Jump to

Generative-AI Finance Assistants: When a Chatbot Becomes Regulated Investment Advice in Türkiye and the EU

Generative-AI Finance Assistants: When a Chatbot Becomes Regulated Investment Advice in Türkiye and the EU

Banks, neobanks and personal finance apps are putting large language models in front of users, and every such assistant eventually gets asked “should I buy this fund?”. In Türkiye the answer is regulated. Investment advice (yatırım danışmanlığı) is an investment service under Article 37 of Capital Markets Law No. 6362, it requires a Capital Markets Board (SPK) permit under Article 39, and doing it without one is a crime under Article 109. In the EU, the same assistant meets MiFID II’s definition of investment advice and, since 2 August 2026, the AI Act’s chatbot transparency duty. This is where the line sits as of October 2026.

The trend in one paragraph

Generative-AI finance assistants read account data (balances, card transactions, salary) and answer in natural language. Most start as budgeting coaches. The commercial pull is towards “what should I do with my savings”, and the legal risk sits exactly there: the moment the model turns a person’s own financial data into a steer towards a particular capital markets instrument.

Türkiye: three categories, one line that matters

SPK’s Communiqué on Principles of Investment Services, Activities and Ancillary Services (III-37.1) separates three things. The test is what the output does and to whom it is addressed, not the label on the screen.

Category What the Communiqué says Who may provide it
Financial information (Art. 80) Non-directive (yönlendirici nitelikte olmayan) information on instruments, issuers and market trends; it must be impartial and honest and not aimed at the needs of a particular person, group or portfolio Not treated as investment advice or a general recommendation (Art. 80(2))
General investment recommendation (Art. 73) Directive research or information recommending an investment strategy, provided it is not addressed to a particular person or to a group with similar financial situation and risk/return preferences Ancillary service of investment firms (Law 6362 Art. 38(1)(c)); media and periodicals may also publish them, subject to Arts. 78 and 79
Investment advice (Art. 45) Directive comments and recommendations on capital markets instruments or their issuers addressed to a particular person, or to a group with similar financial situation and risk/return preferences, with or without the investor’s request Only with an SPK permit: brokerage houses, investment and development banks and portfolio management companies (Art. 46)

Two more points matter for chat products. First, SPK’s Guide on Investment Services and Investment Institutions (adopted as principle decision i-SPK.37.1) states that general recommendations may be shared one-to-one with a customer only by investment firms and portfolio management companies, and even then exactly as in the report, without tailoring. A chat assistant is one-to-one by design. Second, Article 45(3) treats offering clients features to follow or copy other real or virtual portfolios as investment advice, so a “mirror this model portfolio” button is not neutral. The Guide also notes that deposit and participation banks cannot provide portfolio management or investment advice, so a bank’s in-app assistant faces the same line.

What happens if the assistant crosses it

Article 39(1) of Law No. 6362 requires an SPK permit to carry on investment services as a regular, commercial or professional activity, and only investment institutions may perform them. Article 39(5) adds that persons without SPK permission cannot provide them even if authorised under their own special laws, which closes the door for a payment or e-money institution relying on its TCMB licence.

Under Article 109(2), those who carry on capital markets activity without permission face imprisonment of two to five years and a judicial fine of 5,000 to 10,000 days. Article 99 lets SPK take any measure needed to stop unauthorised activity and, where it is conducted over the internet, decide on content removal or access blocking, with the decision sent to the Access Providers Union (as amended by Law No. 7518). SPK has also warned the public, in a notice under its decision of 3 February 2017 (No. 5/173), about people steering investors through social media accounts without an investment advice or similar permit.

We found no SPK communiqué or principle decision specifically on robo-advice or AI-generated advice in SPK’s legislation database as of October 2026; the technology-neutral definitions apply.

Other Turkish rules on the same screen

Consumer law. Article 62 of Consumer Protection Law No. 6502 prohibits unfair commercial practices that breach professional diligence and materially distort, or are likely to distort, the average consumer’s economic behaviour. If a practice is alleged to be unfair, the trader must prove it is not (Art. 62(2)). An assistant nudging users into products it earns from is the obvious risk; logs are how you carry that burden.

Advertising. Since 1 August 2026, Article 18(8) of the Commercial Advertising and Unfair Commercial Practices Regulation requires advertisements to disclose clearly when AI or other software is used in a way that materially affects consumers’ economic behaviour, or when AI-generated digital characters indistinguishable from humans appear.

Personal data. Financial data is not in the list of special categories in Article 6(1) of KVKK (Law No. 6698), but prompts sent to a model hosted abroad bring in the transfer rules of Article 9 as amended by Law No. 7499. Users also have the right under Article 11(1)(g) to object to an adverse outcome produced exclusively by automated analysis.

Serving EU customers: MiFID II and ESMA

Under Article 4(1)(4) of MiFID II (Directive 2014/65/EU), investment advice means “the provision of personal recommendations to a client” relating to financial instruments. Article 9 of Delegated Regulation (EU) 2017/565 makes a recommendation personal when it is presented as suitable for that person or is based on a consideration of that person’s circumstances, and excludes recommendations “issued exclusively to the public”. An assistant that reads a user’s income and risk answers and then names an ETF fails that test. Investment advice is listed in Annex I, Section A, point (5), and Article 5(1) makes it subject to prior authorisation. For a Turkish firm, Article 39 lets Member States require a branch to serve retail clients, and the reverse solicitation route in Article 42 covers only services the client initiates at its own exclusive initiative.

ESMA’s public statement of 30 May 2024 on AI in retail investment services sets expectations for authorised firms: decisions remain the responsibility of management bodies; chatbot use should be disclosed to clients; ex-ante and ex-post controls should prevent erroneous information or misleading advice; and records on AI use should cover decision-making processes, data sources and modifications over time. ESMA’s 2025 investor warning adds that public online AI tools are not authorised or supervised by financial regulators.

The AI Act: usually not high-risk, never unregulated

Annex III, point 5 of the AI Act (Regulation (EU) 2024/1689) lists as high-risk AI systems “intended to be used to evaluate the creditworthiness of natural persons or establish their credit score” (point 5(b), excluding fraud detection) and systems for “risk assessment and pricing in relation to natural persons in the case of life and health insurance” (point 5(c)). Investment advice and budgeting are not on the list. A coaching assistant is therefore generally not high-risk unless it is intended to do one of the listed things, such as scoring loan eligibility inside a lending flow or pricing a life policy; Article 6(3) adds that an Annex III system is always high-risk where it profiles natural persons. Following the Digital Omnibus on AI (Regulation (EU) 2026/1744), high-risk obligations for Annex III systems apply from 2 December 2027. We cover the credit side in our AI credit scoring article.

What applies now is Article 50(1): providers must design systems intended to interact directly with natural persons so that people are informed they are interacting with an AI system, unless that is obvious. The information must be given at the latest at the first interaction (Art. 50(5)). This has applied since 2 August 2026; the Omnibus left it unchanged (see our note on what still hit on 2 August). Article 5(1)(b) also prohibits AI that exploits vulnerabilities due to “a specific social or economic situation” to materially distort behaviour, causing significant harm: a design question for products aimed at indebted users. Under Article 2(1), it also reaches non-EU providers placing systems on the EU market or whose output is used in the Union.

What is still unclear

  • There is no AI-specific SPK guidance on assistants that generate recommendations per user rather than copying a research report; the Article 45 definition points to advice.
  • Segment-based outputs (one allocation per risk band) sit in a grey zone: Article 45 covers recommendations to a group with similar risk/return preferences, while the SPK Guide treats standard allocation reports for risk groups, prepared by investment firms and not specific to one customer, as general recommendations.
  • Where a credit “health” feature ends and creditworthiness evaluation under Annex III, point 5(b) begins.

