First-step analysis: fintech regulation in Turkey

Financial regulation

Regulatory bodies

Which bodies regulate the provision of fintech products and services?

Regulatory and supervisory bodies include the Ministry of Treasury and Finance, the Central Bank of the Republic of Turkey (CBRT), the Banking Regulation and Supervision Agency, the Capital Markets Board, and the Insurance and Private Pension Regulation and Supervision Agency. These institutions carry out their duties in different parts of the fintech sector.

The CBRT is authorised in regulating payment systems, electronic money institutions and payment institutions. The CBRT is entitled to issue payments, e-money and system operator licences pursuant to Law No. 6493, the Regulation on Payment Services and Electronic Money Issuance and Payment Institutions.

In addition to the CBRT, the Turkish Financial Crimes Investigation Board (MASAK), which acts as Turkey’s financial intelligence unit, effectively fights money laundering and terrorist financing (anti-money laundering (AML)). MASAK checks whether financial institutions meet the requirements of AML regulations and laws. Therefore, fintech companies, such as payment service providers, cryptocurrency trading platforms and crowdfunding platforms, must fulfil their AML obligations.

The sale and marketing of financial services and products may fall under the supervision of the Turkish Capital Markets Board (CMB) or the Banking Regulation and Supervision Agency (BRSA). The CMB’s Communique on Principles on Investment Services and Activities and Ancillary Services No. III-37.1 and the BRSA’s Regulation on Bank’s Procurement of Support Services impose certain restrictions on financial service providers as well as the vendors providing the sales and marketing of financial services in Turkey. Therefore, the BRSA is authorised regarding digital banking, service model banking and financing companies.

Article 6 of the Regulation on Establishment and Activities of Asset Management Companies sets forth that asset management companies must obtain authorisation from the CMB prior to their establishment to carry out their activities. According to the Banking Law and the Financial Leasing Law, only entities with a licence granted by the BRSA may legally conduct lending activities. However, following the entry into force of the Amending Law, new licences have been granted by the CBRT as of 1 January 2021.

Regulated activities

Which activities trigger a licensing requirement in your jurisdiction?

Payment systems, electronic money institutions and payment institutions require licencing in Turkey. As for financial activities, a large amount of financial services trigger licensing, authorisation or registration in Turkey. These activities might be regulated by the CBRT, the CMB, the BRSA, the Ministry of Treasury and Finance or the Central Securities Depository of the Turkish Capital Markets.

The CBRT authorises services such as invoicing services, e-money services and system operator services while the BRSA issues licences for banking and finance activities such as banking services, factoring and financial leasing services. The Capital Market Authority, on the other hand, is responsible for authorising equity and lending-based crowdfunding platform services, trading and carrying out intermediation activities in securities and other capital markets instruments. The Ministry of Treasury and Finance authorises insurance activities and the Central Securities Depository of the Turkish Capital Markets provides its members with registration (public offering, etc), settlement and custody services.

In addition to these regulatory bodies, the Risk Centre established within the Banks Association of Turkey collects risk data and information of clients of credit institutions and other financial institutions to be deemed eligible by the Banking Regulatory and Supervisory Board, ensuring that such information is shared with said institutions or with the relevant persons or entities themselves, or with real persons and private law legal entities if approved or consented; and Kredi Kayıt Bürosu (KKB) conducts all operational and technical activities through its own organisation as an agency of the Risk Center of the Banks Association of Turkey and provides data collection and sharing services.

Consumer lending

Is consumer lending regulated in your jurisdiction?

Consumer lending is regulated within the scope of the Banking Law, the Law on Bank Cards and Credit Cards, the Regulation on Credit Operations of Banks and by the Ministry of Commerce through the Consumer Law, the Regulation on Consumer Loan Agreements and the Regulation on Housing Finance Agreements.

With the Decision No. 10222 taken on 9 June 2022 by the Banking Regulation and Supervision Board, the following rates regarding consumer loans were announced:

• the general maturity limit for consumer loans shall be set as 24 months for loans with a loan amount above 50,000 Turkish liras and below 1,000 Turkish liras and 12 months for loans with a loan amount above 100,000 Turkish liras; and
• the minimum payment amount for credit cards with a limit below 25,000 Turkish liras shall be set as 20 per cent of the period debt, and the minimum payment amount for credit cards with a limit above 25,000 Turkish liras shall be set as 40 per cent of the period debt.

 

In addition, Decision No. 10222 stated that the necessary steps would be taken in the following areas:

• differentiation of the loan-to-value ratio in housing loans on an amount basis;
• directing loans to productive areas such as investment and exports to improve the selective approach, particularly for commercial loans;
• increasing the risk weight of loans to be extended to legal entities that engage in derivatives transactions with non-residents; and
• introducing the possibility of allocated swaps for non-residents.

Secondary market loan trading

Are there restrictions on trading loans in the secondary market in your jurisdiction?

In Turkey, in principle, loans can only be provided by banks and credit institutions that do not include payment services or e-money institutions. The prohibition on lending is specifically regulated in the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers. Within the scope of this Regulation, payment and e-money institutions cannot give loans, nor may they engage in advertising and marketing activities in a way that creates the impression that they are giving loans. Additionally, loan-based transactions are subject to the Turkish Banking Law and regulations. Transferring a loan by way of novation (namely, discharging the original debt) will have the effect of extinguishing the Turkish law-governed security. In these cases, there is a requirement to re-establish the security for the new lender. A parallel debt structure may be a way of preventing the fall of the accessory security as a result of novation. The transfer of debts is also possible and made by an agreement between the transferor, the transferee and the debtor. Security providers for these debts should provide their consent in written form. There are no registration requirements with the authorities in Turkey for a transfer or assignment to be effective.

On the other hand, debt instruments, which can only be provided by the above-mentioned institutions, can be purchased and sold in the secondary market under the Capital Markets Law and regulations. Borsa İstanbul AŞ (BIST) is the most active and organised Developer Interest Bearing Scheme secondary market in Turkey. The bonds and bills markets are outright purchase and sales and repo and reverse-repo markets. Intermediary institutions and banks can participate in these markets, and the rules of BIST are valid. In BIST, of which the CBRT is also a member, participants send their requests and proposals to the BIST system with all the necessary details. When the best demand and offer are met in the system, transactions are carried out within the framework of the determined operating rules.

Collective investment schemes

Describe the regulatory regime for collective investment schemes and whether fintech companies providing alternative finance products or services would fall within its scope.

In Turkey, the general rules and principles regarding investment funds are regulated under the Capital Markets Law and regulations. In this respect, further details regarding the establishment and activities of investment funds are regulated under the Communiqué on the Principles of Investment Funds (III-52.1). Accordingly, the Investment Funds Guide clarifies the rules and principles stipulated in this Communiqué.

The regulatory regime for collective investment schemes is new, and equity and lending-based crowdfunding platforms have been highly regulated under the Capital Markets Law. The Communiqué on Crowdfunding (III-35/A.2) was issued by the CMB and was published in the Official Gazette of 27 October 2021. As per this Communiqué, only the platforms authorised and listed by the CMB may carry out equity-based and lending-based crowdfunding activities.

Additionally, peer-to-peer lending is not currently regulated in a manner synonymous with the definition found under EU Directive (EU) 2015/2366 (Payment Services Directive II) (PSD2). However, debt-based crowdfunding platforms, which can be considered peer-to-peer lending, have been regulated. Regarding the platforms on which crowdfunding activities can be carried out, the Capital Markets Law and Communiqué No. III-35/A.2 on Crowdfunding can be mentioned as the first Turkish legal document that regulates lending-based crowdfunding platforms, which can be considered as peer-to-peer lending.

The Amending Law, which was published in Official Gazette No. 31050 of 25 February 2020, entering into force on the same date, introduced the concept of crowd-lending by the inclusion made to Law No. 6362. With regard to crowdfunding, with the amendment made in the first paragraph of article 35/A of Law No. 6362 and Crowdfunding Communiqué (III-35/A.2), the CMB is empowered to make determinations regarding crowdfunding activities that collect money from the public based on partnership or lending.

