Turkey's banking and finance sector is one of the largest and most regulated in the emerging market world. The Banking Law No. 5411 and the Capital Markets Law No. 6362 form the twin pillars of a framework that governs everything from deposit-taking and lending to securities issuance and payment services. For international businesses entering Turkey - whether as investors, lenders, fintech operators or project sponsors - understanding this framework is not optional. Missteps at the licensing or compliance stage can result in regulatory sanctions, contract unenforceability, or criminal liability. This article maps the legal landscape: regulatory architecture, licensing requirements, lending structures, fintech rules, AML obligations, project finance mechanics, and dispute resolution pathways.
Turkey's financial sector is supervised by three principal authorities, each with distinct mandates and enforcement powers.
The Banking Regulation and Supervision Agency (Bankacılık Düzenleme ve Denetleme Kurumu, BDDK) is the primary regulator for deposit banks, participation banks, development and investment banks, and financial holding companies. BDDK issues operating licences, sets capital adequacy standards, conducts on-site inspections, and has the power to revoke licences or transfer management of distressed institutions. Its authority derives principally from Banking Law No. 5411.
The Capital Markets Board (Sermaye Piyasası Kurulu, SPK) regulates capital markets activities: securities issuance, investment firms, portfolio management, and collective investment schemes. The SPK operates under Capital Markets Law No. 6362 and has issued a dense body of secondary legislation covering prospectus requirements, market conduct, and intermediary obligations.
The Central Bank of the Republic of Turkey (Türkiye Cumhuriyet Merkez Bankası, TCMB) oversees monetary policy, payment systems, and foreign exchange regulation. Its role in banking supervision is indirect but significant: TCMB sets reserve requirements, regulates interbank markets, and administers the payment and settlement infrastructure under the Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions No. 6493.
The Financial Crimes Investigation Board (Mali Suçları Araştırma Kurulu, MASAK) sits within the Ministry of Treasury and Finance and is responsible for anti-money laundering and counter-terrorism financing (AML/CFT) oversight. MASAK's authority derives from the Law on Prevention of Laundering Proceeds of Crime No. 5549.
Understanding which regulator governs a specific activity is the first practical step for any international operator. A common mistake is assuming that a single licence covers all financial activities. In Turkey, deposit-taking, payment services, and capital markets intermediation each require separate authorisations from separate regulators.
Establishing a bank or financial institution in Turkey requires navigating a multi-stage licensing process administered primarily by BDDK.
Under Banking Law No. 5411, Article 6, a banking licence application must demonstrate minimum paid-in capital (currently set at a level that places it among the higher thresholds in the region), a credible business plan, fit-and-proper shareholders and managers, adequate internal control and risk management systems, and a transparent ownership structure. Foreign banks wishing to establish a subsidiary - rather than a branch - must additionally satisfy BDDK that their home-country supervisor exercises consolidated supervision equivalent to Turkish standards.
The licensing timeline is formally set at three months from the date a complete application is received, but in practice the process often extends to six to nine months due to requests for supplementary documentation and background checks on ultimate beneficial owners. BDDK has broad discretion to request additional information at any stage, and the clock effectively restarts with each supplementary request.
Branch establishment by a foreign bank follows a parallel but distinct track. Under Article 9 of Banking Law No. 5411, a foreign bank branch must allocate capital equivalent to the minimum required for a domestic bank, appoint a resident general manager, and maintain separate books in Turkey. Branches are subject to the same prudential requirements as domestic banks on a standalone basis.
For non-bank financial institutions - factoring companies, leasing companies, and consumer finance companies - the relevant framework is the Financial Leasing, Factoring, Financing and Savings Finance Companies Law No. 6361. These entities are also licensed by BDDK but face lighter capital requirements and a narrower scope of permitted activities.
Payment institutions and electronic money institutions operate under Law No. 6493 and are licensed by TCMB. The licence categories distinguish between payment institutions (which execute payment transactions but do not issue electronic money) and electronic money institutions (which issue stored value). The application process involves demonstrating minimum capital, safeguarding arrangements for client funds, and IT security standards.
A non-obvious risk for international groups is the requirement under Banking Law No. 5411, Article 18, that significant shareholding changes - defined as acquisitions crossing thresholds of 10%, 20%, 33%, or 50% of capital or voting rights - require prior BDDK approval. Failure to obtain this approval before completing a transaction can render the transfer legally ineffective and expose the acquirer to administrative fines.
To receive a checklist on banking licence applications in Turkey, send a request to info@vlo.com.
Lending in Turkey is governed by a combination of Banking Law No. 5411, the Turkish Commercial Code No. 6102, the Law of Obligations No. 6098, and sector-specific consumer credit legislation.
Only licensed banks, participation banks, and licensed non-bank financial institutions may extend credit on a professional basis. A foreign entity lending into Turkey without a local licence risks having the loan characterised as an unlicensed banking activity, which carries criminal penalties under Banking Law No. 5411, Article 150. This is a critical point for cross-border lenders: structuring a loan as a shareholder loan or intercompany facility does not automatically exempt the transaction from regulatory scrutiny if the lender is acting in a commercial capacity.
Loan agreements in Turkey are typically governed by Turkish law when the borrower is a Turkish entity, particularly for domestic facilities. However, for syndicated loans and project finance transactions involving international lenders, it is common practice to use English law for the facility agreement while subjecting Turkish security documents to Turkish law. This bifurcated structure is recognised in Turkish courts, provided the choice of law is explicit and the transaction does not involve a Turkish consumer.
Interest rate regulation is a recurring concern. TCMB publishes reference rates, and the Law of Obligations No. 6098, Articles 88 and 120, sets limits on contractual and default interest rates. For commercial loans between merchants, the parties have greater freedom to agree rates, but rates that are deemed usurious can be reduced by courts. In practice, it is important to consider that Turkish courts have occasionally recharacterised high-margin commercial loans as consumer transactions, triggering mandatory rate caps.
Foreign currency lending to Turkish borrowers is subject to restrictions introduced through TCMB regulations. Under TCMB Communiqué No. 32 on the Protection of the Value of Turkish Currency, Turkish resident companies below certain revenue and foreign currency debt thresholds are restricted from borrowing in foreign currency from domestic banks. Cross-border foreign currency loans from foreign lenders to Turkish residents are generally permitted but must be reported to TCMB within specified deadlines - typically 30 days from drawdown.
Security interests in Turkey are created under several legal regimes depending on the asset class. Mortgages over real property are governed by the Turkish Civil Code No. 4721 and require notarial execution and registration at the Land Registry (Tapu Sicili). Pledges over movable assets, including shares, receivables, and commercial enterprises, are governed by the Commercial Enterprise Pledge Law No. 6750 and the Pledge of Movables Law No. 6750. Share pledges over Turkish joint stock company (anonim şirket) shares require registration in the share ledger and, for listed companies, notification to the Central Registry Agency (Merkezi Kayıt Kuruluşu, MKK).
A common mistake by international lenders is relying on a pledge agreement executed abroad without completing the Turkish registration steps. An unregistered pledge may be valid between the parties but is unenforceable against third parties and in insolvency proceedings.
Turkey has developed a dedicated fintech regulatory framework over the past several years, centred on Law No. 6493 and its implementing regulations issued by TCMB.
Payment institutions licensed under Law No. 6493 may offer a defined list of payment services: account information services, payment initiation services, money remittance, card issuance, and merchant acquiring. Each service category requires specific authorisation, and a licence for one category does not automatically cover others. TCMB has the power to impose conditions, restrict activities, or revoke licences if an institution fails to maintain minimum capital, safeguarding ratios, or IT security standards.
Digital banking - the operation of a bank without physical branches - became formally possible following BDDK's Digital Bank Regulation issued under Banking Law No. 5411. Digital banks must meet the same capital and governance requirements as conventional banks but are subject to additional requirements around cybersecurity, data localisation, and customer onboarding through digital identity verification. The customer acquisition process must comply with the Electronic Signature Law No. 5070 and the identity verification standards set by BDDK.
Open banking in Turkey is implemented through TCMB's Payment Services Regulation, which requires banks and payment institutions to provide standardised APIs for account information and payment initiation services to licensed third-party providers. The regulation sets technical standards, consent management requirements, and liability allocation rules. Turkish open banking is broadly aligned with the European PSD2 framework but contains local adaptations, particularly around data residency.
Data protection obligations for fintech operators are governed by the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK). Financial institutions processing personal data must register with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK Authority), implement data processing agreements, and comply with cross-border data transfer restrictions. A non-obvious risk is that KVKK imposes data localisation requirements for certain categories of financial data, which can conflict with the data architecture of international fintech groups operating centralised cloud infrastructure.
Cryptocurrency and digital asset regulation in Turkey has evolved rapidly. BDDK and SPK have issued regulations restricting the use of crypto assets as a means of payment for goods and services within Turkey. Crypto asset service providers - exchanges and custody platforms - must register with SPK under the Capital Markets Law No. 6362 as amended. Unregistered crypto asset service providers face administrative closure and criminal liability for their managers.
To receive a checklist on fintech licensing and compliance in Turkey, send a request to info@vlo.com.
Turkey's AML/CFT framework is anchored in Law No. 5549 and the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism. MASAK is the financial intelligence unit and primary enforcement authority.
Obliged entities under Law No. 5549 include banks, participation banks, payment institutions, electronic money institutions, capital markets intermediaries, insurance companies, and certain non-financial businesses such as real estate agents, lawyers acting in financial transactions, and accountants. Each category of obliged entity must implement a risk-based AML/CFT programme covering customer due diligence (CDD), enhanced due diligence (EDD) for high-risk customers, transaction monitoring, suspicious transaction reporting (STR), and record-keeping.
Customer due diligence requirements are set out in the Regulation on Measures, which distinguishes between simplified, standard, and enhanced due diligence based on customer risk profile. For legal entities, CDD requires identification of the ultimate beneficial owner (UBO) - defined as natural persons holding, directly or indirectly, more than 25% of shares or voting rights, or otherwise exercising control. Turkish financial institutions are required to verify UBO information against the Central Registry of Beneficial Owners maintained by the Ministry of Treasury and Finance.
Suspicious transaction reports must be filed with MASAK within 10 business days of the suspicion arising. Failure to file, or filing with material inaccuracies, exposes the institution and its responsible officers to administrative fines and, in aggravated cases, criminal prosecution under the Turkish Criminal Code No. 5237.
International financial groups operating in Turkey through subsidiaries or branches must reconcile their global AML policies with Turkish requirements. A common mistake is assuming that a group-level AML programme automatically satisfies Turkish regulatory standards. MASAK conducts independent assessments and does not recognise foreign regulatory approval as a substitute for Turkish compliance. In practice, it is important to consider that MASAK has increased the frequency and depth of on-site inspections, with particular focus on correspondent banking relationships, cross-border wire transfers, and crypto asset transactions.
Turkey is a member of the Financial Action Task Force (FATF) and has been subject to mutual evaluation processes. The results of these evaluations have driven legislative amendments and increased enforcement activity. Financial institutions operating in Turkey should monitor MASAK guidance notes and FATF follow-up reports as part of their ongoing compliance monitoring.
Record-keeping obligations under Law No. 5549 require obliged entities to retain CDD documentation, transaction records, and STR files for a minimum of eight years from the date of the transaction or the end of the business relationship.
Project finance is a well-established financing technique in Turkey, used extensively in energy, infrastructure, real estate development, and public-private partnership (PPP) projects. The legal framework draws on Banking Law No. 5411, the PPP Law No. 3996, the Electricity Market Law No. 6446, and sector-specific concession legislation.
A typical Turkish project finance structure involves a special purpose vehicle (SPV) - usually a joint stock company (anonim şirket) or a limited liability company (limited şirket) - that holds the project assets, concession rights, and offtake agreements. Lenders take security over the SPV's shares, project accounts, receivables under the offtake agreement, and the concession or licence itself. The enforceability of security over concession rights requires careful analysis: some concessions are granted by public authorities and contain restrictions on assignment or pledge that must be addressed in the financing documents.
The security package in a Turkish project finance transaction typically includes:
Enforcement of project finance security in Turkey follows the general enforcement framework under the Enforcement and Bankruptcy Law No. 2004 (İcra ve İflas Kanunu). Mortgage enforcement proceeds through the execution offices (icra müdürlükleri) and involves a public auction process. The timeline from enforcement notice to completion of auction typically ranges from 12 to 24 months, depending on the complexity of the asset and the debtor's conduct. Lenders should factor this timeline into their recovery analysis when sizing the security package.
PPP projects in Turkey are governed by Law No. 3996 and sector-specific legislation. The PPP framework allows private sponsors to build, operate, and transfer infrastructure assets under long-term concession agreements with public authorities. Lenders to PPP projects benefit from step-in rights - the ability to cure a sponsor default and assume the concession - but these rights must be explicitly negotiated and documented in the concession agreement and the direct agreement with the relevant public authority.
Energy project finance has its own regulatory overlay. Electricity generation licences are issued by the Energy Market Regulatory Authority (Enerji Piyasası Düzenleme Kurumu, EPDK) under Electricity Market Law No. 6446. Lenders taking security over an electricity generation licence must obtain EPDK's consent to the pledge, and enforcement of the pledge requires EPDK approval for the transfer of the licence to a new operator. Failure to engage EPDK at the structuring stage is a recurring mistake that can render the security package materially incomplete.
The business economics of project finance in Turkey are shaped by the currency mismatch between Turkish lira revenues (common in domestic infrastructure) and foreign currency debt service. Lenders and sponsors address this through revenue indexation clauses, foreign currency offtake agreements where permitted by regulation, and currency hedging arrangements. The legal documentation for hedging - typically ISDA Master Agreements with Turkish law schedules - must be carefully integrated with the security package to ensure that close-out netting is enforceable under Turkish law.
To receive a checklist on project finance structuring and security in Turkey, send a request to info@vlo.com.
Banking and finance disputes in Turkey are resolved through a combination of Turkish courts, arbitration, and sector-specific administrative processes.
Turkish courts have jurisdiction over disputes involving Turkish-law governed contracts and Turkish-resident parties. The Commercial Courts of First Instance (Asliye Ticaret Mahkemesi) handle banking and finance disputes at first instance. Istanbul hosts specialised commercial courts with significant experience in complex financial matters. Appeals proceed to the Regional Courts of Appeal (Bölge Adliye Mahkemesi) and, on points of law, to the Court of Cassation (Yargıtay). The total duration of first-instance proceedings in complex banking disputes typically ranges from 18 to 36 months, with appeals adding further time.
Interim relief - attachment orders (ihtiyati haciz) and injunctions (ihtiyati tedbir) - is available under the Civil Procedure Code No. 6100 and the Enforcement and Bankruptcy Law No. 2004. An attachment order can be obtained ex parte on an urgent basis, typically within a few days of application, provided the applicant demonstrates a credible claim and the risk of asset dissipation. The applicant must post security, the level of which is set by the court.
International arbitration is widely used in Turkish banking and finance transactions, particularly for cross-border facilities and project finance. Turkey is a party to the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards, and foreign awards are enforceable in Turkey through recognition proceedings before the Commercial Courts of First Instance. The recognition process typically takes six to twelve months at first instance, subject to the grounds for refusal set out in the Turkish International Private and Procedural Law No. 5718.
A non-obvious risk in arbitration clauses is the treatment of disputes involving Turkish public entities. Turkish administrative courts (İdare Mahkemesi) have exclusive jurisdiction over certain disputes arising from concession agreements and public contracts, and an arbitration clause in a PPP agreement may be unenforceable to the extent it purports to submit administrative law disputes to arbitration. This issue requires careful drafting and, where necessary, the use of international investment arbitration under applicable bilateral investment treaties.
The Banking Arbitration Commission (Bankacılık Tahkim Komisyonu) provides a specialised dispute resolution mechanism for consumer banking disputes under Banking Law No. 5411. This mechanism is mandatory for consumer claims below a threshold set by BDDK and provides a faster, lower-cost alternative to court proceedings for retail customers. Corporate clients are not subject to this mandatory mechanism and retain full freedom to agree on dispute resolution forums.
Enforcement of foreign court judgments in Turkey follows the framework of Law No. 5718. Recognition requires reciprocity between Turkey and the judgment-rendering state, finality of the judgment, and compliance with Turkish public policy. In practice, judgments from EU member states and common law jurisdictions with established reciprocity are routinely recognised, while judgments from states without a bilateral treaty or established reciprocity face greater uncertainty.
What are the main risks for a foreign lender extending credit to a Turkish borrower without a local licence?
A foreign entity that extends credit to Turkish borrowers on a professional or commercial basis without holding a BDDK licence risks having its lending activity characterised as unlicensed banking under Banking Law No. 5411, Article 150. This can result in criminal liability for the individuals involved, administrative fines, and - critically - the potential unenforceability of the loan agreement in Turkish courts. The risk is most acute where the lender is making multiple loans to unrelated Turkish borrowers, charging market-rate interest, and holding itself out as a financial institution. Intercompany and shareholder loans within a corporate group carry lower risk but are not entirely exempt if structured in a way that resembles commercial lending. Engaging Turkish legal counsel before structuring a cross-border lending arrangement is essential to assess the regulatory characterisation of the transaction.
How long does it take to enforce a mortgage security over a Turkish project asset, and what does it cost?
Mortgage enforcement in Turkey proceeds through the execution offices under the Enforcement and Bankruptcy Law No. 2004. From the date of the enforcement notice to the completion of a public auction, the process typically takes between 12 and 24 months in straightforward cases, and longer if the debtor challenges the enforcement or files for bankruptcy protection. Costs include court fees, execution office fees, valuation costs, and legal fees, which together can reach the low to mid tens of thousands of USD or EUR for a significant asset. Lenders should also account for the possibility that the first auction may not attract a bid at the minimum price, requiring a second auction at a reduced reserve. Structuring the security package to include share pledges alongside the mortgage - allowing enforcement through share transfer rather than asset sale - can provide a faster enforcement route in some scenarios.
Should a Turkish project finance transaction use Turkish law or English law as the governing law for the facility agreement?
The choice of governing law depends on the lender group, the project type, and the enforcement strategy. For purely domestic transactions with Turkish lenders, Turkish law is standard and avoids the complexity of foreign law recognition. For international syndications involving foreign banks or development finance institutions, English law is commonly used for the facility agreement because it offers greater contractual flexibility, a well-developed body of finance law, and familiarity for international lenders. Turkish law must govern the security documents - mortgages, share pledges, and account pledges - because these are subject to mandatory Turkish registration requirements. The bifurcated structure is legally sound but requires careful coordination between the English-law facility agreement and the Turkish-law security documents to ensure that enforcement triggers, cure periods, and step-in rights are consistent across the documentation suite.
Turkey's banking and finance legal framework is comprehensive, multi-layered, and actively enforced. Licensing requirements are strict, AML obligations are detailed, and the security and enforcement framework - while functional - requires local expertise to navigate effectively. International businesses that treat Turkish financial regulation as a secondary concern typically encounter problems at the enforcement or dispute resolution stage that could have been avoided at the structuring stage. The cost of non-specialist mistakes - whether an unregistered pledge, an unlicensed lending arrangement, or a defective arbitration clause - consistently exceeds the cost of proper legal structuring from the outset.
Our law firm Vetrov & Partners has experience supporting clients in Turkey on banking, finance, and regulatory matters. We can assist with licence applications, loan structuring, security documentation, AML compliance programmes, and dispute resolution strategy. To receive a consultation, contact: info@vlo.com.