Fast payment system Turkey: FAST, TR Karekod, open banking

Short answer: Turkey's fast payment system is FAST (Fonların Anlık ve Sürekli Transferi), run by the Central Bank: lira only, open 24/7 and completed within seconds. Since 26 August 2026 its limit is TRY 300,000 per transfer or QR merchant payment. TR Karekod is the national QR format and open banking runs through BKM's GEÇİT gateway; only participants and licensed, certified providers connect directly, so a foreign firm works through one of them.

Check an IBAN's format and check digits: Turkey IBAN format checker.

Rules here come from texts of the Central Bank of the Republic of Türkiye (TCMB, or CBRT), Law No. 6493 and the API standard TCMB points to, all read on 6 November 2026.

Card acceptance is in the Turkey payment gateway guide. This is not legal advice, no wallet or bank is recommended, and nothing here implies that Fincode has access to these systems or holds a certification.

What is the fast payment system in Turkey?

FAST is TCMB's instant retail payment system, separate from EFT, moving Turkish lira between accounts at participating institutions around the clock.

A provider outside that list reaches FAST only through a participant. Crypto is not a payment method in Turkey: a TCMB regulation (opens in a new tab) in force since 30 April 2021 bars crypto assets from payments, directly or indirectly. Turkish account basics are in bank account in Turkey for foreigners.

Turkey fast payment limits, with dates

The limit for transfers, Request-to-Pay and dynamically verified QR merchant payments has been TRY 300,000 since 26 August 2026, under TCMB press release 2026-36 of 24 August 2026.

TCMB raises the limit in steps, and the QR regulation lets a provider set a lower ceiling (Art. 8), so keep limits in configuration.

Is a fast payment immediate?

Yes in normal operation: TCMB's FAQ says payments reach the recipient's account within seconds, but a design must handle three exceptions.

• Timeouts. TCMB says transactions not finished within a set time limit are canceled, and the pages read give no value. Treat a lost response as unknown and query before resending.
• Wrong payments. The FAQ sends users to their own institution and says TCMB has no role in refunds; merchant QR refunds have their own flow in TCMB's FAST TR QR guide.
• Who can receive. Both institutions must be participants and only lira moves; the FAQ says a transfer within one institution is a havale, outside FAST.

FAST overlay services: addressing, requests and escrow

Overlay services add addressing and payment requests on top of FAST, both run by BKM, and an escrow service (opens in a new tab) launched on 31 May 2024 mainly for used-car sales through notaries.

Karekod Turkey: what the TR QR Code rules require

TR Karekod is the required format for QR payments under Law 6493, set by a TCMB regulation published on 21 August 2020 (no. 31220).

• Types. Static codes are reusable; dynamic codes are single-use, with a reference and expiry. Models are merchant-presented, consumer-presented and person-to-person, in long and short formats.
• Who generates. Payment service providers and approved system operators holding a BKM generator ID (Art. 5); banks use their EFT codes. Generation can be outsourced (Art. 5(3)).
• Foreign element. TR Karekod is not compulsory for domestic payments with foreign-issued instruments when one party is abroad and a foreign provider's infrastructure is used (Art. 10); foreign apps scanning FAST-TR QR codes use the cross-border flows below.

BKM's table (opens in a new tab) shows 947,214,227 QR payments worth TRY 777.47 billion in January to September 2026, up 143.7% by count year on year (calculated), without splitting out FAST. TCMB's 2025 Annual Report (opens in a new tab) says 90% of POS machines take card payments by TR QR and over 41% take FAST TR QR.

A tested TR Karekod parser

The long format is ID, two-digit length and value, ending with a CRC-16 (polynomial 1021, start FFFF). Run on Python 3.11 on 6 November 2026, on synthetic payloads:

