1 December 2021 WEDNESDAY Official Gazette Number : 31676

COMMUNIQUÉ COMMUNIQUÉ ON THE INFORMATION SYSTEMS OF PAYMENT AND ELECTRONIC MONEY INSTITUTIONS AND THE DATA SHARING SERVICES OF PAYMENT SERVICE PROVIDERS IN THE FIELD OF PAYMENT SERVICES

PART ONE Purpose, Scope, Basis and Definitions

Purpose and scope

ARTICLE 1 – (1) The purpose of this Communiqué is to regulate the procedures and principles regarding the management of the information systems used by payment institutions and electronic money institutions in the execution of their activities and their audit by authorized independent audit institutions, as well as the data sharing services of payment service providers in the field of payment services.

Basis

ARTICLE 2 – (1) This Communiqué has been prepared based on Articles 12, 14, 14/A, 18 and 21 of the Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions dated 20/6/2013 and numbered 6493.

Definitions and abbreviations

ARTICLE 3 – (1) In this Communiqué;

a) Explicit consent: The explicit consent defined in subparagraph (a) of the first paragraph of Article 3 of the Personal Data Protection Law dated 24/3/2016 and numbered 6698,

b) Recipient: The real or legal person to whom the funds subject to the payment transaction are intended to reach,

c) Anonymous prepaid instrument: A prepaid instrument that is not linked to a payment account in any way and for which identity detection or verification has not been carried out, (Added phrase:OG-7/10/2023-32332) that remains within the monetary limits specified in the first paragraph of Article 2.2.9 and the first paragraph of Article 2.2.11 of the General Communiqué of the Financial Crimes Investigation Board (Sequence No: 5) published in the Official Gazette dated 9/4/2008 and numbered 26842, that can be used by making a prior payment or loading, that can be issued with or without the possibility of reloading, and that allows use up to the loaded balance,

ç) API: Interfaces created within the framework of certain conditions and rules so that different software can use services defined on each other and exchange data between them,

d) Disclosure: The information to be provided within the scope of Article 10 of Law No. 6698,

e) Independent audit institution: An independent audit institution among the independent audit institutions authorized by the Public Oversight, Accounting and Auditing Standards Authority, which is included in the list of Independent Audit Institutions Authorized to Perform Information Systems Audit in Banks published by the Banking Regulation and Supervision Agency,

f) Bank: The Central Bank of the Republic of Turkey Joint Stock Company,

g) Bank payment system: Payment systems operated by the Bank,

ğ) Information systems: The entirety of the structure consisting of hardware, software, data, processes and human resources that ensure the fulfillment of the responsibilities determined by legislation regarding information and data of the payment service provider for the purpose of carrying out activities related to the payment service,

the fulfillment of which is ensured by the entirety of the structure consisting of hardware, software, data, processes and human resources,

h) Information asset: Any kind of resource such as hardware, software, document, data and human used in accessing corporate information and in the processing, transmission, storage, protection and destruction of this information,

ı) Primary center: The structure in which primary systems are established,

i) Primary systems: The entirety of the system consisting of infrastructure, hardware, software and data used in the execution of activities, as well as the systems in which all information related to the matters contained in the Law, the Regulation, this Communiqué and other relevant regulations to be issued by the Bank within the scope of the Law is stored in electronic environment in a secure manner and in a way that allows access at any desired moment,

j) Biometric data: Retina, iris, facial characteristics, voice and fingerprint-like personal measurable biological or behavioral characteristics used during the performance of identity verification processes,

k) BKM: The Interbank Card Center Joint Stock Company,

l) BKM-API Gateway: The structure to be established by BKM pursuant to the fifth paragraph of Article 59 of the Regulation for the provision of payment services contained in subparagraphs (f) and (g) of the first paragraph of Article 12 of the Law,

m) (Amended:OG-7/10/2023-32332) BSİSBDHY: The Regulation on Independent Audit of Information Systems and Business Processes published in the Official Gazette dated 31/12/2021 and numbered 31706 sixth repeated,

n) Change management: The information systems service management discipline that aims to ensure that all changes related to information systems are carried out effectively, securely and in a timely manner through the use of pre-determined procedures and to minimize the number of incidents that may arise from these changes and the impact of these incidents on the services provided,

o) Audit trails: Records that enable a financial or operational transaction to be followed step by step from its beginning to its end, and records showing who accessed or attempted to access information assets and which transactions the user performed,

ö) External service provider: The legal person who performs activities on behalf of the institution, other than those that must be performed exclusively by the institution itself within the framework of Article 21 of the Regulation, or who provides services of a nature assisting the institution in their performance,

p) Electronic channel: Any kind of electronic service method such as mobile application, internet branch, telephone services, ATM, kiosk device, API and similar, through which customers can receive payment services remotely without going to the physical branch and representatives of the payment service provider,

r) Electronic money: The monetary value issued in exchange for funds accepted by the electronic money issuing institution, stored electronically, used to perform the payment transactions defined in the Law, and accepted as a payment instrument by real and legal persons other than the electronic money issuing institution,

s) Electronic money issuing institution: Electronic money institutions, banks within the scope of the Banking Law dated 19/10/2005 and numbered 5411, and the Post and Telegraph Organization Joint Stock Company,

ş) Electronic money user: The real or legal person who benefits from the electronic money issuance and redemption services offered by institutions issuing electronic money in the capacity of sender, recipient or both,

t) Electronic money institution: The legal person authorized to issue electronic money within the scope of the Law,

u) Fund: Banknote, coin, book money or electronic money, ü) Sender: The real or legal person who gives a payment order from its own payment account or without having a payment account,

v) Strong customer authentication: The method used in authentication, consisting of at least two components, where the compromise of one component does not compromise the security of the other component, and these two components are selected from two different component classes, one being something the customer knows, possesses, or a biometric characteristic of the customer,

y) Secure component: A component such as a SIM card or smart card that does not allow the confidential data it contains to be accessed, copied, or extracted by unauthorized persons,

z) Sensitive customer data: Personal data and customer security credentials used in giving a payment order or verifying the customer's identity, which, if obtained or altered by third parties, could enable fraud or fake transactions on behalf of the customer,

aa) Account information service: The service defined in subparagraph (g) of the first paragraph of Article 12 of the Law,

bb) Account information service provider - AISP: The legal person providing the payment service defined in subparagraph (g) of the first paragraph of Article 12 of the Law,

cc) Account servicing payment service provider (ASPSP): The payment service provider with which a payment account is held (Additional phrase: RG- 28/3/2025-32855), which is obliged to connect to the BKM API Gateway and provide the necessary infrastructure in accordance with Article 59 of the Regulation, and which is designated in the ninth paragraph of the same article,

çç) Service level: The level predetermined in writing by the service provider regarding the content and quality of the service, taking into account the cost of the services and the needs and expectations of those receiving the services, and shared with the relevant parties,

dd) Secondary center: The structure established in such a way that, in cases where the primary center cannot be used, the primary and secondary systems can be accessed ready for use, allowing personnel to work, and not carrying the same risks as the structure where the primary center is established,

ee) Secondary systems: Primary system backups that ensure, in the event of an interruption in activities carried out through primary systems, that these activities are continued within the acceptable interruption periods specified in the business continuity plan and that all information regarding the matters in the Law, the Regulation, this Communiqué and other relevant regulations to be issued by the Bank within the scope of the Law can be accessed,

ff) Unmanned service point: Devices such as ATMs and kiosks, owned by one or more institutions and having a physical location, where customers can perform payment transactions or electronic money-related transactions by themselves,

gg) Internet branch: Electronic channels through which customers can access the services offered by payment service providers within the scope of the Law via the internet, regardless of the device or platform they use, and can view, change their own financial or personal data, or perform transactions creating financial liability, and where services are offered through the website,

ğğ) Transaction information: Information including the transaction time of the executed transaction, the nature of the transaction, and for a payment transaction, the total amount to be debited to the account including costs, commissions and fees, and the sender and recipient of the payment, or for a batch payment order, the total amount to be debited to the account including costs, commissions and fees, and the sender and recipients,

hh) Transaction verification code: In transactions creating financial results, created to be specific to the transaction that a customer, who identifies himself to the system through one of the authentication methods, wishes to perform and to be used in transaction approval within a certain validity period,

the information shown to the person at the time of approval together with the relevant transaction information and which becomes invalid if the recipient or amount changes,

ıı) Merchant: The real or legal person who agrees to sell goods and services with a payment method within the scope of payment services under the contract made with the payment service provider,

ii) Law: The Law No. 6493 dated 20/6/2013 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions,

jj) Mutual authentication: The authentication method used to ensure that communicating information systems are sure of each other's identities, in which both parties authenticate their own identity to the other party,

kk) Interruption: The disruption of the operational business and processes of the payment service provider related to its activities within the scope of the Law, other than planned ones,

ll) Authentication: The mechanism that provides assurance that a declared identity truly belongs to the person declaring it,

mm) Identity identifier: The combination of numbers, letters or symbols assigned to the customer by the payment service provider for the purpose of identifying and distinguishing them from other users,

nn) Personal data: The information defined in subparagraph (d) of the first paragraph of Article 3 of Law No. 6698,

oo) User: Any kind of user, such as personnel or customer, for whom an account has been defined on the information systems of the payment service provider in order to perform transactions,

öö) Institution: Payment institutions and electronic money institutions,

pp) Mobile application: The specialized electronic channel through which customers can perform their transactions within the scope of the Law via the application belonging to the payment service provider on a mobile device such as a smartphone or tablet,

rr) Mobile application activation: Matching the customer's mobile device with the customer for the mobile application,

ss) Customer: The payment service user and the electronic money user,

şş) Customer information: All kinds of information obtained directly or indirectly regarding the customer's personal and financial situation, including transaction information, balance information, personal data, identity identifier, title belonging to customers,

tt) Customer security credentials: Personalized information given to the customer by the payment service provider or determined by the customer and agreed upon with the payment service provider for the purpose of performing the authentication process,

uu) Incident: Any development that causes an interruption in the operation of information systems or a decrease in service quality, including cyber incidents,

üü) Session: The logical connection established between the parties for data transfer, presentation, or financial transactions to be carried out, established to cover the entire process from users' inclusion in information systems via electronic channels through the authentication mechanism until they complete their transactions and leave the system,

vv) Payment instrument: The card, mobile phone, password, and similar personalized instrument determined between the payment service provider and the customer and used by the customer to give a payment order,

yy) Payment order: The instruction given by the customer to the payment service provider for the purpose of executing the payment transaction,

zz) Payment order initiation service: The service defined in subparagraph (f) of the first paragraph of Article 12 of the Law,

aaa) Payment order initiation service provider - PISP: The legal entity providing the payment service specified in subparagraph (f) of the first paragraph of Article 12 of the Law,

bbb) Payment account: The account opened in the name of the customer and used in the execution of the payment transaction,

ccc) Payment service: The services accepted as payment services within the framework of Article 12 of the Law,

ççç) Payment service user: The natural or legal person benefiting from a specific payment service in the capacity of sender, recipient, or both,

ddd) Payment service provider: Banks under Law No. 5411, electronic money institutions, payment institutions, and the Post and Telegraph Organization Joint Stock Company,

eee) Payment transaction: The activity of depositing, transferring, or withdrawing funds carried out upon the instruction of the sender or recipient,

fff) Payment institution: The legal entity authorized under the Law to provide and execute payment services,

ggg) Prepaid instrument: The physical or non-physical payment instrument that allows the customer to use funds equivalent to the amount paid before spending, paid to the payment service provider issuing the payment instrument, as electronic money in payment services,

ğğğ) Password: The confidential character string used in authentication, consisting of letters, numbers, and/or special characters,

hhh) Personnel: All kinds of users authorized to perform transactions on the institution's information systems, such as institution personnel, representative personnel, and external service provider employees,

ııı) Project management: The process that ensures the planning, organization, and execution of information systems projects through the use of predetermined methodologies in a manner that ensures completion in accordance with the projected time schedule, budget, and quality level,

iii) Competition-sensitive data: All kinds of quantitative data that can be associated with price, such as fees, commissions, interest,

jjj) Risk-based authentication: The approach of facilitating the authentication process for low-risk profiles and making it more comprehensive and restrictive for high-risk profiles by dynamically evaluating various risk factors,

kkk) Penetration test: The test carried out to detect and fix security vulnerabilities of information systems before they are exploited,

lll) Cyber incident: The cyber incident defined in Article 3 of the Communiqué on the Procedures and Principles Regarding the Establishment, Duties, and Activities of Cyber Incident Response Teams published in the Official Gazette dated 11/11/2013 and numbered 28818,

mmm) Cyber incident response: The cyber incident response defined in Article 3 of the Communiqué on the Procedures and Principles Regarding the Establishment, Duties, and Activities of Cyber Incident Response Teams,

nnn) SMS OTP: The one-time password transmitted via the SMS service offered by electronic communication operators,

ooo) Problem: The root cause of one or more incidents,

ööö) Continuous business relationship: The continuous business relationship defined in the Regulation on Measures Regarding the Prevention of Laundering of Proceeds of Crime and Financing of Terrorism put into effect by the Council of Ministers Decision dated 10/12/2007 and numbered 2007/13012,

ppp) One-time password: The randomly generated string of letters, numbers, and/or special characters to be used only once in authentication,

rrr) Representative: The natural or legal person acting on behalf and account of the institution,

sss) Terminal: The electronic device or software provided by the payment service provider, used in the execution of all kinds of purchase of goods and services or cash payment document issuance transactions based on the information on the payment instrument and sensitive customer data, and payment

transactions and transactions related to electronic money,

şşş) End-to-end secure communication: The transmission of the data subject to communication by encrypting it by the sender in a way that only the recipient can decrypt, so that only the recipient can access the data,

ttt) Distance communication tool: Any tool or medium that allows the conclusion of a contract without physical face-to-face contact, such as letter, catalog, telephone, fax, (Repealed phrase:OG-7/10/2023-32332) electronic mail message, internet, SMS services,

uuu) Senior management: The members of the organization's board of directors, the general manager and deputy general managers, the managers of internal control and risk management units, and, even if employed under other titles, the managers of units other than advisory units who, by virtue of their authority and duties, serve in positions equivalent to or higher than deputy general manager,

üüü) Data sharing services: The electronic channel through which parties acting on behalf of customers can remotely access the payment services offered by HHS via APIs and carry out transactions within the scope of the Law, or instruct HHS to carry out such transactions,

vvv) Patch: A program add-on prepared for the purpose of fixing security vulnerabilities detected in programs or an erroneous function in the content of the program,

yyy) Regulation: The Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers published in the Official Gazette dated 1/12/2021 and numbered 31676,

zzz) (Added:OG-7/10/2023-32332) MASAK: The Presidency of the Financial Crimes Investigation Board of the Ministry of Treasury and Finance,

aaaa) (Added:OG-7/10/2023-32332) Near field communication: The short-range wireless connection technology in which data transmission is provided over the magnetic field that arises by bringing electronic devices into contact with each other or bringing them close together contactlessly at a short distance in order to provide communication between these devices,

bbbb) (Added:OG-4/9/2026-33360) Identity document: The identity card defined in the Republic of Turkey Identity Card Regulation published in the Official Gazette dated 3/12/2019 and numbered 30967,

shall mean.

CHAPTER TWO

Principles to Be Taken as Basis in Information Systems Management

General provisions regarding information systems management

ARTICLE 4 – (1) While carrying out its activities related to information systems, the organization shall primarily observe the objective that the service for whose operation it is responsible works uninterruptedly, securely, effectively and efficiently.

(2) The organization shall establish its information systems in a manner compatible with the subject, volume, complexity and scope of the activities it carries out within the scope of the Law and in accordance with the necessary administrative and technical measures for the security of personal data, and shall update them by also taking technological developments into account.

(3) The organization shall establish in writing the policies regarding information systems management in a manner compatible with its main strategy and objectives, review them regularly at least once a year, and update them where necessary. The approval of the policies regarding information systems management by the board of directors is mandatory.

(4) The organization shall carry out all kinds of management activities related to its activities within the scope of the Law, including information systems management, within a holistic approach and within the framework of corporate governance practices, and shall place the elements regarding information systems management in the appropriate place within the organizational structure, taking into account the size of the organization and the complexity of its activities.

(5) The organization shall establish in a clear, understandable and written manner the duties and responsibilities of the units within the organizational structure related to information systems and the job descriptions of the personnel in these units. The documents prepared pursuant to this paragraph shall be approved by the board of directors. The suitability of the documents shall be reviewed at least once a year.

(6) Awareness of the personnel assigned to information systems management regarding the duties and responsibilities assigned to them shall be ensured, and they shall be kept informed of changes that occur in duties and responsibilities.

(7) The organization shall clearly determine the duties, authorities and responsibilities regarding information systems management and shall provide all kinds of resources necessary for information systems management.

(8) The organization shall establish the necessary function within the internal control system established pursuant to Article 26 of the Regulation in order to check that the activities regarding information systems management are compliant with policies, regulations and generally accepted relevant international standards. The personnel who will work on these matters must have the necessary experience and knowledge.

(9) The board of directors of the organization shall be responsible for the conduct of information systems management in accordance with the provisions set out in this Communiqué.

(10) When an application for an operating license is made pursuant to Article 11 of the Regulation, the appointment of the manager responsible for the information systems infrastructure must have been made, before the final approval stage. The manager to be appointed must have taken part in project teams of similar scale in the information systems sector.

(11) When an application for an operating license is made pursuant to Article 11 of the Regulation, the production environment of the information systems infrastructure required by the one-year business plan must have been established, before the final approval stage.

Risk management regarding information systems

ARTICLE 5 – (1) The organization shall establish a risk management framework and a structure with sufficient richness of tools in order to ensure that all risks that may jeopardize the smooth operation of information systems are identified, measured, monitored and effectively managed. Within the scope of the risk management framework, the organization shall establish in writing policy, procedure and process documents that include the procedures and principles regarding the measures to be implemented in order to manage risks and the controls to be established. The documents prepared pursuant to this paragraph shall be approved by the board of directors.

(2) While establishing the risk management framework it will set up, the organization shall take into consideration the risks regarding information systems and the relevant legislation and national and international standards.

(3) While assessing the risks regarding information systems pursuant to the first paragraph, the main activities and other activities of the organization, the activities of representatives and external service providers, if any, its dependencies on third parties, and the organization's connections with other payment service providers and payment systems shall also be taken into consideration.

(4) The institution shall conduct a comprehensive risk assessment regarding information systems before significant changes in information systems and at least once a year, and shall prepare a report containing the assessment results and the actions to be taken in relation thereto, independent of any change and covering the previous year, by the end of January each year, and submit it to the board of directors and the Bank.

(5) In order to ensure the effective implementation of the measures and controls contained in the documents to be created pursuant to the first paragraph, the institution shall take the necessary measures regarding organizational structure, personnel and other resources, and shall ensure that the responsibilities regarding the implementation of the measures and controls contained in the documents to be created pursuant to the first paragraph are clearly determined in the job descriptions to be created within the framework of the fifth paragraph of Article 4.

Information systems operation

ARTICLE 6 – (1) The institution shall clearly determine in writing the objectives regarding the reliability, resilience and continuity of the operation of information systems within the framework of the defined service levels, and shall take the necessary measures in line with these objectives, including the use of current software versions for which provider or manufacturer support continues, in order to ensure the effective and efficient operation of information systems.

(2) The institution shall measure the level of compliance with the objectives it has determined within the scope of the first paragraph at regular intervals, at least once a year, and shall ensure that the results are evaluated by the board of directors and that the actions to be taken in relation thereto are determined in cases where compliance cannot be achieved. The document resulting from the process shall be reported to the Bank for each year by the end of January of the following year at the latest.

(3) The institution shall establish information systems in a manner that has sufficient capacity for the defined service levels, shall primarily ensure that the capacity is scalable, and shall perform effective capacity management for information systems.

(4) The institution shall ensure the creation, secure storage, updating and reporting to senior management of the information systems inventory and configuration information. The institution, within the scope of these activities;

a) Shall create hardened and tested secure standard configuration information for operating systems, databases and applications on desktop, laptop, mobile devices and servers, as well as for network devices such as firewalls, routers and switches. Shall record the said standard configuration information, deviations from the standard configuration or updates to the standard configuration as part of change management and subject them to an approval mechanism. For any change request outside the secure standard configuration, shall record information such as the business requirement, the duration of the requirement and who the business owner in need of this business requirement is.

b) Creates a software inventory for operating systems on desktop, laptop, mobile devices and servers, showing the type, version number, patch level of these operating systems and the list of databases and applications installed on them.

c) Ensures that the software inventory created pursuant to subparagraph (b) is also integrated with the hardware inventory and that the information on which software is on which hardware can be tracked from a single point.

(5) The organization carries out all kinds of changes related to information systems in accordance with change management procedures whose process is defined and approved by senior management.

(6) The organization executes all kinds of projects to be carried out in information systems through in-house development or external procurement in accordance with the project management procedures it has determined in accordance with generally accepted relevant international standards and best practice examples. In software development processes, it is ensured that development, test and production environments are separate from each other and that the processes of development, testing and transition to production are carried out by different persons in accordance with the principle of segregation of duties.

(7) The organization designs and operates the processes and systems related to its activities within the scope of the Law in a way that does not allow a critical transaction to be initiated, approved and completed by a single person.

(8) The organization decommissions the relevant information systems component when the provider or manufacturer support for information systems components ends or when the current status of these components cannot provide the necessary level of security and reliability according to the conditions of the day.

Incident management and cyber incidents

ARTICLE 7 – (1) Within the framework of predetermined procedures, the organization performs incident management in a manner that includes timely detection of incidents, including customer complaints, intervention within a reasonable period of time, recording, reporting, analysis including determination of the potential size, impact, damage of the incident and affected customers, resolution in a way that restores information systems services to normal operation in the shortest possible time and with the least damage, and timely informing of all relevant stakeholders about the incident.

(2) In the event that some or all of the organization's customers are affected by the incident, the customers are contacted, information about the incident is given and, if any, the matters that the customers need to do regarding the subject are conveyed.

(3) The organization informs its customers and the Personal Data Protection Board as soon as possible in cases of a cyber incident leading to the leakage or disclosure of sensitive customer data or personal data, or in cases where personal data is obtained by others through unlawful means.

(4) The organization performs problem management in a manner that includes detailed examination of the incident after each significant incident, root cause analysis, determination of its effects, and follow-up and reporting of the problem related to the incident.

(5) The institution shall also handle cyber incidents within the scope of incident management and shall make the necessary notifications to the Bank within the scope of the cyber incident management and cyber incident response process that it will establish in accordance with the legislation.

(6) The institution shall prepare in writing the classification criteria for classifying cyber incidents according to their level of significance, and shall establish procedures and response plans for handling and resolving a cyber incident that occurs within the time appropriate to the significance level determined in this context. Within the scope of the response plans, all processes relating to the elements in the first paragraph shall be addressed.

(7) The response plans created shall be tested regularly at least once a year and the test results shall be reported to the board of directors.

(8) The procedures and principles regarding what must be done by the institution within the scope of cyber incident management and cyber incident response process shall be determined by the Communiqué to be issued by the Bank.

Information security and information security management

ARTICLE 8 – (1) The institution, taking into consideration the generally accepted relevant international standards and best practice examples, shall establish an information security management framework containing rules, principles and policies in order to ensure the confidentiality, integrity and availability of the information systems related to its activities.

(2) The institution shall establish an information security management system in accordance with the information security management framework it has established within the scope of the first paragraph.

(3) The institution shall clearly determine the duties, authorities and responsibilities regarding the establishment, management, regular review at least once a year and updating when necessary of the information security management system.

(4) Within the scope of the information security management system, the duties, authorities and responsibilities of personnel at every level regarding information security shall be clearly determined and the necessary information shall be provided to ensure that the relevant personnel are aware of this.

(5) The institution shall establish the necessary mechanisms for the monitoring and reporting of incidents related to information security breaches within the scope of the information security management system.

(6) The institution shall prepare an information asset classification guide approved by the board of directors in order to establish appropriate controls regarding information assets in line with security requirements. It shall clearly determine the access rights for information assets in each class and the procedures for storage, transmission and destruction, and shall inform all personnel about classification and related obligations.

(7) The institution shall classify all information assets in accordance with the information asset classification guide, also taking into account the level of importance and legal obligations. When determining the class of the information asset, criteria such as the degree of confidentiality, integrity requirement, availability requirement, retention period and minimum backup frequency, and whether the data is sensitive customer data, customer information or personal data on a data-specific basis shall be taken into consideration.

(8) In the information security management system, all matters relating to personnel, including the personnel's starting work, changing duty and position, and leaving work, shall be evaluated with respect to their aspects affecting information security and the necessary measures shall be taken.

(9) The institution shall ensure the security of all kinds of hardware and infrastructure in its own possession related to its activities and the physical environment related thereto within the scope of the information security management system. The institution shall exercise the necessary diligence to ensure the security of hardware and infrastructure not in its own possession related to its activities and the physical environment related thereto, and shall check that the security is ensured.

(10) The institution shall ensure that all communication processes related to activities within the scope of the Law between internal and external networks and operational transactions related to its main activities are designed to be carried out using security controls and tools. In establishing security controls and tools, a layered security architecture in which, if one security layer is breached, the other security layer comes into play shall be taken as a basis and solutions suitable for current technology shall be used.

(11) The institution shall perform network segmentation in order to reduce the impact of threats that may come from the internal network and to ensure controlled passage by separating the sub-sections of the internal network with different security sensitivities from each other. It shall be ensured that the traffic related to each service in the internal network reaches only the network segments necessary for itself, that the data traffic between different network segments is secure, and that only authorized devices connect to the internal network. Connections made to critical network segments shall be regularly identified, a requirement assessment shall be made for each of these connections, and unnecessary connections shall be terminated.

(12) It shall be ensured that systems containing sensitive customer data or customer information are located in a private internal network and cannot be accessed directly from the internet in any way. Communication with systems in the private internal network shall be established only through proxy applications or firewall devices. Servers or systems visible over the internet or from outside the institution's network shall be regularly checked to determine whether there is a valid business need requiring them to be visible, and if not necessary, these servers and systems shall be moved to the institution's internal network and ensured to have internal network IP addresses.

(13) It is essential that structures such as domain management servers established for identity and access management on the network are created specific to the institution and are not part of another domain or similar outside the institution.

(14) The institution shall inspect the content of traffic flowing from its internal network to external networks. It shall be ensured that the content inspection to be performed is of a nature to prevent traffic flow to malicious IP addresses and the leakage of sensitive customer data and customer information, and has the capability to record session information and detect unusually long sessions and generate alerts for them.

(15) It is ensured that the ports, protocols and services on each system connected to the network are open and running only based on approved business needs for their necessity. In this regard, based on a secure baseline configuration, port scanning is performed regularly for critical servers and systems, and ports that are open although they are not in the secure baseline configuration are ensured to be closed.

(16) The Institution is obliged to exercise due care for information security in any changes to be made regarding information systems.

(17) The personnel to whom duties, authorities and responsibilities related to the information security management system are assigned shall continuously monitor the compliance of the information security management system with legislation and standards on information security and with the information security management framework established within the scope of the first paragraph, take the necessary measures to ensure compliance, and regularly report the compliance status to the Institution's board of directors at least once a year.

(18) The Institution shall carry out the necessary activities to increase the awareness of its personnel on information security issues and to ensure that they are informed about the relevant legislation and directives, and shall document these activities.

(19) The Institution is obliged to have the personnel involved in providing services to customers over the telephone receive periodic training on social engineering attacks and other known fraud methods, and to carry out activities to increase the security awareness of these employees.

(20) The Institution shall establish mechanisms in services provided via the internet to verify that the interface belongs to the Institution.

(21) The Institution shall ensure that the customer can verify that the source of all software and mobile applications related to the services it provides through electronic channels is itself.

(22) The Institution is obliged to take measures to ensure that all software and mobile applications related to the services it provides through electronic channels do not contain matters that would jeopardize information security, and to provide the necessary patches and updates to remedy security vulnerabilities.

(23) The Institution shall take measures to ensure that sensitive customer data and customer information used by its mobile applications cannot be accessed by other software and applications on the device where the mobile application is used.

(24) In cases such as the loss, theft, or seizure of the device on which mobile applications are used, the Institution is obliged, following the notification of this situation to the Institution by the customer, to immediately ensure that the sensitive customer data and customer information on the device cannot be accessed by unauthorized persons, and to take measures in line with the technology of the day to reduce the risks that may arise within this scope.

(25) Personnel are not allowed to remotely access applications and systems on the internal network from outside the Institution unless they are approved by passing through the relevant control mechanisms in accordance with the requirements of the job and the day. In cases where remote access is allowed, secure connection methods based on strong authentication are applied, audit trails for accesses are kept, the duration of the connection and the devices from which the connection can be made are restricted, and personnel are forced to re-authenticate their identity at certain intervals.

(26) The Institution is obliged to establish an effective authentication and access management structure consistent with the principles of separation of duties and authority to the extent required by the duty, in relation to its activities.

(27) The Institution shall regularly test the effectiveness of the information security management system at least once a year, record the test results, and report them to senior management.

(28) The Institution shall create a whitelist for the applications it uses or may need, ensure that only the needed applications are installed on information system elements, and take measures to prevent the installation and execution of applications outside this whitelist on these elements.

(29) The Institution shall regularly scan information system elements to check whether any application not on the whitelist is installed.

(30) The Institution shall establish the infrastructure to ensure the detection of malicious software and security vulnerabilities by checking information system elements at the necessary frequency and regularly.

(31) The Institution shall use solutions that scan incoming and outgoing e-mails on the e-mail server to block e-mails containing malicious software or attachments that are unnecessary in line with the Institution's business needs. For e-mails sent from the Institution, techniques that verify the sender's identity are used on e-mail servers.

(32) The Institution's information system elements are configured so that they do not automatically play the content when a portable media or external device is plugged into these elements, and anti-malware tools are set to automatically scan such devices when they are plugged in. In addition, it is ensured that the connection interfaces to which such external devices will be connected are disabled by default, that the use of such devices is limited only to personnel with a business need, and that attempts to use external devices are also monitored.

(33) Personnel are not allowed to have local administrator privileges unless there is a mandatory business need. In the event of such a need, it is ensured that, following the approval of the business unit and the information systems manager, the said authority is granted within the framework of defined and recorded procedures and will be taken back again at the end of the work.

Data security and privacy

ARTICLE 9 – (1) The Institution shall establish in writing policies and procedures to ensure the confidentiality and security of sensitive customer data and customer information obtained during the conduct of its activities and processed, transmitted or stored through information systems, and to prevent their leakage outside the Institution, and shall take the necessary measures for this purpose.

(2) The Institution shall take measures to ensure the confidentiality of data in the information systems it uses in relation to its activities. The measures taken to ensure the confidentiality of data must be appropriate to the confidentiality level of the data.

(3) (Amended sentence: RG-7/10/2023-32332) It is essential that sensitive customer data and customer information be stored in an encrypted manner or in secure components. The encryption techniques to be used must be in line with the technology of the day and national and international standards, must provide reasonable assurance regarding data security and privacy, and must not have lost their reliability.

(4) In the event that sensitive customer data, customer information and competition-sensitive data are transmitted wirelessly or over the internet, such transmission shall be carried out via end-to-end secure communication.

(5) In the event that the use of data-hosting information system elements is suspended, it shall be ensured that the data they contain are securely and without delay destroyed in accordance with their confidentiality classification.

(6) Sensitive customer data may not be given to parties other than external service providers and authorities expressly authorized by law, except in the cases permitted within the scope of the Law, the Regulation and this Communiqué. Customer information may be given to parties other than authorities expressly authorized by law, provided that the customer is informed about the limits of sharing and the explicit consent of the customers is obtained. The customer's explicit consent is obtained securely in accordance with Law No. 6698. Consent to be obtained via a contract in an electronic environment may only be realized upon the first login and provided that the customer is explicitly informed. The customer's consent to share their information cannot be made a prerequisite for the service to be provided.

(7) In personal data processing activities related to transactions falling within the scope of the Law, the provisions set forth in Law No. 6698 and the regulations made pursuant to this Law shall be applied primarily, and compliance with the procedures and principles determined within the scope of these provisions is mandatory.

Identity verification

ARTICLE 10 – (1) The Institution establishes a sufficient and effective identity verification system for use in transactions carried out on its information systems. Within the framework of the identity verification system to be established, the roles and responsibilities assigned to personnel are clearly documented in writing.

(2) The identity verification techniques to be used are determined based on the result of the risk assessment to be carried out, without prejudice to the provisions of the eighth paragraph. The risk assessment is carried out by taking into consideration the necessary matters, including but not limited to the type and nature of the transactions planned to be carried out through information systems, the magnitude of the financial and non-financial effects it may cause, if any, the payment instrument used in carrying out the transaction, transaction types, the sensitivity level of the data subject to the transaction, whether it is a regular payment based on an instruction, the customer's transaction limits, whether the counterparty of the transaction is on the list of secure recipients, the ease of use of the identity verification technique, and the need for authorization specific to emergency situations.

(3) The Institution clearly determines for which sub-elements of the information systems the identity verification system will be valid and which identity verification techniques will be used for which sub-element in the identity verification system.

(4) A password policy that is in line with the technology of the day and secure is determined for identity verification. One-time passwords to be used in authentication must be long enough to provide the required level of security, observe methods that minimize the risks of detection and prediction by unauthorized persons, and be valid for a certain period of time.

(5) The security of components to be used for authentication such as passwords, variable passwords, one-time password devices, encryption secret keys, smart cards, and transaction verification codes shall be ensured starting from the production stage until they reach the user. It shall be ensured that no information about any of the strong authentication factors can be obtained through the transaction verification code, that other valid transaction verification codes cannot be derived from a known transaction verification code, and that transaction verification codes cannot be imitated. In the event that an error occurs in the generation of the transaction verification code or it cannot be generated, measures shall be taken to ensure that the person attempting authentication cannot understand which authentication factor the error originated from.

(6) The organization shall ensure the establishment of the necessary infrastructure for the storage and transfer of data used for authentication by ensuring their confidentiality, integrity, and security. During authentication processes, it shall be ensured that the authentication factors known by the customer and components such as one-time passwords or transaction verification codes are entered through the relevant channel without the involvement and access of personnel.

(7) In authentication;

a) Informing the user about previous failed authentication attempts at the moment they log into the system,

b) Blocking the relevant user's access if failed attempts exceed a certain number,

c) Not providing information such as that the username does not exist in the system or that the password was entered incorrectly after failed authentication attempts,

ç) Terminating the session that remains running in the background after a certain period of inactivity or because a secure logout was not performed, after a certain period of time,

d) Except in cases where multiple customers are authorized to use the same payment account or to open different sessions at the same time, not allowing and warning the customer if multiple sessions are attempted to be opened at the same time for the same customer,

is required.

(8) In transactions carried out by customers through electronic channels that produce financial results or do not produce financial results, it is essential to use strong authentication unless otherwise explicitly permitted by regulations. During strong authentication, it is essential that the component possessed by the customer be specific to the customer and not imitable. In authentication (Amended phrase:RG-4/9/2026-33360), in cases where the identity document is used together with the card PIN or biometric data, or where a secure electronic signature is used, the requirements of this paragraph shall be deemed fulfilled. Passwords, PINs or biometric data that are not under the control of the institution's mobile application but are under the control of the device manufacturer cannot be used as strong authentication elements within the scope of this paragraph.

(9) Within the scope of the obligations under the Law No. 5549 on the Prevention of Laundering of Proceeds of Crime dated 11/10/2006, when subsequent payments requiring identity verification after the establishment of a contract pursuant to Article 22 are initiated through electronic channels, the strong authentication method shall be used.

(10) In the modification of information such as the telephone number and address used to deliver the payment instrument and the authentication instrument to the customer, the list of secure recipients defined by the customer, and the list of transactions that can be performed using single-component authentication, the strong authentication method shall be used.

(11) When access to sensitive customer data is provided or when a standing payment order is given, the strong authentication method shall be used.

(12) Without prejudice to the obligations under Law No. 5549, for transactions that must be carried out with strong authentication pursuant to the ninth paragraph, if the customer's approval has been obtained through a contract or secure methods and the payment transaction is carried out with a recipient on the list of secure recipients, the application of strong authentication shall not be mandatory.

(13) For financial transactions to be carried out by the customer, a transaction verification code shall be generated by the institution to obtain the customer's approval, and the customer's approval shall be obtained by presenting it to the customer together with the transaction information. For transactions that do not produce financial consequences, whether or not to use a transaction verification code shall be decided by the institution according to the risk assessment specified in the second paragraph, and the obligation to prove that the transaction carried out in relation to transactions where a transaction verification code is not used was performed by the customer shall belong to the institution. When single-component authentication is performed, if the transaction verification code is presented to the customer for approval in a way that constitutes a different component from the one used in authentication, strong authentication shall be deemed fulfilled.

(14) If the institution fails to provide a strong authentication mechanism in cases required under this article, the obligation to prove that the transactions carried out were authorized by the customer shall belong to the institution.

(15) There is no strong authentication requirement for transactions related to anonymous prepaid instruments.

(16) Information contained on documents that serve to identify the customer and that substitute for the (Repealed phrase:RG-4/9/2026-33360) identity document, as well as the mother's maiden name, cannot be used for authentication purposes at any stage during the provision of activities within the scope of the Law through electronic channels. In cases where a security question is used as the component known by the customer in authentication, the security question must not relate to any of the information contained on documents that substitute for the (Repealed phrase:RG-4/9/2026-33360) identity document, and its answer must be determined by the customer themselves.

(17) If the first association of an authentication component with a customer is to be carried out remotely, the association shall be made using secure methods and by performing strong authentication.

(18) The institution shall establish the technological and legal infrastructure that will ensure non-repudiation for transactions carried out within the scope of the Law.

(19) The institution shall take measures to ensure session security in the use of information systems and measures to guarantee that authentication information remains correct from the beginning to the end of the session.

(20) Within the scope of strong authentication, the institution shall ensure that the authentication components preferred by its customer belong to different component classes. The institution may use SMS OTP or a transaction verification code via SMS as the component class possessed by the customer in the strong authentication process. If SMS OTP or a transaction verification code via SMS is used for logging in within the scope of strong authentication of a customer who has installed and activated the institution's mobile application, or for verifying any transaction during the continuation of the session, this factor cannot be counted as the component possessed by the customer in strong authentication. During the initial installation, activation, or reactivation stages of the institution's mobile application, or in cases where the institution's mobile application becomes unusable, the use of SMS OTP or a transaction verification code via SMS as the component possessed by the customer within the scope of strong authentication shall not constitute a violation of the provision of this paragraph.

(21) In cases where SMS technology is used during authentication, the institution shall establish the necessary infrastructure to identify customers who have performed a SIM card change with electronic communication operators or changed electronic communication operators through number portability, and for such customers, unless the customer's explicit confirmation regarding the change is obtained, a method based on the SIM card cannot be used in authentication to be performed within the scope of transactions to be carried out through electronic channels for 90 days from the date the change was made. Otherwise, the obligation to prove that the transaction carried out was performed by the customer shall belong to the institution for all kinds of transactions carried out.

(22) The component known by the customer to be used in strong authentication must not be sent automatically by being remembered by the mobile application or internet browser or by being linked to other local authentication methods, and the component known by the customer must be mandatorily entered by the customer.

(23) While performing the identity verification process in the internet branch, before logging in, a welcome message or image previously determined by the customer with strong authentication is ensured to be shown to the customer.

(24) While performing the strong authentication process in the internet branch, a transaction verification code is generated to be signed with a cryptographic secret key assigned to the customer. In cases where it is not possible for the transaction verification code to be signed with a cryptographic secret key assigned to the customer, provided that the provisions of paragraph twenty are reserved, a verification code may be sent to the customer via SMS.

(25) In cases where the application PIN defined for the mobile application or a biometric data belonging to the customer designated as an authentication element is used to access a customer-specific cryptographic key and a unique information associated with the customer is verified online at the institution through this cryptographic key, strong authentication is deemed to have been fulfilled.

(26) Provided that the mobile application is activated and used as an authentication element possessed by the customer, single-factor authentication does not constitute a violation of paragraph eight during other payment transactions where strong authentication is not mandated in relevant regulations, including this article, such as the customer wishing to view customer and account information solely through the mobile application, the sender and recipient of the payment being the same, it being a regular payment executed based on the customer's instruction, the payment transaction being carried out with a recipient in the previously defined trusted beneficiaries list, and the institution deciding in this direction as a result of the risk assessment specified in paragraph two, without the need for an additional authentication element. The obligation to prove that the transaction carried out in relation to these transactions performed with single-factor authentication was made by the customer belongs to the institution. In cases where the customer logs in to the mobile application for the first time or more than 90 days have passed since the last session opened with strong authentication, it is essential that strong authentication be applied.

(27) It is essential that strong authentication be applied in transactions to be carried out via telephone, including non-financial transactions. It is ensured that the personnel who greet the customer to provide service via telephone without applying strong authentication cannot see information related to the customer or that the transaction menu related to the customer is not active. In the authentication to be applied for the execution of financial transactions between the customer's own accounts and non-financial transactions, PIN information may be used as the element known by the customer.

(28) In the event of a risky transaction notification such as loss, theft, and fraud, it is ensured that customers connected to personnel can access customer information to the extent that personnel need to know without authentication, and necessary security measures are taken.

(29) Without a telephone connection or in the event that the connection is terminated, no transaction related to the customer can be carried out except for risky transaction notifications such as loss, theft, and fraud.

(30) In cases where the customer wishes to make changes to the authentication or telephone information used in electronic channels via the telephone channel, it is ensured that this change is carried out through automated systems without the involvement and access of personnel.

(31) In cases where the customer needs to be called by telephone, checks are performed before the call is made to ensure that the telephone has not been redirected to another number.

(32) The bank is authorized to introduce exceptions or establish additional security measures with respect to the authentication rules regulated in this article.

Access management

ARTICLE 11 – (1) The institution shall clearly determine the authorizations and restrictions regarding the access of personnel to the networks, subsystems, applications, data, and physical environments included in the system, within the scope of the duties, authorities, responsibilities, and privileges of the personnel, in a manner that allows access to the information required by the job, and shall take necessary measures to prevent unauthorized access.

(2) The institution shall clearly determine the access controls to be applied and the authorizations to be assigned and shall establish them in writing. The authorizations of persons who have access authorization to information systems shall be regularly reviewed at least once a year.

(3) It is ensured that the rules to be established within the scope of access management observe the principle of separation of duties and that the duties of requesting, authorizing, and managing access authorizations are separated from each other. In cases where full and proper separation of duties is not possible, additional risk-reducing or compensating controls shall be established to prevent errors and abuses that may arise from this situation.

(4) Within the scope of access management, it is essential that authorizations be made in a manner limited to the scope and duration they need, taking into consideration the duties and responsibilities of the personnel.

(5) Within the scope of access management, the institution shall take necessary measures to detect unusual situations by monitoring logins at unusual hours, exceedances of normal login times, transactions generally performed from a computer other than the one usually worked on, and to identify passive accounts that have not shown any activity for a long time and to remove the authorization when it is no longer needed.

(6) Within the scope of access management, it is essential that privileged authorizations not be defined to the extent possible. In the case of the definition of privileged authorities, it is essential that such authorities are assigned only when absolutely needed and used only in a manner limited to the matters needed, that during the use of these authorities additional security controls are established together with identity verification, that the shared use of such authorities is prevented, and that in cases requiring shared use, techniques that assign responsibility to the persons using the authority are used.

(7) Authorizations specific to emergencies are made temporarily and by recording the entire process.

(8) After all changes regarding personnel, including the change of duty and position of personnel and their leaving employment, the necessary changes within the scope of access management are made without delay.

(9) The organization determines unique identification codes for all personnel who have the authority to perform transactions on information systems, and shared or predefined accounts are not used unless mandatory. In cases where the use of shared or predefined accounts is mandatory, additional controls are established for these accounts to assign responsibility to the person performing the transaction.

(10) Critical information systems are hosted in secure areas such as data centers, system rooms, and network equipment rooms that have appropriate security barriers and entry controls. Access to these areas is limited to those who must have access authorization, access authorizations are regularly reviewed and updated at least once a year.

(11) Access of personnel other than those authorized under the tenth paragraph, visitors, external service provider employees, or contractor company personnel to data centers and critical information systems is subject to an approval mechanism, their activities are closely monitored and they are accompanied throughout their work in the data center.

(12) Audit trails of physical accesses to data centers and system rooms are kept. In these areas, camera recording systems are used in a way that does not contain blind spots and retains records for at least one year. The images recorded by camera recording systems are backed up at a different campus. In the event of any dispute or suspicious situation, the retention period of the relevant records is extended until the situation in question is resolved.

Security vulnerabilities and breaches

ARTICLE 12 – (1) The organization ensures, in compliance with the information security management framework, the investigation of possible security breaches against information systems, the determination of appropriate measures to be taken to prevent security breaches, the taking of necessary measures to detect and respond in a timely manner in the event of a security breach, and the evaluation and recording of realized security breaches and detected security vulnerabilities.

(2) The organization subjects all servers it owns and that are related to the system, as well as the communication network, to vulnerability scanning at regular intervals at least six times a year before and after initial commissioning.

(3) The organization ensures that information systems are regularly subjected to penetration testing at least once a year by real or legal persons who do not have any duty regarding the fulfillment of information security requirements and who have a national or international certificate on penetration testing, in line with scenarios covering possible internal and external threats.

(4) Penetration tests are applied within the framework of the procedures and principles set out in ANNEX-5.

(5) The organization remediates the priority findings it detects as a result of the evaluation of possible and realized security breaches and vulnerability scanning and penetration tests, taking into account the importance levels of the findings, the risks they may create together, the value of the assets in which they are detected, and the recommendations in the penetration test reports, within the shortest possible time and ensures that appropriate protective measures are taken until these findings are remediated. The remediation of findings within a reasonable time is followed within the framework of an action plan created for this purpose and approved by the organization's boards of directors. It is checked that the measures taken remediate the detected security vulnerability or reduce the risks arising from the security vulnerability to an acceptable level.

(6) The organization submits to the Bank, at least once a year and by the method deemed appropriate by the Bank, a report containing the realized security breaches, the results of the penetration test and the detected critical security vulnerabilities, the measures taken for their remediation and their results.

(7) The organization securely preserves the evidence related to realized security breaches for at least ten years.

Creation of audit trails

ARTICLE 13 – (1) The organization establishes an audit trail record system in a manner that allows the monitoring of physical or logical accesses to customer information and information systems, unauthorized access attempts, and transactions carried out in information systems related to activities within the scope of the Law.

(2) Audit trails are stored for at least ten years in a manner that allows detailed examination and scanning, ready for audit, with confidentiality, integrity, and security ensured, in a redundant manner and with time stamps.

(3) The records to be kept in the audit trail record system include, at a minimum, depending on the nature of the access or transaction;

a) The type of transaction and the unique identifier of the transaction,

b) Transaction amount, transaction date, transaction time,

c) Customer identifying information, except for transactions carried out with anonymous prepaid instruments,

ç) Identity information of the personnel, intermediary personnel, and external service provider employee,

d) (Amended:RG-7/10/2023-32332) The application in which the access or transaction took place, communication network protocol, time and source, and target port and IP information,

e) Information showing what the change made is, together with the transaction or event that creates the record,

includes these matters.

(4) Intervention by personnel in the audit trails related to their own activities is prevented.

(5) The queries made by the institution before other institutions or organizations regarding data held through web services, APIs or similar methods, and the audit trails regarding the purpose for which these queries were made, are also evaluated within the scope of this article.

(6) Audit trails are backed up in secure environments and, if needed, stored at the institution in a manner that allows review by providing restoration from these backups within a reasonable period not exceeding 24 hours.

(7) Techniques are used to prevent the audit trail recording system from stopping or, if it stops, to detect this situation.

(8) If the audit trail recording system stops for any reason, it is essential that no transaction be allowed to take place (Amended phrase:OG-7/10/2023-32332) until the audit trail recording system is brought back into operation. (Added sentences:OG-7/10/2023-32332) The audit trails of transactions that take place until the audit trail recording system is brought back into operation are ensured to be recorded into the audit trail recording system after it is brought back into operation within the scope of the continuity objectives of the audit trail recording system, while preserving their security and integrity. In cases where transactions continue to take place when the audit trail recording system stops, the obligation to prove that every transaction carried out was performed by authorized persons in accordance with the provisions of the Regulation and this Communiqué belongs to the institution. Without prejudice to the provisions of Article 54 of the Regulation, if any party suffers damage due to these transactions, the institution is obliged to compensate the damage suffered by the parties.

(9) If external services are procured by the institution for information systems, the institution is responsible for the compliance of the external service provider's audit trail recording system with the provisions of this article.

(10) The provisions specified in this article apply to voice recordings regarding transactions carried out by the customer in services provided by telephone. It is essential that voice recordings be of a nature and quality that will allow reliable evidence to be obtained and ensure that responsibilities are clearly determined.

Information systems continuity plan

ARTICLE 14 – (1) The institution prepares an information systems continuity plan as part of the business continuity plan established pursuant to Article 30 of the Regulation.

(2) The information systems continuity plan;

a) The information systems continuity objectives to be determined in a manner compatible with the business continuity plan, and the backup and recovery procedures to be established and the resources to be used in order to achieve these objectives,

b) The processes for identifying the source of the event requiring the implementation of the plan, the damage it caused, its potential size and impact, and the parties affected by it, and for ensuring that the findings are conveyed to the relevant management units,

c) The criteria and procedures related to the decision-making process for the implementation of the plan, and the duties, authorities and responsibilities of the persons or groups that will take part when the plan is activated,

ç) The method of communication with relevant stakeholders,

d) The method for recording the decisions taken and actions implemented within the scope of the plan,

contains.

(3) Within the scope of the information systems continuity plan to be prepared pursuant to this article, the importance level of information systems components and the data on them is evaluated, acceptable interruption durations and acceptable data losses are determined for each component, and recovery procedures for the components are developed in line with these determined limits.

(4) Within the scope of the information systems continuity plan, the institution prepares procedures for ensuring return from the secondary center to the primary center without any loss after the requirements cease to exist.

(5) The institution tests the effectiveness of the information systems continuity plan regularly at least once a year. The test also includes the seamless execution of one day's operations through the secondary center. Institutions that do not have a secondary center pursuant to the fourth paragraph of Article 15 may perform their tests in the form of remote work. The institution plans these tests in a manner that includes its representatives and branches, as well as other institutions and third-party service providers that have a connection to its information systems.

Secondary center, secondary system and data backup center

ARTICLE 15 – (1) In order to ensure the uninterrupted continuation of its activities, the institution is obliged to establish secondary centers and systems and to test them periodically.

(2) Care is taken to design secondary systems in a manner that prevents problems that may be experienced in primary systems in the face of emergency and unexpected situations from also being experienced in backup systems.

(3) The institution is obliged to establish a data backup center in order to prevent the loss of data in the primary system as a result of emergency and unexpected situations. The data backup center is designed by taking into account the risks of unauthorized access to data and includes at minimum the same level of security features as the primary systems.

(4) In the event that the primary center becomes unusable due to the occurrence of emergency and unexpected situations, the institution establishes a secondary center at a location different from the primary center in order to ensure the uninterrupted continuation of its activities, determines the emergency personnel who will take duty in such situations and their duties, and takes the necessary measures for the emergency personnel to be able to work at this center. The secondary center must be designed in a manner that enables emergency personnel to also effectively use the backup systems and data backup centers. In cases where remote working possibilities exist and the primary center becomes unusable due to the occurrence of emergency and unexpected situations, the requirement to establish a secondary center may not be applied, provided that measures have been taken to ensure the uninterrupted continuation of activities.

(5) The location of the secondary center, secondary systems and data backup center is determined in a way that prevents emergencies and unexpected situations from affecting the backups simultaneously and proportionally with the primary systems and centers.

Management of the external service procurement process related to information systems

ARTICLE 16 – (1) The institution may procure external services for all or part of its information systems, provided that the decision-making power and responsibility in functions such as information systems management, content design, access, control, updating, obtaining information and reports remain with the institution, in terms of fulfilling the conditions set out in this article and the obligations required by the Law and relevant secondary regulations.

(2) The senior management of the institution shall establish an adequate oversight structure for external service procurement within the scope of information systems that enables the risks that the performance of the said service through external service procurement will create for the institution to be adequately assessed and managed, and the relations with the external service provider to be carried out effectively. In this context, the senior management of the institution shall, at a minimum, for services performed through external service procurement, monitor the availability, performance and quality of the service, security breach incidents occurring within the scope of this service, and the security controls, financial conditions and contractual compliance of the external service provider, and report to the board of directors once a year. As performance indicators, at a minimum, the service level definitions set out in the external service procurement contract specified in the ninth paragraph of this article shall be used.

(3) When the institution chooses to procure external services on matters related to information systems, the following rules shall apply:

a) The responsibility of the institution and the senior management of the institution continues.

b) The obligations of the institution towards the relevant parties continue.

c) There shall be no change in the conditions to be complied with by the institution regarding the granting of an operating license and the maintenance of the operating license within the scope of the Law and the Regulation.

(4) When the institution procures external services pursuant to the first paragraph;

a) To exercise due diligence in the selection of the external service provider institution,

b) To carry out external service procurement in a manner that does not reduce the quality of the internal control and risk management framework and does not diminish the effectiveness of the Bank's audit activities regarding the institution,

c) To regulate matters related to external service procurement also taking into account the business continuity plan,

ç) To clarify the obligations of the external service provider institution through a contract,

d) To take the necessary measures to effectively manage the additional risks that external service procurement will create, taking these risks into account,

e) To take the necessary measures for the confidentiality and security of data relating to itself, its personnel and its customers in external service procurements,

f) To ensure that an appropriate exit strategy is determined for managing the risks related to cases where external service procurement ends or is interrupted other than as planned,

is obliged.

(5) The types of access rights granted to external service providers shall be evaluated specifically. A risk assessment shall be carried out for these accesses, which may be physical or logical; accordingly, additional controls shall be established if necessary. While carrying out the risk assessment, the type of access needed, the value of the data accessed, the controls being carried out by the external service provider institution and the effects of this access on the security of the institution's information shall be taken into account.

(6) The institution is responsible for the operations of the external service provider with respect to the activities subject to external service.

(7) The institution may use cloud computing services established domestically as an external service to process, store and transmit all kinds of data. However, the procurement of cloud computing services in a manner that will process, store and transmit sensitive customer data, competition-sensitive data, personal data or any kind of information that can be associated with the customer and makes him/her identifiable or identifiable is possible only if this external service is procured with a private cloud service model in which it is offered only over hardware and software resources allocated solely to the institution. In the event that it is provided by external service providers deemed appropriate by the Bank, the institution may procure external services with the community cloud service model, in which hardware and software resources allocated to other credit institutions or financial institutions whose activities related to payment service providers or information systems are regulated and supervised by a competent authority within the framework of the relevant legislation are physically shared, but a separate resource specific to each payment service provider is logically assigned. The provision of the community cloud service by a credit institution or financial institution that is the parent company, subsidiary or subsidiary of the parent company of the institution and whose activities related to information systems are regulated and supervised by a competent authority within the framework of the relevant legislation (Additional phrase:RG-7/10/2023-32332) or by their subsidiaries providing services related to information systems to them shall not constitute a violation of the provisions of this paragraph, provided that the hardware and software resources allocated only to the parent company, its subsidiaries and the subsidiaries of the parent company are physically shared but a separate resource specific to the institution is assigned by making a logical separation. If the institution procures cloud computing services for test and development environments and systems that do not contain customer data, by taking the necessary security measures, the provision of this paragraph shall not apply.

(8) Access to be granted to external service providers shall be limited to the information required by the work.

(9) The contract related to external service procurement shall include, at a minimum, the following matters:

a) Definitions regarding the scope of the service and service levels, and the rights and obligations of the institution and the external service provider.

b) The conditions for termination of the service and provisions regarding the destruction by the external service provider of the data, information, documents and records obtained while providing the external service in the event of termination of the service.

c) The obligations of the external service provider and the organization within the scope of the information systems continuity plan.

ç) Provisions ensuring that all systems and processes within the scope of external service procurement comply with the organization's own risk management, security and confidentiality policies.

d) Provisions regarding the ownership and intellectual property rights of the products and services subject to the contract.

e) Provisions ensuring that the provisions constituting obligations for external service providers in the contract are also included as binding clauses in contracts to be made with subcontractors.

f) Provisions regarding the management of risks arising from the termination or interruption of external service procurement other than planned.

g) Provisions ensuring that the legislative provisions to which the organization is subject are also applied to external service provider organizations within the framework of the service received.

ğ) Provisions ensuring that, in the event that activities within the scope of external service procurement are carried out within the organization, they are subject to the same audits without narrowing the scope, whichever audits are envisaged in terms of independent audit.

h) Provisions regarding the obligation of external service providers to provide all kinds of information and documents requested by the Bank regarding the activities they carry out in a timely and accurate manner, and to keep and operate all kinds of records in electronic, magnetic and similar media related to these and all necessary systems and passwords to access and make the records readable, ready for examination. ı) Provisions regarding the authority of the Bank, the organization and the independent audit institution to request all kinds of information and documents from the external service provider regarding the subject of external service procurement.

i) Provisions ensuring that changes to be made on the organization's information systems upon the instruction of the Bank are fulfilled by the external service provider within the scope of the service received within the instruction period.

j) Provisions regarding the ownership of information, documents and records related to transactions carried out through external service procurement belonging to the organization and the confidentiality of information, documents and records belonging to the organization.

k) Provisions regarding the procedures to be followed in case of violation of contract provisions for any reason.

(10) The organization checks whether providers such as search engines and social media platforms from which it wishes to receive advertising services for the services it offers within the scope of the Law have taken measures to prevent fake advertisements given on behalf of the organization, and cannot receive advertising services from providers that do not take appropriate measures. The organization must include provisions in contracts to be made with providers such as search engines and social media platforms from which it receives advertising services, stating that in the event of fake advertisements being published, it can obtain the necessary information specific to the incident in order to protect the customer. The provisions of this paragraph also apply to contracts made with intermediary companies that the organization agrees with to receive advertising services within this scope.

(11) The Bank is authorized to request the organization to stop external service procurement in cases where it concludes that the organization's receiving services from outside negatively affects the smooth operation of the system or where the organization providing the service obstructs the Bank's activities related to the supervision of the organization.

(12) (Added:RG-7/10/2023-32332) Regarding service procurements that do not have the potential to affect the confidentiality, integrity and accessibility of data and the continuity of the services offered by the organization, that do not cause sensitive customer data and customer information to be shared with the external service provider, and that are not specifically designed and offered for the organization, the provisions of the ninth paragraph are applied to the extent that they are compatible with their nature.

(13) (Added:RG-7/10/2023-32332) Maximum care is taken to ensure that products and services to be procured within the scope of critical information systems and security are produced in Türkiye or that the manufacturers' R&D centers are located in Türkiye, and this is evaluated as an important criterion in external service procurement. It is mandatory for such providers and manufacturers to have intervention teams in Türkiye. The Bank is authorized to determine additional conditions regarding the security products and other information technology elements to be used by organizations.

Informing customers and website

ARTICLE 17 – (1) Customers who will benefit from the services offered by the organization are clearly informed about the conditions, risks and exceptional situations related to the services. The organization warns its customers about the risks and threats related to the services it offers and shows maximum care to create customer awareness on these issues.

(2) Within the scope of the first paragraph, at a minimum the following matters are brought to the customer's knowledge:

a) Guiding instructions regarding the secure use of devices, software or mobile applications and payment instruments and sensitive customer data offered to customers by the organization.

b) The steps that customers must follow in cases such as the loss, theft, deletion or alteration of devices, software or mobile applications and payment instruments and sensitive customer data offered to customers by the organization.

c) The risks carried by the services offered and the conditions related to these services; the rights and responsibilities of customers and the organization.

ç) Guiding instructions regarding what to do in case of suspicion of fraud or encountering any problem during the receipt of the service, and the steps that customers must follow.

(3) Customers are informed in advance in cases such as an interruption of more than two hours in payment services, planned maintenance and changes.

(4) Mechanisms are established through which problems that the customer may experience due to information systems and services provided based on them can be tracked and allowing customers to convey their complaints. Complaints are evaluated and resolved as soon as possible; in this context, in the complaint units or call centers to be established, in the menus that will greet the customer, the process of transmitting fraud cases related to the service offered through the electronic channel is brought to the customer's attention in the main menu and in the first ranks, and necessary work is carried out to remedy the notifications conveyed to the institution as soon as possible.

(5) The institution enables the customer to monitor transaction information and balance information. In order for this information to be monitored using the electronic channels offered by the institution, necessary guidance is provided to customers. In this context, it is essential that any documents such as statements, receipts, account summaries containing sensitive customer data or customer information that the institution will transmit to its customers in electronic environment are provided through the electronic channels offered by the institution. If the customer requests, these documents are sent to the communication or e-mail address specified by the customer in a way that does not contain sensitive customer data.

(6) On the institution's website, the institution's trade title, contact information, head office address and the Bank's contact information are included. While the Bank's contact information is provided on the institution's website, the Bank's contact information cannot be positioned in a way that precedes the institution's contact information in terms of awareness and recognition.

(7) The institution carries out customer-specific announcements, warnings and similar continuous information needs through a secure channel previously agreed with the customer. Customers are informed that information not coming through this channel should not be relied upon.

(8) Techniques are used to verify that the accessed website belongs to the institution.

(9) All kinds of information and explanations necessary for informing customers defined within the scope of this Communiqué and the Regulation are always kept open to customer access on the institution's website.

(10) The payment services offered, the days and hours when these services are accessible and other conditions regarding the services, the risks that the services offered may cause, the methods that customers should use to protect against these risks, guiding security guides to increase customer awareness, and matters regarding the responsibilities and rights of customers who will benefit from these services, as well as other general information that should be provided to customers within the scope of the Regulation, are included on the website.

(11) The information and explanations regarding the services offered must be clear and understandable, placed in an attention-grabbing place on the website, and guidance and systemic restrictions are applied to ensure that customers view them at least once in a fully readable manner before starting to benefit from the relevant payment service.

(12) In the services within the scope of the Law offered by the institution through the electronic channel, controls that minimize the possibility of customers making incorrect transactions are provided, information on all kinds of amounts, commissions and fees that customers are obliged to pay regarding the transactions they initiate is clearly brought to the customer's knowledge at the time of the transaction, and if the customer approves them, the said transactions are carried out.

(13) The institution avoids using expressions in its marketing activities, advertisements or publications that would give the impression and information that any service it offers to its customers is absolutely safe or that there is no security risk in these services.

(14) In cases where the information that must be provided within the scope of this Communiqué for the services offered by the institution within the scope of the Law is insufficient in terms of information possibilities due to reasons arising from the platform on which the service is provided or the device used by the customer while receiving the service, the institution provides the necessary guidance for the customer to access the said information through different channels.

Electronic certificates

ARTICLE 18 – (1) The institution uses the electronic certificates described in the Electronic Signature Law dated 15/1/2004 and numbered 5070 for the purpose of verifying the identity of the institution's website and securely identifying the parties within the scope of the data sharing services in Article 23.

(2) The electronic certificate contains the code given to the institution by the Bank for use in reporting and information regarding the type of the institution.

Monitoring of high-risk transactions

ARTICLE 19 – (1) The institution establishes monitoring mechanisms for all transactions carried out by customers who are parties to the transaction, as well as representatives, merchants and unmanned service points, in order to detect and prevent transactions for fraud or deception purposes and transactions that can be considered within the scope of financial crime. In this context, it evaluates suspicious or high-risk transactions in detail. The institution is responsible for conducting effective monitoring of the transactions that have occurred, regarding the merchant party to the transaction and the service it offers. In this context, the institution is responsible for conducting a risk assessment study for the merchant, having information about whether the service offered by the merchant is subject to social engineering activities and the compatibility of the specified service with the service actually offered, and taking necessary measures by reviewing the risk assessment in case of intense customer complaints regarding the services.

(2) Without prejudice to the obligations under Law No. 5549, if the institution detects that unusual, suspicious or high-risk transactions have been carried out, it ensures that customers are warned as soon as possible through appropriate methods such as telephone or SMS. If a contact information through which the customer can be reached in a short time has not been shared with the institution, this paragraph provision shall not apply.

(3) Frequent execution of low-value payment transactions within a short period of time or frequent use of a low-value payment instrument within a short period of time is considered a high-risk transaction.

(4) The institution establishes transaction monitoring mechanisms to detect and prevent transactions that occur in relation to the services it offers through electronic channels within the scope of the Law, which are unusual, have a fraud or fraudulent risk. Within the scope of the transaction monitoring mechanism, at a minimum, the following risk elements are monitored in appropriate cases:

a) Known fraud methods for transactions that produce financial results.

b) The amount of each payment transaction carried out and whether, based on these amounts, the customer shows an unusual payment, fund transfer or behavioral pattern in all transactions carried out in physical environments, and in transactions carried out through electronic channels, if the customer approves, also using location information.

c) The list of lost, stolen or compromised authentication elements by unauthorized persons. ç) Indications that malicious software may have infected each authentication session.

d) If possible, records regarding whether the customer and the parties to whom the customer made payments or transferred funds have previously carried out payment transactions within the scope of fraud or fraudulent activities.

e) (Amended phrase: Official Gazette-7/10/2023-32332) Scenarios deemed appropriate within the scope of suspicious transaction types included in the guidelines published by MASAK.

(5) The institution evaluates high-risk transactions by filtering them and closely monitors customers who trigger these filters.

(6) Within the scope of the risk management activities it carries out, the institution ensures that necessary investigations are conducted, including on social media and online platforms, to determine whether the services offered by the institution within the framework of the Law are used in illegal activities, particularly illegal betting, and that appropriate measures are taken to prevent such transactions.

(7) Within the scope of the measures to be taken pursuant to the sixth paragraph, the institution assigns a sufficient number of personnel who will be directly responsible for this work and;

a) Ensuring that the personnel to be assigned determine which persons, accounts, cards, workplaces are used in illegal activities at the institution by using the links related to money transfers made through the institution in virtual media that allow illegal betting and similar illegal activities, especially social media and online platforms,

b) Immediately terminating the provision of payment services to the identified customers, closely monitoring the persons, accounts, cards, workplaces that send money to or receive money from these customers, and terminating the provision of payment services to these customers if there is suspicion that they are used in or involved in illegal activities, particularly illegal betting,

c) Repeating the steps in subparagraph (a) until a reasonable opinion is formed that other persons, accounts, cards, workplaces related to money transfers made through the institution in virtual media that allow illegal betting and similar illegal activities are not used,

ç) Recording the persons, accounts, cards, workplaces identified pursuant to this article and all transactions carried out in relation to them, and reporting the recorded customers and the transactions carried out through these customers to the Bank and, depending on the nature of the illegal transaction, primarily to MASAK (Amended phrase: Official Gazette-7/10/2023-32332) and other relevant public authorities,

d) Recording the virtual media that have been checked and determined to allow illegal betting and similar illegal activities, and notifying the Bank and MASAK (Amended phrase: Official Gazette-7/10/2023-32332),

ensures.

(8) The number of personnel to be assigned by the institution pursuant to the seventh paragraph must be determined by taking into account the institution's transaction volume and amounts and the types of payment services it provides, in a way that ensures an adequate control mechanism. The Bank is authorized to request, considering the institution's transaction volume and amounts, that the personnel to be assigned pursuant to the seventh paragraph be appointed specifically for this work.

(9) Institutions that exclusively provide the payment services specified in subparagraph (g) of the first paragraph of Article 4 of the Regulation are exempt from the obligations in this article.

Businesses, representatives and unmanned service points

ARTICLE 20 – (1) In the contracts the institution will conclude with businesses and representatives;

a) To take necessary measures to ensure the confidentiality and security of sensitive customer data,

b) Not to hold, process or record sensitive customer data on its own premises, except for communication between the terminals necessary for the performance of services and the institution,

c) To immediately notify the institution in the event of a significant security incident,

it is obliged to ensure that provisions regarding these are included.

(2) The institution is obliged to oversee that the requirements of the provisions within the scope of the first paragraph, which will be included in the contracts it will conclude with businesses and representatives, are fulfilled, and to terminate the contract if it is understood that they are not fulfilled. In cases where the explicit consent of customers is obtained by informing them about the holding, processing or recording of sensitive customer data by businesses, the condition of compliance with subparagraph (b) of the first paragraph is not required.

(3) It is essential that there is mutual authentication and end-to-end secure communication between the API, physical or virtual terminals and unmanned service points that enable the execution of payment transactions or transactions related to electronic money, and the institution. Unauthorized physical or electronic access to sensitive customer data processed at terminals and unmanned service points is prevented.

(4) The organization is obliged to provide training to its representatives on current fraud and deception methods and the measures to be taken within the scope of Law No. 5549, and to inform its users about the safe use of unmanned service points.

(5) The organization is obliged to take the necessary measures against threats such as theft, fraud and deception regarding unmanned service points. In this context, controls are established to prevent and detect the placement of foreign apparatuses or card copying devices, fake keyboards, cameras and other such devices on unmanned service points.

(6) All default passwords on unmanned service points are changed in a way that cannot be easily guessed.

(7) Measures are taken to prevent all kinds of unauthorized access to unmanned service points and terminals and the loading of malicious software onto them.

(8) Current software versions with provider or manufacturer support are used on unmanned service points and terminals, and necessary updates are made without delay in order to eliminate security vulnerabilities.

(9) Identity verification provisions are applied for transactions carried out at unmanned service points; taking into account matters such as transaction type, number and limit, a control and monitoring mechanism is established against the possibility of suspicious transactions being carried out and the necessary notifications are made.

(10) The organization installs security cameras at the locations where unmanned service points are located. Security camera recordings are stored for at least six months at an image quality sufficient to identify individuals, and whether the camera equipment is working properly is checked regularly. If there is a security camera infrastructure that also covers the unmanned service point in terms of viewing area and meets the conditions in this paragraph, no additional security camera is installed. For unmanned service points located in the activity area of public security and intelligence agencies, the requirement to install a security camera is fulfilled provided that permission can be obtained from the relevant public security and intelligence agencies.

Restrictions regarding information systems

ARTICLE 21 – (1) Organizations are obliged to keep their primary and secondary systems and data backup centers within the country. In the implementation of this article, the provisions of the thirteenth paragraph of Article 19 of the Regulation are reserved.

(2) It is essential that all information systems used in the execution of payment transactions between the customers of the same organization or the customers of different organizations, and their backups, be located within the country. In this context, in case of outsourcing, the information systems used by the external service provider in carrying out the activities related to the said service and their backups are also kept within the country.

(3) In cases where one of the parties to the payment transaction is not a customer of the organization, the organization is subject to the provisions of this Communiqué for the parts of the transaction occurring on its side.

(4) (Added:RG-7/10/2023-32332) In cases where one of the parties to the payment transaction (itself or its service provider) is located abroad, the organization may, provided that the data continues to be stored within the country, only to the extent required for the payment transaction to be carried out smoothly and in accordance with the principle of proportionality, share the data needed with the relevant third parties abroad, depending on the request or instruction from the customer regarding the payment transaction and without prejudice to the obligations under Article 9 of Law No. 6698. If the Bank decides as a result of its assessment that this would adversely affect the development of the payments field, it may stop the sharing made pursuant to this paragraph or introduce additional restrictions regarding them.

Processes to be carried out by means of remote communication

ARTICLE 22 – (Amended:RG-7/10/2023-32332)

(1) In the processes of identity verification and establishment of a contractual relationship to be carried out by means of remote communication, in cases where a centralized structure approved by the Bank is not used, the organization uses internet-based methods that allow remote identity verification and verification of the biometric data of the person whose identity is to be verified (Added phrase:RG-4/9/2026-33360) and fulfills at least the following:

a) (Amended:RG-4/9/2026-33360) Obtaining the information required to be obtained from the person whose identity is to be verified and the identity document in order to perform identity verification.

b) (Amended:RG-4/9/2026-33360) Checking the accuracy of the identity document obtained for remote identity verification and the data and information contained in the identity document primarily by using near field communication, performing tests regarding the authenticity, integrity, wear and tampering status of the identity document and the data and information contained in the identity document, especially security elements visually distinguishable under white light, photograph and signature, and continuously recording the process of checking the front and back of the identity document in terms of visual elements.

c) (Amended:RG-4/9/2026-33360) In case verification using near field communication cannot be performed for any reason pursuant to subparagraph (b), checking the accuracy of the identity document and the data and information contained in the identity document by using at least one of optical character recognition, card reader or other methods determined by the Bank after obtaining the opinion of MASAK, performing tests regarding the authenticity, integrity, wear and tampering status of the security elements visually distinguishable under white light and of the types and numbers deemed appropriate in the General Communiqué of the Financial Crimes Investigation Board (Sequence No: 19) published in the Official Gazette dated 30/4/2021 and numbered 31470, the identity document and the data and information contained in the identity document, and continuously recording the process of checking the front and back of the identity document in terms of visual elements.

ç) Recording the consent and explicit consent of the person whose identity is to be verified regarding the use of biometric data for remote identity verification and that the contract process will be conducted via remote communication tool.

d) Conducting a liveness test of the person whose identity is to be verified using online real-time video, online real-time moving photo, or online video interview methods, and during the remote identity verification process, comparing the person's face with the identity document

if it can be obtained using near field communication, the photo in the contactless chip, and if not obtainable, the photo on the identity document, biometrically, and verifying that the photo and personal information on the identity document match the person.

e) Performing device and environment control in terms of light and noise level, signal strength, and similar criteria.

f) Verifying the contact information related to the method to be used as the remote communication tool by appropriate methods.

(2) In the liveness test procedures conducted pursuant to the first paragraph, if online real-time video or online real-time moving photo methods are used, it is mandatory that the video or moving photo in question is captured instantly by the person whose identity is to be verified in accordance with the instructions to be given, that a structure is created that does not allow a previously recorded video or moving photo to be included in the liveness test, and that all recordings made within this scope are recorded in real-time on the institution's servers. During the liveness test of the person whose identity is to be verified, the necessary checks must be performed on at least three images within the framework of commands to be given randomly from among options determined in a way that ensures unpredictability to the person whose identity is to be verified by third parties, and the process in question must be recorded without interruption.

(3) (Amended: Official Gazette-4/9/2026-33360) For anonymous prepaid instruments, within the scope of Law No. 5549 and relevant legislation provisions, for one-time payment transactions that do not require identity verification and are not within the scope of a continuous business relationship, and during the execution of processes related to information, contracts, receipts, and similar documents required for electronic money issuance and payment transactions specified in the first paragraph of Article 2.2.11 of the General Communiqué on Financial Crimes Investigation Board (Sequence No: 5), if a remote communication tool is used, the provisions of the first paragraph are not mandatory to apply.

(4) The processes conducted via remote communication tool within the scope of the first paragraph are designed and operated in accordance with the principle of separation of duties in cases where there is manual intervention by personnel, in a way that does not allow initiation, approval, and completion by a single person. In the processes conducted via remote communication tool within the scope of this article, the information systems used are considered critical information systems within the scope of the thirteenth paragraph of Article 16.

(5) The processes conducted via remote communication tool within the scope of the first paragraph are recorded including all steps, and the data obtained are stored in accordance with the Law, the Regulation, this Communiqué, and other relevant regulations. In case of dispute, the institution is responsible for proving that the transactions during the processes conducted via remote communication tool were carried out in accordance with the provisions in the Regulation and this Communiqué.

(6) The institution shall establish in writing the processes and procedures to be followed regarding the processes to be conducted via remote communication tool within the scope of the first paragraph, regularly test the established processes and procedures at least twice a year, and take all measures, especially technological and operational requirements, and make necessary updates regarding the deficiencies, errors, weaknesses, and vulnerabilities that arise in the test results.

(7) In the processes to be conducted via remote communication tool within the scope of the first paragraph, the (Amended phrase: Official Gazette-4/9/2026-33360) identity document to be obtained from the person whose identity is to be verified, the security and verification features to be considered during the verification of the identity document and the criteria to be used in this context, and the security and verification features to be considered during the verification of the person whose identity is to be verified and the criteria to be used in this context are documented in writing.

(8) In the processes to be conducted via remote communication tool within the scope of the first paragraph, the questions to be asked and the expressions to be used for guidance in order to verify the identity of the person whose identity is to be verified during the interview, to verify it, and to ensure that the contract is not made under the duress or coercion of another party; the stages related to the course of the interview and the questions to be asked at each stage and the expressions to be used for guidance are established in writing and regularly updated in line with current developments and threats.

(9) The institution is obliged to fulfill the following conditions in the processes to be conducted through the methods specified in the first paragraph:

a) The process must be conducted in real-time and without interruption.

b) The process is carried out with end-to-end secure communication.

c) The image and sound quality in the method used is ensured to be at a sufficient level to enable the necessary checks to be performed effectively in accordance with this article, and controls are established throughout the process to demonstrate that the image quality is at the desired level. In measuring image quality, at minimum, attention is paid to ensuring that it is possible to visually view the person being interviewed clearly, to visually verify the presented (Amended phrase: Official Gazette-4/9/2026-33360) identity document under white light, and to check that the presented (Amended phrase: Official Gazette-4/9/2026-33360) identity document has not been falsified.

ç) In the event of doubt regarding the validity of the identity document presented by the person whose identity is to be determined during the process (Amended phrase:RG- 4/9/2026-33360), or of actions that may constitute fraud or forgery, the process is terminated.

(10) In cases where the conditions set out in this article are not complied with, a contract cannot be established through the methods specified in paragraph one, point (d); in contracts established in this manner, all responsibility for unauthorized, erroneously executed or similar problematic transactions belongs to the organization.

(11) The organization monitors the persons whose identity it has determined via remote communication means and the customers who are parties to the contracts it has established under a different risk profile. Depending on the type and amount of transactions carried out by these customers, additional security and control methods are applied.

(12) In contracts to be established via remote communication means pursuant to paragraph one, after remote identity verification is performed or the customer's identity is verified face-to-face, if the customer prefers to provide their declaration of intent to establish the contract via online video interview or to establish the contractual relationship through an electronic channel, it is mandatory that it be obtained over the same electronic channel after strong customer authentication is performed within the scope of Article 10. In the application of this paragraph, the provisions set out in the second section of the fourth part of the Regulation are reserved.

(13) In cases where remote identity verification is performed within the conditions set out in this article, the requirements of strong customer authentication within the scope of Article 10 shall be deemed to have been fulfilled.

(14) In the application of this article, the provisions of the General Communiqué of the Financial Crimes Investigation Board (Sequence No: 19) (Repealed phrase:RG-4/9/2026-33360) shall be applied with priority.

(15) The Bank is authorized to determine, if needed, the other procedures and principles to be applied within the scope of this article.

(16) (Added:RG-4/9/2026-33360) Identity verification of natural persons who are not Turkish nationals may be performed through remote identity verification by using a passport with near-field communication capability, in accordance with the standard No. 9303 of the International Civil Aviation Organization (ICAO), within the framework of the principles set out in Article 4/C of the General Communiqué of the Financial Crimes Investigation Board (Sequence No: 19).

THIRD SECTION

Data Sharing Services Used in Payment Services

Data sharing service

ARTICLE 23 – (1) The HHS shall, within the scope of the activities set out in points (f) and (g) of the first paragraph of Article 4 of the Regulation, provide data sharing services to the HBHS and ÖBHS by establishing the necessary connections in accordance with the fifth paragraph of Article 59 of the Regulation.

(2) In the payment order initiation service, the parties to the data sharing service are the ÖBHS and the HHS.

(3) In the payment account information service, the parties to the data sharing service are the HBHS and the HHS.

(4) In the data sharing service, the parties use the electronic certificates determined by the Bank, and it is checked that the parties are authorized by the Bank.

(5) In activities related to data sharing services, the confidentiality, integrity, currency and security of all relevant data, particularly sensitive customer data, customer information and competition-sensitive data, shall be ensured.

(6) Data sharing services shall be carried out in accordance with the provisions set out in Article 59 of the Regulation and the technical and operational requirements determined by the Bank pursuant to the first paragraph of the same article.

(7) For each information request and payment order initiation transaction by the customer related to the services specified in points (f) and (g) of the first paragraph of Article 4 of the Regulation, separate approval shall be given. For the account information service, approval for the relevant accounts and the transactions defined on these accounts may also be given through the contract drawn up.

Obligations of the HHS regarding the data sharing service

ARTICLE 24 – (1) The HHS shall connect to the BKM API Gateway in accordance with Article 59 of the Regulation, and shall provide the necessary infrastructure to all other authorized payment service providers requesting the provision of the payment services set out in points (f) or (g) of the first paragraph of Article 4 of the Regulation with respect to the payment accounts held with it.

(2) The HHS shall carry out requests received within the scope of the account information service and the payment order initiation service without delay.

(3) In the event of an error occurring in transactions carried out by the HBHS and ÖBHS, the HHS shall clearly notify the relevant HBHS and ÖBHS of the cause of the error.

(4) The HHS shall be obliged, in relation to the provision of the payment services set out in points (f) and (g) of the first paragraph of Article 4 of the Regulation, to make the developments in accordance with the Regulation, this Communiqué and the technical and operational requirements determined pursuant to Article 59 of the Regulation, to document the technical specifications related thereto, and to inform all relevant parties 3 months in advance of any change to be made in these technical specifications.

(5) The HHS shall provide a test environment to enable the HBHS and ÖBHS to test their software and applications in relation to the provision of the payment services set out in points (f) and (g) of the first paragraph of Article 4 of the Regulation. Sensitive customer data shall not be shared through the test environment.

(6) The provision, availability, performance and the support service included therein of the payment services set out in points (f) and (g) of the first paragraph of Article 4 of the Regulation, by the HHS, limited to the services within the scope of this article, must be no different from the HHS's direct online access to the payment account provided to the customer.

(7) The HHS shall comply with the key performance indicators and service level targets defined within the scope of the Regulation, this Communiqué and the technical and operational requirements determined pursuant to Article 59 of the Regulation, in relation to the provision of the payment services set out in points (f) and (g) of the first paragraph of Article 4 of the Regulation. Statistics regarding performance indicators and service level targets shall be published regularly by the method to be determined by the Bank.

(8) HHS cannot introduce additional difficulties such as flows and marketing activities outside the purpose of the service, compared to the rules and requirements it sets for direct online access to the payment account provided to the customer in the provision of payment services set out in subparagraphs (f) and (g) of the first paragraph of Article 4 of the Regulation.

Session features and audit trails

ARTICLE 25 – (1) The parties to the data sharing service establish end-to-end secure communication, including connections with the customer, and guarantee the traceability of all transactions.

(2) The sessions established by the customer with the HHS through the HBHS and ÖBHS are based on authentication.

(3) Each session contains a unique session number and timestamp.

(4) The transactions in the session are recorded securely and in detail by the parties that have the burden of proof to the extent of the control area, including the transaction number, timestamp and all relevant transaction data.

(5) The timestamp is based on the timestamp defined within the scope of Law No. 5070.

(6) The parties endeavor to keep the session they open short and close it as soon as the transaction ends.

Authentication and transaction security in data sharing services

ARTICLE 26 – (1) In the account information service, strong customer authentication is applied by the HHS to the customer in accordance with the provisions set out in Article 10 at the time of obtaining the customer's consent.

(2) In the payment order initiation service, strong customer authentication is applied by the HHS to the customer in accordance with the provisions set out in Article 10, and the customer's approval is obtained with the transaction verification code.

(3) In the payment order initiation service, exceptions or additional security measures regarding the application of strong customer authentication by the HHS to the customer are determined by the Bank within the scope of the technical and operational requirements established pursuant to Article 59 of the Regulation.

Contingency measures regarding data sharing services

ARTICLE 27 – (1) The HHS prepares contingency plans, including the measures to be taken in the event of interruption of the data sharing services it provides, within the scope of the information systems continuity plan to be prepared pursuant to Article 14.

(2) The contingency plans to be prepared pursuant to the first paragraph include communication plans regarding informing the HBHS and ÖBHS and alternative access methods that can be used.

(3) The HHS, HBHS and ÖBHS promptly report significant incidents regarding data sharing services to the Bank.

FOURTH CHAPTER

Independent Audit of Information Systems

Independent audit of information systems

ARTICLE 28 – (1) Independent audit of information systems; is the process consisting of the stages of forming an opinion on the effectiveness, adequacy and compliance of the said internal controls and putting the results into a report, as a result of the evaluation by independent audit institutions of information system elements such as processes, activities, software, hardware within the scope of information systems management, and the internal controls established within these systems and processes, in order to determine the compliance status of the institution with the provisions of this Communiqué.

(2) The audit activity to be carried out regarding the information systems of the institution pursuant to the first paragraph is performed by independent audit institutions included in the list of Independent Audit Institutions Authorized to Perform Information System Audit in Banks published by the Banking Regulation and Supervision Agency. The Bank is authorized to decide, if it deems necessary, that the institution shall not receive independent audit service from an independent audit institution included in this list pursuant to this article, or that an independent audit institution not included in this list may perform information systems audit at the institution.

(3) The report to be created as a result of the audit activities carried out pursuant to the first paragraph must be shared by the institution with the Bank by the end of February of the year following the audit period. The Bank is authorized to grant additional time upon the request of the institution in cases it deems necessary. The Bank is authorized to decide that the reporting to be made by the institution shall be made electronically in accordance with the method it will determine. The Bank may request additional explanation from the independent audit institution or the institution on matters related to the independent audit activity, if it deems necessary.

(4) The independent audit institution takes into consideration how the services performed by the institution through outsourcing affect its information systems, and accordingly, if it deems necessary, plans its audit to also cover the external service providers and develops an effective audit approach.

(5) Information systems audit at the institution is performed every two years. The first audit activity to be carried out pursuant to the first paragraph regarding an institution that has obtained a new activity permit is conducted to cover the year following the granting of the activity permit to the institution. The Bank may differentiate the scope and frequency of the information systems audit in cases it deems necessary.

(6) The Bank is authorized to determine the principles, procedures and essentials regarding the independent audit activities to be carried out regarding information systems.

(7) Banks within the scope of Law No. 5411 are subject, with the provisions of the eighth paragraph being reserved, to the legislation issued by the Banking Regulation and Supervision Agency based on Law No. 5411 regarding the independent audit of the information systems they use in relation to their activities within the scope of the Law.

(8) The Bank may, in necessary cases, request that the information systems of the Post and Telegraph Organization Joint Stock Company and the banks within the scope of Law No. 5411 be audited by independent audit institutions within the framework of the provisions of the Law, the Regulation and this Communiqué and the instructions and circulars of the Bank, in relation to their activities within the scope of the Law.

Management statement

ARTICLE 29 – (1) The institution is obliged to prepare, in each audit period, a management statement approved by the board of directors and the general manager, providing assurance as of the audit period regarding the internal controls it has established as required by the provisions of this Communiqué.

(2) The independent audit institution, while forming the audit opinion, examines the management declaration and the work constituting the basis for this declaration. If the independent audit institution detects a deficiency or inaccuracy in the declaration as a result of this examination, it includes these findings as findings in the audit report.

(3) In the event that the audited institution refuses to provide the management declaration, the persons authorized to sign the information systems audit report may issue a qualified opinion, disclaim an opinion, or, within the framework of the conditions specified in the fifth paragraph of Article 30, make a proposal to the management of the independent audit institution to withdraw from the audit. If the independent audit institution decides to withdraw, the situation, together with its reasons, is notified to the Bank within at most seven business days as of the date the decision is taken.

Formation of the audit opinion and the audit letter

ARTICLE 30 – (1) As a result of the audit carried out at the institution by the independent audit institution; in cases where an unqualified, qualified or adverse opinion is reached, the audit letter is issued in accordance with the examples in ANNEX-1, ANNEX-2, ANNEX-3, respectively. In the presence of conditions requiring a disclaimer of opinion, the audit letter is issued in accordance with the example in ANNEX-4.

(2) The persons authorized to sign the audit report, in the event that no significant control deficiency is found as a result of the audit and no restriction or obstruction is encountered within the scope of the audit, issue an unqualified opinion in accordance with the example in ANNEX-1, also taking the opinions of the independent audit teams under their supervision.

(3) The persons authorized to sign the audit report, also taking the opinions of the independent audit teams under their supervision;

a) Although they encounter at least one significant control deficiency as a result of the audit, they consider that these deficiencies do not affect the whole or a large part of the audited party's information systems and payment area processes and systems,

b) Although not at a level requiring a disclaimer of opinion, the existence of any matter limiting information systems audit activities or their inability to obtain sufficient information about a newly established system or process, or,

c) The inability to obtain sufficient and appropriate audit evidence for the formation of the audit opinion,

in such cases, they issue a qualified opinion in accordance with the example in ANNEX-2.

(4) The persons authorized to sign the audit report, if the significant control deficiencies encountered as a result of the audit, when evaluated individually or together;

a) They form the conviction that they affect the whole or a large part of the audited party's information systems and payment area processes, or,

b) There is a difference arising from the incomplete or incorrect transmission of a significant control deficiency with all its significant aspects after the audit carried out by the independent audit institution within the audited body,

in such cases, they issue an adverse opinion in accordance with the example in ANNEX-3, also taking the opinions of the independent audit teams under their supervision.

(5) The persons authorized to sign the audit report, in cases where they consider the uncertainties and limitations encountered in the audit work to be significant enough to prevent the expression of an opinion, may disclaim an opinion on the controls over the information systems and payment area processes, also taking the opinions of the independent audit teams under their supervision. In this case, the audit letter is issued in accordance with the example in ANNEX-4. In the report to be issued in the event of a disclaimer of opinion, it is mandatory to include the opinions of the independent audit institution regarding the reasons leading to the disclaimer.

(6) The Bank is authorized to determine the principles, procedures and essentials to be observed regarding the formation of the audit opinion and the audit letter.

PART FIVE

Miscellaneous and Final Provisions

Posta ve Telgraf Teşkilatı Anonim Şirketi and banks, and bank and credit cards

ARTICLE 31 – (1) Posta ve Telgraf Teşkilatı Anonim Şirketi is subject to the provisions of this Communiqué, except for Article 16, with respect to the payment services it offers and electronic money issuance.

(2) Banks within the scope of Law No. 5411 are not subject to the provisions of this Communiqué, except for the third section titled data sharing services used in payment services and the seventh and eighth paragraphs of Article 28, with respect to the payment services they offer and electronic money issuance.

(3) With respect to bank and credit cards, the relevant provisions of this Communiqué shall not apply to matters contained in the Bank Cards and Credit Cards Law No. 5464 dated 23/2/2006 and the regulations made under this Law.

Repealed communiqué

ARTICLE 32 – (1) The Communiqué on the Management and Audit of Information Systems of Payment Institutions and Electronic Money Institutions published in the Official Gazette dated 27/6/2014 and numbered 29043 has been repealed.

Transitional provisions

PROVISIONAL ARTICLE 1 – (1) Institutions operating as of the date this Communiqué enters into force are obliged to comply with the provisions introduced by this Communiqué and not previously included in the Communiqué on the Management and Audit of Information Systems of Payment Institutions and Electronic Money Institutions repealed pursuant to Article 32 of this Communiqué, (Amended phrase:OG-27/6/2023-32234) by 30/9/2023.

(2) Payment service providers that hold a payment account with them as of the date this Communiqué enters into force and are among the top ten participants according to total number in terms of account payment transactions carried out in the Bank Payment Systems in 2020 shall fulfill the obligations they must fulfill within the scope of the first paragraph of Article 24 of this Communiqué (Amended phrase:OG-27/6/2023-32234) by 30/9/2023. The Bank is authorized to extend this period twice, each time not exceeding six months. (Amended third and fourth sentences:OG-28/3/2025-32855) Payment service providers that hold payment accounts with them and are participants in the Instant and Continuous Transfer of Funds System as of the date this provision enters into force shall fulfill the obligations they are required to fulfill within the scope of the first paragraph of Article 24 of this Communiqué by 31/12/2025. Among the institutions that hold payment accounts with them as of the date this provision enters into force, are not participants in the Instant and Continuous Transfer of Funds System, and provide their customers with direct online access to the payment accounts held with them, those ranking among the top ten in terms of payment volume for the 2024 calendar year shall fulfill the obligations they are required to fulfill within the scope of the first paragraph of Article 24 of this Communiqué by 31/12/2025, and those that will rank among the top ten in subsequent years shall fulfill them by the end of the year in which they are included. (Added sentences:OG-7/10/2023-32332) For payment service providers that hold payment accounts with them, those that have applied to the Bank for an operating license pursuant to the third paragraph of Article provisional 3 of the Law and whose operating license evaluation process is ongoing, and institutions that have received permission from the Bank to offer the payment services specified in subparagraphs (f) and (g) of the first paragraph of Article 4 of the Regulation, providing the services they offer related to data sharing services whose technical requirements have been determined within the scope of the first paragraph of Article 24 of this Communiqué by using non-standard services shall not be considered a violation of this paragraph until 30/6/2024.

(3) Data sharing services whose technical requirements have been determined within the scope of the sixth paragraph of Article 23 of this Communiqué may continue to be provided by using non-standard services until (Amended phrase:OG-27/6/2023-32234) 30/9/2023. The Bank is authorized to extend this period by up to six months. (Added sentence:OG-7/10/2023-32332) In the application of this paragraph, the exceptions set out in the following subparagraphs are reserved:

a) (Added:OG-7/10/2023-32332) Those that have applied to the Bank for an operating license pursuant to the third paragraph of Article provisional 3 of the Law and whose operating license evaluation process is ongoing may provide the data sharing services whose technical requirements have been determined within the scope of the first paragraph of Article 24 of this Communiqué by using non-standard services until 30/6/2024. The Bank is authorized to extend this period by up to six months.

b) (Added:OG-7/10/2023-32332) Banks within the scope of Law No. 5411 and institutions that have received permission from the Bank to offer the payment services specified in subparagraphs (f) and (g) of the first paragraph of Article 4 of the Regulation may, with respect to payment accounts held with payment service providers that are not among the top ten participants in terms of total number of account payment transactions carried out in the Bank's Payment Systems in 2020, provide the data sharing services whose technical requirements have been determined within the scope of the first paragraph of Article 24 of this Communiqué by using non-standard services until 30/6/2024. The Bank is authorized to extend this period by up to six months.

(4) Data sharing service services whose technical requirements have not been determined within the scope of the sixth paragraph of Article 23 of this Communiqué shall continue to be provided by using non-standard services until the requirements are determined. After the technical and operational requirements are determined by the Bank, compliance shall be ensured for these services as well within one year at the latest, and the services shall begin to be carried out in accordance with the said requirements. The Bank is authorized to extend this period by up to six months.

(5) Until the necessary regulations are made by the Bank pursuant to the sixth paragraph of Article 28 of this Communiqué, the information systems independent audit work to be carried out under this Communiqué shall be carried out, except for the condition in the second paragraph of Article 28 of this Communiqué, within the framework of the procedures and principles set out in (Amended phrase:OG-7/10/2023-32332) BSİSBDHY. While the procedures and principles set out in (Amended phrase:OG-7/10/2023-32332) BSİSBDHY are applied within the framework of this Communiqué, the terms bank and audited entity referred to in (Amended phrase:OG-7/10/2023-32332) BSİSBDHY shall mean the institution, and the term information systems audit shall mean the audit defined in the first paragraph of Article 28 of this Communiqué.

(6) (Added:OG-7/10/2023-32332) As of the date the Law enters into force, institutions that have been granted a limited operating license by the Banking Regulation and Supervision Agency for the provision of the payment service specified in subparagraph (ç) of the first paragraph of Article 12 of the Law, subject to various preconditions, primarily that transactions in which the service provider of one of the parties to the money transfer transaction is abroad are carried out, that no other activities are carried out, and that these activities are carried out only through the counters of representatives, are obliged to comply with the provisions of Article 21 of this Communiqué by 30/6/2024, provided that they continue to comply with the preconditions set out by the Banking Regulation and Supervision Agency when granting the operating license. The Bank is authorized to extend this period twice, each time by up to six months.

Entry into Force

ARTICLE 33 – (1) This Communiqué enters into force on the date of its publication.

Execution

ARTICLE 34 – (1) The provisions of this Communiqué shall be executed by the President of the Central Bank of the Republic of Turkey.

Click for its annexes.

	Official Gazette in which the Communiqué was Published
	Date	Number
	1/12/2021	31676
	Official Gazettes in which the Communiqués Amending the Communiqué were Published
	Date	Number
1.	25/11/2022	32024
2.	28/2/2023	32118
3.	29/4/2023	32175
4.	27/6/2023	32234
5.	7/10/2023	32332
6.	28/9/2024	32676
7.	28/3/2025	32855
8.	4/9/2026	33360