, including banks, accept EU wallets on request (micro and small enterprises excluded) | e-KYC |
| End-2027 | G20 cross-border payment targets (not binding) | Cross-border |
| By 2028 | ECB expects full Pontes implementation and an Appia blueprint | Tokenised money |
Where to start
- Draw each product’s fund flow and name the licence holder at every regulated step.
- Run cash legs through a bank or TCMB-licensed institution, never crypto assets.
- Before minting a token, write down what right it gives and against whom.
- Keep an inventory of models and agents, with the person who owns each decision.
- Write separate refund rules for authorised and unauthorised fraud cases.
- Route each data source through ÖHVPS, a customer instruction (Banking Law Art. 73(3)) or a KVKK basis.
- Add these dates to your compliance calendar; our fintech law hub tracks them.
Which Turkish authority licenses a fintech?
It depends on the activity: TCMB for payment and e-money institutions (Law No. 6493 Arts. 14(1), 18(2)), SPK for investment firms and crypto-asset service providers (Law No. 6362 Arts. 39, 35/B), and the BDDK Board for financing companies (Law No. 6361 Art. 4).
Can a Turkish business pay or get paid in stablecoins?
No. Article 3(2) of the TCMB Regulation on the Disuse of Crypto Assets in Payments bars using crypto assets directly or indirectly in payments, and in our reading a stablecoin is a crypto asset: Law No. 6362 has no separate stablecoin category (as of October 2026).
Does the EU AI Act apply to a Turkish fintech?
It can: it reaches a non-EU provider placing AI systems on the EU market, and a non-EU provider or deployer whose output is used in the Union (Art. 2(1)). Article 50 applies now; credit-scoring high-risk duties from 2 December 2027.
Sources. Law No. 6493 (RG 27.6.2013, No. 28690), Arts. 10, 12-14, 18, 20, 28; TCMB Regulation on Payment Services and Electronic Money Issuance (RG 1.12.2021, No. 31676, as amended to RG 4.9.2026, No. 33360), Arts. 18, 21, 34, 41, 52, 54, 64, 69, 72; TCMB Information Systems Communiqué (RG 1.12.2021, No. 31676), Art. 21; TCMB Regulation on the Disuse of Crypto Assets in Payments (RG 16.4.2021, No. 31456), Arts. 3, 4; Capital Markets Law No. 6362 (RG 30.12.2012, No. 28513), Arts. 3, 13, 35/B, 39, 109, 109/A, as amended by Law No. 7518 (RG 2.7.2024, No. 32590); SPK Communiqué III-37.1, Art. 45; Banking Law No. 5411 (RG 1.11.2005, No. 25983 bis), Arts. 60, 73; Law No. 6361 (RG 13.12.2012, No. 28496), Art. 4; BDDK Support Services Regulation (RG 5.11.2011, No. 28106), Art. 4; MASAK Compliance Programme Regulation (RG 16.9.2008, No. 26999), Arts. 18, 19; Law No. 6698 (KVKK) (RG 7.4.2016, No. 29677), Arts. 6, 11; Civil Code No. 4721 (RG 8.12.2001, No. 24607), Art. 705; Penal Code No. 5237 (RG 12.10.2004, No. 25611), Art. 158, as amended by Law No. 7589 (RG 31.7.2026, No. 33326); amendment to the Commercial Advertising Regulation (RG 1.7.2026, No. 33297); Medium-Term Programme 2027-2029 (RG 6.9.2026, No. 33362 bis); Regulation (EU) 2024/1689 (AI Act) (OJ L, 12.7.2024), Arts. 2, 27, 50, Annex III, as amended by Regulation (EU) 2026/1744; Regulation (EU) 2023/1114 (MiCA) (OJ L 150, 9.6.2023), Arts. 2, 48-50; PSR final compromise text, Council doc. 8221/26 (17.4.2026), Arts. 35, 43, 59; Regulation (EU) 2024/1624 (AMLR) (OJ L, 19.6.2024), Arts. 22, 76, 90. Further instruments are cited in each linked article.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Climate Fintech in Türkiye: CBAM, the Turkish ETS, Carbon Credits and ESG Data
October 22, 2026Open Banking in Türkiye: A Practical Legal Guide for Fintechs (2026)
October 18, 2026Open Finance After PSD2: Where the EU FiDA Proposal Stands and What It Means for Türkiye (2026)
November 2, 2026Tokenised Funds and Fractional Ownership in Türkiye: Which Regime Applies to Retail Investors (October 2026)
November 1, 2026Closing a Startup in Türkiye: Dissolution, Liquidation and Deregistration Under TCC 529–548
November 1, 2026Programmable Treasury in Türkiye: Conditional Payments, Smart Contracts and 24/7 Collateral (TBK, Law 6493)
October 31, 2026Related Practice Areas
ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →