TURKEY Law and Practice Contributed by: Caghan Tansel, TANSEL
More broadly, Türkiye has taken policy steps towards fintech test environments: the Istanbul Finance Center describes its Fintech Center as a platform intended to host a regulatory sandbox for payment systems, and recent market commentary confirms that Fintech Zone Istanbul offers a testing environment for fintech start-ups, but not one that formally waives regulatory requirements. Separately, the Central Bank has invited banks, payment institutions and e-money institutions to participate in Digital Turkish Lira use-case testing, with successful applicants eligible for joint tests in a sandbox; however, this is better understood as a central bank digital currency research and develop- ment environment, not a general-purpose sandbox for private blockchain, tokenisation or crypto-asset projects. 1.1.3 Regulation of Blockchain Technology Government and Regulatory Attitude Türkiye’s approach is best described as “regulated encouragement”: public authorities appear will- ing to support fintech, digital-money and compliant crypto-asset infrastructure, but the policy priority is risk control rather than deregulation. The CMB’s 2025 communiqués created a licensing, governance, custody, audit and capital-adequacy framework for crypto-asset service providers, while MASAK has tightened AML expectations for the sector. At the same time, the Central Bank continues to encourage supervised Digital Turkish Lira use-case testing with banks, payment institutions and e-money institutions. The clearest prohibited use case remains payments: crypto-assets cannot be used directly or indirectly as a means of payment, and payment/e-money institu- tions are restricted from intermediating certain flows to or from crypto-asset platforms. Blockchain Technology Without Crypto-Assets Türkiye does not have a general, standalone statute regulating blockchain technology as such. Where a blockchain-enabled product does not involve crypto- assets, the analysis depends on the underlying activ- ity, sector and data flows. A bank, payment institution, e-money institution, insurer, capital-markets institu- tion or other regulated firm using blockchain-enabled infrastructure would remain responsible under its ordinary regulatory obligations, including information- systems governance, outsourcing, operational resil-
ience, auditability, cybersecurity and customer-data protection. For example, banking information-systems rules set minimum standards for the management and risk control of banks’ IT systems, while the Central Bank framework for payment and e-money institutions also treats external service providers and cloud-type arrangements as supervised operational issues. Data Privacy and the Right to Be Forgotten Blockchain-based products and services must com- ply with the Turkish Personal Data Protection Law No 6698 where they process personal data, includ- ing wallet-linked identifiers, customer records, trans- action metadata or other information relating to an identified or identifiable person. The main challenge is that blockchain immutability can conflict with KVKK principles such as purpose limitation, data minimisa- tion, storage limitation and the obligation to erase, destroy or anonymise personal data once the legal basis for processing disappears. In practice, Turkish- law compliant blockchain designs should avoid put- ting personal data directly on-chain, use off-chain storage where possible, rely on hashes or references only after assessing re-identification risk, and build mechanisms to delete, anonymise or make inacces- sible the off-chain personal data connected to the blockchain record. 1.1.4 Smart Contracts Smart contracts are capable of being enforced in Türkiye in principle, but there is no separate statu- tory regime giving them automatic legal status mere- ly because they are deployed on blockchain. Their enforceability is assessed under ordinary Turkish contract law: there must be legally valid mutual and corresponding declarations of intent, the parties must have capacity, the subject matter must be lawful and possible, and any mandatory form requirement must be satisfied. Turkish law generally recognises freedom of form for contracts unless a specific law requires otherwise, so purely digital or code-based arrange- ments may be enforceable where no written, notarised or official form is required. However, if the transaction is subject to written-form requirements, reliance on blockchain keys or wal- let signatures alone may be insufficient; the Turkish Electronic Signature Law recognises only “secure
657 CHAMBERS.COM
Powered by FlippingBook