Instruction on the Principles to be Complied with Regarding Activities

CENTRAL BANK OF THE REPUBLIC OF TÜRKİYE

HEAD OFFICE
3 December 2021

We request the repetition of the following marks in the replies:
E-TCMB.56887358-501.07-1576

Subject: Instruction on the Principles to be Complied with Regarding Activities KEP

To Distribution Addresses

As is known, with Law No. 7192, "Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions and on Amendment of Certain Laws", amendments were made to Law No. 6493, "Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions" (Law No. 6493), and the authority of the Banking Regulation and Supervision Agency regarding the regulation and supervision of payment and electronic money institutions was transferred to our Bank, to enter into force as of 1 January 2020.

In this context, within the scope of the provisions of the "Regulation on Payment Services and Issuance of Electronic Money and on Payment Service Providers" (Regulation) and the "Communiqué on Information Systems of Payment and Electronic Money Institutions and on Data Sharing Services of Payment Service Providers in the Field of Payment Services" (Communiqué), published in the Official Gazette dated 1 December 2021 and numbered 31676, the necessity of drafting this instruction has arisen:

Regarding Label and Certificate Format and Internet Applications:

The first paragraph of Article 18 of the Regulation, titled "Representative", stipulates: "The Institution may carry out payment services through a representative via electronic or physical channels. In order for the Institution to carry out payment services through a representative, it must obtain the necessary information and documents from the representative pursuant to the thirteenth paragraph, be convinced that the representative does not pose a risk in the smooth and compliant provision of payment services, and have the representative registered in the list created electronically by the Union. The contract between the Institution and the representative is drawn up in writing. The Institution may not authorize third parties in any way for the purpose of providing payment services, other than the use of a representative under this Article, and may not sign a contract with third parties under any name other than a representation contract." It is the governing provision, and in the event that the conditions specified in the said Article are met, it is possible to carry out payment and electronic money services through a representative.

In this context, in order to prevent consumers from transacting with unauthorized representatives;

• A sample of the labels to be affixed to the exterior of all your representatives in a manner that can be easily seen by the consumer before entering the representative, containing our Bank's logo and the statement that you are an authorized institution, alongside your Company's logo, alongside the "first three digits are the institution code used in reports, the following two digits are the provincial traffic code and the last five digits are the representative code, making a total of ten-digit representative code", and alongside the "scan, verify" statement underneath, prepared in the format provided in Annex-1, (so that when scanned, the information regarding the relevant representative in the representative list on your Company's website and its location on the map can be reached);

• "... the company ... is authorized by the payment/electronic money institution ... as a representative to provide payment/electronic money services as of the date ..." statement, the "authorized representative certificate" issued by your Company in accordance with the attached format, with at least two wet signatures, one of which is the General Manager, a copy of which is in the format provided in Annex-1, to be hung in all your representatives in a manner that can be easily seen by consumers;

• Our Bank's logo and the statement that you are an authorized institution alongside your Company's logo to appear side by side on your website, and Our Bank's logo and the statement that you are an authorized institution alongside your Company's logo and the relevant representative code to appear side by side on the relevant representative's website,

• Your Company's ownership structure, corporate governance, and the address and contact information of branches and representatives to be entered on your Company's website simultaneously with the change,

• The list of representatives to be included on your Company's website to be kept the same and up-to-date as the list created by the Union in accordance with the sixth paragraph of Article 18 of the Regulation

is required.

In addition, it is considered useful to remind that the return of the said label and certificate to you in the event of the termination of the representative relationship with your relevant representative is your Company's responsibility.

Regarding the POS Service Used in Bill Payment Transactions:

In the event that bill payment transactions are made by representatives via credit card through the physical POS device allocated to the payment or electronic money institution; closed-loop physical POS devices must be used in a manner that will be open only to bill payment intermediary transactions, and no collection must be made from said POS devices for other goods or services offered by the representative.

Regarding Bill Payments:

In the first paragraph of Article 12 titled "Payment service" of Law No. 6493, "money transfer" in subparagraph (ç) and "services related to the intermediation of bill payments" in subparagraph (e) have been counted as payment services.

In the first paragraph of Article 4 titled "Payment service" of the Regulation, subparagraph (e) defines "Services related to the intermediation of bill payments", and the first paragraph of Article 15 contains the provision: "The Institution shall operate limited to the payment services set forth in the first paragraph of Article 4 of this Regulation, among those specified in activity license applications and deemed appropriate by the Bank. Permission must be obtained from the Bank regarding the planned activity in order to provide the payment services regulated in the first paragraph of Article 4 of this Regulation but not specified in the activity license application."

Accordingly, the relationship underlying the invoice is a commercial relationship and it must be issued to indicate the consideration given in return for goods or work. Under Law No. 6493, "services for the intermediation of invoice payments" have been regulated exclusively, separately from other payment services. In this context, it is seen that the intermediation of payments arising from continuous business relationships based on a subscription contract has been assessed as an "original", "special", "separate" payment service. Therefore, services for the intermediation of invoice payments are accepted as intermediation of payments arising from continuous business relationships (subscription contracts).

In this context, considering that payments relating to "credit card debt", which do not constitute a service provided for the fulfillment of a need, do not fall within the definition of invoice set out in Article 4, first paragraph, subparagraph (e) of the Regulation, and that it is not possible for them to be carried out solely by payment institutions having the authority to intermediate invoice payments under Article 12, first paragraph, subparagraph (e) of Law No. 6493, if the said service is structured as the transfer of funds by the sender to the payee or to a payment service provider acting on behalf of the payee, without opening any account in the name of the sender, it is possible for the said service to be offered as a "money transfer" under Article 12, first paragraph, subparagraph (ç) of Law No. 6493. On the other hand, if it is desired to offer the said service through a "payment account", it is assessed that, depending on the business model to be determined, the institution that will operate as the sender's payment service provider must be authorized under Article 12, first paragraph, subparagraph (a) or (b) of Law No. 6493.

In addition, provisions regarding the obligation to inform consumers in payment transactions are set out in Article 37 titled "Single-use payment" and Article 41 titled "Framework contract" of the Regulation, and provisions regarding the information to be given about additional charges to be taken in payment transactions are set out in Article 51 titled "Information on additional charges and discounts".

Pursuant to the said provisions, the receipts or payment vouchers given to consumers following the invoice payment transaction must contain, at a minimum: the trade name, address and agent code of the agent carrying out the payment transaction; in the event that a credit card is used in the payment transaction, the card information in a manner compliant with the legislation; the name of the institution issuing the invoice; the consumer's invoice subscriber number; the amount of the invoice subject to the payment transaction; and the details and amount information of the fees collected from the consumer due to the said payment transaction.

Regarding Reports Made to Our Bank:

The first paragraph of Article 28 of the Regulation titled "Accounting, reporting and independent audit" stipulates: "The institution is obliged to account for all its transactions in accordance with their true nature within the framework of the procedures and principles determined by the Public Oversight, Accounting and Auditing Standards Authority, and to prepare its financial reports in a form and content that can meet the need for information, in a clear, reliable and comparable manner, suitable for audit, analysis and interpretation, in a timely and accurate manner." In this context, with the Decision of the Public Oversight, Accounting and Auditing Standards Authority (KGK) dated 21/08/2014 and numbered 75935942-050.01.04 – [01/26] published in the Official Gazette dated 26/08/2014 and numbered 29100; in accordance with Article 88 and Provisional Article 1 of the Turkish Commercial Code dated 13/1/2011 and numbered 6102, and Articles 9, 26 and Provisional Article 1 of Decree Law No. 660 dated 26/9/2011, it has been decided to apply Turkish Financial Reporting Standards (TFRS) in the preparation of individual and consolidated financial statements of payment and electronic money institutions for account periods beginning on 1/1/2014 and thereafter.

EK / SCU / ŞÇC
This document has been signed with a secure electronic signature.
Hacı Bayram Mah. İstiklal Cad. No:10 PK:06050 Ulus Altındağ - ANKARA Telefon No: (312) 507 50 00, Faks No: (312) 507 56 40 E-mail: iletisimbilgi@tcmb.gov.tr, Web: http://www.tcmb.gov.tr KEP Address: merkezbankasi@hs02.kep.tr, Trade Registry Number: 269, Swift: tcmbtr2a For Information: Şule ÇOKAKOĞLU CERİTOĞLU Uzman Yardımcısı Telefon No: 3125078069 Verification Code:3T90F-4FNRV-2JM8V-CGFGE Verification Address:https://www.turkiye.gov.tr/tcmb-ebys

In this context, although there is no objection to payment and electronic money institutions keeping their legal books in accordance with the provisions of the Tax Procedure Law (VUK) unless there is a provision to the contrary in the regulations to be made by our Bank, within the framework of the third paragraph of Article 29 of the Regulation titled "Audit and Reporting to the Bank", the TFRS published by the KGK must be applied in the preparation of the financial statements to be transmitted to our Bank and the year-end financial statements, and in the equity calculation to be made within the framework of Article 33 of the Regulation, financial statements prepared by applying TFRS must be taken as basis.

Regarding Intermediating Mobile Payments:

In paragraph (d) of the first paragraph of Article 12 of Law No. 6493, "the payment transaction where the approval for the execution of the payment transaction is given by the sender through an information or electronic communication device and the payment is made to an information or electronic communication operator acting solely as an intermediary between the payment service user and the provider of goods or services" is counted as a payment service.

In order to prevent user grievances arising from the said payment service, to make certain reminders regarding compliance with the legislation, and to take the necessary actions in this regard;

1. Excluding mobile payment transactions where the purchase process is initiated by the sender via SMS and payment transactions initiated by the sender using the mobile application offered by the sender's payment service provider; in low-value mobile payment transactions according to Article 73 of the Regulation titled "Low-value payment transactions and low-value payment instrument and electronic money", at a minimum, the sender manually enters the mobile phone number on the internet page where readable, clear and sufficient information regarding the product or service is provided and payment approval is obtained, the sender manually enters the one-time password sent via SMS to the mobile phone number entered by the sender into the relevant section, or the sender completely replies via SMS to the statement regarding the approval given that will be included in the SMS sent to the sender, and as a result of the verification by the sender's payment service provider of the SMS content or password transmitted by the sender, the payment transaction is carried out,

2. In subscription transactions carried out with the payment method mentioned in the first article, at least 3 days before each charging to be collected after the first transaction, the sender is informed regarding the charging and the cancellation of the subscription, and for subscription transactions, payment approval is obtained again from the sender at least once a year,

3. The "Msisdn Forwarding" technology is not used in mobile payment transactions for the purpose of obtaining the mobile phone number, and the said technology can only be used by the sender's payment service provider for the purpose of risk control and establishing additional security measures,

4. In mobile payment transactions, it is reminded that the sender's payment service provider must also include its merchants in the transaction monitoring mechanisms within the scope of the fourth paragraph of Article 19 of the Communiqué titled "Monitoring of high-risk transactions" and monitor them effectively; in this context, both the sender's and the recipient's payment service providers must have knowledge that the merchants they serve, the services offered by the merchants, and the services are not subject to social engineering activities; furthermore, the sender's payment service provider and the recipient's payment service provider must effectively monitor the compatibility of the service stated to be offered with the service actually offered, and necessary measures must be taken to ensure compliance with the obligations set out in Article 9 titled "Merchant registry system" and Article 10 titled "Services offered to the merchant" of the Regulation,

5. By the sender's and the recipient's payment service providers, the suspension of not only the services in question but all services offered by merchants that carry out or mediate fraud or fraudulent transactions or illegal betting or gambling activities,

6. By the recipient's payment service provider, users are not directed to the payment page through links (connections) in different channels such as social media, advertisements, search engines or news sites; users are directed to the payment page through pages where readable and clear information about the scope, content, refund/cancellation method and fee of the product or service is provided,

7. Many complaints have reached our Bank regarding the commission rate applied to the payment service user by the sender's and the recipient's payment service providers, and in the said complaints it has been observed that there are commission rates that may be incompatible with the ordinary course of commercial life, and although the necessary evaluations have been made by our Bank on the subject, the necessary sensitivity and care must be shown by the sender's and the recipient's payment service providers

it has been decided that organizations providing mobile payment services be instructed within the scope of the eighth paragraph of Article 21 titled "Audit" of Law No. 6493, and a summary table regarding the obligations of the parties within the scope of the said instruction articles is included in Annex-2.

On the other hand, while the exceptions deemed appropriate for certain legal entities in Article 13 of the instructions of the Banking Regulation and Supervision Agency dated 22 May 2018 and numbered 6852 and dated 13 August 2018 and numbered 10568 remain valid, for additional requests to include other legal entities within the scope of the said exceptions, together with the evaluations included in the article, it is necessary to apply to our Bank.

Regarding the subject, the first paragraph of Article 27 titled "Non-compliance with regulations and decisions" of Law No. 6493; "Administrative fines from twenty thousand Turkish Liras to five hundred thousand Turkish Liras are imposed by the Board on legal entities operating as payment service providers and by the Bank on legal entities operating as system operators, which act contrary to the matters included in this Law and the regulations to be issued based on this Law and the decisions taken and for which no separate penal sanction is foreseen in this Section." provision is imperative.

In this context, the necessary sensitivity and care must be shown regarding compliance with the instructions given by our Bank and the relevant legislation.

We request information and necessary action.

CENTRAL BANK OF THE REPUBLIC OF TURKEY
Head Office

İLKER DURUSOY
EMRE KARPUZ
GOVERNOR DEPUTY GOVERNOR
ASSISTANT

Annex: 1) Label, Logo and Certificate Displays
2) Obligations of the Parties Regarding the Instruction Articles on Mediation of Mobile Payments
Table

ANNEX-1: Label, Logo and Certificate Displays

Note: The corporate logo of our Bank to be used on labels and certificates can be accessed from the "Flicker" application (https://www.flickr.com/photos/merkez_bankasi/albums/7215766520757196 8 ) located in the social media section of the official website of our Bank (https://www.tcmb.gov.tr).

Frame dimensions 0,2 cm
15 cm
60 cm
1,5 cm
6 cm
2 cm
14,7 cm
2 cm
14,7 cm
2 cm
14,7 cm
1,5 cm
6,4 cm

AUTHORIZED REPRESENTATIVE CERTIFICATE

..................... has been authorized as a representative by the company ..................... to provide payment services as of the date .....................

REPRESENTATIVE CODE
PAYMENT
INSTITUTION

ANNEX-2: Table of Parties' Obligations Regarding the Instruction Articles on Intermediation of Mobile Payments

Instruction No.	Scope of Instruction	Obligated Party
1.	Control of transactions below 300 TL	AHS-GHS
	Legible, clear and sufficient information	AHS
	Total fee information	AHS-GHS
	Manual phone number entry	AHS
	One-time password	GHS
	SMS response (SMS confirmation and OTP)	GHS
	Verification of the SMS	GHS
2.	Providing information 3 days prior to each transaction after the first transaction	AHS
	Providing the option to cancel the subscription	AHS
	Obtaining subscription payment confirmation at least 1 time each year	AHS
3.	Use of "Msisdn Forwarding" technology solely for risk and security purposes	GHS
4.	Monitoring of the transactions of merchant members	AHS-GHS
	Obtaining information regarding the services and purposes of merchant members	AHS-GHS
	Monitoring the conformity of the service actually provided with the service offered	AHS-GHS
	Taking the necessary measures within the scope of compliance with Articles 9 and 10 of the Regulation	AHS-GHS
5.	Halting fraud/scam/betting/gambling activities	AHS-GHS
6.	Redirection to the direct payment page	AHS
	Legible information regarding the scope, refund, cancellation and fee of the service	AHS
7	Exercising due care regarding the commission rate applied to the payment service user in a manner consistent with the ordinary course of commercial life	AHS-GHS

[*] AHS: The Payee's Payment Service Provider GHS: The Payer's Payment Service Provider