On 4 September 2026 the Central Bank of the Republic of Türkiye (TCMB) amended Article 41 of the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers so that it now names, in terms, the two ways a customer can be verified when a framework contract is set up remotely: biometric methods, or identity documents with electronic authentication capability. The amendment was published in Official Gazette No. 33360 and took effect the same day. A companion amendment to TCMB’s Information Systems Communiqué, published in the same Gazette, rewrote parts of the remote identification procedure and opened a passport-based route for non-Turkish nationals. If you run onboarding or compliance at a payment or e-money institution, or plan to enter Türkiye as a foreign PSP or EMI, this is the rulebook your app flow has to match.
What Article 41 said before, and what it says now
Article 41 governs framework contracts, and most of its paragraphs deal with those concluded through a “remote communication means” (internet, phone, SMS and similar channels where the parties never meet). Paragraph 4 lets the provider collect the customer’s information and documents by post, fax, email, online video call, a central structure approved by TCMB, or “other innovative methods suited to current technology”. Its second sentence sets the standard for those documents. That sentence has now been changed twice:
| Version | Second sentence of Art. 41/4 (our translation) |
|---|---|
| Original (RG 1.12.2021) | Information and documents obtained from the customer under a framework contract set up remotely in a way that allows the customer’s identity to be verified must be readable and verifiable. |
| From 7.10.2023 | The words “identity” and “from the customer” were deleted: information and documents obtained under a framework contract set up remotely in a way that allows the customer to be verified must be readable and verifiable. |
| From 4.9.2026 | Information and documents obtained under a framework contract set up remotely in a way that allows the customer to be verified by biometric methods or with identity documents having electronic authentication capability must be readable and verifiable. |
The rest of Article 41 is unchanged: the provider decides on a risk assessment who may onboard remotely and may insist on a face-to-face contract (41/7); TCMB may limit remotely contracted services (41/8); the customer must request and approve the remote route (41/10); and staff are trained at least annually on phishing, social engineering and coercion (41/11).
The real procedure lives in the Communiqué
Read alone, the Regulation change looks modest. It makes sense next to Article 22 of TCMB’s Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services, rewritten in October 2023. Since then, Article 22 has required, at a minimum:
- checking the identity document “as a rule” by near field communication (NFC), plus tests for originality, integrity, wear and tampering, with the check recorded without interruption;
- recording the person’s approval and explicit consent to the use of biometric data and to the remote contracting process;
- a liveness test by online real-time video, online real-time moving photo or online video call, and a biometric comparison of the face with the photo on the chip (or, if the chip photo cannot be read, the printed photo);
- device and environment checks, and verification of the contact details used for the channel.
Liveness runs on random commands across at least three images, pre-recorded footage must be excluded, and recordings are saved in real time on the institution’s own servers (22/2). Where staff intervene manually, no single person may start, approve and complete the process (segregation of duties), and the systems count as critical information systems (22/4). In a dispute, the institution must prove compliance (22/5), and written procedures are tested at least twice a year (22/6).
Among other changes, the 4 September Communiqué amendment added “biometric data” to Article 22/1; defined “identity document” as the Turkish identity card; tightened the fallback when NFC fails, so that the check by OCR, a card reader or another method TCMB sets after consulting MASAK must now cover at least the type and number of security features accepted under MASAK General Communiqué No. 19; and allowed non-Turkish natural persons to be identified remotely with an NFC-enabled ICAO 9303 passport under Article 4/C of that MASAK Communiqué.
What “biometric methods” and chip reading mean, and what the texts leave open
In practice there are two linked checks. The document check reads the chip in the Turkish ID card (or a foreigner’s passport) over NFC, typically with the customer’s phone, so the data comes from the issuer’s chip rather than a photographed card. The person check is a liveness test followed by a biometric face match against that chip photo. Article 22/13 adds a useful consequence: a remote identification carried out under Article 22 is deemed to satisfy strong customer authentication requirements under Article 10.
What the texts do not do is equally important. Neither the Regulation nor the Communiqué defines “biometric methods” or lists the accepted biometric modalities, matching thresholds, false-acceptance rates, certification schemes or vendor requirements. Article 22/7 leaves the documents, security features and verification criteria to the institution’s own written documentation, and Article 22/15 reserves TCMB’s power to set further procedures. Unless TCMB issues such procedures, the detail sits in your own documentation and is tested in supervision. One separate rule is worth flagging for product teams: under Article 10/8, a password, PIN or biometric that is controlled by the device manufacturer rather than the institution’s app cannot be used as a strong authentication element. Phone-level face unlock is not a substitute for the Article 22 biometric check.
KVKK: biometric data is special category data
Article 6(1) of the Personal Data Protection Law No. 6698 lists biometric data among special categories of personal data. Since Law No. 7499 amended Article 6 (in force on 1 June 2024), Article 6(3) starts from a prohibition and lists the grounds on which processing is possible, including the data subject’s explicit consent, processing being expressly provided for in laws, and necessity for establishing, exercising or protecting a right. Article 6(4) still requires the adequate measures determined by the Personal Data Protection Board.
For payment and e-money institutions the practical question is less open than it looks, because Article 22/1(ç) of the Communiqué itself requires the institution to record the person’s explicit consent to the use of biometric data. KVKK defines explicit consent as consent on a specific matter, based on information and given with free will. Two design points follow. Biometric consent should be a distinct, informed step, not a clause in the terms. And it is prudent to keep a non-biometric path (such as face-to-face onboarding, which Article 41/7 contemplates) so that refusing biometrics does not simply mean losing the service. Our earlier note on how the Authority approaches biometrics is a useful companion read.
MASAK: remote identification is also an AML rule
MASAK General Communiqué No. 19 (RG 30.4.2021) sets the principles for remote identification under Law No. 5549 on the Prevention of Laundering Proceeds of Crime. Since General Communiqué No. 25 (RG 4.11.2023), its Article 5/C provides that payment and e-money institutions carry out remote identification for continuous business relationships under the methods and measures in the TCMB Communiqué. The TCMB Communiqué in turn says, in Article 22/14, that MASAK General Communiqué No. 19 applies with priority. The two texts have to be read together, and breaches of General Communiqué No. 19 attract the penalties under Law No. 5549 (Article 7).
For foreign nationals, the new route depends on Article 4/C of General Communiqué No. 19, added by General Communiqué No. 32 (RG 27.6.2026). It is stricter than the domestic flow: a video call with specially trained staff (AI tools may support liveness or photo comparison under the conditions of Article 4(9)); a mandatory NFC chip match, failing which no relationship can be established; address verification within three months, with no transfers or cash withdrawals before it; no onboarding of nationals of countries the institution classes as risky; high-risk treatment, including a first transfer from a bank account or card matching the customer’s identity; notification to MASAK within one month of starting; and quarterly statistics.
How this compares with remote onboarding at banks
Banks follow a separate BDDK regulation (RG 1.4.2021 No. 31441), to which MASAK General Communiqué No. 19 refers them. As published in 2021, the main differences were:
| Point | Banks (BDDK Regulation, 2021 text) | Payment and e-money institutions (TCMB Communiqué Art. 22) |
|---|---|---|
| Format | Online video call with a trained customer representative | Liveness by real-time video, real-time moving photo or video call; no human agent expressly required for Turkish nationals (MASAK rules apply with priority) |
| Biometrics and consent | Only biometric data among special categories; explicit consent recorded electronically | Explicit consent to biometric use recorded; biometric face match with chip photo |
| Document check | NFC chip verification | NFC “as a rule” |
| If NFC fails | At least four visual security features, plus a first financial movement from the person’s own account at another bank | OCR, card reader or a TCMB method set after consulting MASAK, plus security features accepted under MASAK General Communiqué No. 19 |
Where to start
- Map your onboarding flow against amended Article 22, step by step, and record gaps.
- Make the chip read the primary route and limit the fallback to what Article 22/1(c) allows.
- Separate the biometric explicit consent from contract acceptance, review the privacy notice, and document the adequate measures under KVKK Article 6(4).
- Update written procedures, the twice-yearly tests, annual staff training and the remote onboarding risk assessment.
- If you plan to onboard foreign nationals by passport, build the MASAK Article 4/C controls first, including the one-month notification.
- Check vendor contracts: recordings must be stored on the institution’s servers in real time.
For the wider licensing picture, see our fintech law hub, our payment and e-money institution licence page and the recent change to minimum equity floors.
Did payment institutions need a branch visit to onboard customers before this change?
No. Article 41 already allowed remote framework contracts, and since October 2023 the Communiqué has set an NFC and biometric remote identification procedure. The 2026 change writes biometric methods and electronic ID documents into the Regulation itself and amends that procedure.
Can a foreign customer be onboarded remotely by a payment or e-money institution?
Yes, with an NFC-enabled ICAO 9303 passport under MASAK General Communiqué No. 19 Article 4/C. That route requires, among other things, a video call with trained staff, a successful chip match and high-risk treatment.
Does TCMB specify which biometric technology or vendor to use?
Not in the texts we reviewed. They set steps and outcomes; specific criteria go into the institution’s own procedures, and TCMB may set further procedures.
Sources. Regulation amending the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, Art. 1 (RG 4.9.2026 No. 33360); Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, Art. 41 (RG 1.12.2021 No. 31676); Amending Regulation, Art. 22 (RG 7.10.2023 No. 32332); Communiqué amending the Information Systems Communiqué, Arts. 1-3 (RG 4.9.2026 No. 33360); Information Systems Communiqué, Art. 22 as replaced (RG 7.10.2023 No. 32332); Information Systems Communiqué, Art. 10/8 (RG 1.12.2021 No. 31676); MASAK General Communiqué No. 19 (RG 30.4.2021 No. 31470); MASAK General Communiqué No. 25, Art. 5/C (RG 4.11.2023 No. 32359); MASAK General Communiqué No. 32, Art. 4/C (RG 27.6.2026 No. 33293); Law No. 6698, Arts. 3 and 6 (RG 7.4.2016 No. 29677); Law No. 7499, Arts. 33 and 40 (RG 12.3.2024 No. 32487); BDDK Regulation on Remote Identification Methods for Banks, Arts. 4-8 (RG 1.4.2021 No. 31441).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Hybrid Working Is Now in the Regulation: Article 9(2) of the Remote Working Regulation and What Contracts Must Say
September 27, 2026Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Türkiye Bans Social Media for Under-15s from 1 November 2026: What Platforms Must Change (Law 7578)
October 12, 2026MASAK Thresholds Doubled from 7 October 2026: AML Obligations for Payment, E-Money and Crypto Firms in Türkiye
October 8, 2026Türkiye's Age Verification Regulation for Social Networks: the e-Devlet Token, Rules for 15 to 17 Year Olds and the Deadlines
October 16, 2026Türkiye Extends Maternity Leave to 24 Weeks and Paternity Leave to 10 Days: What Employers Must Update (Law 7578)
October 15, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →