Guide on External Service Providers Providing Community Cloud Services to Payment and Electronic Money Institutions

Payment Systems and Financial
Technologies General Directorate

FEBRUARY 2025
Version 1.3

CENTRAL BANK OF THE REPUBLIC OF TÜRKİYE

Version History

Update Date	Update Description	Version
July 2022	First Version	1.0
April 2023	• An addition has been made to the external service providers that can provide community cloud in Article 1 of the Compliance Conditions section. • A change has been made in Article 2 of the Compliance Conditions section. • A change has been made in the certificates in Article 4 of the Compliance Conditions section. • Changes have been made in some articles in the Compliance Supervision section. • The Implementation of the Guide section has been added.	1.1
September 2023	• A new article has been added to the Compliance Conditions section. • A change has been made in the certificates in Article 4 of the Compliance Conditions section. • Changes have been made in the Implementation of the Guide section.	1.2
February 2025	• The compliance date of Version 1.3 has been updated as 30 June 2025. • Typographical errors have been corrected.	1.3

In the seventh paragraph of Article 16 of the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in the Field of Payment Services (Communiqué), published in the Official Gazette dated 1 December 2021 and numbered 31676 and entered into force,

“ (7) The institution may use cloud computing services established domestically as an external service to process, store and transmit all kinds of data. However, receiving cloud computing services in a way that will process, store and transmit sensitive customer data, competition-sensitive data, personal data or any kind of information that can be associated with the customer and makes it specific or identifiable is only possible if this external service is received with a private cloud service model where it is provided only over hardware and software resources allocated solely to the institution. In case it is provided by external service providers deemed appropriate by the Bank, the institution may receive external services with the community cloud service model where hardware and software resources allocated to payment service providers or other credit institutions or financial institutions whose activities related to information systems are regulated and supervised by a competent authority within the framework of relevant legislation are physically shared but logically a separate resource specific to each payment service provider is assigned. The provision of the community cloud service by a credit institution or financial institution that is the main shareholder, subsidiary or subsidiary of the main shareholder of the institution and whose activities related to information systems are regulated and supervised by a competent authority within the framework of relevant legislation does not constitute a violation of the provisions of this paragraph, provided that the hardware and software resources allocated only to the main shareholder, its subsidiaries and the subsidiaries of the main shareholder are physically shared but a separate resource specific to the institution is assigned by making a logical separation. If the institution receives cloud computing services by taking the necessary security measures for test and development environments and systems that do not contain customer data, the provision of this paragraph shall not apply”,

the provision is included. Pursuant to the aforementioned provision, receiving external services with the community cloud service model where hardware and software resources are physically shared but a separate resource specific to each payment service provider is logically assigned is possible only under the conditions that the aforementioned hardware and software resource is allocated to payment service providers or other credit institutions or financial institutions whose activities related to information systems are regulated and supervised by a competent authority within the framework of relevant legislation and that the external service provider providing the said service is granted compliance by the Central Bank of the Republic of Türkiye (Bank).

This guide contains the conditions that external service providers that will provide community cloud services as specified above must fulfill in order to obtain compliance, as well as important issues regarding the application, evaluation and supervision processes, and it is possible for the Bank to make changes in the implementation of the issues in the guide or to request additional information and documents if deemed necessary within the framework of the evaluations.

A. COMPLIANCE CONDITIONS

Pursuant to the seventh paragraph of Article 16 of the Communiqué, the external service provider that wishes to provide services to payment and electronic money institutions (Institution) with the community cloud service model where hardware and software resources are physically shared but logically a separate resource specific to each payment service provider is assigned;

1.

a. Being a credit institution or financial institution regulated by a competent authority or a private law legal entity of which they are the main shareholder,

b. Operating before a union established by law,

c. Being an electronic communications operator as defined in the first paragraph of Article 3 of the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions or an institution or private law legal entity of which they are the main shareholder,

d. Being a public institution, organization, foundation operating in the fields of industry-technology established by special law or presidential decree, or a private law legal entity operating in the field of industry-technology of which they are the main shareholder

e. Being a system operator as defined in the first paragraph of Article 3 of the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions or a private law legal entity of which they are the main shareholder,

meeting at least one of the conditions,

2. Not subjecting the activities related to the community cloud service itself to external service procurement from parties other than its main shareholder, subsidiary or subsidiary of its main shareholder,

3. In order to ensure that the services provided are maintained uninterruptedly, securely, effectively and efficiently;

a. For each of the operation/monitoring team, infrastructure team and information security team, employing a sufficient number and competence of personnel, with at least 1 (one) person each having a minimum of 7 (seven) years of experience in similar fields,

b. Establishing the necessary information systems and technological infrastructure,

4. If it does not have its own data center, receiving only hardware hosting or dedicated hardware services from external service providers that meet the data center standards in this Guide for primary and secondary centers,

5. Having the following certificates that are specified below and remain valid:

a. Certificates regarding data center standards;

    i. Having a TSE TS EN 50600 data center operation certificate for the primary center with an Availability Class, Protection Class and Energy Detail Level of at least 3

    ii. Having a TSE TS EN 50600 data center operation certificate for the secondary center with an Availability Class, Protection Class and Energy Detail Level of at least 3, or if this is not available, having a Tier 3 or Tier 4 data center infrastructure certificate

b. Certificates regarding community cloud service;

    i. TS ISO/IEC 27001 Information Security Management System certificate obtained from certification bodies accredited by TÜRKAK

ii. TS EN ISO 22301 Business Continuity Management certificate obtained from certification bodies accredited by TÜRKAK,

iii. TS ISO/IEC 20000-1 Information Technology Service Management System certificate obtained from certification bodies accredited by TÜRKAK,

iv. TS ISO/IEC 27017 Information Security Management System in Cloud Services certificate obtained from accredited certification bodies,

v. TS ISO/IEC 27701 Personal Data Management System certificate obtained from certification bodies accredited by TÜRKAK

6. Having carried out a penetration test within the past one year as of the date of application, in line with scenarios covering possible internal and external threats, by real or legal persons who do not have any duty regarding the fulfillment of information security requirements of information systems and who have a national or international document on penetration testing, and in accordance with “Annex-5: Information Systems Penetration Testing Procedures and Principles” of the Communiqué annexes, and having remedied the identified priority findings,

7. Establishing in writing policy, procedure and process documents that include the procedures and principles regarding the measures to be implemented and the controls to be established in order to ensure the identification, measurement, monitoring and effective management of all risks, including dependencies on third parties, that may jeopardize the smooth operation of information systems, and having a risk management framework approved by senior management,

8. The primary and secondary systems dedicated to the community cloud service and the data backup centers being located domestically,

9. As a result of an on-site examination to be carried out by the Bank's technical team if deemed necessary by the Bank, no negativity or deficiency having been identified within the scope of the compliance of the organization and the external service provider with the Communiqué

fulfills the conditions.

B. COMPLIANCE APPLICATION

1. In accordance with the seventh paragraph of Article 16 of the Communiqué, the external service provider that wishes to provide services with the community cloud service model, in which hardware and software resources are physically shared for organizations but a separate resource specific to each payment service provider is logically assigned, applies in writing to the Bank1 with the information and documents specified below:

a. Documents showing that it fulfills the requirements in the Compliance Conditions section of this guide,

[1] To get information about the process: toplulukbulutuiletisim@tcmb.gov.tr

b. Risk assessment report carried out within the last one year within the scope of Article 6 in the Compliance Conditions section,

c. Documents showing the information systems architecture and network topology,

d. Management and organization chart and personnel information,

e. Information regarding the external services received,

f. Information regarding the services it provides as an external service provider,

g. Information regarding the organizations to which external services are currently provided (if any) and the services provided to these organizations,

h. Services offered and/or planned to be offered within the scope of the community cloud and (if any) service packages,

i. Contact information.

2. If the Bank finds any deficiency in the information and documents specified above, it does not take the application into evaluation and informs the external service provider in writing accordingly, granting a reasonable period not exceeding 30 (thirty) days for the deficiency to be remedied.

3. If the missing information and documents are not submitted to the Bank by the external service provider within the granted period, the application process is evaluated negatively.

C. COMPLIANCE ASSESSMENT

After the external service provider submits the information and documents required for the application completely, the compliance assessment process is initiated by the Bank.

1. If deemed necessary during the compliance assessment process, it is possible for the Bank to conduct an on-site examination (which may also cover the primary center and/or secondary centers) within the scope of condition 9 in the Compliance Conditions section. The external service provider is obliged to provide the information and documents requested by the bank team during the on-site examination.

2. The Bank may request additional information and documents from the external service provider during the assessment process.

3. After completing its assessment, the Bank notifies the applicant external service provider of the result in writing.

D. COMPLIANCE MONITORING

Pursuant to the seventh paragraph of Article 16 of the Communiqué, in order for payment and electronic money institutions to be able to provide services with the community cloud service model in which hardware and software resources are physically shared but a separate resource specific to each payment service provider is logically allocated, the external service provider granted suitability is obliged to fulfill the following matters after the suitability is granted.

1. The external service provider shall notify the Bank in writing without delay of significant changes occurring in the information and documents contained in Article 1 of the Suitability Application section. In any case, the said

shall transmit the current versions of the documents to the Bank at least once every two years as of the date the suitability is granted.

2. The external service provider is obliged to submit to the Bank, within a reasonable period determined by the Bank, the additional information and documents requested by the Bank when necessary.

3. Within the framework of the service received, the external service provider is likewise obliged to comply with the legislative provisions to which payment and electronic money institutions are subject.

4. The Bank may, if it deems necessary, conduct an on-site examination and/or request an independent audit to be conducted in a manner whose scope is determined by the Bank. The said audit activity shall be carried out by independent audit institutions included in the list of Independent Audit Institutions Authorized to Perform Information Systems Audit in Banks published by the Banking Regulation and Supervision Agency.

5. The external service provider shall perform the penetration test specified in Article 6 of the Suitability Conditions section of this guide at least once in each calendar year following the year in which the suitability approval is obtained. The external service provider shall prepare a report containing the security breaches that occurred, the results of the penetration test and the critical security vulnerabilities identified, the measures taken to eliminate them and their results, at least once a year, have it approved by its senior management, and transmit it to the Bank if the Bank requests it.

6. The external service provider shall conduct a comprehensive risk assessment regarding its information systems before significant changes to occur in its information systems and at least once a year. It shall prepare a report containing the risk assessment results and the actions to be taken in relation thereto, covering the previous year, by the end of January each year, have it approved by its senior management, and transmit it to the Bank if the Bank requests it.

7. The external service provider is obliged to notify the Bank in detail of this situation and the nature of the service to be provided, and to obtain the Bank's approval, before including a new institution/organization in the resource for which it provides physical sharing of hardware and software resources.

8. In the event that the conditions of compliance with the requirements set out in this guide deteriorate, the Bank may revoke the suitability granted to the external service provider within the scope of the seventh paragraph of Article 16 of the Communiqué; as well as warn the said external service provider in writing to ensure the necessary compliance and request that the deficiencies be remedied within the period it determines, not exceeding 6 (six) months from the date the warning is transmitted.

9. The external service provider shall notify the Bank within 12 hours at the latest of structural problems or interruptions that disrupt normal operations, cause interruption, or prevent the processing, storage and transmission of data within the scope of the community cloud service. A detailed report, including the measures to be taken regarding the event causing the structural problems or interruptions, shall be transmitted to the Bank within 10 business days at the latest.

E. IMPLEMENTATION OF THE GUIDE

1. External service providers granted suitability to provide community cloud services before 01 February 2025 are obliged to become compliant with version 1.3 of the Guide by 30 June 2025.