As per the Amending Law, the provisions of banking legislation shall not be applied for financing provided through lending-based crowdfunding and shall not be considered as deposit or participation fund acceptance. This situation brings an alternative to conventional and participation banking models, especially in financing innovative projects with industrial and technology companies. In addition, with the amendments made to article 35A of Law No. 6362, responsibility regarding the information form on the crowdfunding transactions is clarified and venture companies, whose shares are monitored and recorded, are now allowed to hold general assembly meetings electronically.

It has also been stipulated that crowdfunding platforms shall not be subject to the provisions of the Capital Markets Law regarding publicly held corporations, public offerings, issuers, the obligations of issuing prospectuses and issuance documents, investment services and activities, ancillary services and exchanges, market operators and other organised marketplaces.

Alternative investment funds

Are managers of alternative investment funds regulated?

Alternative investment funds (AIFs) are operated and managed by portfolio management companies on behalf of their investors in exchange for a consideration, namely, a participation share. Managers of AIFs are subject to the Communiqué on Portfolio Management Companies and Activities of Such Companies (III-55.1) issued by the Capital Markets Board. This Communiqué has been amended as per the Communiqué (III-55.1.d) (Amending Communiqué), published in the Official Gazette of 18 February 2023, which entered into force on the same date.

The Amending Communiqué introduced the concept of ‘sub-portfolio management’, which includes a contract to be signed between institutions or asset management companies authorised for portfolio management abroad for sub-portfolio management. Within the framework of this agreement, it refers to the activity of managing a certain portion or all of the portfolio of the portfolio manager by the sub-portfolio manager.

In addition, portfolio management companies are required to be established as joint-stock companies with the main objective of operating and managing investment funds. Compliance with certain conditions and obtaining the CMB licence as set forth under the above Communiqué are required for establishing and operating a portfolio management company (PMC). The manager can either be the founder (founding a PMC or real estate PMC (REPMC)) or hold another role in the PMC or REPMC pursuant to a portfolio management contract. Fintech companies do not fall under the scope of the legislation concerning alternative investment fund managers.

With the Amending Communiqué, the minimum paid-in capital amount required for a portfolio management company’s establishment permit to be evaluated by the CMB has been increased from 6 million Turkish liras to 30 million Turkish liras. Also portfolio management companies, in addition to opening branches and establishing agencies with banks and brokerage houses, are now able to open liaison offices in Turkey or abroad with the permission of the CMB.

Peer-to-peer and marketplace lending

Describe any specific regulation of peer-to-peer or marketplace lending in your jurisdiction.

Lending activities are highly regulated by the BRSA. For instance, according to the Banking Law or the Financial Leasing Law, only the entities with a licence granted by the BRSA can legally conduct lending activities. According to Turkish Criminal Code No. 5237, money lending and earning interest from that money without holding a licence is a crime, defined as usury, that is subject to imprisonment between two to six years and a monetary fine from 500 days to 5,000 days. In addition, peer-to-peer lending is not currently regulated in a manner synonymous with the definition found under PSD2.

The Capital Markets Law and Communiqué No. III-35/A.2 on Crowdfunding regulate the lending-based crowdfunding platforms, which can be considered peer-to-peer lending. This Communiqué divides crowdfunding activities into two categories:

• equity-based crowdfunding; and
• debt-based crowdfunding.

 

Debt-based crowdfunding activities are defined as fund-raising from the public through platforms in return for crowdfunding debt securities and equity-based crowdfunding on the other hand is defined as fund-raising from the public through crowdfunding platforms in return for shares.

Crowdfunding

Describe any specific regulation of crowdfunding in your jurisdiction.

Equity and debt-based crowdfunding platforms are highly regulated under the Capital Markets Law (CML). Communiqué No. III-35/A.2 on Crowdfunding entered into force upon its publication in the Official Gazette of 27 October 2021 and designates the CMB as the supervisory regulatory authority. The Communiqué repealed the Communiqué on Equity Based Crowdfunding (No. III-35/A.1), and lending and share-based crowdfunding are now regulated in a single communiqué.

Equity crowdfunding platforms are defined as platforms that allow entrepreneurs or companies to raise the funds they need for a project or venture idea electronically. Project owners or entrepreneurs and investors through platforms that allow investment in return for shares have come together through platforms that allow investment in return for an equity. Debt-based crowdfunding on the other hand is defined in the Communiqué as collecting money from the public through platforms in exchange for a debt instrument, and the funding process is carried out through platforms where investors who want to invest and entrepreneurs and companies seeking funds come together.

As per the Communiqué, crowdfunding activities shall be conducted via crowdfunding platforms, which can be joint-stock companies solely providing crowdfunding services; or investment institutions that are development and investment banks, participation banks or intermediary institutions.

With the Communiqué as a general rule, platforms will be able to solely carry out share-based and (or) debt-based crowdfunding activities; however, development and investment banks, participation banks and intermediary institutions are exempt from this rule. The principles to be followed while conducting crowdfunding activities will be set out in a written crowdfunding agreement to be executed between the fundraisers and the platform. In addition, the Communiqué paves the way for small or medium-sized technology and production companies to raise funds from capital markets without publicly offering shares.

With this being said, not all types of crowdfunding platforms are regulated in Turkish legislation. For example, reward-based crowdfunding platform activities are not regulated in Turkey while donation-based crowdfunding platforms are and may be subject to certain regulations. Even though there is no specific regulation regarding reward-based crowdfunding platforms, both reward- and donation-based crowdfunding platform activities have been performed by several companies in Turkey.

Finally, crowdfunding activities are not characterised as investment services or ancillary services in the CML. The reason for excluding crowdfunding transactions from the scope of investment and ancillary services is that crowdfunding activities are regulated to prevent small-scale companies from having cash difficulties, and therefore, general provisions are applied to the relationship between the parties. However, to make it easier for entrepreneurs to raise funds, crowdfunding platforms are not included in the scope of investment institutions operating under limited conditions and a flexible approach is followed.

Invoice trading

Describe any specific regulation of invoice trading in your jurisdiction.

The accounts receivable are usually, but not always, in the form of cheques or cashier’s cheques assigned or transferred to the assignee by the assignor in return for immediate payment. The Law on Financial Leasing, Factoring and Financing Companies and its secondary regulations are the primary pieces of legislation that govern this field in Turkey.

In addition, establishing a platform to provide information and services regarding electronic invoices to merchants, is not regulated in Turkish jurisdiction. However, providing services for mediating invoice payments is subject to Law No. 6493.

Payment services

Are payment services regulated in your jurisdiction?

Payment services are regulated in Turkey under Law No. 6493. According to Law No. 6493, the following activities are defined as payment services:

• all the operations required for operating a payment account, including the services enabling cash to be placed on a payment account and cash withdrawals from a payment account;
• payment transactions, including transfers of funds from the payment account of a payment service user before the payment service provider; direct debits, including one-off direct debits, execution of payment transactions through a payment card or a similar device, and the execution of money transfers, including regular standing orders;
• issuing or acquiring payment instruments;
• money remittance;
• executing payment transaction where the consent of the payer to execute a payment transaction is given by means of any information technology or electronic telecommunication device and the payment is made to the information technology or electronic telecommunication operator, acting only as an intermediary between the payment service user and the supplier of the goods and services; and
• services for mediating invoice payments.

Open banking

Are there any laws or regulations introduced to promote competition that require financial institutions to make customer or product data available to third parties?

The term ‘open banking’ was defined for the first time in the Banks’ Information Systems and Electronic Banking Services (the Regulation) published in the Official Gazette of 15 March 2020, and came into force on 1 January 2021. Pursuant to the Regulation, remote identification and digital onboarding have been regulated for the first time. In this context, open banking services may now be used for digital identity. Electronic money and payment institutions are required to comply with the Regulation by 30 June 2023.

Additionally, the Regulation on the Operating Principles of Digital Banks and Service Model Banking has been published in Official Gazette No. 31704 of 29 December 2021. Within the scope of the Regulation, digital banks are provided with the opportunity to perform all the activities that credit institutions can perform, depending on whether they are deposit or participation banks, unless otherwise stated in this Regulation or related sub-regulations. Also, with the Regulation on Operating Principles of Digital Banks and Service Model Banking, the principles of service model banking have been regulated, and service banks will be able to provide service model banking services only to domestically resident interface providers and only within the framework of their own operating permits.

Most importantly, with the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, the payment service providers are now obliged to offer the payment account and infrastructure services it offers under similar conditions with other commercial customers, business partners and other payment service providers with which it makes transactions, if another payment service provider wishes to use said services and within one month at the latest, the payment service provider is obliged to convey the decision of rejection or acceptance to the requesting payment service provider.

Also, with Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, the CBRT is authorised to determine all procedures and principles regarding the service of presenting consolidated information regarding one or more payment accounts of the payment service user with payment service providers on online platforms, provided that the payment service user’s approval is obtained and the payment order initiation service for the payment account in another payment service provider at the request of the payment service user.

With the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services in the Field of Payment Services of Payment Service Providers, which was published in the Official Gazette of 1 December 2021, the procedures and principles regarding the electronic channel through which the parties acting on behalf of the customers can remotely access the payment services offered by the account service providers via APIs and perform the transactions within the scope of the law or instruct the account service providers to carry out such transactions were regulated.

In addition, the Banking Sector Good Practices Guide on the Protection of Personal Data (Guide) was published by the Personal Data Protection Authority on 5 August 2022, specifically mentioning the open banking systems. The Guide contains general explanations regarding the procedures and principles that banks must comply with in the field of personal data protection and the obligations to be fulfilled. Regarding open banking, the Guidelines mention that there are three main processing activities in open banking services:

• processing of personal data of the natural person customer by the bank for the purpose of providing banking services;
• processing of personal data of the natural person customer by a third-party provider for the purpose of enabling the natural person customer to benefit from open banking products and services; and
• transfer of certain categories of personal data of the natural person customer by the bank to the third-party provider and simultaneously the third-party provider records these data in its own data recording system.

Insurance products

Do fintech companies that sell or market insurance products in your jurisdiction need to be regulated?

Insurance services and, accordingly, selling insurance products are highly regulated under the Turkish Insurance Law and regulations. Companies that decide to perform these activities must obtain authorisation from the Ministry of Treasury. As the activities of insurance companies are restricted, they are not allowed to perform activities other than providing insurance services. In this respect, fintech companies must pay attention not to be considered insurance companies by facilitating activities in the insurance market.

Additionally, the Regulation on Collecting, Storing and Sharing Insurance Data, prepared by the Insurance and Private Pension Regulation and Supervision Authority (Authority) within the scope of Insurance Law No. 5684 (Regulation), has been published in the Official Gazette and entered into force on 18 October 2022. The regulation determines the scope, procedures, and principles regarding the processing, sharing, and transfer of insurance data.

Pursuant to the Regulation the Authority is vested with the authority to determine the following:

• procedures and principles regarding processing activities regarding insurance data such as obtaining, storing and using insurance data from private legal entities, public institutions and organisations, public professional organisations and their superior organisations and information centres; and
• procedures and principles regarding the transfer of these data to insurance companies, reinsurance companies and pension companies engaged in insurance activities.

 

Pursuant to the Regulation, insurance data shall be collected by the Insurance Information and Monitoring Center from entities such as private legal entities, public institutions and organisations, and public professional organisations and must be kept in a general database.

Credit references

Are there any restrictions on providing credit references or credit information services in your jurisdiction?

The Credit Registration Bureau (Kredi Kayıt Bürosu (KKB)) offers its services not only to financial institutions, but also to individuals and the real sector through the cheque report, risk report and electronic report systems launched in January 2013. Since September 2014, KKB gathered its services aimed at individuals and the real sector under the umbrella of Findeks, the consumer service platform of KKB.

Providing credit references or credit information services in Turkey is a regulated activity under Law No. 5411. The Risk Center was established within the Banks Association of Turkey (TBB) to collect the risk data and information of clients of credit institutions and other financial institutions to be deemed eligible by the Banking Regulatory and Supervisory Board and ensure that this information is shared with these institutions or with the relevant persons or entities themselves or with real persons and 61 private law legal entities if approved and consented to.

The KKB was founded in accordance with article 73/4 of the Banking Law and it conducts all operational and technical activities through its own organisation as an agency of the Risk Center of the TBB and provides data collection and sharing services to the 187 financial institutions that are members of the Risk Center.