Identity checks are moving from document photos to chips, liveness checks and, in the EU, a digital identity wallet. On 4 September 2026 the Central Bank of the Republic of Türkiye (TCMB) wrote biometric methods and chip-enabled identity documents into the remote identification rules for payment and e-money institutions. In the EU, each Member State must offer a European Digital Identity Wallet by 24 December 2026 on our calculation (the Commission says “by the end of 2026”), and private firms that must use strong user authentication, including banks and financial services firms, must accept it on request a year later. Fintechs onboarding Turkish and EU customers will run two rulebooks side by side. This note sets out both as of October 2026.
The trend in one paragraph
Customers increasingly prove who they are with something the state has already verified. In Türkiye that is the chip in the identity card or passport, read by the customer’s phone and matched to a live face. In the EU it will be a state-backed wallet app that shares only the attributes requested. Neither removes the onboarding firm’s AML and data protection duties.
EU: what eIDAS 2 requires, and when
eIDAS 2 (Regulation (EU) 2024/1183, amending Regulation (EU) No 910/2014) key provisions:
- Wallet for everyone (Art. 5a(1)). Each Member State “shall provide at least one European Digital Identity Wallet within 24 months of the date of entry into force of the implementing acts” referred to in Article 5a(23) and Article 5c(6). Those acts (Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980 and 2024/2982 under Article 5a(23), and 2024/2981 under Article 5c(6)) were all published on 4 December 2024 and entered into force on the twentieth day following publication, 24 December 2024. By our calculation the wallet deadline is therefore 24 December 2026; the Commission describes it as “by the end of 2026”. Implementing Regulation (EU) 2025/848 on relying party registration applies from the same date, 24 December 2026. Implementing Regulation (EU) 2026/1731 (OJ 22.7.2026) updated the technical standards in four of those acts and defers some features, such as the wallet user’s portrait in the mandatory identification data, to 11 August 2028; we do not read it as moving the deadlines.
- Free for individuals, assurance level high (Art. 5a(11) and (13)). Wallets are provided under an electronic identification scheme with assurance level high, and issuance, use and revocation are free of charge to natural persons.
- Relying parties register (Art. 5b(1)). A relying party that intends to rely on wallets “shall register in the Member State where it is established”.
- Private acceptance duty (Art. 5f(2)). Private relying parties that are required by Union or national law, or by contract, to use strong user authentication for online identification, expressly including banking and financial services, must accept the wallet “no later than 36 months” from the entry into force of the same implementing acts, and only on the user’s voluntary request. Microenterprises and small enterprises are excluded. On the same calculation, that is 24 December 2027.
- Very large online platforms (Art. 5f(3)) must also accept the wallet for user authentication on the user’s voluntary request, limited to the minimum data necessary.
EU anti-money laundering: the wallet becomes a CDD tool
The new Anti-Money Laundering Regulation (Regulation (EU) 2024/1624, “AMLR”) applies from 10 July 2027. Article 22(6) lets obliged entities verify identity by a document or by “the use of electronic identification means which meet the requirements of Regulation (EU) No 910/2014 with regard to the assurance levels ‘substantial’ or ‘high’ and relevant qualified trust services”. Recital 66 says such electronic identification “should be taken into account and accepted by obliged entities”. Under Article 28, the EU AML Authority was to submit draft technical standards by 10 July 2026 listing the attributes these means must carry.
Türkiye: four rulebooks, one customer journey
Turkish remote identity verification is sectoral. The rules you follow depend on your licence.
Banks. BDDK’s Regulation on Remote Identification Methods to be Used by Banks (Official Gazette 1.4.2021, No. 31441, in force 1.5.2021) is built around a real-time video call with a trained customer representative (Arts. 4 and 5). ID card chip data is verified over NFC (Art. 7(2)); if that fails, at least four visual security features are checked and the first transaction must come from the person’s own account at another bank (Art. 7(3)). Liveness detection and a biometric face comparison are required (Art. 8). Biometric data is the only special category data allowed, with explicit consent recorded electronically (Art. 6(2)), and if the customer objects to a transaction that creates obligations for the customer or a third party, the burden of proof is on the bank (Art. 11(1)). A 2023 amendment extended the process to legal entities (Arts. 7/A to 7/C) and authorised the BDDK Board to set rules for AI-based methods (Additional Art. 1).
Payment and e-money institutions. TCMB is the licensing authority. The amendment published in the Official Gazette of 4.9.2026 (No. 33360) added “biometric methods or identity documents capable of electronic identity verification” to Article 41(4) of the Payment Services Regulation, and the same day’s communiqué amendment made NFC chip verification the main route under Article 22 of the TCMB information systems communiqué and opened a passport route for non-Turkish nationals (Art. 22(16)). We cover the details in our article on TCMB biometric remote identification.
MASAK (AML layer). MASAK General Communiqué No. 19 (Official Gazette 30.4.2021, No. 31470) sets the AML conditions for remote identification. Banks follow the BDDK regulation (Art. 5); payment and e-money institutions follow the TCMB communiqué (Art. 5/C, added in 2023). Since 27 June 2026, Article 4/C (Communiqué No. 32) allows remote identification of non-Turkish natural persons with an NFC-enabled ICAO 9303 passport, subject to strict conditions: a video call by trained staff (AI liveness or photo comparison permitted within limits), mandatory chip matching, address verification within three months with no transfers or cash withdrawals before it, a verification transfer from a bank account or card in the customer’s name, high-risk classification, notification to MASAK within one month of starting, and quarterly statistics. Citizens of countries the firm has identified as risky cannot be onboarded this way.
e-Devlet and e-signature. e-Devlet accepts, among others, mobile signature, electronic signature and the chip ID card for login. Under the Electronic Signature Law No. 5070, a secure electronic signature has the same legal effect as a handwritten one (Art. 5), but transactions that the law subjects to official form or special formality cannot be made with it, nor can guarantee contracts other than bank letters of guarantee and surety bonds issued by insurers established in Türkiye. As of October 2026 we have not identified an official Turkish digital identity wallet published in the Official Gazette that private firms are required or expressly permitted to rely on.
Biometrics: special category data on both sides
Under KVKK (Law No. 6698) Article 6(1), biometric and genetic data are special categories of personal data. Since 1 June 2024, Article 6(3) as amended by Law No. 7499 prohibits processing them unless one of the listed conditions applies, including explicit consent, express provision in laws, or necessity for establishing, exercising or protecting a right. The BDDK regulation still requires explicit consent for the biometric step. Under the GDPR, Article 9(1) covers “biometric data for the purpose of uniquely identifying a natural person”, which is exactly what a selfie-to-chip face match does, and Article 3(2)(a) brings a Turkish firm offering services to people in the EU into scope.
EU wallet vs Turkish e-KYC routes
| Issue | EU Digital Identity Wallet | Turkish remote identification |
|---|---|---|
| Legal basis | eIDAS 2 (Reg. 2024/1183), Arts. 5a to 5f; AMLR Art. 22(6)(b) from 10 July 2027 | BDDK regulation (banks); TCMB Regulation Art. 41(4) and communiqué Art. 22 (payment/e-money); MASAK Communiqué No. 19 |
| Who vouches for identity | Wallet provided by, under a mandate from, or recognised by a Member State, assurance level high | Issuing state via the ID card or passport chip, checked by the firm |
| Human in the loop | No video call required by eIDAS | Video call with trained staff; AI support only within the limits the rules allow |
| Biometrics | Inside the wallet ecosystem; GDPR Art. 9 applies | Liveness and face match by the firm; KVKK Art. 6 applies |
| Foreign customers | Cross-border by design within the EU | Non-Turkish nationals: NFC passport under MASAK Art. 4/C, high-risk regime |
| Firm’s duty | Register in Member State of establishment; private relying parties required to use strong user authentication accept on request by 24 December 2027 (our calculation) | Optional route; if used, every condition must be met and the whole process recorded |
| Cost to the user | Free for natural persons | Not addressed in the rules we reviewed |
What is still unclear
First, reach: Article 5f(2) speaks of private relying parties within the EU framework, and registration is tied to the Member State of establishment. We found no route in Article 5b or Implementing Regulation 2025/848 for a relying party established outside the EU. Our reading is that the acceptance duty bites on an EU-licensed group entity that is not a micro or small enterprise, not on the Turkish parent. Second, the reverse direction: no Turkish rule we reviewed names the EU wallet as an accepted remote identification means, so for a Turkish-licensed firm a wallet presentation does not replace the NFC passport and video call route.
Where to start
- Map customers by nationality and document, and match each segment to its rule (BDDK, TCMB or MASAK Art. 4/C).
- For remote onboarding of foreigners, build the Art. 4/C controls: risky-country list, address check, verification transfer, MASAK notice and quarterly reporting.
- Treat face matching as special category processing: document the KVKK Art. 6(3) condition you rely on (and GDPR Art. 9 for EU users), and keep consent where the sector rule requires it.
- If you have or plan an EU entity, budget for wallet acceptance and relying party registration, and design CDD for AMLR Art. 22(6) from 10 July 2027.
- Build identity as interchangeable modules (NFC chip read, liveness, wallet presentation) with per-jurisdiction rules.
- Read the wider picture on our fintech law hub.
Can a Turkish fintech onboard customers with the EU Digital Identity Wallet?
Not as a stand-alone route under Turkish rules as of October 2026. The Turkish texts we reviewed describe NFC chip checks, liveness and a video call, and none lists the EU wallet. An EU-licensed entity in your group can use the wallet for EU customer due diligence once the AMLR applies from 10 July 2027.
Will a Turkish payment institution have to accept the EU wallet?
Article 5f(2) of eIDAS 2 requires private relying parties that must use strong user authentication, including in banking and financial services, to accept the wallet on request by 24 December 2027 on our calculation. Our reading is that this reaches EU-established entities that are not micro or small enterprises, not a Turkish entity without an EU establishment.
Is a selfie match biometric data under KVKK?
Yes. Article 6(1) of Law No. 6698 lists biometric data as special category data, and Article 6(3), as amended by Law No. 7499 from 1 June 2024, allows processing only under the listed conditions. For EU users, GDPR Article 9(1) covers biometric data used to uniquely identify a person.
Sources. Regulation (EU) 2024/1183 (eIDAS 2), Arts. 5a, 5b, 5f, OJ L, 30.4.2024; Implementing Regulations (EU) 2024/2977, 2024/2979, 2024/2980, 2024/2981 and 2024/2982, OJ L, 4.12.2024; Implementing Regulation (EU) 2026/1731, OJ L, 22.7.2026; Implementing Regulation (EU) 2025/848, OJ L, 7.5.2025; Regulation (EU) 2024/1624 (AMLR), Arts. 22, 28, recital 66, OJ L, 19.6.2024; Regulation (EU) 2016/679 (GDPR), Arts. 3(2), 9(1); BDDK Remote Identification Regulation, RG 1.4.2021/31441, amended RG 6.4.2022/31801 and RG 25.5.2023/32201; TCMB Payment Services Regulation amendment and communiqué amendment, RG 4.9.2026/33360; MASAK General Communiqué No. 19, RG 30.4.2021/31470, amended by No. 25 (RG 4.11.2023/32359) and No. 32 (RG 27.6.2026/33293); Law No. 6698, Art. 6, as amended by Law No. 7499 (RG 12.3.2024/32487); Electronic Signature Law No. 5070, Arts. 4 and 5 (RG 23.1.2004/25355).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
UK Crypto Authorisation Window Closes 28 February 2027: What Turkish Crypto Platforms With UK Users Need to Decide
October 14, 2026When Does a Turkish Game Studio Need a UK or US Holding?
October 2, 2026Climate Fintech in Türkiye: CBAM, the Turkish ETS, Carbon Credits and ESG Data
October 22, 2026Stablecoins, Tokenised Deposits and Wholesale CBDC: Legal Status for Turkish Businesses (October 2026)
October 21, 2026In-App Purchases and Refunds in Türkiye: The Digital-Content Exception, Pre-Contract Information and the Child Who Bought Gems
October 21, 2026MASAK's New Hawala and Money Mule STR Guides: What Payment, E-Money and Crypto Firms Must Do (October 2026)
October 20, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →