Europe opened bank account data to third parties in 2018 with PSD2. The next step, the Financial Data Access proposal (FiDA, COM(2023) 360 of 28 June 2023), would extend customer-permissioned sharing to mortgages, savings, investments, pensions and non-life insurance. As of October 2026 FiDA is still not law: the European Parliament’s Legislative Observatory records the file as “Awaiting Parliament’s position in 1st reading”, and trilogues have produced no agreement. The payments side is further ahead: Parliament’s ECON committee approved the agreed text of the Payment Services Regulation (PSR) on 5 May 2026, and it awaits formal adoption. For a Turkish wealth, lending or insurtech app, the real question is which parts of FiDA are worth building now, because Türkiye’s own data-sharing rules still stop at payment accounts.
Open finance in one paragraph
Open banking lets a customer tell a third party to read their payment account data or initiate a payment from that account, through a standard interface the bank must provide. Open finance applies the same idea to loans, funds, pensions and insurance policies. The legal questions are who must open the data, who may receive it, who pays for the pipes, and who controls the customer’s permission.
What the FiDA proposal would do
The proposal is a regulation, directly applicable across the EU. Its building blocks:
| Element | What the proposal says |
|---|---|
| Data in scope (Art. 2(1)) | Mortgage credit agreements, loans and accounts other than payment accounts; savings, investments in financial instruments, insurance-based investment products and crypto-assets; occupational and PEPP pension rights; non-life insurance; and data forming part of a creditworthiness assessment of a firm |
| Exclusions | Sickness and health insurance data of a consumer, life insurance (other than insurance-based investment products) and data collected for a consumer creditworthiness assessment (Recital 9, Art. 2(1)(e)) |
| Customer rights (Arts. 4-5) | On the customer’s electronic request, the data holder must make the data available to the customer, or to a data user the customer has given permission to, without undue delay, continuously and in real time |
| Who may receive data (Art. 6) | Only authorised financial institutions or licensed financial information service providers (FISPs), and only for the purposes the customer permitted |
| Permission dashboard (Art. 8) | The data holder must offer a dashboard to monitor and manage permissions, easy to find in its interface, keeping a record of withdrawn or expired permissions for two years |
| Data sharing schemes (Arts. 9-11) | Data holders and users must join schemes within 18 months of entry into force; schemes set standards, liability, dispute resolution and “reasonable” compensation; the Commission may step in by delegated act if no scheme emerges |
| FISP licence (Arts. 12-14) | Authorisation by a Member State competent authority, with professional indemnity insurance; a third-country FISP can be authorised if it designates a legal representative in the EU |
Most of it would apply 24 months after entry into force. A data holder may claim compensation from a data user, but only under scheme rules (Art. 5(2)).
Where FiDA stands as of October 2026
The Parliament’s ECON committee voted its report on 18 April 2024 and the decision to enter interinstitutional negotiations was confirmed in plenary on 18 December 2024; the Council agreed its negotiating mandate on 4 December 2024. No provisional agreement has been recorded since. FiDA has not been withdrawn: the Commission’s work programmes for 2025 (published 11 February 2025) and 2026 (21 October 2025) both list it in Annex III among pending proposals, and it does not appear in the list of withdrawn proposals published in the Official Journal on 6 October 2025.
The final scope is still open. According to the Council’s press release, its mandate excludes occupational pension data while letting Member States opt in, follows a step-by-step approach to implementation, and would have gatekeepers “strictly regulated and supervised”. These are negotiating positions, not law, but in our reading they point to a narrower and phased regime than the Commission proposed.
How FiDA fits with the PSR and the Data Act
| Instrument | Status | Data | Relevance for a Turkish app |
|---|---|---|---|
| PSD2 (Directive (EU) 2015/2366) | Applies; opened payment account data in 2018 | Payment accounts | The current EU baseline for account information and payment initiation services |
| PSR (2023/0210(COD)) | Agreed text approved by ECON on 5 May 2026; awaiting formal adoption | Payment accounts | Mandatory dedicated interface (Art. 35) and a consent dashboard at the bank (Art. 43); most of it applies 21 months after entry into force |
| Data Act (Regulation (EU) 2023/2854) | Applicable since 12 September 2025 | Data from connected products and related services | Users can have product data shared with a third party (Art. 5), relevant for telematics-based insurance |
| FiDA (2023/0205(COD)) | Proposal, in trilogue | Financial data beyond payment accounts | Would require a FISP licence or financial-institution authorisation to receive data |
The PSR’s dashboard is close to FiDA’s: it must show each consent, its purpose, validity and data categories, allow withdrawal free of charge, allow re-establishment within 48 hours, and keep a two-year record. It must not contain language that discourages use of third-party providers. We cover the payments reform in our PSD3 and PSR article, and the PSD2 entry explains the current baseline.
The Data Act is the horizontal layer. Where any Union law obliges a data holder to make data available to a business, its Chapter III requires fair, reasonable and non-discriminatory terms (Arts. 8(1) and 12(1)), and FiDA’s recitals describe it as complementing the Data Act. Article 5(3) of the Data Act already excludes designated gatekeepers as eligible third parties, a question FiDA’s negotiators must also settle.
Türkiye today: open banking, but only for payment accounts
Turkish open banking rests on Article 12(1)(f) and (g) of Law No. 6493, added by Law No. 7192 in 2019: payment order initiation and the online presentation of consolidated payment account information with the user’s approval. Services run through the Payment Services Data Sharing Services (ÖHVPS) developed by BKM, the Interbank Card Centre. On 17 March 2026 the Central Bank (TCMB) announced version 2.0.0, adding card information and transactions to account information, plus future-dated and recurring payment initiation; it reported 16.4 million users and 53 participants. Licensing and consent flows are covered in our open banking guide.
