TRschema world-payments-v1trajectory: not recorded
Last updated · 14 modules · 65 sourced
findings · 79 sources in the cumulative register
14Modulesbaseline.modules[]
65Findingsmodules[].findings[]
12Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix(sums to 14 rendered modules; click to filter)
Jurisdiction brief
Lead Signal
Turkiye's bank-centred payments licensing regime came under direct enforcement stress this cycle, with the Central Bank of the Republic of Turkiye revoking, and then judicially reinstating, e-money institution Papara's licence over an illegal-betting-linked money-laundering probe. CBRT revoked Papara's Law No. 6493 e-money licence on 31 October 2025 under Articles 16 and 19 following a MASAK investigation; an Ankara administrative court stayed the revocation in December 2025, and CBRT reinstated the licence under TMSF trusteeship in January 2026. Lexology Pro reporting characterises this as the fourth Turkish fintech e-money or payment-licence revocation over illegal-betting allegations within the year, indicating a systemic enforcement pattern against non-bank payment institutions rather than an isolated case. The bank-versus-non-bank distinction is analytically central to this case: Papara operates under the nonbank_pi_emi licensing track rather than as a licensed bank, and this cycle's evidence indicates non-bank payment institutions are bearing the brunt of illegal-betting-related enforcement risk in Turkiye's payments market, with direct implications for how such institutions should weight ongoing licensing and litigation risk relative to bank-licensed competitors. The judicial mechanics of the case are themselves noteworthy: Ankara's 25th Administrative Court's stay of execution allowed Papara to resume operations pending appeal notwithstanding CBRT's revocation decision, and CBRT's subsequent reinstatement under TMSF trusteeship represents an intermediate supervisory posture — neither full restoration of ordinary licensed status nor continued suspension — that is itself a distinctive feature of how Turkish authorities are currently managing enforcement actions against systemically relevant non-bank payment institutions.
Other Developments
BDDK board reshuffle. Turkiye's banking regulator, BDDK, saw a board composition change under Presidential Decision No. 2026/44 (6 February 2026 Official Gazette), appointing Yakup Asarkaya as Second Chairman under Chairman Sahap Kavcioglu. BDDK's board sits at the apex of Turkiye's prudential supervision of the banking and payments sector, and a chairmanship-level appointment during an active enforcement period involving one of the sector's most prominent e-money institutions is a governance signal worth tracking for any indication of enforcement-posture continuity or change under the reshuffled board.
Bank-fintech integration continues. Aktif Bank's subsidiary Aktif Ventures launched Apilion, a banking-as-a-service API marketplace giving fintechs access to core banking, investment, payments and insurance infrastructure. This is a low-confidence, single-sourced development, but it is consistent with reporting characterising the Turkish market as one where fintechs grow in partnership with banks rather than in competition with them. Aktif Ventures' Apilion platform is positioned as infrastructure enabling fintechs to plug into core banking, investment, payments and insurance rails through a single API layer, which, if the reporting proves durable, would reinforce Turkiye's existing pattern of bank-anchored fintech infrastructure rather than disintermediated non-bank competition.
Unconfirmed Revolut-FUPS acquisition talks. Deal-stage, unconfirmed reports describe Revolut in talks to acquire Turkish digital bank FUPS as a potential licensing fast-track into the Turkish payments market. This rests on a single lower-tier source and is explicitly a rumoured rather than confirmed transaction; any such deal would require BDDK approval. The rationale reported for the talks is explicitly a licensing fast-track: acquiring an already-licensed Turkish digital bank would allow Revolut to enter the market without pursuing its own BDDK licence application from scratch, consistent with how foreign entrants have historically approached market access in jurisdictions with demanding licensing processes.
Cross-Monitor Connections
The Papara enforcement action and its illegal-betting-related money-laundering basis is the subject of first-party analysis at the Financial Integrity Monitor, which this brief does not reproduce; World Payments Monitor's own treatment is confined to the payments-licensing, litigation and market-structure dimensions of the same underlying facts. The illegal-gambling market-access and enforcement dimension of the same enforcement wave is separately covered by the Advennt Gambling Regulatory Monitor from an operator-risk perspective. This division of labour matters for readers assessing overall Turkish payments-sector risk: the picture presented here should be read alongside, not instead of, that connected analysis, since all three monitors are drawing on overlapping but analytically distinct readings of the same underlying enforcement wave.
Outlook
The most consequential open question is whether Turkiye's non-bank payment institutions face further licence actions on the Papara pattern, which would confirm a systemic rather than episodic enforcement posture against the sector; the "fourth such revocation within the year" characterisation already reported suggests this is more likely than not. Separately, the practical effect of judicial review on CBRT enforcement outcomes bears continued monitoring, since it materially affects how much deterrent weight administrative licence action actually carries in the Turkish payments market. Whether the Revolut-FUPS talks, if confirmed, proceed to a BDDK-approved transaction would be a significant market-structure signal. For risk assessments generally, the Papara case is a reminder that non-bank e-money institutions handling high transaction volumes remain subject to abrupt, headline-level licensing action even where the underlying legal process ultimately produces a more nuanced outcome than the initial revocation headline suggested.
trust tier: ai_unverified
Regulatory Status
Turkiye's payments regulatory environment this cycle is defined by active enforcement stress on its non-bank payment-institution licensing regime and by a governance change at its prudential regulator. CBRT revoked, and subsequently reinstated under TMSF trusteeship, Papara Elektronik Para A.S.'s e-money licence over an illegal-betting-related money-laundering probe, in a sequence that included an Ankara administrative court's stay of the original revocation. Lexology Pro reporting characterises the Papara case as the fourth such Turkish fintech licence revocation over illegal-betting allegations within the year, indicating a systemic rather than isolated enforcement pattern against the sector. Separately, BDDK's board composition changed under Presidential Decision No. 2026/44, with Yakup Asarkaya appointed Second Chairman under Chairman Sahap Kavcioglu.
Commercially, Turkiye's bank-centred fintech market structure continues to develop through both domestic incumbent-bank infrastructure investment (Aktif Bank's Apilion banking-as-a-service marketplace) and potential foreign-entrant activity (unconfirmed Revolut-FUPS acquisition talks, reportedly aimed at a licensing fast-track into the market). Both of these commercial developments rest on lower-tier sourcing and should be treated as developing rather than settled signals.
Outlook
The most consequential open questions for Turkiye's payments market this cycle are whether further non-bank payment institutions face licensing action on the Papara pattern, whether the Papara appeal resolves toward full reinstatement or a different outcome, and whether the Revolut-FUPS talks, if confirmed, proceed to a BDDK-approved transaction.
14 of 14 modules
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
Non-bank market access via PI and EMI licences under Law No. 6493 (2013); CBRT competent authority since 1 Jan 2020 (operational licensing from 18 Jan 2021); ~86 licensed PI/EMIs in 2024.
Movement — NEWLicensing enforcement pattern established via Papara caseCold-start jurisdiction, first material domain content
Open gap — wpm-int-4Internal date inconsistency: W1a standing prose cited Law No. 6493 as 2016 whereas the correct enactment year is 2013 (challenger f-004). Needs correction at composer/patch stage.no under-indexing note recorded
Standing sub-brief415 words · last cycle wpm-2026-08-21
Licensing, Authorisation & Market Access
Turkiye's payments and e-money licensing regime came under direct and material enforcement stress this cycle. The Central Bank of the Republic of Turkiye (CBRT) revoked Papara Elektronik Para A.S.'s e-money institution licence on 31 October 2025, acting under Law No. 6493 Articles 16 and 19 following a MASAK investigation into illegal-betting-related money laundering. Lexology Pro reporting characterises this as the fourth Turkish fintech e-money or payment-licence revocation over illegal-betting allegations within the same year, a high-confidence indicator that Turkish authorities are treating licensing enforcement as a primary lever against illegal-betting-related financial flows moving through the non-bank payment sector specifically.
The subsequent procedural history is as important as the initial revocation for assessing licensing risk: an Ankara administrative court stayed the revocation in December 2025, allowing Papara to resume operations pending appeal, and CBRT then reinstated the licence under TMSF trusteeship in January 2026. This sequence — revocation, judicial stay, reinstatement under trusteeship — represents an outcome materially different from either a clean revocation or an unchallenged continuation of licensed status, and should be read by market participants as the realistic range of outcomes for a comparable licensing enforcement action in Turkiye's current environment.
This cycle's evidence also includes a governance-level development at the prudential-regulator level: BDDK's board composition changed under Presidential Decision No. 2026/44 (6 February 2026 Official Gazette), with Yakup Asarkaya appointed Second Chairman under Chairman Sahap Kavcioglu. While this is a lower-materiality, monitored-tier development relative to the Papara licensing action, it is relevant context given BDDK's supervisory role over the banking and payments sector in which the Papara case unfolded.
Carrying the bank-PSP versus non-bank PI/EMI distinction explicitly: Papara operates under the non-bank payment-institution/e-money-institution licensing track rather than as a licensed bank, and this cycle's enforcement activity is concentrated specifically on that non-bank track. No comparable licensing enforcement action against a bank-licensed payment-services provider was identified this cycle, a distinction market entrants weighing a bank-charter route against a non-bank e-money licence route in Turkiye should factor into their risk assessment.
Outlook
The described "fourth such revocation" pattern suggests further licensing action against non-bank payment institutions on a similar illegal-betting-laundering theory is more likely than not in coming cycles; whether any such future action follows the same revocation-stay-reinstatement sequence as Papara, or results in a cleaner outcome, will be an important signal for the practical deterrent weight of CBRT licensing enforcement. The BDDK board reshuffle's effect, if any, on future enforcement posture is not yet resolved by available evidence.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Safeguarding under Law No. 6493 requires e-money issuers to convert received funds into e-money without delay and to hold customer funds in segregated, blocked bank accounts at Law No. 5411 banks during the term of use, separate from the institution's own assets. PIs/EMIs must additionally deposit minimum security amounts with the CBRT (tiered by activity). Institutions are activity-restricted to permitted payment/e-money services. Conduct is governed by framework agreements with users, KVKK data-protection obligations, mandatory data localisation within Türkiye, and MASAK AML reporting. The CBRT supervises, audits, and can suspend or revoke licences.
Open gap — wpm-int-1Current (post-30 June 2025) minimum-capital and security-deposit thresholds for PIs/EMIs are not precisely captured; research cited historical TRY 2m/3m/5m figures while challenger evidence indicates materially higher amounts (e.g. TRY 15m bill-payment floor). Exact current schedule needs T1/T2 confirmation.Emerging-market non-bank prudential thresholds are under-tracked; annual CBRT re-determinations require active monitoring.
Standing sub-brief239 words · last cycle wpm-2026-06-27
Conduct, Safeguarding & Promotions
Türkiye's safeguarding regime for non-bank EMIs rests on bank-held blocked segregation. E-money issuers must transfer funds received for e-money issuance into a separate bank account at Law No. 5411 banks, with the holding bank blocking those amounts during the term of use, thereby segregating customer funds from institution assets. This is a segregation mechanism rather than an insurance or trust structure, and it shapes EMI cost and liquidity profiles accordingly.
Layered on top is a security-deposit buffer. Historically, bill-payment-intermediation PIs faced a TRY 2m minimum, other PIs TRY 3m and EMIs TRY 5m deposited with the CBRT, but these figures are now historical: the CBRT determines amounts annually and significantly higher figures — including a TRY 15m floor for bill-payment-only activity — entered force on 30 June 2025. The exact current schedule following the January 2025 determinations is not precisely captured and requires T1/T2 confirmation; the figures carried here are assessed with the caveat that current amounts are materially higher than the legacy thresholds. The distinction matters most for non-bank PIs and EMIs, for whom rising annual minimum-security thresholds raise the capital cost of operating and may pressure smaller licensees.
Outlook
The annual CBRT minimum-capital and security-deposit re-determination is expected around Q1 2026, set in January and entering force mid-year, and is trending materially higher. Precise capture of the post-30 June 2025 schedule remains an open intelligence gap requiring confirmation from primary or specialist sources.
No periodic updates recorded against this sub-brief.
Crypto-as-payment banned since Apr 2021; CASPs regulated under Law No. 7518 (Jul 2024); no MiCA-equivalent stablecoin category; Digital TL CBDC pilot phase one complete.
Open gap — wpm-int-2The future migration of stablecoin payment-rail issuance to CBRT payment-services law rests on single-source T3 commentary with no official roadmap; the regulatory trajectory for TRY stablecoin payment instruments is unconfirmed.no under-indexing note recorded
Standing sub-brief249 words · last cycle wpm-2026-06-27
Stablecoins & Digital Money
Türkiye has no dedicated stablecoin category equivalent to MiCA EMTs; stablecoins currently fall under CML/CMB crypto-asset rules established by Law No. 7518. Industry commentary anticipates that stablecoin payment-rail issuance may migrate to CBRT payment-services law in future, but no official roadmap is published, and that forward-migration assertion rests on single-source commentary rather than confirmed policy.
Law No. 7518, published in the Official Gazette No. 32590 on 2 July 2024, established Türkiye's first crypto-asset legal framework, authorising the CMB/SPK to license and supervise CASPs, with TÜBİTAK supplying technical standards and MASAK enforcing AML. Crypto-asset trading is therefore regulated, but crypto-as-payment is separately and structurally blocked: the CBRT Regulation on the Disuse of Crypto Assets in Payments, published 16 April 2021 and in force 30 April 2021, prohibits direct or indirect use of crypto assets in payments and bars PIs and EMIs from intermediating crypto trading platforms. This prevents non-bank PIs and EMIs from building crypto-settled payment products domestically, sharply constraining any prospective TRY-denominated stablecoin payment rail.
On the public-money side, the bank-led CBDC programme is advancing. The CBRT completed phase one of the Digital Turkish Lira pilot in February 2024, confirming a two-tier programmable payment model with bank-supplied wallets, testing offline resilience and cross-border interoperability and aligning R&D with BIS standards.
Outlook
The stablecoin and digital-money module is established. The key uncertainty is whether stablecoin payment-rail issuance migrates into CBRT payment-services law; absent an official roadmap, the regulatory trajectory for TRY stablecoin payment instruments remains unconfirmed.
No periodic updates recorded against this sub-brief.
Operational resilience for Turkish payments draws on the CBRT's information-systems communiqué for PIs/EMIs and the BDDK's 2020 banking IT regulation (Regulation on Banks' Information Systems and Electronic Banking Services). Institutions must run annual information-systems risk assessments, submit reports to the CBRT by end-January, notify the KVKK board and customers of cyber incidents, and use independent auditors for IT systems. Türkiye mandates strict authentication (universal 2FA, an SMS-OTP ban for mobile banking), data localisation, and real-time incident reporting; cybersecurity oversight is shared among BDDK, CBRT and a Cybersecurity Authority empowered under Law No. 7545 (2025). Core RTGS/instant-payment infrastructure is CBRT-developed and self-assessed against BIS-IOSCO PFMI.
Standing sub-brief171 words · last cycle wpm-2026-06-27
Operational Resilience & Critical Infrastructure
Türkiye operates among the strictest authentication regimes globally. Universal two-factor authentication is mandated and SMS-OTP is banned for mobile banking under the BDDK 2020 Regulation on Banks' Information Systems and Electronic Banking Services, with real-time incident reporting, data localisation, ISO 27001 and PCI DSS compliance required, and an annual IS risk assessment reported to the CBRT by end-January. The SMS-OTP ban forces PSPs — banks and non-banks alike — to adopt phishing-resistant authentication, raising onboarding and infrastructure costs.
Cyber oversight is coordinated across BDDK for banking, the CBRT for payment systems, and a Cybersecurity Directorate whose powers were significantly expanded under Law No. 7545 enacted in March 2025. This third agency adds regulatory complexity for payment operators navigating overlapping BDDK, CBRT and Directorate mandates. The Law No. 7545 development is single-source and carried as assessed.
Outlook
The resilience module is established with high confidence on the authentication regime. The practical effect of the expanded Cybersecurity Directorate mandate on payment operators warrants monitoring as implementation detail emerges.
No periodic updates recorded against this sub-brief.
Card-scheme infrastructure runs through the Interbank Card Center (BKM), a non-profit jointly owned by the CBRT (controlling stake since April 2020) and banks, which operates the domestic card authorisation/clearing switch, the local 3DS ACS, the BKM Express wallet and the domestic Troy card scheme. Visa and Mastercard dominate alongside Troy (~25M cards in 2026, with Discover/Diners reciprocal acceptance abroad). PCI DSS and 3D Secure 2.2 are enforced; the TR QR Code (TR Karekod) is the national QR standard. Card clearing settles on a deferred net basis (e.g. T+2 via Gosas for member banks). PSPs must share payment infrastructure with other PSPs on request under Article 8 of the Payment Services Regulation.
Open gap — wpm-int-3Exact date of the CBRT controlling-stake acquisition in BKM (research stated 30 Apr 2020) is not corroborated by T1; only year-level (2020) confirmation available.no under-indexing note recorded
Standing sub-brief251 words · last cycle wpm-2026-06-27
Scheme & Network Compliance
The Interbank Card Center (BKM) operates the domestic card authorisation and clearing switch, the local 3DS ACS, the BKM Express wallet and the Troy domestic scheme, with the CBRT having acquired a controlling interest in BKM in 2020; Gosas clears card transactions on deferred net settlement at T+2. The exact 30 April 2020 date for the controlling-stake acquisition is not corroborated by primary sources, so year-only framing is adopted. CBRT control of BKM gives the central bank direct leverage over domestic card switching, the Troy scheme and 3DS infrastructure.
Troy itself has scaled materially: it reached approximately 67 million cards as of August 2025, capturing a roughly 20% share of card transactions, and offers credit, debit and prepaid issuing, with acceptance on the US Discover network since 2017. This represents meaningful domestic-scheme displacement of Visa/Mastercard volume; a research-stated figure of around 25 million cards in 2026 is materially understated and stale, and the corrected figure is carried pending higher-tier confirmation.
The access regime is mandatory. Article 8 of the CBRT Payment Services Regulation obliges all PSPs — banks, PIs and EMIs — to make their payment account services and payment infrastructure available to other PSPs on request, with a decision required within one month. This lowers entry barriers for non-bank PSPs but creates margin-squeeze friction with bank POS owners.
Outlook
The scheme module is established. Troy's continued card-base growth and transaction-share trajectory remain the key tracker, alongside the competitive dynamics created by mandatory Article 8 infrastructure access.
No periodic updates recorded against this sub-brief.
Domestic rails centre on the CBRT-owned FAST instant-payment system (launched January 2021, 24/7, sub-second settlement in central-bank money) with BKM-run overlay services (KOLAS easy-addressing, TR QR Code), plus the EFT (BPS/RPS) and ESTS RTGS systems. Cross-border settlement flows through correspondent banking and Visa/Mastercard rails; FAST currently operates within national boundaries with cross-border interoperability under exploration. Türkiye is a large remittance and e-export corridor; PayU/iyzico explicitly position Türkiye as a bridge between CEE and Africa for local-currency cross-border trade. International digital wallets (PayPal, Apple Pay, Google Pay) are not permitted to operate domestically.
Open gap — wpm-int-6FAST cross-border interoperability status and any specific corridor go-live commitments are only described as 'under exploration'; no concrete timeline or counterparty corridors evidenced.no under-indexing note recorded
Standing sub-brief149 words · last cycle wpm-2026-06-27
Payment Corridor Dynamics
The central plank of the corridor view is FAST, the CBRT-developed and owned instant-payment system, which launched a pilot on 18 December 2020 and opened to all customers on 8 January 2021. FAST executes 24/7 sub-second payments in central-bank money, with overlay services — KOLAS easy-addressing and the TR QR Code — commissioned to BKM, and direct participation open to banks and non-bank PSPs with no joining or annual fee. Fee-free non-bank participation in a 24/7 central-bank instant rail is a strong driver of account-to-account payment growth and a competitive threat to card volumes.
On the cross-border dimension, FAST cross-border interoperability is described only as under exploration, with no concrete timeline or specific corridor go-live commitments evidenced.
Outlook
The domestic instant rail is confirmed and established. Cross-border interoperability is the open question; the absence of concrete corridor timelines is a flagged intelligence gap pending further evidence.
No periodic updates recorded against this sub-brief.
Türkiye's payments market is large and fast-growing — 110M+ active cards and ~86 licensed payment/e-money institutions in 2024, with combined PI/EMI transaction volume around TRY 5 trillion (vs ~TRY 120 trillion for banks). The structure blends bank-owned utilities (BKM, Troy) with a deep fintech layer: major acquirers/PSPs include PayTR, iyzico (Prosus/PayU-owned), Param, Stripe Turkey, and marketplace wallets (Trendyol Cüzdan, HepsiPay). Neobank/embedded-finance players Papara (a unicorn) and ColendiBank (BDDK-licensed 2024) are scaling. Fintech led Turkish startup investment in 2025 with a record ~$219.7M raised, and Sipay (valuation ~$875M) bills itself as Türkiye's largest fintech.
Standing sub-brief271 words · last cycle wpm-2026-08-21
Industry Structure & Commercial Dynamics
Turkiye's payments market structure showed continued bank-fintech integration this cycle alongside an unconfirmed foreign-entry signal. Aktif Bank's subsidiary Aktif Ventures launched Apilion, a banking-as-a-service API marketplace giving fintechs access to core banking, investment, payments and insurance infrastructure through a single integration layer. This is a low-confidence, single-sourced development, but it is consistent with broader commentary characterising the Turkish fintech sector as one that grows in partnership with incumbent banks rather than through disintermediated competition.
Separately, and at a lower confidence tier still, reports describe Revolut in unconfirmed, deal-stage talks to acquire Turkish digital bank FUPS, with the reported rationale being a licensing fast-track into the Turkish payments market via acquisition of an already-licensed institution rather than a standalone BDDK application. Any such transaction would require BDDK approval, underscoring the regulator's continued gatekeeping role over market structure even in an acquisition-based entry route.
Read together, these two developments point toward a market structure in which both domestic incumbent-bank infrastructure plays and potential foreign-entrant acquisition plays are actively being pursued as routes into or within the Turkish payments market, against a backdrop in which the non-bank payment-institution sector is simultaneously facing significant licensing-enforcement pressure. This combination — commercial expansion activity proceeding in parallel with licensing enforcement risk — is itself the notable structural read for this cycle.
Outlook
Confirmation or denial of the Revolut-FUPS talks would be the most significant near-term market-structure signal, given its implications for the pace of foreign entry via acquisition. Continued expansion of bank-anchored BaaS infrastructure such as Apilion would reinforce the current bank-centred structural pattern rather than a shift toward non-bank-led market structure.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
2025 AML/financial-crime crackdown on payment companies ahead of FATF on-site; Law No. 6493 Arts 27-40 enforcement framework; Competition Board PF/bank acquiring disputes.
Movement — NEWJudicial stay of CBRT licence decisionCold-start jurisdiction, first material domain content
Standing sub-brief248 words · last cycle wpm-2026-08-21
Legal & Litigation
Turkiye's payments-sector litigation landscape this cycle is defined by a single but structurally significant event: Ankara's 25th Administrative Court ruled to stay execution of CBRT's decision cancelling Papara's e-money licence, allowing the company to resume operations pending appeal. This establishes, for the first time in this evidence base, that judicial review can meaningfully constrain a Central Bank enforcement action in the Turkish payments sector pending appeal, rather than such enforcement actions taking immediate and unreviewable effect.
The practical sequence that followed — CBRT reinstating Papara's licence under TMSF trusteeship in January 2026, rather than either restoring full ordinary licensed status or maintaining the original revocation — indicates that the litigation outcome produced an intermediate supervisory arrangement rather than a clean win for either the regulator or the licensee. This is an important precedent for assessing litigation risk and likely outcomes in any comparable future enforcement dispute between a Turkish non-bank payment institution and its prudential regulator: the realistic range of outcomes includes intermediate, trusteeship-style arrangements alongside the two more commonly anticipated poles of clean revocation or clean reinstatement.
Outlook
Whether the underlying appeal on Papara's licence status is ultimately resolved in the company's favour, in CBRT's favour, or in some further intermediate arrangement will be an important signal for the durability of this cycle's judicial-constraint precedent. Any subsequent licensing enforcement action against another Turkish payment institution will be a natural test of whether courts continue to be willing to stay CBRT enforcement decisions pending appeal.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Merchant acquiring is conducted by banks and CBRT-licensed payment facilitators/PIs; the Turkish Competition Board treats PFs and banks as competitors in this market while PFs depend on banks' POS access. Dispute/chargeback handling is centralised through BKM, which operates a standardised central chargeback system, and consumer-favourable rules (aligned with EU standards) place the burden of proving transaction authenticity on merchants. 3D Secure 2.2 and a deep installment (taksit) culture shape acquiring economics. iyzico (Prosus/PayU), PayTR, Param and Stripe Turkey are leading acquirers; iyzico cites buyer-protection services securing over 4 million consumer transactions.
Open gap — wpm-int-5Merchant-acquiring operational economics (chargeback ratios, high-risk MCC handling, acquirer stress) are thinly evidenced beyond competition-law framing; under-indexed relative to regulatory/structural findings.Merchant-acquiring ops are a methodology-flagged under-indexed area.
Standing sub-brief138 words · last cycle wpm-2026-06-27
Merchant Acquiring & Risk
The acquiring module turns on an unresolved competition tension. The Turkish Competition Board treats payment facilitators and banks as competitors in the merchant-acquiring market while their POS-access relationship is also vertical, raising unresolved margin-squeeze concerns where no bank holds a dominant position. This horizontal-and-vertical relationship between payment facilitators and banks creates structural margin-squeeze risk shaping acquirer economics. Dispute and chargeback handling is centralised through BKM, with the merchant authenticity burden placed on the acquiring side.
Merchant-acquiring operational economics — chargeback ratios, high-risk MCC handling and acquirer stress — are thinly evidenced beyond the competition-law framing and are an under-indexed area relative to the regulatory and structural findings.
Outlook
The acquiring module is established but assessed. The unresolved margin-squeeze question and the under-indexed operational economics are the priority areas for deeper evidencing in future cycles.
No periodic updates recorded against this sub-brief.
Open banking is being built out through BKM's GATE infrastructure under CBRT authority, with Payment Initiation and Account Information Services (the ÖHVPS/DSSP framework) defined under Article 12 of Law No. 6493; certification (HHS/YÖS) deadlines were rescaled to a December 2025 ÖHVPS 2.0 transition, and the March 2025 amendment narrowed the connection obligation. Digital wallets were brought into the licensing perimeter (compliance deadline extended to 31 December 2025), with interoperable card-on-file treated as wallet/open-banking services. The CBRT runs the Digital Turkish Lira CBDC pilot, and instant-rail/QR products (FAST, TR Karekod, KOLAS) plus BNPL (Colendi, Garanti Pay) are expanding.
Standing sub-brief156 words · last cycle wpm-2026-06-27
Product Innovation & Market Development
Open banking is built through BKM's GATE infrastructure under CBRT authority, with payment initiation services and account information services defined under Article 12 of Law No. 6493. Institutions with a transition obligation must complete ÖHVPS 2.0 certification and go into production by 31 December 2025, while a March 2025 amendment narrowed the connection obligation. The digital-wallet compliance deadline was likewise extended to 31 December 2025. Together these deadlines bring TPPs and wallet providers fully into the CBRT perimeter, reshaping product-access economics for both banks and non-banks.
This thematic product-access regulatory view sits alongside the Digital Turkish Lira CBDC pilot, whose phase-one completion is detailed under W2, as a forward driver of programmable-payment innovation.
Outlook
The product-innovation module is established and confirmed. The principal near-term event is the 31 December 2025 ÖHVPS 2.0 production go-live and digital-wallet licensing deadline, after which full participant onboarding into the CBRT open-banking perimeter can be assessed.
No periodic updates recorded against this sub-brief.
Consumer protection rests on Türkiye's Consumer Protection Law (consumer-favourable, broadly EU-aligned) plus the CBRT payment-services conduct rules and KVKK data protection. Card-dispute/chargeback handling is centralised through BKM, with merchants bearing the authenticity burden. Türkiye has no dedicated UK-style mandatory APP-fraud reimbursement scheme; instead fraud control operates at system level — the CBRT mandates fraud controls through FAST instructions and the Security Overlay Service (SIPER) for risk-data sharing, plus a centralised Merchant Registration System and transaction monitoring. Universal 2FA and the SMS-OTP ban harden consumer authentication.
Standing sub-brief116 words · last cycle wpm-2026-06-27
Consumer Protection & APP Fraud
Türkiye has no dedicated UK-style mandatory APP-fraud reimbursement scheme. Fraud control instead operates at system level, via CBRT FAST instructions, the Security Overlay Service (SIPER) for risk-data sharing, a centralised Merchant Registration System and transaction monitoring, with BKM operating centralised chargebacks under a merchant authenticity burden, and universal 2FA and the SMS-OTP ban hardening authentication. The reliance on system-level controls rather than a reimbursement mandate shifts liability allocation away from a UK-style PSP reimbursement model.
Outlook
The consumer-protection module is established but assessed. Any move toward a mandatory reimbursement regime would materially change liability allocation; absent that, the system-level control architecture is the operative model and warrants monitoring for incremental change.
No periodic updates recorded against this sub-brief.
MASAK FIU; FATF grey-list exit 28 Jun 2024 (R.15 partially compliant); crypto Travel Rule fully in force; late-2025 on-site inspection over residual payments-sector gaps. Sentinel-fed.
Standing sub-brief178 words · last cycle wpm-2026-06-27
AML/CFT & Financial Crime (Sentinel.gi-fed)
This module is sourced from the Sentinel.gi feed; the World Payments Monitor attributes the intelligence to Sentinel and does not re-analyse illicit finance. Per the Sentinel feed, Türkiye's FIU is MASAK; the country was grey-listed in October 2021 and removed on 28 June 2024 after completing its action plan, with one Recommendation (R.15) assessed partially compliant. CASPs are designated obliged parties, and a crypto Travel Rule (Official Gazette 25 December 2024) applies with a 15,000 TRY threshold. A late-2025 FATF on-site inspection reflects residual payments-sector supervision and enforcement gaps.
The original illicit-finance analysis of these surfaces is routed to the FIM monitor via cross-monitor flags. Within the World Payments view, the FATF status and the on-site inspection are noted only as direct drivers of the payments-sector enforcement crackdown and of residual correspondent-banking de-risking pressure.
Outlook
The Sentinel-fed AML/CFT surface is stable but consequential. The outcome of the late-2025 FATF on-site inspection is the key forward signal, with potential to drive further payments-sector enforcement; refer to the FIM monitor for the underlying financial-crime analysis.
No periodic updates recorded against this sub-brief.
T?FIM (sentinel.gi) per-JID baseline profile — Turkey (Türkiye) — AML/CFT regime built on Law No. 5549, MASAK as FIU with broad real-time data access, and a 2018 National Risk Assessment. Turkey exited the FATF grey list in June 2024 after enhanced follow-up since its 2019 MER; only Recommendation 15 (virtual assets) remains partially compliant. MASAK is gaining new crypto/bank account-freeze powers; CMB is building a VASP licensing regime.
Wholesale and correspondent-related settlement runs through the CBRT's EFT systems — interbank payments and banks' international correspondent transactions settle in the Turkish Lira Interbank Payments System (BPS), customer payments in the Customer Payments System (RPS) — with ESTS for securities, all open to banks operating in Türkiye and benchmarked against BIS-IOSCO PFMI. Cross-border card flows clear via BKM or correspondent banking. Although Türkiye was removed from the FATF grey list in June 2024, international banks that imposed enhanced due diligence during the 2021-2024 listing continue to apply elevated scrutiny, so Turkish counterparties face higher documentary requirements and residual de-risking pressure in cross-border transactions.
Standing sub-brief155 words · last cycle wpm-2026-06-27
Correspondent Banking, Settlement & Access
The analytical spine of this structural module is the bank versus non-bank access asymmetry in cross-border settlement. Interbank and banks' international correspondent transactions settle in the CBRT Turkish Lira Interbank Payments System (BPS), customer payments in the Customer Payments System (RPS), and securities in ESTS, all open to banks operating in Türkiye and benchmarked against BIS-IOSCO PFMI. These settlement systems are a bank-PSP domain; non-bank PIs and EMIs do not enjoy the same correspondent access.
Despite the June 2024 FATF delisting, international and correspondent banks continue to apply elevated enhanced due diligence, leaving Turkish counterparties with higher documentary requirements and residual de-risking pressure. This sustains cross-border friction for Turkish counterparties even as the formal FATF status has improved.
Outlook
The correspondent-banking module is stable with high confidence. Residual de-risking is expected to persist despite the delisting; whether elevated EDD eases as FATF on-site verification concludes is the key forward variable.
No periodic updates recorded against this sub-brief.
Trailing-12-month commercial activity led by iyzico/Paynet $87M close, Midas $80M Series B (QED), ColendiBank launch and record ~$219.7M 2025 fintech funding.
Standing sub-brief225 words · last cycle wpm-2026-08-21
Commercial Intelligence & Fintech
Two discrete commercial events surfaced in Turkiye's fintech sector this cycle, both carrying lower-confidence sourcing. Aktif Bank's subsidiary Aktif Ventures launched Apilion, a banking-as-a-service API marketplace giving fintechs access to core banking, investment, payments and insurance infrastructure; this is a completed product release, though the amount of any associated investment was not disclosed and the finding rests on a single lower-tier source.
Separately, reports describe Revolut in rumoured, deal-stage talks to acquire Turkish digital bank FUPS, with the deal rationale reported as a licensing fast-track into the Turkish payments market. This event carries "rumoured" status rather than "completed" or even "announced" status, the deal amount was not publicly disclosed, and the sourcing is a single lower-tier commercial-intelligence platform rather than a primary corporate announcement from either party. Any resulting transaction would require BDDK approval.
Both events should be read as distinct from the structural bank-fintech-integration and market-access themes covered elsewhere: this module records the discrete commercial facts of the product launch and the rumoured acquisition talks themselves, not the broader structural or regulatory significance of either.
Outlook
Confirmation of the Revolut-FUPS talks progressing to a formal announcement, or their quiet lapse, will resolve the current rumoured status. Further product announcements building on or competing with the Apilion BaaS marketplace would be the natural next commercial-intelligence signal to watch in this space.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Filters combine as OR inside a group and AND across
groups.
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for Turkey
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
not recorded
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.
Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.
Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.