FAST_LIMIT_KURUS = 300_000 * 100      # TCMB press release 2026-36, from 26 August 2026

def crc16(text):
    crc = 0xFFFF
    for byte in text.encode("utf-8"):
        crc ^= byte << 8
        for _ in range(8):
            crc = ((crc << 1) ^ 0x1021 if crc & 0x8000 else crc << 1) & 0xFFFF
    return f"{crc:04X}"

def tlv(*objects):
    return "".join(f"{tag}{len(value):02d}{value}" for tag, value in objects)

def seal(body):
    return body + "6304" + crc16(body + "6304")

def parse(text):
    out, i = {}, 0
    while i < len(text):
        head = text[i:i + 4]
        if not (head.isascii() and head.isdigit()):
            raise ValueError(f"bad tag or length at {i}")
        tag, size = head[:2], int(head[2:])
        if tag in out or i + 4 + size > len(text):
            raise ValueError(f"duplicate or truncated tag {tag}")
        out[tag] = text[i + 4:i + 4 + size]
        i += 4 + size
    return out

def build(amount_kurus, city="İSTANBUL"):
    fast = tlv(("00", "TR.GOV.TCMB.FAST"), ("01", "TR" + "0" * 24),  # synthetic IBAN
               ("02", "01"), ("20", "0" * 32))                       # flow type, fake hash
    return seal(tlv(("00", "01"), ("01", "12"), ("30", fast),         # dynamic QR
                    ("51", tlv(("00", "10"), ("02", "9999"), ("03", "SYNTH0001"),
                               ("06", "261105101500"), ("07", "261105103000"))),
                    ("52", "0000"), ("53", "949"), ("54", f"{amount_kurus:012d}"),
                    ("58", "TR"), ("59", "SAMPLE KAFE"), ("60", city)))

def check(payload):
    try:
        d = parse(payload)
        ident, amount = parse(d.get("51", "")), d.get("54", "0")
    except ValueError as error:
        return [f"malformed: {error}"]
    if not (list(d)[-1:] == ["63"] and crc16(payload[:-4]) == d["63"]):
        return ["bad CRC"]
    problems = []
    if d.get("01") == "12" and not {"03", "07"} <= ident.keys():
        problems.append("dynamic QR needs reference and expiry")
    if not (amount.isascii() and amount.isdigit()):
        problems.append("amount is not digits")
    elif "30" in d and int(amount) > FAST_LIMIT_KURUS:
        problems.append("over the FAST limit")
    return problems or ["ok"]

print(crc16("123456789"))               # standard check value
qr = build(12_345)                      # TRY 123.45
print(qr)
print(parse(qr)["54"], parse(qr)["60"], check(qr))
print(check(qr.replace("000000012345", "000000099999")))
print(check(build(30_000_001)))
print(check(seal(qr[:-8] + "5412000000000100")))
print(check(seal("000201010212")))

Output:

29B1
00020101021230920016TR.GOV.TCMB.FAST0126TR0000000000000000000000000202012032000000000000000000000000000000005159000210020499990309SYNTH00010612261105101500071226110510300052040000530394954120000000123455802TR5911SAMPLE KAFE6008İSTANBUL6304A1C0
000000012345 İSTANBUL ['ok']
['bad CRC']
['over the FAST limit']
['malformed: duplicate or truncated tag 54']
['dynamic QR needs reference and expiry']

The altered amount fails the CRC and the over-limit payment is flagged; the last two carry valid CRCs, yet a naive parser would let the second amount win silently or crash on the missing tag 51. The template follows TCMB's FAST TR QR guide (opens in a new tab), version 1.6 of September 2025, but the IBAN, hash and generator ID are invented: not a payable code, and only an authorized generator may create real ones. The guide's 6008İSTANBUL sample ends in CRC 3F2E, reproduced here on UTF-8 bytes (ISO-8859-9 gives 1E03); length 08 counts characters.

Open banking Turkey: who may connect

Only banks and firms licensed by TCMB for payment initiation or account information (Law 6493 Art. 12(1)(f) and (g)) may call these APIs, after BKM certification; a foreign developer can build for one of them but cannot connect alone.

• Regulation Art. 59. BKM checks technical compliance and publishes those who pass. FAST participants and the top ten others by payment volume must connect as account providers and block unauthorized access.
• TCMB's guide of 30 April 2023. Banks need no extra license but must certify. A firm delivering bank statement data through a bank's XML service needs letter (g); a bank sharing statements with business customers' own systems stays outside.
• Who is live. BKM's page (opens in a new tab) (undated, read 6 November 2026) lists in production 36 bank-status account providers (PTT among them) and 12 payment-institution ones, plus 25 bank and 18 institution third-party providers.

For scoping in general, see Fincode's project and product analysis service; budget drivers are in fintech app development cost.

ÖHVPS API 2.0.1: what a developer actually reads

TCMB's guide names ohvps.github.io (opens in a new tab) as the standard in force; on 6 November 2026, version 2.0.1 is active, with a 7 October 2026 transition date.

• Language. JSON fields are Turkish, such as rizaNo (consent number); headers are English, such as X-Request-ID and PSU-Timestamp.
• Transport. TLS 1.2 or higher, electronic certificates under E-Signature Law No. 5070, and message signing where an endpoint requires it.
• Payment initiation calls. POST /odeme-emri-rizasi for consent, POST /erisim-belirteci for the token after strong authentication, then POST /odeme-emri, and GET /odeme-emri/{odemeEmriNo} for status.
• Consent states. B awaiting, Y authorized, K used, E became a payment order, S ended, I canceled. A user may hold one active account-information consent per provider and account provider; a new request while one is Y or K returns TR.OHVPS.Business.ConsentAlreadyExists.
• Newer scope. BKM lists (opens in a new tab) future-dated and standing payment orders, card details and movements, consent updates, and corporate account-information consent extended from 6 to 12 months.
• Dates. New FAST participants get six months (opens in a new tab) to certify and connect as account providers.

The public test area (opens in a new tab) needs no membership but returns static, stateless data, so it cannot show end-to-end behavior; BKM's production-like simulator, for participants, carries the certification scenarios. The FAQ (opens in a new tab) says the document prevails over the simulator and certification slots need a month's notice. Neither was exercised here.

Open banking examples and an English glossary

Both appear as consolidated account views and pay-by-bank checkouts.

Frequently asked questions

Is a fast payment immediate in Turkey?

Yes in normal operation: TCMB says payments reach the recipient's account within seconds, 24/7, and that a transaction not finished within the set time limit is canceled.

What is the FAST limit in Turkey?

TRY 300,000 per transaction for transfers, Request-to-Pay and QR merchant payments since 26 August 2026 (TCMB press release 2026-36); escrow allows TRY 5,000,000 (FAST FAQ, read 6 November 2026).

Can a foreign company connect to FAST directly?

Participants are banks, eligible payment and e-money institutions and PTT, so a foreign company without such a license works through a participant.

Who can use Turkish open banking APIs?

Banks and firms licensed by TCMB under Law 6493 Article 12(1)(f) or (g), after BKM technical certification; a foreign developer can only build for one of them.

Sources

• TCMB: Press Release No. 2026-36 on FAST limits, 24 August 2026 (opens in a new tab)
• TCMB: EFT, EMKT and FAST systems (Turkish) (opens in a new tab)
• TCMB FAST site: Frequently asked questions (Turkish) (opens in a new tab)
• TCMB FAST site: Participants (Turkish) (opens in a new tab)
• TCMB: Annual Report 2024, section 2.5.2 (opens in a new tab)
• TCMB: Regulation on the Generation and the Use of TR QR Code, with technical annex (English) (opens in a new tab)
• TCMB: Guide on payment data-sharing services, 30 April 2023, including scenario 3 (Turkish) (opens in a new tab)
• TCMB: Regulation on Payment Services, Resmî Gazete 1 December 2021 no. 31676, consolidated to 4 September 2026, Articles 18, 21, 33, 59 and 60 (Turkish) (opens in a new tab)
• TCMB: Communiqué on Information Systems and Data-Sharing Services, Articles 21 and 23 to 27 (Turkish) (opens in a new tab)
• Mevzuat: Law No. 6493, Articles 12 and 14 (Turkish) (opens in a new tab)
• ÖHVPS API Principles and Rules, version 2.0.1: Core principles (Turkish) (opens in a new tab)
• ÖHVPS API Principles and Rules, version 2.0.1: Payment initiation (Turkish) (opens in a new tab)
• ÖHVPS API Principles and Rules, version 2.0.1: Consent states (Turkish) (opens in a new tab)
• TCMB: Annual Report 2025, section 2.5 (FAST volumes, participants, TR QR coverage, GEÇİT) (opens in a new tab)
• TCMB: Payment systems legislation, including the FAST TR QR guide version 1.6, the own-funds communiqué and the regulation on crypto assets in payments (Turkish) (opens in a new tab)

This guide is general information about software and markets, not investment, legal or tax advice. Automated trading can lose money, past or backtested performance does not guarantee future results, and the rules that apply depend on your jurisdiction and your exchange's terms. Sources, checks and corrections: see the editorial policy.