Guide on Administrative Fines under Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions

Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions Administrative Fines Explanation Guide Payment Systems and Financial Technologies General Directorate February 2026

1. Purpose:

The purpose of this guide is to provide information regarding the method to be followed by the Central Bank of the Republic of Turkey (Bank) in determining the administrative fines (İPC) to be applied to payment and electronic money institutions within the scope of the Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions dated 20/6/2013 and numbered 6493.

2. Legal Basis and Authority of Administrative Fine Application within the Scope of Law No. 6493

In Article 27 of Law No. 6493

"(1) (Amended first and second sentences:12/11/2019-7192/14 md.) Legal entities operating as system operators or payment service providers that act contrary to the provisions contained in this Law and the regulations to be issued based on this Law and the decisions taken, and for which no separate criminal sanction is foreseen in this Section, shall be imposed an administrative fine by the Bank's Management Committee from forty thousand Turkish liras to nine hundred thousand Turkish liras. However, if a benefit is obtained or damage is caused in this manner, the amount of the administrative fine to be imposed cannot be less than twice this benefit or the damage caused. If one of these misdemeanors is committed more than once until an administrative sanction decision is rendered, one administrative fine shall be imposed on the relevant party and the fine to be imposed shall be increased by two times. However, if a benefit is obtained or damage is caused by committing this misdemeanor, the amount of the administrative fine cannot be less than three times this benefit or damage. (2) The decisions taken within the scope of the first paragraph shall be notified to the relevant institution together with their justifications. (3) The administrative fine decision shall be rendered after the defense of the relevant party is taken. If no defense is submitted within one month from the date of notification of the letter requesting defense, it shall be deemed that the right to defense has been waived. (4) Administrative fines imposed according to this Law shall be paid within one month from the date of notification of the decision. (5) (Added:12/11/2019-7192/14 md.) A lawsuit may be filed before the competent administrative court against the administrative fines to be imposed pursuant to this article."

The provisions are included and the said provisions constitute the basis of the administrative fines to be applied to the Institutions within the scope of their transactions contrary to Law No. 6493 and secondary regulations.

3. Method to be Followed in Administrative Fines to be Imposed by our Bank

In cases where there is no benefit obtained or it cannot be determined in return for the transactions of the Institutions contrary to Law No. 6493 and secondary regulations and all relevant legislation; the amount of İPC to be paid by the Institution for the relevant violation will be reached as a result of applying the rates determined according to the subject of the violation within the scope of the Regulation to the revenues of the Institutions or determining the fine from the lower limit specified by Law No. 6493 for the violation.

A. Concepts:

• Revenue: Refers to the amount in line number 1 of the KZ200UP form (Profit/Loss Information Form) reported by the Institutions to our Bank.

• Violation Type: Refers to the main headings under which the frequently encountered violations of the Institutions within the scope of the legislation are classified.

• İPC rates: Refers to the rate to be used for determining the amount of İPC to be applied for each violation type, taking into consideration the possible effects of the violation on the sector and the activities of the Institutions.

• Graduation multiplier: Refers to the multiplier value to be used to ensure that the İPCs to be applied to Payment and Electronic Money Institutions are determined according to the size of their revenues submitted to our Bank via the KZ200UP notification form.

B. Method

• While determining the İPC amounts to be calculated for the Institutions, if the revenue of the Institution in the year in which the violation occurred can be determined, the revenue of the determined year shall be used; if the revenue cannot be determined, the revenue of the previous year shall be used.

• In cases where the violation is continuous or the date of the violation cannot be determined, the revenue of the Institution shall be determined based on the date of the document on which the determination is based. If the revenue for the current year cannot be determined as of the date of the document on which the determination is based, the revenue of the previous year shall be taken as basis. Since the KZ200UP form containing the revenue item has been reported to our Bank starting from 2024, while determining the İPC amounts for periods before 2024, "Net Sales Revenue" in the KZ100UP form shall be taken as basis instead of "Revenue".

• While determining the İPC amounts to be determined based on revenue, the amount to be determined by multiplying the revenue determined within the scope of the above methods with the rate determined in Table 1 according to the violation type and the graduation multiplier determined in Table 2 according to the revenue of the Institution shall be taken as basis. If the said amount is less than the lower limit fine amount valid in the relevant year, the lower limit fine amount shall apply; if it is more than the upper limit fine amount valid in the relevant year, the upper limit fine amount shall apply; if it is between the two, the calculated amount shall apply.

• On the other hand, in violations where it is foreseen to impose a fine from the lower limit, the lower limit fine amount valid in the year in which the act occurred (updated using revaluation rates) shall be applied.

Accordingly, the sanctions and measures foreseen according to the violation types within the scope of the legislation and the rates to be applied on their revenues are in Table 1; the graduation multipliers determined by taking into consideration the revenues of the Institutions are in Table 2.

The specified determinations and methods aim to increase predictability in the administrative fine process, and in practice, within the scope of the authority derived from the Law, it is possible for the Central Bank of the Republic of Turkey Management Committee to decide not to impose an administrative fine or to apply a lower or higher fine, taking into account matters such as competition and equality in the sector, the impact on the institution's activities, and proportionality, depending on the nature of the violation.

Table – 1: Sanctions and measures to be applied according to violation types and rates

No.	Violation Type	Rate/Limit
1	Late Notifications – First Time Within Two Calendar Years	Warning
2	Late Notifications – Each Additional Violation Occurring After the First Time Within Two Calendar Years	Lower limit
3	Unauthorized Share Transfer – With Respect to Indirect Shareholders	Lower limit
4	Unauthorized Share Transfer – With Respect to the Direct Institution	0,0150
5	Minimum Equity Obligation	0,0075
6	Outsourcing – Individual Violation	Lower limit
7	Outsourcing – Comprehensive Violation	0,0025
8	Providing Services Outside the Scope of Operating License (Activities Institutions Cannot Perform)	0,0100
9	Providing Payment Services Outside the Scope of Operating License	0,0150
10	Failure to Extend Credit	0,0150
11	Violations Regarding Business Premises, Representatives and Unmanned Service Points – Individual Violation	Lower limit
12	Violations Regarding Business Premises, Representatives and Unmanned Service Points – Comprehensive Violation	0,0010
13	Internal Control – Individual Violation	Lower limit
14	Internal Control – Comprehensive Control Deficiency	0,0150
15	Risk Management – Individual Violation	Lower limit
16	Risk Management – Comprehensive Violation	0,0150
17	Monitoring of Risky and Suspicious Transactions – Individual Violation	Lower limit
18	Monitoring of Risky and Suspicious Transactions – Comprehensive Violation	0,0150
19	Accounting, Reporting and Independent Audit Matters – Individual Breach	Lower Limit
20	Accounting, Reporting and Independent Audit Matters – Aggregate Breach	0,0025
21	Informing Customers and Complaint Management – Individual Breach	Lower limit
22	Informing Customers and Complaint Management – Aggregate Breach	0,0075
23	Reports Made to Our Bank – Individual Error	Lower limit
24	Reports Made to Our Bank – Aggregate Error	0,0010
25	Breach of Collateral Requirements	0,0100
26	Breaches Not Evaluated Within the Scope of Article 34 of Law No. 6493 on the Protection of Funds Collected as Payment Funds and Electronic Money – Individual Breach	Lower limit
27	Breaches Not Evaluated Within the Scope of Article 34 of Law No. 6493 on the Protection of Funds Collected as Payment Funds and Electronic Money – Aggregate Breach	0,0150
28	Breach of Identity Verification, Identity Authentication and Transaction Security Obligations – Individual Breach	Lower Limit
29	Breach of Identity Verification, Identity Authentication and Transaction Security Obligations – Aggregate Breach	0,0075
30	Breach of Information Security Obligations – Individual Breach	Lower Limit
31	Breach of Information Security Obligations – Aggregate Breach	0,0100
32	Breach of Business and Information Systems Continuity Obligations – Individual Breach	Lower Limit
33	Breach of Business and Information Systems Continuity Obligations – Aggregate Breach	0,0150
34	Breach of Information Systems Management and Operation Obligations – Individual Breach	Lower Limit
35	Breach of Information Systems Management and Operation Obligations – Aggregate Breach	0,0025
36	Breach Regarding Data Sharing Services Used in Payment Services – Individual Breach	Lower Limit
37	Breach Regarding Data Sharing Services Used in Payment Services – Aggregate Breach	0,0010
38	Audit Trails – Individual Breach	Lower Limit
39	Audit Trails – Overall Non-Compliance	0,0100
40	Other (Evaluated on a per non-compliance basis)	-

Table – 2: Tiers and tier multiplier

Tiers	Multiplier
Up to 0 - 35 million TL	1
35 million TL - up to 75 million TL	1,25
75 million TL - up to 500 million TL	1,5
500 million TL and above	2