Turkey

The subsequent procedural history is as important as the initial revocation for assessing licensing risk: an Ankara administrative court stayed the revocation in December 2025, allowing Papara to resume operations pending appeal, and CBRT then reinstated the licence under TMSF trusteeship in January 2026. This sequence — revocation, judicial stay, reinstatement under trusteeship — represents an outcome materially different from either a clean revocation or an unchallenged continuation of licensed status, and should be read by market participants as the realistic range of outcomes for a comparable licensing enforcement action in Turkiye's current environment.

This cycle's evidence also includes a governance-level development at the prudential-regulator level: BDDK's board composition changed under Presidential Decision No. 2026/44 (6 February 2026 Official Gazette), with Yakup Asarkaya appointed Second Chairman under Chairman Sahap Kavcioglu. While this is a lower-materiality, monitored-tier development relative to the Papara licensing action, it is relevant context given BDDK's supervisory role over the banking and payments sector in which the Papara case unfolded.

Carrying the bank-PSP versus non-bank PI/EMI distinction explicitly: Papara operates under the non-bank payment-institution/e-money-institution licensing track rather than as a licensed bank, and this cycle's enforcement activity is concentrated specifically on that non-bank track. No comparable licensing enforcement action against a bank-licensed payment-services provider was identified this cycle, a distinction market entrants weighing a bank-charter route against a non-bank e-money licence route in Turkiye should factor into their risk assessment.

Outlook

The described "fourth such revocation" pattern suggests further licensing action against non-bank payment institutions on a similar illegal-betting-laundering theory is more likely than not in coming cycles; whether any such future action follows the same revocation-stay-reinstatement sequence as Papara, or results in a cleaner outcome, will be an important signal for the practical deterrent weight of CBRT licensing enforcement. The BDDK board reshuffle's effect, if any, on future enforcement posture is not yet resolved by available evidence.

Layered on top is a security-deposit buffer. Historically, bill-payment-intermediation PIs faced a TRY 2m minimum, other PIs TRY 3m and EMIs TRY 5m deposited with the CBRT, but these figures are now historical: the CBRT determines amounts annually and significantly higher figures — including a TRY 15m floor for bill-payment-only activity — entered force on 30 June 2025. The exact current schedule following the January 2025 determinations is not precisely captured and requires T1/T2 confirmation; the figures carried here are assessed with the caveat that current amounts are materially higher than the legacy thresholds. The distinction matters most for non-bank PIs and EMIs, for whom rising annual minimum-security thresholds raise the capital cost of operating and may pressure smaller licensees.

Outlook

The annual CBRT minimum-capital and security-deposit re-determination is expected around Q1 2026, set in January and entering force mid-year, and is trending materially higher. Precise capture of the post-30 June 2025 schedule remains an open intelligence gap requiring confirmation from primary or specialist sources.

Law No. 7518, published in the Official Gazette No. 32590 on 2 July 2024, established Türkiye's first crypto-asset legal framework, authorising the CMB/SPK to license and supervise CASPs, with TÜBİTAK supplying technical standards and MASAK enforcing AML. Crypto-asset trading is therefore regulated, but crypto-as-payment is separately and structurally blocked: the CBRT Regulation on the Disuse of Crypto Assets in Payments, published 16 April 2021 and in force 30 April 2021, prohibits direct or indirect use of crypto assets in payments and bars PIs and EMIs from intermediating crypto trading platforms. This prevents non-bank PIs and EMIs from building crypto-settled payment products domestically, sharply constraining any prospective TRY-denominated stablecoin payment rail.

On the public-money side, the bank-led CBDC programme is advancing. The CBRT completed phase one of the Digital Turkish Lira pilot in February 2024, confirming a two-tier programmable payment model with bank-supplied wallets, testing offline resilience and cross-border interoperability and aligning R&D with BIS standards.

Outlook

The stablecoin and digital-money module is established. The key uncertainty is whether stablecoin payment-rail issuance migrates into CBRT payment-services law; absent an official roadmap, the regulatory trajectory for TRY stablecoin payment instruments remains unconfirmed.

Cyber oversight is coordinated across BDDK for banking, the CBRT for payment systems, and a Cybersecurity Directorate whose powers were significantly expanded under Law No. 7545 enacted in March 2025. This third agency adds regulatory complexity for payment operators navigating overlapping BDDK, CBRT and Directorate mandates. The Law No. 7545 development is single-source and carried as assessed.

Outlook

The resilience module is established with high confidence on the authentication regime. The practical effect of the expanded Cybersecurity Directorate mandate on payment operators warrants monitoring as implementation detail emerges.

Troy itself has scaled materially: it reached approximately 67 million cards as of August 2025, capturing a roughly 20% share of card transactions, and offers credit, debit and prepaid issuing, with acceptance on the US Discover network since 2017. This represents meaningful domestic-scheme displacement of Visa/Mastercard volume; a research-stated figure of around 25 million cards in 2026 is materially understated and stale, and the corrected figure is carried pending higher-tier confirmation.

The access regime is mandatory. Article 8 of the CBRT Payment Services Regulation obliges all PSPs — banks, PIs and EMIs — to make their payment account services and payment infrastructure available to other PSPs on request, with a decision required within one month. This lowers entry barriers for non-bank PSPs but creates margin-squeeze friction with bank POS owners.

Outlook

The scheme module is established. Troy's continued card-base growth and transaction-share trajectory remain the key tracker, alongside the competitive dynamics created by mandatory Article 8 infrastructure access.

On the cross-border dimension, FAST cross-border interoperability is described only as under exploration, with no concrete timeline or specific corridor go-live commitments evidenced.

Outlook

The domestic instant rail is confirmed and established. Cross-border interoperability is the open question; the absence of concrete corridor timelines is a flagged intelligence gap pending further evidence.

Separately, and at a lower confidence tier still, reports describe Revolut in unconfirmed, deal-stage talks to acquire Turkish digital bank FUPS, with the reported rationale being a licensing fast-track into the Turkish payments market via acquisition of an already-licensed institution rather than a standalone BDDK application. Any such transaction would require BDDK approval, underscoring the regulator's continued gatekeeping role over market structure even in an acquisition-based entry route.

Read together, these two developments point toward a market structure in which both domestic incumbent-bank infrastructure plays and potential foreign-entrant acquisition plays are actively being pursued as routes into or within the Turkish payments market, against a backdrop in which the non-bank payment-institution sector is simultaneously facing significant licensing-enforcement pressure. This combination — commercial expansion activity proceeding in parallel with licensing enforcement risk — is itself the notable structural read for this cycle.

Outlook

Confirmation or denial of the Revolut-FUPS talks would be the most significant near-term market-structure signal, given its implications for the pace of foreign entry via acquisition. Continued expansion of bank-anchored BaaS infrastructure such as Apilion would reinforce the current bank-centred structural pattern rather than a shift toward non-bank-led market structure.

The practical sequence that followed — CBRT reinstating Papara's licence under TMSF trusteeship in January 2026, rather than either restoring full ordinary licensed status or maintaining the original revocation — indicates that the litigation outcome produced an intermediate supervisory arrangement rather than a clean win for either the regulator or the licensee. This is an important precedent for assessing litigation risk and likely outcomes in any comparable future enforcement dispute between a Turkish non-bank payment institution and its prudential regulator: the realistic range of outcomes includes intermediate, trusteeship-style arrangements alongside the two more commonly anticipated poles of clean revocation or clean reinstatement.

Outlook

Whether the underlying appeal on Papara's licence status is ultimately resolved in the company's favour, in CBRT's favour, or in some further intermediate arrangement will be an important signal for the durability of this cycle's judicial-constraint precedent. Any subsequent licensing enforcement action against another Turkish payment institution will be a natural test of whether courts continue to be willing to stay CBRT enforcement decisions pending appeal.

Merchant-acquiring operational economics — chargeback ratios, high-risk MCC handling and acquirer stress — are thinly evidenced beyond the competition-law framing and are an under-indexed area relative to the regulatory and structural findings.

Outlook

The acquiring module is established but assessed. The unresolved margin-squeeze question and the under-indexed operational economics are the priority areas for deeper evidencing in future cycles.

This thematic product-access regulatory view sits alongside the Digital Turkish Lira CBDC pilot, whose phase-one completion is detailed under W2, as a forward driver of programmable-payment innovation.

Outlook

The product-innovation module is established and confirmed. The principal near-term event is the 31 December 2025 ÖHVPS 2.0 production go-live and digital-wallet licensing deadline, after which full participant onboarding into the CBRT open-banking perimeter can be assessed.

Outlook

The consumer-protection module is established but assessed. Any move toward a mandatory reimbursement regime would materially change liability allocation; absent that, the system-level control architecture is the operative model and warrants monitoring for incremental change.

The original illicit-finance analysis of these surfaces is routed to the FIM monitor via cross-monitor flags. Within the World Payments view, the FATF status and the on-site inspection are noted only as direct drivers of the payments-sector enforcement crackdown and of residual correspondent-banking de-risking pressure.

Outlook

The Sentinel-fed AML/CFT surface is stable but consequential. The outcome of the late-2025 FATF on-site inspection is the key forward signal, with potential to drive further payments-sector enforcement; refer to the FIM monitor for the underlying financial-crime analysis.

Despite the June 2024 FATF delisting, international and correspondent banks continue to apply elevated enhanced due diligence, leaving Turkish counterparties with higher documentary requirements and residual de-risking pressure. This sustains cross-border friction for Turkish counterparties even as the formal FATF status has improved.

Outlook

The correspondent-banking module is stable with high confidence. Residual de-risking is expected to persist despite the delisting; whether elevated EDD eases as FATF on-site verification concludes is the key forward variable.

Separately, reports describe Revolut in rumoured, deal-stage talks to acquire Turkish digital bank FUPS, with the deal rationale reported as a licensing fast-track into the Turkish payments market. This event carries "rumoured" status rather than "completed" or even "announced" status, the deal amount was not publicly disclosed, and the sourcing is a single lower-tier commercial-intelligence platform rather than a primary corporate announcement from either party. Any resulting transaction would require BDDK approval.

Both events should be read as distinct from the structural bank-fintech-integration and market-access themes covered elsewhere: this module records the discrete commercial facts of the product launch and the rumoured acquisition talks themselves, not the broader structural or regulatory significance of either.

Outlook

Confirmation of the Revolut-FUPS talks progressing to a formal announcement, or their quiet lapse, will resolve the current rumoured status. Further product announcements building on or competing with the Apilion BaaS marketplace would be the natural next commercial-intelligence signal to watch in this space.