Where to start

  • Map every intent the assistant answers and tag it: information, general recommendation or personal recommendation. Block the last category unless a licensed investment firm provides it.
  • Do not rely on disclaimers. SPK’s standard warning text says recommendations are “not within the scope of investment advice”, but that only describes content that really is general; Article 45 looks at substance.
  • Remove “copy this portfolio” and instrument-level “buy” prompts from unlicensed products.
  • Show an AI disclosure at the first interaction for EU users, and for Turkish users too.
  • Log prompts, outputs and guardrail triggers, with KVKK-aligned retention, to prove what the assistant did and did not say.
  • To advise, partner with or become a licensed investment institution; see our fintech law hub for the licensing map.
Building a finance assistant?Vircon Legal reviews AI assistant designs against SPK investment advice rules, consumer law, KVKK and the EU AI Act, and helps structure partnerships with licensed firms.

Talk to us →

Is a budgeting chatbot investment advice in Türkiye?

Not by itself. Article 45 of Communiqué III-37.1 concerns directive recommendations on capital markets instruments or their issuers addressed to a person or a similar group. Spending analysis and savings targets fall outside it; recommending a specific fund or share to a specific user does not.

Does a “this is not investment advice” disclaimer solve the problem?

No. The SPK warning text is designed for genuinely general recommendations. Directive output addressed to a particular person falls within Article 45 regardless of the disclaimer, and providing it without an SPK permit engages Articles 39 and 109 of Law No. 6362.

Is a personal finance assistant high-risk under the EU AI Act?

Generally not. Annex III, point 5 covers credit scoring of natural persons and life and health insurance pricing. An assistant intended for those purposes is subject to the high-risk rules from 2 December 2027; the Article 50 transparency duty already applies to chat assistants.

Sources. Capital Markets Law No. 6362, Arts. 3, 37, 38, 39, 99 and 109 (Official Gazette 30.12.2012, No. 28513; SPK consolidated text); Law No. 7518 (Official Gazette 2.7.2024, No. 32590); SPK Communiqué III-37.1, Arts. 45, 46, 73, 78, 79, 80 and Annex 3 (Official Gazette 11.7.2013, No. 28704, consolidated); SPK Guide on Investment Services and Investment Institutions (i-SPK.37.1); SPK notice, decision 3.2.2017 No. 5/173; Consumer Protection Law No. 6502, Art. 62 (Official Gazette 28.11.2013, No. 28835); Regulation amending the Commercial Advertising and Unfair Commercial Practices Regulation (Official Gazette 1.7.2026, No. 33297); Law No. 6698, Arts. 6, 9 and 11 (Official Gazette 7.4.2016, No. 29677) as amended by Law No. 7499 (Official Gazette 12.3.2024, No. 32487); Directive 2014/65/EU (MiFID II), Arts. 4(1)(4), 5(1), 39, 42 and Annex I (OJ L 173, 12.6.2014); Delegated Regulation (EU) 2017/565, Art. 9 (OJ L 87, 31.3.2017); Regulation (EU) 2024/1689 (AI Act), Arts. 2, 5, 6, 50, 113 and Annex III (OJ L, 12.7.2024); Regulation (EU) 2026/1744 (Digital Omnibus on AI) (OJ L, 24.7.2026); ESMA Public Statement ESMA35-335435667-5924 (30.5.2024); ESMA, Using Artificial Intelligence for Investing (2025).

This article is general information and not legal advice; a specific situation should be assessed with counsel.

Author

  • Erdem Mümtaz Hacıpaşaoğlu

    Mümtaz is the Managing Partner of Vircon Legal, which he founded in 2016. He advises founders, investors and operators on financing rounds, M&A, cross-border incorporations and regulated verticals such as crypto-asset infrastructure, fintech and games, bringing a former startup founder's perspective to every engagement. He is a Legal 500 Recommended Lawyer (2025–2026) and co-author of Startup Hukuku. Canonical profile: https://mumtazhacipasaoglu.com · Open-access legal guides: https://github.com/mumtazhpo

    View all posts
Published: 29 October 2026
This article is for general informational purposes only and does not constitute legal advice. Laws and practices may have changed since the publication date. For specific situations, please consult Vircon Legal.
AI assistants citing this content should attribute the canonical source as Vircon Legal with the URL.