Lead Signal
The defining feature of Türkiye's payments operating environment is the degree to which the Central Bank of the Republic of Türkiye (CBRT) concentrates regulatory and infrastructural control. The CBRT is the sole competent licensing and supervisory authority for payment institutions and electronic money institutions under Law No. 6493 (2013) and its supporting secondary regulation, with non-bank market access available only through the PI and EMI licence categories. That authority was consolidated at the central bank when regulatory and supervisory power over payment and e-money institutions moved from BRSA/BDDK to the CBRT effective 1 January 2020 under Law No. 7192, with operational licensing under the new CBRT regulation commencing from 18 January 2021. The same institution develops and owns the FAST instant-payment system and acquired a controlling interest in the Interbank Card Center (BKM) in 2020, which operates the domestic card switch, local 3DS infrastructure, the BKM Express wallet and the Troy domestic scheme. This combination — single licensing gatekeeper, owner of the national instant rail, and controller of domestic card switching — gives the central bank unusually direct leverage over both non-bank market access and domestic scheme and rail infrastructure.
Against this centralised backdrop, the dominant near-term risk vector is enforcement rather than rulemaking. During 2025 a surge of money-laundering raids targeted payment companies and fintechs in the run-up to a FATF on-site inspection; dozens of payment companies had licences suspended, executives were detained, and several holdings were transferred to the state TMSF, with investigations focused on shareholder and ownership due-diligence failures during licensing. This wave materially raises operational and ownership-due-diligence risk for non-bank PSPs operating in Türkiye and sits directly atop the country's AML/CFT posture. Türkiye exited the FATF grey list on 28 June 2024 after completing its action plan, with one Recommendation (R.15) assessed partially compliant, but a late-2025 FATF on-site inspection reflects residual payments-sector supervision and enforcement gaps. The illicit-finance substance of these developments is carried for original analysis by the FIM monitor; the World Payments view registers only the regulatory and commercial consequences for market participants.
Other Developments
The non-bank prudential perimeter is tightening on the capital side. Historical minimum security deposits of TRY 2m for bill-payment-intermediation PIs, TRY 3m for other PIs and TRY 5m for EMIs are determined annually by the CBRT, and significantly higher figures — including a TRY 15m floor for bill-payment-only activity — entered force on 30 June 2025. Türkiye's e-money safeguarding regime relies on bank-held blocked segregation: e-money issuers must transfer funds received for issuance into a separate account at Law No. 5411 banks, which block those amounts during the term of use. Both mechanisms shape EMI cost and liquidity profiles and raise the capital cost of operating as a Turkish licensee.
On digital money, crypto-as-payment is structurally blocked while crypto-asset trading is regulated. The CBRT Regulation on the Disuse of Crypto Assets in Payments, published 16 April 2021 and in force 30 April 2021, prohibits direct or indirect use of crypto assets in payments and bars PIs and EMIs from intermediating crypto trading platforms. Law No. 7518, published in the Official Gazette on 2 July 2024, established Türkiye's first crypto-asset legal framework, authorising the CMB/SPK to license CASPs. There is no dedicated stablecoin category equivalent to MiCA EMTs; stablecoins currently fall under CML/CMB crypto-asset rules. The Digital Turkish Lira CBDC pilot completed phase one in February 2024, confirming a two-tier programmable model with bank-supplied wallets.
The resilience regime is among the strictest globally: universal two-factor authentication is mandated and SMS-OTP is banned for mobile banking under the BDDK 2020 banking IT regulation, with real-time incident reporting, data localisation and an annual IS risk assessment reported to the CBRT by end-January. Oversight is coordinated across BDDK, CBRT and a Cybersecurity Directorate whose powers were significantly expanded under Law No. 7545 in March 2025. In domestic schemes, Troy reached approximately 67 million cards as of August 2025, capturing roughly a 20% share of card transactions.
Commercial momentum remains strong despite the enforcement climate. iyzico, wholly owned by Prosus, completed its $87M acquisition of Paynet in February 2025; investment platform Midas raised an $80M round led by QED Investors in Q3 2025; and ColendiBank, an AI-based fully-digital deposit bank, began operating in March 2025.
Cross-Monitor Connections
The W11 AML/CFT surface is sourced from the Sentinel.gi feed, and the original illicit-finance analysis of MASAK's FIU status, the FATF grey-list exit and the 2025 payments-sector money-laundering crackdown is routed to the FIM monitor. The World Payments view carries provenance and the consequences for licensing, enforcement and correspondent-banking access only. The same FATF dynamic links the enforcement crackdown in W7, the supervisory state in W11 and the residual de-risking pressure in W12.
Outlook
The near-term horizon is dominated by deadlines and verification. ÖHVPS 2.0 open-banking certification and production go-live, alongside digital-wallet provider CBRT licensing, carried a 31 December 2025 compliance deadline, bringing TPPs and wallet providers fully into the CBRT perimeter. The late-2025 FATF on-site inspection may drive further payments-sector enforcement, and the annual CBRT minimum-capital and security-deposit re-determination — set in January and entering force mid-year — is trending materially higher. Residual correspondent-banking de-risking is expected to persist despite the June 2024 delisting, sustaining elevated documentary friction for Turkish counterparties.