On 17 March 2026 the Central Bank of the Republic of Türkiye (TCMB) announced version 2.0.0 of the national open banking service set. Account information now covers card data, and payment initiation supports future-dated and standing orders. The TCMB reports 53 participants, 16.4 million users and an average of 12.3 million transactions a day. For a fintech, the hard questions are legal: which regulated service your product performs, whether you need a TCMB licence, how consent and authentication work, and who pays when a payment goes wrong.
The two services in Law No. 6493, Article 12
Since Law No. 7192 of 2019, Article 12(1) of Law No. 6493 lists two services that together form what the market calls open banking:
- Payment initiation service (point f): initiating a payment order, at the user’s request, on a payment account held with another payment service provider.
- Account information service (point g): presenting, on online platforms and subject to the user’s approval, consolidated information on one or more payment accounts the user holds with payment service providers.
The TCMB calls these the payment services data-sharing services (ÖHVPS) and says they were defined in line with the EU’s PSD2. The detail sits in two TCMB instruments published in Official Gazette No. 31676 of 1 December 2021: the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (the “Regulation”, Articles 59 to 61) and the Communiqué on information systems and data-sharing services (the “Communiqué”, Articles 23 to 27).
Under Article 4(16) of the Regulation, a transaction is payment initiation only if the payer uses a provider other than the one holding the account.
Who may provide them, and the route in
Under Article 13 of Law No. 6493, only banks, electronic money institutions, payment institutions and PTT may provide payment services. A non-bank needs a TCMB authorisation covering point (f), point (g) or both; the licensing authority is the TCMB, not the BDDK. According to the TCMB’s April 2023 guide, a bank acting as a third party needs no licence but must complete the same technical certification.
An account-information-only licence is lighter: Article 14/A(1) of the Law lifts the cash share issuance, registered share and minimum capital requirements, and Article 33(9) of the Regulation substitutes professional liability insurance or collateral that grows with customer numbers. Our payment and e-money licence page covers the general application process.
Open banking adds a technical step. Under Article 59(3) and (4) of the Regulation, Bankalararası Kart Merkezi A.Ş. (BKM) tests compliance with the TCMB’s technical requirements, records and publishes those that pass, and they become authorised providers once the TCMB grants permission; Article 11(10)(c) puts the BKM document in the final approval file. The TCMB guide also accepts an agent (temsilci) model under Article 18 of the Regulation, provided customers contract with the licensed provider and the agent does not present the service as its own.
Acting as a payment institution without permission carries one to three years’ imprisonment and a judicial fine of up to 5,000 days (Law No. 6493, Article 28).
The gateway: GEÇİT and the account provider’s duties
The Communiqué defines the “BKM-API Geçidi” as the structure BKM sets up under Article 59(5) of the Regulation; the TCMB’s 2022 launch announcement calls it the “Açık Bankacılık Geçidi” (GEÇİT). Account providers expose their services through it and third parties integrate once. Per the TCMB guide, both sides sign an undertaking with BKM rather than with each other, and Articles 60(4) and 61(4) of the Regulation require no service-specific agreement except on fees, which must be reasonable and cost-based and may be capped or banned by the TCMB (Article 59(7)).
Under Article 24 of the Communiqué, the account provider must execute requests without delay, give three months’ notice of technical changes, provide a test environment, match the performance of its own online channel and add no obstacles such as off-purpose flows or marketing. Since the amendment published in the Official Gazette of 28 March 2025, Article 59(9) of the Regulation limits the connection duty to participants in the FAST instant payment system and to the top ten non-participants by payment volume each year. The Communiqué’s transitional provision gave FAST participants, and the top ten non-participants by 2024 payment volume, until 31 December 2025.
Banks also answer to the BDDK’s Regulation on Banks’ Information Systems and Electronic Banking Services (Official Gazette No. 31069, 15 March 2020). As published, Article 3(1)(a) defines “open banking services” as a channel through which customers, or parties acting for them, reach a bank’s services via APIs, web services or file transfer. Article 41 relaxes the two-factor rule of Article 34 for that channel only with end-to-end secure communication, compensating controls and source restrictions, and lets the BDDK Board set the services and procedures.
Consent, authentication and data limits
Two concepts must not be confused. The first is the user’s approval (onay) of the payment service: under Article 23(7) of the Communiqué it is given separately for each information request and each payment initiation, although for account information it may also be given by contract for specified accounts and transactions. The second is explicit consent (açık rıza) under Law No. 6698 (KVKK), which Article 62(5) of the Regulation and Article 9(7) of the Communiqué say applies first to personal data processing.
Strong customer authentication is applied by the account provider, not the third party (Communiqué, Article 26), and payment initiation also needs a transaction verification code; exemptions are set by the TCMB. The first version of the API Principles and Rules (v1.0.0, February 2022) requires account providers to support at least browser-based redirect authentication.
A payment initiation provider may never hold the payer’s funds, may not change the payee or the amount, and may not store sensitive customer data (Regulation, Article 60(3)). An account information provider may access only the designated accounts and may not request sensitive data (Article 61(2)). Data obtained through either service may not be shared with third parties in Türkiye or abroad without a request or instruction from the customer, even where the customer has consented (Article 62(4)). Consent to data sharing may not be made a condition of the service (Communiqué, Article 9(6)).
Who is liable when something goes wrong
For an unauthorised payment initiated through a third party, the customer claims from the account provider, which must refund at once; if the initiation provider or its infrastructure was at fault, it reimburses the account provider’s costs, including the loss (Regulation, Article 54(7) and (8)). Within its sphere of control, the initiation provider must prove the payment was authorised, correctly recorded and unaffected by technical failure (Article 54(2)). Article 71 applies the same logic to non-executed or defective payments.
BKM keeps audit trails of gateway transactions for five years, and those records apply in disputes between the parties (Article 59(6)). Each party must log sessions in detail, with time stamps based on Electronic Signature Law No. 5070, to the extent it carries the burden of proof (Communiqué, Article 25). An account provider may block a third party’s access on objective and provable grounds of fraudulent or unauthorised access, but it must inform the customer and report to the TCMB (Regulation, Article 53(8) and (9)).
Does my product need a licence?
The table draws on the TCMB’s April 2023 guide. The TCMB stresses that the final assessment depends on the business model, so treat it as a first screen, not a conclusion.
| Product | Likely position |
|---|---|
| Personal finance app showing a user’s accounts at several banks | Account information service (point g). Generally needs a TCMB licence, or an agent arrangement with a licensed provider. |
| Accounting or ERP tool that contracts with banks itself and pulls clients’ transaction data | Treated by the TCMB as point (g), so a licence is needed. |
| Accounting tool, where the client company contracts with its bank and the tool only processes the data or runs as licensed software | The TCMB treats this as outside points (f) and (g) under the technical service exclusion in Article 12(2)(ğ). |
| Checkout “pay by bank” that initiates a transfer from the payer’s account | Payment initiation (point f). The provider that initiates the payment needs a TCMB licence, or an agent arrangement with a licensed provider. |
| Wallet storing cards issued by other banks and paying merchants | The TCMB guide treats this flow as payment initiation in addition to the virtual POS service, run outside the gateway. |
| Group treasury accessing affiliates’ accounts through one group IP address | Within open banking, but the TCMB points to the intra-group exclusion in Article 12(2)(j). |
The EU comparison: PSD2 today, PSR next
PSD2 (Directive (EU) 2015/2366) gives users the right to use payment initiation and account information providers where the account is accessible online (Articles 66 and 67), and requires strong customer authentication for online account access and electronic payment initiation (Article 97). Under PSD2 each account provider grants access itself; Türkiye routes standardised traffic through one gateway. Both systems ease the regime for account-information-only providers (PSD2, Article 33).
The Council’s 2 October 2026 state of play records a provisional agreement with the Parliament on 27 November 2025 and COREPER’s confirmation of the texts on 22 April 2026. Formal adoption and Official Journal publication were still pending as of 8 October 2026, so neither PSD3 nor the PSR applies yet. In the Payment Services Regulation compromise text dated 17 April 2026 (numbering may change), Article 35 requires a dedicated interface for online accounts, and Article 43 requires account providers to give users a dashboard to monitor and manage the consents they have given. Our fintech law hub tracks both regimes.
Where to start
- Map each product flow against points (f) and (g), and record why any flow falls under an exclusion.
- Choose the route: your own TCMB licence, an extension of an existing one, or an agent arrangement with a licensed provider.
- Budget for BKM technical certification and the information systems audit under the Communiqué.
- Keep payment approvals and KVKK explicit consent separate; never bundle them.
- Set retention rules for when approval expires or the customer leaves.
- Build logging that can carry your burden of proof under Articles 54 and 71.
Can a foreign PSD2-licensed provider serve Turkish users through GEÇİT?
Not on its EU licence. Article 4(2) of the Regulation reserves payment services to the TCMB, banks, TCMB-licensed institutions established in Türkiye and PTT, so a Turkish licensed entity or a structure around a licensed provider is needed.
Is screen scraping with the user’s banking password an alternative?
Not a safe one. Account providers subject to the gateway duty must stop unauthorised parties from accessing payment accounts to provide these services (Regulation, Article 59(5)), and unlicensed provision is a criminal offence.
Can we keep account data after the user’s approval expires?
According to the TCMB guide, only with the customer’s approval; when the relationship ends, the data must be deleted except mandatory audit trails. KVKK deletion duties apply as well.
Sources. Law No. 6493 (RG 27.6.2013/28690), Arts. 12, 13, 14/A, 28; TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (RG 1.12.2021/31676, as amended including RG 28.3.2025/32855), Arts. 4, 11, 18, 33, 53, 54, 59-62, 71; TCMB Communiqué on Information Systems and Data-Sharing Services (RG 1.12.2021/31676, as amended), Arts. 3, 9, 23-27, Provisional Art. 1; TCMB Guide on Data-Sharing Services in Payment Services (30 April 2023); ÖHVPS API Principles and Rules v1.0.0 (February 2022); TCMB press releases 2022-48 and 2026-13; BDDK Regulation on Banks’ Information Systems and Electronic Banking Services (RG 15.3.2020/31069), Arts. 3, 34, 41; Directive (EU) 2015/2366 (OJ L 337, 23.12.2015), Arts. 33, 66, 67, 97; Council documents 8221/26 (PSR), 8222/26 (PSD3) and 13589/26.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
