Banking & Finance Law in Türkiye: A Practical Guide for Foreign Businesses

If your company banks, borrows, lends or moves money in Türkiye, your day-to-day life is shaped by Banking Law No. 5411 and its regulator, the BDDK, alongside the Central Bank (CBRT) and Türkiye's anti-money-laundering body, MASAKMASAKThe Financial Crimes Investigation BoardTürkiye's financial intelligence unit — the body that receives suspicious-transaction reports and supervises anti-money-laundering duties.Glossary →. This guide explains, in plain English, who regulates what, what a foreign business can and cannot do, and where banking and finance disputes are resolved. It is general information, not legal advice for your specific situation.

The legal framework at a glance

Banking in Türkiye sits on one main statute: Banking Law No. 5411 (Bankacılık Kanunu). It defines what a bank is, who may carry out banking activities, and the supervision regime that applies to them. Around it sit several other pillars you will meet as a foreign business:

• Banking Law No. 5411 — the core framework for banks, credit institutions and their supervision.
• The Central Bank Law (Law No. 1211) — governs the Central Bank of the Republic of Türkiye (CBRT / TCMB), monetary policy and the payment-system backbone.
• Capital Markets Law No. 6362 — governs securities, public offerings and capital-market instruments (a separate regulator, the CMB/SPK).
• Law No. 6493 on payment and electronic-money services — the rulebook for payment institutions and e-money providers (fintech).
• AML legislation (Law No. 5549) on the prevention of laundering of proceeds of crime, supervised by MASAK.

Foreign-exchange movements are also shaped by the long-standing Decree No. 32 on the Protection of the Value of Turkish Currency and CBRT circulars issued under it. The takeaway: "banking and finance" is not one law but a layered system, and which layer governs your matter depends on what you are actually doing.

Who regulates banking: the BDDK and the CBRT

Two institutions matter most. The BDDK (Bankacılık Düzenleme ve Denetleme Kurumu — the Banking Regulation and Supervision Agency) is the licensing and prudential supervisor. It decides who may operate as a bank, sets capital and risk rules, and can intervene in troubled institutions. The CBRT (Türkiye Cumhuriyet Merkez Bankası — the Central Bank) runs monetary policy, manages reserves, oversees the payment and settlement systems, and administers parts of the foreign-exchange regime.

For a foreign business the practical division is simple:

• Questions about who can take deposits or extend credit, and how a bank is licensed and supervised → BDDK and Law No. 5411.
• Questions about moving money, FX rules, payment systems and reference rates → CBRT and the FX regime.

A third body, the SDIF (Savings Deposit Insurance Fund / TMSF), insures deposits up to a statutory ceiling and can take over failed banks. The deposit-insurance ceiling (per depositor, per bank) is set by the TMSF Board and revalued annually on the official revaluation rate — as of 2026, approximately TRY 1,200,000; this changes periodically, so confirm the current figure before relying on it.

What counts as a bank, and the two-stage licence

Under Law No. 5411 you cannot simply call yourself a "bank" or take deposits. Banking activities — broadly, accepting deposits or participation funds and channelling them into credit — are reserved for licensed credit institutions. The law recognises, in essence, deposit banks, participation banks (interest-free / Islamic-finance model, using "participation funds" instead of conventional deposits) and development and investment banks, which do not take ordinary deposits.

Licensing happens in two stages, both decided by the BDDK board:

• Establishment permit (kuruluş izni) — approval to incorporate the bank, subject to conditions on founders, capital and corporate form (a joint-stock company).
• Operating permit (faaliyet izni) — a separate approval that lets the licensed entity actually begin banking, granted once capital is paid in and operational, governance and risk requirements are met.

The minimum paid-in capital, the share that must be paid before operations begin, and the fit-and-proper criteria for founders and managers are all set by statute and BDDK regulation and are updated periodically. We deliberately do not quote a current capital figure here because it moves; confirm the live threshold with counsel or the BDDK before planning.

Foreign companies and banking in Türkiye

Most foreign businesses are not trying to become a bank — they need to use the banking system: open accounts, borrow, take security, and move funds in and out. The good news is that Türkiye is generally open to foreign capital, and a Turkish company with foreign shareholders is treated, for banking purposes, much like any domestic company.

Practical points that come up repeatedly:

• Opening a corporate account usually requires your Turkish company's trade-registry records, tax number, signature circular and identification of beneficial owners. Account opening for foreign-controlled entities involves enhanced identity and source-of-funds checks (see AML below).
• Cross-border lending — a Turkish company borrowing FX from abroad must observe the FX-borrowing rules under Decree No. 32 and CBRT circulars, which restrict who may borrow in foreign currency and on what terms. Get the structure reviewed early.
• Branch vs. subsidiary — a foreign bank wanting a presence in Türkiye can, in principle, operate through a licensed branch or a Turkish-incorporated subsidiary; each route has its own BDDK permitting path.
• Security and collateral — Turkish law offers mortgages, commercial-enterprise pledges, movable pledges (under the movable-pledge regime) and assignment of receivables; perfecting them correctly is what makes them enforceable in an enforcement (icra) proceeding.

AML and MASAK: the compliance you cannot skip

Every banking relationship in Türkiye runs through anti-money-laundering controls. The framework is built on Law No. 5549 on the Prevention of Laundering of Proceeds of Crime, supervised by MASAK (Mali Suçları Araştırma Kurulu — the Financial Crimes Investigation Board, Türkiye's financial intelligence unit). Banks and other obliged parties must:

• Identify customers and beneficial owners (know-your-customer / KYC) before opening accounts and on an ongoing basis;
• Apply enhanced due diligence to higher-risk customers, including some cross-border and politically exposed relationships;
• Monitor transactions and file suspicious-transaction reports to MASAK;
• Keep records for the statutory retention period.

For a foreign business this is not red tape to resent but the reason your account application asks for ownership charts, source-of-funds evidence and director IDs. Coming to the bank with a clean, well-documented file is the single biggest thing you can do to avoid delays. Sanctions screening — including international sanctions regimes — also sits inside this compliance layer.

Fintech, payments and e-money

If your model is digital — a payment app, a wallet, a marketplace that holds customer funds — you are likely in the world of Law No. 6493 on payment and securities-settlement systems, payment services and electronic-money institutions. It separates two regulated categories that are not banks but are still licensed:

• Payment institutions — firms that execute payment transactions, money remittance and similar services;
• Electronic-money institutions — firms that issue e-money (stored value redeemable at par).

Licensing and supervision for these institutions is exercised under Law No. 6493 by the Central Bank (CBRT/TCMB), to which this competence was transferred from the BDDK with effect from the start of 2020; because the supervisory landscape continues to evolve, confirm the current position before relying on it. The point for founders: holding or moving customer money in Türkiye, even without taking "deposits," can still require a licence. Crypto-asset service providers are subject to their own evolving rules introduced into the capital-markets framework, and that area is changing quickly — treat any summary as a starting point and confirm the current position.

For the licensing route itself — the categories, capital, the Central Bank's two-stage application and the fees — see our guide to the fintech license in Turkey.

Where banking and finance disputes go

When something goes wrong — a disputed debit, an unpaid loan, a guarantee called, a frozen account — the route depends on the parties and the contract.

• Commercial banking disputes between businesses (loan, guarantee, facility-agreement claims) are generally heard by the commercial courts of first instance (asliye ticaret mahkemesi), with appeals to the regional courts of appeal and then the Court of Cassation (Yargıtay).
• Debt enforcement — collecting on a defaulted loan, cheque or promissory note runs through the enforcement and bankruptcy system (icra ve iflas) under Enforcement and Bankruptcy Law No. 2004, often the fastest route for a documented debt.
• Consumer banking complaints have their own consumer-protection channels and arbitration committees, but a foreign business client will usually be outside the consumer regime.
• Regulatory action by the BDDK (sanctions, licence decisions) is challenged before the administrative courts, not the civil courts.
• Arbitration — many cross-border finance contracts choose arbitration and a foreign governing law; whether that choice holds up in Türkiye depends on how the clause is drafted and on mandatory Turkish rules.

Under the Court of Cassation's settled case-law, the precise characterisation of the banking relationship (for example, whether an instrument is a guarantee or a surety) can decide the outcome, so getting the contract right at the start matters more than the forum you later choose.

Banking secrecy and your information

Türkiye protects banking and customer secrecy by statute. Under Banking Law No. 5411 (the secrecy duty in Article 73), banks and their staff must keep customer and transaction information confidential and may share it only in the cases the law permits — for example, with supervisory authorities, in defined information-sharing arrangements, or under a court order. This sits alongside Türkiye's data-protection law (KVKKKVKKPersonal Data Protection Law No. 6698Türkiye's data protection statute — the rules on collecting, storing and transferring personal data, and the authority that enforces them.Glossary →, Law No. 6698), which governs personal data more broadly.

For a foreign business this matters in two directions: your own financial information enjoys protection, but you should also expect that your bank will lawfully report and share data with regulators and MASAK where required. If a dispute involves obtaining a counterparty's banking records, that almost always requires a proper legal channel — you cannot simply demand them.

Frequently asked questions