Payment institution (PI) and electronic money institution (EMI) license within the framework of Law No. 6493: capital threshold, IT infrastructure, MASAK and KVKK compliance coordinated. BRSA examines it for an average of 6-12 months.
License types
- Payment Institution (PI): Money transfer, virtual POS, bill collection.
- Electronic Money Institution (EMI): Prepaid card, e-wallet, end-of-term money holding.
Capital threshold
- PI: Minimum 1M TL (updated annually).
- EMI: Minimum 5M TL (updated annually).
- Capital must be in cash; Non-cash (real estate) is not accepted.
IT infrastructure
- Data center is in Türkiye (at least main DC).
- Disaster recovery (DR) site is in different city.
- ISO 27001 + ISO 22301 certification is recommended.
- Transaction reconciliation, reporting, MASAK integration is ready.
- PCI-DSS Level 1 (card storage) or Level 4 (transaction only).
MASAK compliance integration
- KYC/KYB system: T.R. authentication, MERSİS query, e-payment tool verification.
- Transaction monitoring: Risk score matrix, above-threshold transfer alert.
- STR automation: Trigger rules, compliance officer review panel.
- Monthly MASAK reporting coordination.
What happens in case of unlicensed activity?
6493 SK article 18: Administrative fine up to 1,000,000 TL + suspension of activity + criminal complaint. There is an example of a criminal complaint for senior banking managers in old practices.
Is the foreign license (Lithuanian EMI etc.) valid in Türkiye?
No. Local BRSA license is required for Türkiye; EU passport is not valid in Türkiye. The typical solution for foreign operators is the use of Turkish representation + local payment infrastructure (integrator).
Can a company awaiting a license operate?
No. The license cannot provide payment services until it receives approval. BRSA proactive communication is recommended for pre-registration + limited pilot.
Is an internal auditor necessary?
Yes. Appointing an independent internal audit unit and compliance officer is mandatory. Reporting independent of CEO/CTO authority is important.
How long does it take?
BRSA average 6-12 months; pre-application consultancy for another 4-6 months. A total of 12-18 months of realistic planning.
Relevant legislation
- Law No. 6493 — Payment & electronic money; licensing, operating permit.
- BRSA Regulations — Payment institution / EML permission, capital, reporting.
- 5549 SK — MASAK; KYC, STR, regular activity.
- KVKK + GDPR — Data security, cross-border transfer.
- PCI-DSS — Card storage; PCI level 1-4 compliance.