Since 17 January 2025, EU banks, payment and e-money institutions, crypto-asset service providers and most other financial entities have had to run their technology under the Digital Operational Resilience Act (DORA). On 18 November 2025 the European Supervisory Authorities named the first 19 cloud, data and IT providers they will oversee directly. Turkish payment institutions, banks and crypto-asset service providers already must keep their primary and secondary systems in the country, and everyone faces a slower deadline: moving encryption to post-quantum algorithms. Below, as of October 2026: what applies to a Turkish fintech and to a Turkish vendor selling to EU financial firms.
The trend in one paragraph
Operational resilience means a financial firm keeps its important services running through a cyberattack, a cloud outage or a failed update, and recovers quickly. Three threads meet: regulators treat ICT failure as a core financial risk with reporting clocks and testing duties; much of the sector runs on the same few cloud and IT providers, so one outage can hit many firms at once (concentration risk); and today’s public-key encryption is expected to become breakable by future quantum computers, so data stolen now can be decrypted later.
DORA in brief: who is in and what applies
DORA (Regulation (EU) 2022/2554) Article 2(1) lists the financial entities in scope, including credit institutions, payment institutions, account information service providers, electronic money institutions, investment firms, and crypto-asset service providers authorised under MiCA. Exempted payment and e-money institutions are in scope but, under Article 16, follow a simplified ICT risk management framework instead of Articles 5 to 15.
| Area | What DORA requires |
|---|---|
| Governance (Art. 5-6) | A documented ICT risk management framework; the management body defines, approves and is responsible for it |
| Incident reporting (Art. 19; Delegated Reg. 2025/301 Art. 5) | Initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it; intermediate report within 72 hours of the initial notification; final report within one month after the latest intermediate report |
| Testing (Art. 26) | Entities identified by their authority must run threat-led penetration testing (TLPT) at least every 3 years, on live production systems |
| Register of information (Art. 28(3)) | A register of all contracts for ICT services, separating those that support critical or important functions; yearly reporting to the authority |
| Concentration risk (Art. 29) | Before contracting for critical functions, assess whether the provider is not easily substitutable or whether too much sits with one provider; for third-country providers, also consider EU data protection compliance and effective enforcement of the law in that country |
| Critical providers (Art. 31) | ESAs designate critical ICT third-party providers (CTPPs) and oversee them directly; a non-EU CTPP may be used only if it sets up an EU subsidiary within 12 months of designation |
The list has 19 names, among them Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations, Oracle Nederland, SAP, IBM, Bloomberg, LSEG Data and Risk, Equinix (EMEA) and Deutsche Telekom. The ESAs update the list yearly (Art. 31(9)); check the current version.
If you are a Turkish vendor serving EU financial firms
A Turkish SaaS, core banking, KYC or data vendor is not a “financial entity” under Article 2 and, unless designated as critical, is not supervised under DORA. In our reading, DORA reaches it through the contract: Article 28(1) keeps the EU customer fully responsible even when it outsources. Article 30(2) sets the minimum content of every ICT services contract, including:
- a full description of the services and whether subcontracting is allowed, and on what conditions;
- the countries or regions where services are provided and data is processed or stored, with advance notice of any change;
- access, recovery and return of data if the vendor becomes insolvent, stops its business or the contract ends;
- help during ICT incidents at no extra cost or at a cost set in advance;
- full cooperation with the customer’s competent and resolution authorities, and termination rights with minimum notice periods.
For critical or important functions, Article 30(3) adds precise service levels, contingency plan testing, TLPT participation, unrestricted access, inspection and audit rights, and exit strategies with a mandatory transition period. Expect these as a DORA addendum. If you also serve Turkish regulated clients, the location clause must describe both EU and Turkish hosting accurately.
The Turkish rules: localisation first
Türkiye has no single DORA equivalent: each regulator sets information systems rules for its licensees, with core systems kept in the country.
| Who | Instrument | Key points |
|---|---|---|
| Payment and e-money institutions (TCMB) | Communiqué on Information Systems of Payment and E-Money Institutions (RG 1.12.2021/31676) | Primary and secondary systems and data backup centres must be in Türkiye (Art. 21(1)); outsourced systems used for payment transactions and their backups must also be kept in Türkiye (Art. 21(2)); cyber incidents notified to TCMB and response plans tested at least yearly (Art. 7); independent IS audit every two years (Art. 28(5)) |
| Payment and e-money institutions (TCMB) | Payment Services Regulation (RG 1.12.2021/31676), Art. 21 | Unless the Regulation provides otherwise, payment services and e-money issuance cannot be outsourced; information systems can be, under a written contract, reported to TCMB; a foreign provider’s country must not legally block TCMB’s information access or audit |
| Banks (BDDK) | Regulation on Banks’ Information Systems and Electronic Banking Services (RG 15.3.2020/31069) | Primary and secondary systems in Türkiye (Art. 25(1)); outsourced or cloud systems within that scope also stay in Türkiye (Art. 25(5)); cloud for these systems via a private cloud dedicated to one bank, or a community cloud subject to BDDK Board permission (Art. 29(11)) |
| Capital markets institutions and crypto-asset service providers (SPK) | Communiqué on Procedures and Principles of IS Management (VII-128.10), RG 13.3.2025/32840, in force 30.6.2025 | Replaced VII-128.9 (Art. 32) and now lists CASPs in scope (Art. 2(1)(i)); primary and secondary systems in Türkiye (Art. 27(1)); cloud use is treated as outsourcing (Art. 19(6)); crypto-asset platforms may use foreign cloud for order-matching environments if the provider has a representative in Türkiye, with all records moved to domestic systems at day end (Art. 30(4)); IS internal auditors must hold the IS audit licence by 31.12.2026 (Provisional Art. 1) |
| CASPs (SPK) | Law No. 6362 Art. 35/B(2) (added by Law No. 7518); Communiqué III-35/B.1 | Licensing requires compliance with IS criteria set by TÜBİTAK; outsourcing for information security follows VII-128.10 and the TÜBİTAK criteria (Art. 31(7)); IS independent audit at least once a year (Art. 48(1)) |
Two horizontal instruments also apply. Cyber Security Law No. 7545 (RG 19.3.2025) requires those providing services through information systems to report detected vulnerabilities or cyber incidents to the Cybersecurity Presidency without delay (Art. 7(1)(b)); see our piece on the new authority map. Presidential Circular 2019/12 (RG 6.7.2019) requires critical data such as population, health and communication records and genetic and biometric data to be stored securely in Türkiye.
The effect on concentration risk is direct: a Turkish licensed firm cannot diversify its core systems into foreign regions, so its options are domestic data centres, cloud regions in Türkiye or the models the regulator allows. A narrower provider pool makes exit planning harder.
Post-quantum cryptography: the deadlines that are not yet law
On 13 August 2024 NIST published its first three finalised post-quantum standards: FIPS 203 (ML-KEM, for general encryption), FIPS 204 (ML-DSA, digital signatures) and FIPS 205 (SLH-DSA, a backup signature method). In the EU, a Commission Recommendation of 11 April 2024 asked Member States to coordinate the transition, and the NIS Cooperation Group’s June 2025 roadmap sets milestones: first steps and national plans by the end of 2026, high-risk use cases transitioned by the end of 2030, medium-risk ones by the end of 2035. These are addressed to Member States, not directly to companies.
For financial firms, the binding hook is DORA’s ICT risk RTS (Delegated Regulation (EU) 2024/1774). For entities outside the simplified regime, Article 6 requires an encryption policy covering data at rest, in transit and, where necessary, in use, and Article 6(4) requires provisions for updating cryptographic technology based on developments in cryptanalysis. Recital 9 expressly mentions “threats from quantum advancements”. Article 7 adds lifecycle key management and a certificate register.
The Turkish texts are technology-neutral but point the same way. The TCMB communiqué requires encryption techniques that are current, consistent with national and international standards and still reliable (Art. 9(3)). The BDDK regulation requires keys long enough not to be broken during the period they are valid and usable (Art. 9(2)), the “store now, decrypt later” problem for long-lived confidential data. We found no official Turkish post-quantum guidance or timeline as of October 2026.
What remains unclear
- How one platform reconciles Article 30 audit and data return rights for EU clients with Turkish localisation duties for Turkish clients.
- Whether Türkiye will adopt CTPP-style direct oversight of cloud and data centre providers; none exists today.
- When a “high-risk” use case under the EU roadmap becomes a supervisory expectation for a payment or e-money institution.
Where to start
- Put every ICT contract into one register, flagging those supporting critical or important functions.
- For each critical provider, write a realistic exit plan and check whether a domestic alternative exists.
- Vendors: prepare a standard DORA Article 30 addendum and a data location statement before EU customers ask.
- Run an incident drill against the 4-hour and 24-hour DORA clock and the Turkish notification lines (TCMB for payment and e-money institutions, and the Cybersecurity Presidency under Law No. 7545).
- Start a cryptographic inventory: where RSA and elliptic curve keys are used, which data must stay confidential past 2030, and which suppliers support ML-KEM and ML-DSA.
- Licensed firms: check your IS audit calendar and, for CASPs and capital markets firms, the 31.12.2026 auditor licence deadline. Our payment and e-money licence page and the fintech law hub list the related obligations.
Does DORA apply directly to a Turkish software company?
Not as a financial entity. Unless designated as a critical ICT third-party provider, a Turkish vendor is reached through its EU customers, who must include the Article 30 clauses in their contracts.
Can a Turkish payment institution host its systems on a foreign cloud?
Not for its primary and secondary systems. The TCMB communiqué requires those systems and data backup centres, and an outsourced provider’s systems and backups used for payment transactions, to be in Türkiye.
Is post-quantum migration mandatory today?
No fixed legal deadline applies to companies yet. DORA’s RTS already requires EU financial entities outside the simplified regime to update cryptography based on developments in cryptanalysis, and the EU roadmap targets 2030 for high-risk use cases at Member State level.
Sources. Regulation (EU) 2022/2554 (DORA), OJ L 333, 27.12.2022, Arts. 2, 5, 6, 16, 19, 26, 28, 29, 30, 31, 64; Delegated Regulation (EU) 2024/1774, recital 9, Arts. 6-7; Delegated Regulation (EU) 2025/301, Art. 5; ESAs, designation of CTPPs (18.11.2025); NIST, FIPS 203, 204, 205 (13.8.2024); Commission Recommendation C(2024) 2393; EU PQC Coordinated Implementation Roadmap (June 2025); TCMB Information Systems Communiqué, RG 1.12.2021/31676, Arts. 7, 9, 21, 28; TCMB Payment Services Regulation, RG 1.12.2021/31676, Art. 21; BDDK Regulation on Banks’ Information Systems and Electronic Banking Services, RG 15.3.2020/31069, Arts. 9, 25, 29; SPK Communiqué VII-128.10, RG 13.3.2025/32840, Arts. 2, 19, 27, 30, 32, Provisional Art. 1; SPK Communiqué III-35/B.1, RG 13.3.2025/32840, Arts. 31, 48; Law No. 7518, RG 2.7.2024/32590 (Law No. 6362 Art. 35/B); Cyber Security Law No. 7545, RG 19.3.2025/32846, Art. 7; Presidential Circular 2019/12, RG 6.7.2019/30823.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