Beyond payment accounts, there is no Turkish equivalent of FiDA. Three rules shape what a wealth or insurtech app can do instead:
- No general portability right. Article 11 of Law No. 6698 (KVKK) lists the data subject’s rights (information, correction, deletion, objection to automated outcomes, damages) but not a right to receive data in a machine-readable format or have it transmitted to another controller.
- Bank secrecy needs the customer’s instruction. Under Article 73(3) of Banking Law No. 5411, customer-secret data cannot be shared with third parties in Türkiye or abroad without the customer’s request or instruction, even if KVKK explicit consent is obtained, and any sharing must be limited to the stated purpose and proportionate.
- Credit data has its own channel. Article 73(4) exempts information exchange among banks and financial institutions directly, through the Risk Centre or through companies set up by at least five banks or financial institutions. The Risk Centre, set up within the Banks Association of Türkiye under Additional Article 1, shares customers’ risk data with member institutions, with the persons concerned and, with their consent, with other individuals and private-law entities. KKB states that it runs the Risk Centre’s operations on the Association’s behalf.
We have not identified any binding Turkish rule that extends open-banking-style access to insurance or private pension data as of October 2026.
Where Türkiye’s framework could go
The Medium-Term Programme 2027-2029 (Official Gazette of 6 September 2026, supplementary issue 33362) gives three signals. It commits to work supporting wider use of FAST and the ÖHVPS; to a national policy framework on data economy covering data ownership and sharing responsibilities, with umbrella data governance legislation; and to completing KVKK alignment with the GDPR, with the third quarter of 2027 as the target. None of this mentions open finance by name or creates rights today, but a GDPR-aligned KVKK could bring a portability right, and a data governance law could carry FiDA-style sharing obligations. Both are worth watching.
What is unclear
In the EU: the final FiDA scope, the treatment of gatekeepers, the compensation rules and whether a law will be agreed at all. In Türkiye: whether sharing beyond payment accounts will be built on TCMB’s payment framework, banking secrecy rules, KVKK or a new data governance law, and who would supervise it. Until then, it depends on customer instructions, contracts and existing credit bureau channels. Our fintech law hub tracks these files.
Where to start
- Map which datasets you need (accounts, cards, loans, funds, pensions, policies) and which legal channel reaches each today.
- Use ÖHVPS for payment account and card data through a licensed participant or your own TCMB licence; do not rely on scraping.
- For bank data outside ÖHVPS, build a customer instruction flow that satisfies Banking Law Art. 73(3), alongside your KVKK basis and privacy notice.
- Build a permission dashboard now, modelled on FiDA Art. 8 and PSR Art. 43: purpose, data categories, validity, one-click withdrawal, two-year history.
- If you target EU customers, plan the licence: check whether you need an account information authorisation under PSD2 today, and a FISP licence (with an EU legal representative) if FiDA is adopted in its proposed form.
- For EU telematics insurance products, check Data Act Art. 5.
Is FiDA already law in the EU?
No. As of October 2026 it is a proposal in trilogue, with no provisional agreement recorded. The Commission still lists it as pending, and the Council’s mandate takes a narrower, step-by-step approach.
Can a Turkish company receive EU financial data under FiDA?
Under the proposal, a third-country firm could be authorised as a financial information service provider if it designates a legal representative in the EU and meets the authorisation conditions, including professional indemnity insurance. The final text may change this.
Does KVKK give Turkish users a data portability right?
No. Article 11 of Law No. 6698 lists the data subject’s rights and does not include portability. The Medium-Term Programme 2027-2029 targets completing KVKK alignment with the GDPR in the third quarter of 2027, which may change this, but it creates no right today.
Sources. FiDA proposal, COM(2023) 360 final, 28.6.2023, Arts. 2, 4-6, 8-14, Recitals 9 and 47; Legislative Observatory, 2023/0205(COD); Commission work programme 2026, Annex III, COM(2025) 870; Commission work programme 2025, Annex III, COM(2025) 45; Council note on withdrawn proposals (OJ C, C/2025/5423, 6.10.2025); Council press release on FiDA, 4.12.2024; PSR provisional agreement, European Parliament ECON, PE787.675, 5.5.2026, Arts. 35, 43, 112; Legislative Observatory, 2023/0210(COD); PSD2, Directive (EU) 2015/2366, OJ L 337, 23.12.2015, Art. 115; Data Act, Regulation (EU) 2023/2854, OJ L 22.12.2023, Arts. 5, 8, 12; Law No. 6493 (RG 27.6.2013, No. 28690) Art. 12(1)(f)-(g) as added by Law No. 7192 (RG 22.11.2019, No. 30956); Law No. 6698 (RG 7.4.2016, No. 29677) Art. 11; Banking Law No. 5411 (RG 1.11.2005, No. 25983 bis) Art. 73 and Additional Art. 1; TCMB press release 2026-13, 17.3.2026; Medium-Term Programme 2027-2029 (RG 6.9.2026, No. 33362 bis).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Generative-AI Finance Assistants: When a Chatbot Becomes Regulated Investment Advice in Türkiye and the EU
October 29, 2026Banking-as-a-Service and Embedded Finance in Türkiye: Who Must Hold the Licence and Which Partnership Models Work
October 26, 2026Open Banking in Türkiye: A Practical Legal Guide for Fintechs (2026)
October 18, 2026Tokenised Funds and Fractional Ownership in Türkiye: Which Regime Applies to Retail Investors (October 2026)
November 1, 2026Closing a Startup in Türkiye: Dissolution, Liquidation and Deregistration Under TCC 529–548
November 1, 2026Programmable Treasury in Türkiye: Conditional Payments, Smart Contracts and 24/7 Collateral (TBK, Law 6493)
October 31, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →