Card acquiring in Türkiye sits under two laws and two regulators. Law No. 5464 on Bank Cards and Credit Cards reserves the signing of card merchant agreements to banks and to organisations with a permit from the Banking Regulation and Supervision Board (BDDK). Law No. 6493 makes acceptance of payment instruments a payment service that needs a licence from the Central Bank of the Republic of Türkiye (TCMB). A payment facilitator (payfac) that onboards small merchants under its own acceptance has to fit both. The sub-merchant data-sharing rules changed in July 2026. Our fintech law hub has the wider map; this guide reflects November 2026.
Two laws, two regulators
Law No. 5464 defines an “organisation that signs merchant agreements” (üye işyeri anlaşması yapan kuruluş) as a bank or other organisation that contracts with businesses to enable acceptance of bank or credit cards (Art. 3(h)). The merchant (üye işyeri) is the person that agrees, under that contract, to sell goods and services to cardholders (Art. 3(i)). Setting up card systems, issuing cards or signing merchant agreements needs a BDDK Board permit (Art. 4(1)). Conditions include a joint-stock company, fit founders, a statutory minimum paid-in capital, adequate staff and technology, and an entry fee of 5% of that capital (Art. 4(2)).
No one else may, as a business, set up a card system, issue cards or sign merchant agreements (Art. 34). Doing so without the permit carries one to three years’ imprisonment and a judicial fine of up to 1,000 days (Art. 38(1)). Unlicensed payment services are a separate offence (Law No. 6493 Art. 28(1)).
Law No. 6493 lists issuing or accepting a payment instrument as a payment service (Art. 12(1)(c)). TCMB’s Regulation on Payment Services (Official Gazette 1 December 2021, No. 31676) defines acceptance as services that end with the provider transferring funds to the merchant, including contracting with the merchant (Art. 3(1)(ğğ)). Law No. 6493 does not apply to matters regulated by Law No. 5464 and its secondary rules (Art. 24(1)).
Who may acquire card transactions
Banks acquire under their banking licence; the BDDK Regulation on Bank Cards and Credit Cards (Official Gazette 10 March 2007, No. 26458) does not apply its permit application and permit decision articles (among others, Arts. 5 and 11) to banks (Art. 28(1)).
Non-banks can acquire too. A 2020 amendment (Official Gazette 25 September 2020, No. 31255) deals with organisations holding a permit to sign merchant agreements that are non-bank payment service providers under Law No. 6493. It disapplies several BDDK rules to them, including the share-transfer approval paragraphs (Art. 28(2)), and requires an annual Annex 5 filing with the BDDK by 15 April (Art. 16(5)). In our reading, a payment or e-money institution signing card merchant agreements in its own name therefore needs both a TCMB licence covering acceptance and a BDDK permit under Law No. 5464. Our payment and e-money licence page covers the TCMB side.
How the payfac model fits Turkish rules
Visa defines a payment facilitator as “an entity that contracts with an Acquirer to deposit Transactions, receive settlement from, or contract with an Acquirer on behalf of a Sponsored Merchant” (Visa Core Rules, April 2026). A sponsored merchant is treated as a merchant of the payfac’s acquirer, and the acquirer is liable for acts and omissions of the payfac and its sponsored merchants. Mastercard follows a similar model, in which the acquirer registers the payfac. Scheme rules are contractual; they do not replace Turkish law.
Turkish rules speak of “sub-merchants” (alt işyeri). Where an acquirer’s merchant is a payment or e-money institution that lets sub-merchants use the acquirer’s POS under Law No. 6493, BDDK Regulation Art. 27/A(9) requires that:
- the institution reports each sub-merchant’s trade name and tax or citizenship number to the acquirer;
- every transaction carries a reference number identifying the sub-merchant, so the acquirer can track it;
- the acquirer does not contract with, or provide POS to, an institution that fails these duties, and does not use sub-merchant data for marketing.
TCMB’s Regulation covers a provider that serves merchants using another provider’s infrastructure (Art. 10(2)-(3)). It must give the host provider the merchant’s registry code, identity or tax number and name within ten business days. The host may ask for nothing more beyond other legal requirements and transaction data, may ask the provider not to serve a merchant on risk grounds, may not block the service arbitrarily, and may use the data only for risk assessment, reviews and technical set-up. Since version 1.2 of the İKS Rules (July 2026), this sharing must run through BKM’s İKS data-sharing services, under a transition BKM sets (Art. 22(4)).
Models compared
Our reading of the texts; we found no TCMB or BDDK guidance mapping these models.
| Model | What it does | What it needs |
|---|---|---|
| Bank acquirer | Signs merchant agreements, settles to merchants | Banking licence (BDDK Regulation Art. 28(1)) |
| Payment or e-money institution acquiring in its own name | Signs card merchant agreements directly | TCMB licence covering acceptance (Law No. 6493 Art. 12(1)(c)) and BDDK permit (Law No. 5464 Art. 4) |
| Licensed aggregator or payfac on an acquirer’s POS | Is the acquirer’s merchant, serves sub-merchants | TCMB licence; sub-merchant reporting and references (BDDK Regulation Art. 27/A(9)); data sharing with the host (TCMB Regulation Art. 10(2)) |
| Agent of a licensed institution | Performs payment services for the institution | Written contract, registration on the Association list, no sub-agents (TCMB Regulation Art. 18) |
| Referral or marketing partner | Introduces merchants | Not an agent if it never intermediates fund transfers (TCMB Regulation Art. 18(1)) |
| Technical service provider or gateway | Data, security, IT and network services supporting authorisation | Outside Law No. 6493 only if it never owns the funds at any point (Art. 12(2)(ğ)) |
An unlicensed platform collecting card payments for sellers fits none of these rows unless it is a genuine commercial agent under the narrow exclusion in Law No. 6493 Art. 12(2)(b); see our marketplace payments article.
Merchant onboarding and monitoring
Each merchant receives a single merchant code from BKM, matched to its address and identity or tax number (TCMB Regulation Art. 9(1)-(3)). Providers check the registry and any negative record before onboarding, and re-check at least yearly (Art. 10(1)). Terminations for reasons other than commercial or technical ones are reported with the reason (Art. 9(6)), within one business day under the İKS Rules (Art. 22(1)(c)). Transactions are recorded and monitored per merchant (Art. 10(4)).
Payment and e-money institutions are MASAK obliged parties (Measures Regulation Art. 4(1)(e)). Since 25 February 2025, for payment services through a terminal supplied under the acceptance service, merchant relationships get at least the enhanced measures in Article 13(1)(a)-(f) of the Compliance Programme Regulation: more information on the merchant and the relationship, senior approval and closer monitoring among them (banks may skip point (f)). Providers must regularly check that terminals are used for their purpose and not lent to others except where the rules allow (Art. 13(3)).
A payfac must also pass card conduct rules down to sub-merchants. Merchants may not charge cardholders a commission or similar extra for using a card (Law No. 5464 Art. 17(1)). In an instruction of 27 January 2021, TCMB relayed the BDDK’s finding that an instalment “maturity difference” added at online checkout breaches this, and its view that payment institutions should not keep working with such merchants, including those dropped by banks; TCMB asked for checks on existing and new merchants. Merchants may not disclose, store or copy card information without the cardholder’s written consent, or share card data with anyone but their acquirer (Art. 23(1)). For internet transactions, acquirers and merchants must set up 3-D Secure or equivalent authentication infrastructure and observe PCI DSS, although requiring it for each transaction is their choice (BDDK Regulation Art. 27/A(7)).
QR is part of acquiring too. In instructions of 2 May 2024 and 29 August 2025, TCMB asked FAST participants providing card acceptance to make their card-accepting merchants ready for FAST TR Karekod, with contractual steps due by 31 December 2025, unless a merchant opts out or TCMB considers it technically impossible.
Chargebacks and liability
A chargeback reverses a card transaction through the scheme’s dispute process; in a payfac chain the loss flows to whoever contracted with the merchant. Turkish law points the same way for remote sales: in disputes over transactions made by giving the card number by phone, online, order form or similar means, the burden of proof is on the merchant (Law No. 5464 Art. 32(1)), and the cardholder is not liable for unlawful use in such transactions (Art. 15(3)). Visa requires the payfac agreement to make the payfac liable for cardholder disputes caused by its sponsored merchants and financially liable for each transaction. It also requires a direct acquirer agreement with any sponsored merchant above USD 1 million in annual volume, subject to listed exceptions. Sub-merchant contracts should mirror this: dispute evidence, refunds, reserves or set-off, termination.
Where to start
- Choose your model: merchant agreements in your own name (TCMB licence and BDDK permit) or a licensed payfac on an acquirer’s POS.
- If you only refer merchants or supply technology, document that you never intermediate or own funds.
- Build sub-merchant reporting with tax or ID numbers and per-sub-merchant transaction references.
- Connect to İKS: checks before onboarding, yearly re-checks, one-day termination reports, data sharing through BKM.
- Apply the enhanced MASAK measures to terminal merchants and test that terminals are not lent out.
- Put surcharge, card-data, 3-D Secure and FAST TR Karekod duties into sub-merchant terms.
- Price chargeback risk: evidence, reserves and Visa’s USD 1 million direct-contract threshold.
FAQ
Can a payment institution acquire card transactions in Türkiye?
Yes, with a TCMB licence covering acceptance of payment instruments. To sign card merchant agreements in its own name it also needs a BDDK permit under Law No. 5464 Article 4; the BDDK Regulation expressly provides for non-bank providers holding that permit (Arts. 16(5), 28(2)).
Can an unlicensed company act as a payment facilitator?
In our reading, no. Acceptance is a payment service reserved to licensed providers (Law No. 6493 Arts. 12(1)(c), 13), and signing card merchant agreements is reserved to authorised organisations (Law No. 5464 Art. 34). It may act as a referral partner or technical provider if it never intermediates or owns funds.
What must a payfac report about its sub-merchants?
To the acquirer: each sub-merchant’s trade name and tax or citizenship number, and a unique reference in every transaction (BDDK Regulation Art. 27/A(9)). To a host provider whose infrastructure it uses: registry code, identity or tax number and name within ten business days (TCMB Regulation Art. 10(2)), via BKM’s İKS services.
Sources. Law No. 5464 on Bank Cards and Credit Cards (Official Gazette 1.3.2006, No. 26095), Arts. 3, 4, 15, 17, 23, 32, 34, 38; Law No. 6493 (Official Gazette 27.6.2013, No. 28690), Arts. 12, 13, 24, 28; BDDK Regulation on Bank Cards and Credit Cards (Official Gazette 10.3.2007, No. 26458, consolidated), Arts. 16, 27/A, 28; amending BDDK Regulation (Official Gazette 25.9.2020, No. 31255); TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (Official Gazette 1.12.2021, No. 31676, consolidated), Arts. 3, 9, 10, 18; Merchant Registry System (İKS) Rules, version 1.2 (July 2026), Art. 22; TCMB instruction on online shopping sites (27.1.2021); TCMB instructions on FAST TR Karekod merchant payments of 2.5.2024 and 29.8.2025; MASAK Measures Regulation (Official Gazette 9.1.2008, No. 26751), Art. 4; amendment to the Compliance Programme Regulation (Official Gazette 25.12.2024, No. 32763), Arts. 3, 13; Visa Core Rules and Visa Product and Service Rules (18.4.2026), sections 5.3.1.1-5.3.1.4 and definitions; Mastercard, Payment facilitators.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Acquiring a Turkish Payment or E-Money Institution: TCMB Approval for Share Transfers and What Due Diligence Must Cover
November 6, 2026Marketplace Payments in Türkiye: Payment Service or Commercial-Agent Exclusion?
November 4, 2026Banking-as-a-Service and Embedded Finance in Türkiye: Who Must Hold the Licence and Which Partnership Models Work
October 26, 2026Agentic Commerce in Türkiye: When an AI Agent Pays, Who Consented?
October 25, 2026In-App Purchases and Refunds in Türkiye: The Digital-Content Exception, Pre-Contract Information and the Child Who Bought Gems
October 21, 2026Deepfakes, Impersonation and APP Fraud in Türkiye: Who Bears the Loss?
October 20, 2026Related Practice Areas
Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Employment Law
Employment contracts, ESOP, termination, non-compete, work permits.
View service →