What is Open Banking?
Open Banking is the regulatory framework requiring banks to share customer financial data (with explicit customer consent) with licensed third-party providers via standardized APIs: enabling fintechs, account-aggregation platforms, payment-initiation services, and other innovators to build customer-facing products on top of bank infrastructure. Open Banking restructures the traditional bank-customer relationship: customers can authorize third parties to access their account data or initiate payments directly from their accounts, breaking the historical bank monopoly on customer-banking relationships and triggering significant competitive restructuring of financial services.
The architectural framework emerged from the EU’s Payment Services Directive 2 (PSD2, effective 2018) which mandated bank API exposure for: (i) Account Information Service Providers (AISPs): services aggregating customer account data across multiple banks (personal-finance management, lending decisioning, credit scoring); and (ii) Payment Initiation Service Providers (PISPs): services initiating payments from customer accounts at customer instruction (alternative to card payments, A2A transfers). PSD2 became the global reference framework, with UK Open Banking (2018), Australia Consumer Data Right (2020), Brazil Open Finance (2021), and Türkiye’s Open Banking framework (2021) all building on the PSD2 model.
Türkiye’s Open Banking framework rests on the payment initiation and account information services that Law No. 7192 added to Law No. 6493 (in force 1 January 2020), and on TCMB’s regulation and communiqué of 1 December 2021; banks’ open banking services are also governed by BDDK’s regulation on banks’ information systems and electronic banking (in force 1 July 2020). The framework requires: (i) licensed third-party service providers: fintechs must obtain a TCMB licence (typically Payment Institution / Ödeme Kuruluşu license or E-Money Institution / Elektronik Para Kuruluşu license) to access bank APIs; (ii) standardized API architecture: account-holding institutions must provide API-based data sharing services, routed through the BKM-API Gateway set up by BKM (Bankalararası Kart Merkezi) under TCMB’s regulation; (iii) strong customer authentication (SCA): biometric or multi-factor authentication for API access; (iv) customer-consent management: granular, time-bounded, revocable consent mechanisms; and (v) incident reporting and operational-resilience requirements.
The competitive impact of Open Banking has been substantial across mature markets: customer-owned data portability reducing bank switching friction; API-native fintech ecosystem emergence (Plaid, TrueLayer, Tink in Europe; Belvo, Pluggy in Latin America); banks responding through API monetization, premium-data tiers, and partnership strategies; regulatory expansion to “Open Finance” (insurance, pensions, investments) and “Open Data” (utilities, energy, telecoms) in some jurisdictions; and tension between data-sharing benefits and privacy concerns driving ongoing regulatory refinement.
For Turkish fintechs and bank-partnership strategies, Open Banking is operationally foundational: TCMB licensing as Payment Institution or E-Money Institution provides the regulatory perimeter for API access, technical integration with major Turkish banks (İş Bank, Garanti BBVA, Akbank, Yapı Kredi, Ziraat, Halkbank) requires API-specific contracts and technical compliance, MASAK AML obligations apply to all customer-data flows, KVKK privacy requirements layer onto data-sharing mechanics, and operational resilience is supervised by TCMB for payment and e-money institutions and by BDDK for banks. Vircon Legal advises Turkish fintechs and banks on Open Banking strategy: licensing analysis, API-integration legal architecture, customer-consent framework design, MASAK/KVKK compliance integration, and the strategic positioning of Open Banking activity within broader fintech regulatory landscape.
Source. Law No. 6493 Art. 12(1)(f)-(g) as amended by Law No. 7192; TCMB Regulation on Payment Services and E-Money Issuance and Communiqué on Information Systems and Data Sharing Services (Official Gazette 1.12.2021, No. 31676); BDDK Regulation on Banks’ Information Systems and Electronic Banking Services (Official Gazette 15.3.2020, No. 31069).