Introduction

The rapid expansion of the digital economy has transformed payment services from supportive financial utilities into core components of global geopolitical and macroeconomic strategy. As Turkiye advances toward a highly digitized, cash-lite economic model, its regulatory framework for payment and electronic money institutions has undergone structural tightening.

This article analyzes the legal position of foreign electronic payment institutions in Turkiye, compares local regulatory architectures with global standards — principally the European Union’s PSD2/PSD3 framework — and proposes policy optimizations to balance market competitiveness with financial sovereignty.

1. Legal Standing of Foreign Payment Institutions in Turkiye

The entry, operation, and compliance obligations of payment and e-money institutions in Turkiye are strictly governed by Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions.[1] Initially supervised by the Banking Regulation and Supervision Agency, regulatory authority was fully transferred to the Central Bank of the Republic of Turkiye to align payment systems directly with monetary policy and financial stability.[2]

There are currently 58 licensed Electronic Money Institutions in Türkiye. All of these institutions are licensed by the Central Bank of the Republic of Türkiye and are officially registered members of the Turkish Payment and Electronic Money Institutions Association.

For foreign electronic payment institutions — such as PayPal, Wise, and Revolut — entering the Turkish market is not a matter of passporting a foreign license.

Global Companies with Local Subsidiaries

Turkish Fintechs with Foreign Investment or Ownership

• İninal: This pioneer prepaid-card provider is owned by Multinet Up, a major corporate services and fintech group based in France.
• PayTR: One of Turkiye’s largest payment and e-money gateways received significant foreign private-equity backing from Actera Group.
• Papara: Recently acquired by Better Headline, an international investment vehicle owned by the founders of the global marketplace Trendyol.

Strategic Global Partnerships

According to local regulations, international fintech companies that do not hold a direct license, such as Alipay or WeChat Pay, can still operate in Turkiye by establishing cross-border representation agreements with existing licensed Turkish institutions.

Territoriality Requirements

• Mandatory Local Incorporation: Foreign institutions cannot operate through cross-border branches. They must establish a local joint-stock company and obtain an explicit operating license from the CBRT.
• Data Localization: Law No. 6493 and secondary regulations require institutions to maintain their primary and secondary information systems and user data locally within Turkiye.[3]
• Shareholder Scrutiny: Any foreign entity acquiring a 10% or greater shareholding faces fit-and-proper background checks, including financial-transparency and criminal-record reviews.

2. Two Pathways for Foreign Market Entry

Pathway A — Full Licensing via Turkish Subsidiary

Foreign institutions seeking an independent presence must incorporate a Turkish joint-stock company and apply for a CBRT operating license. The CBRT regularly updates minimum equity thresholds to account for macroeconomic shifts, ensuring that only highly liquid, resilient firms operate in the market.

Table 1 — Minimum Financial Requirements (as of 2025)

Pathway B — International Cooperation (Article 19 Model)

A lesser-known but legally available mechanism allows foreign-licensed institutions to serve Turkish customers without obtaining a full local license. Under Article 19 of the Regulation on Payment Services, Electronic Money Issuance and Payment Service Providers, institutions may enter a cooperation arrangement with a licensed Turkish partner, subject to explicit CBRT approval.

Table 2 — Article 19 Cooperation Requirements

3. Comparative Matrix: Turkiye vs. EU Regulatory Frameworks

Turkiye’s regulatory environment shares structural origins with EU frameworks — primarily due to early harmonization efforts — yet has diverged materially on data governance, market access, and digital asset integration. The original article presents a structured comparison with the EU’s PSD2 and emerging PSD3 architecture.[4]

4. Regulatory Friction Points for Foreign Institutions

Turkiye’s regulatory framework is designed to safeguard financial sovereignty and protect consumers. However, it creates three distinct entry barriers for global electronic payment providers.

A. The Cloud Ban and the PayPal Precedent

The most notable exit from the Turkish market occurred when PayPal suspended operations after failing to secure a license renewal under the localization mandate. Global fintechs typically achieve economies of scale through centralized data centers. Turkiye’s insistence on physical server localization forces foreign providers to build redundant local infrastructure, materially reducing the financial viability of market entry.[5]

B. Strict Prohibition on Crypto and Stablecoins

Global payment processors — including Stripe, Visa, and PayPal — increasingly use stablecoins such as USDC to settle cross-border transactions instantly at low cost. The CBRT’s prohibition on crypto assets in payment services insulates the domestic market from these innovations, widening the technology gap with global fintech ecosystems.[6]

C. Capital and Guarantee Intensity

Substantial minimum equity requirements — while ensuring only resilient firms operate — represent a material capital expenditure for foreign startups establishing a Turkish footprint. The licensing timeline of one to two years compounds this burden by delaying the point at which a foreign entrant can generate revenue.

5. Cross-Border Transaction Dynamics

Cross-border electronic payment flows through non-bank financial institutions in Turkiye are structurally asymmetric, dominated by inbound streams.

• Micro-Exports and E-Commerce Payouts: Turkish merchants selling on global platforms such as Amazon and Etsy rely on integrated gateways to receive cross-border earnings. Turkiye’s total e-commerce volume surpassed TRY 1.85 trillion.
• Digital Freelancing and Remote Work: Turkish software developers and remote workers receive international transfers through local e-money wallets that function as cross-border collection points.
• Tourism and Expat Remittances: Traditional remittance corridors are migrating to digital wallets, particularly for transfers from the Eurozone and Gulf states directed at Turkiye’s expatriate population.

Outbound cross-border digital payments face tighter constraints. The majority of outbound flows consist of B2B spending directed at global technology providers such as Google Ads, Meta Ads and AWS. These flows are generally channelled through licensed domestic banks or CBRT-compliant e-money firms.[7]

At the infrastructure level, the CBRT’s TR QR Code initiative has achieved 85% penetration across active physical POS machines in Turkiye — a strategic foundation for eventual linkage with international clearing networks.[8]

6. Dedicated Accounts and User Fund Safeguarding

One of the most consequential divergences between the Turkish framework and global standards concerns how payment institutions are required to protect user funds held in transit.

A. The Turkish Framework: Mandatory Dedicated Accounts

Under the CBRT’s 2021 Payment Services Regulation and its 2023 amendment, Turkish payment and e-money institutions are obliged to hold user payment funds in strictly segregated dedicated accounts, physically separate from the institution’s own operational accounts.[9]

• Prohibition on Collateralization: Payment funds and e-money redemption funds held in dedicated accounts cannot be pledged, attached, or used as collateral by the institution.
• Interest Asymmetry: Payment institutions may earn overnight interest on funds held in safeguarding accounts, whereas e-money institutions are explicitly prohibited from doing so.
• Domestic Custody Only: Dedicated accounts must be held at a Turkish-licensed bank or the CBRT itself.
• No Insurance Alternative: Turkish law mandates physical account segregation as the sole method of fund protection.

B. The EU/Global Framework

Under PSD2 Article 10 and the forthcoming PSD3 framework, EU payment and e-money institutions are subject to comparable safeguarding obligations but with greater structural flexibility.[10] Institutions may use account segregation or an insurance or guarantee method. The proposed PSD3 framework also introduces the possibility of central-bank safeguarding accounts, subject to the central bank’s discretion.

C. Comparative Assessment

In practical terms, the Turkish regime reinforces the broader localization imperative. A foreign entrant cannot use its global treasury infrastructure to satisfy Turkish safeguarding obligations. It must open dedicated accounts at a Turkish bank, map Turkish user float to those accounts and prevent operational co-mingling.

7. Policy Optimization Proposals

I. Conditional Cloud and Hybrid Data Framework

The CBRT could transition from absolute physical data localization to a risk-based hybrid model. Foreign institutions could use global cloud infrastructure for high-performance processing, provided that an encrypted, real-time mirror copy of transaction data and user records is maintained in a local data warehouse accessible to Turkish regulators.

II. FinTech Passporting via Bilateral Digital Treaties

Turkiye could develop bilateral digital payment treaties with key trading blocs, particularly the EU and the UK, creating a fast-track, mutual-recognition licensing mechanism for highly compliant global institutions.

III. Regulatory Sandbox for Cross-Border Digital Asset Settlement

While protecting the Turkish Lira remains paramount, the CBRT could introduce a controlled sandbox allowing e-money institutions to use tokenized fiat assets or regulated stablecoins strictly for wholesale, cross-border trade settlements.[11]

Conclusion

Turkiye’s electronic payment framework is structurally sound, resilient, and advanced in terms of domestic orchestration, open banking execution, and real-time infrastructure. However, its defensive posture toward data localization, cross-border integration, and digital asset participation limits the engagement of top-tier foreign electronic payment institutions.

The Article 19 cooperation mechanism already provides a workable bridge for foreign institutions unwilling or unable to commit to full local establishment. Broadening awareness of this pathway, combined with the structural reforms proposed above, represents the most pragmatic route toward a more open, competitive, and internationally integrated Turkish payment sector.

Non-bank payment institutions in Turkiye — organized under TÖDEB — already process hundreds of billions of lira annually, with virtual and physical POS services accounting for approximately 75% of total transaction volume.[12]

References

1. Official Gazette of the Republic of Turkiye, Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, published on 27 June 2013.
2. Law No. 7192, which transferred regulatory powers over payment service providers from the BRSA to the CBRT.
3. CBRT, Regulation on Payment Services and Electronic Money Issuance, Payment Institutions and Electronic Money Institutions.
4. European Parliament and Council, Directive (EU) 2015/2366 on payment services in the internal market and the emerging PSD3/PSR framework.
5. CBRT Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Security Requirements.
6. CBRT, Regulation on the Disallowance of Crypto Assets in Payments.
7. OECD, Competition in Mobile Payment Services — Note by Türkiye.
8. CBRT, Annual Infrastructure Report, Chapter 2.5 on Financial Infrastructure.
9. CBRT Payment Services Regulation, as amended in 2023, and related commentary on safeguarding accounts.
10. European Banking Authority, PSD2 Article 10 safeguarding requirements and commentary concerning proposed PSD3.
11. Turkish Personal Data Protection Law No. 6698, Article 9.
12. TÖDEB, Sector Report on Payment and Electronic Money.