MERCHANT REGISTRY SYSTEM (İKS) RULES

JULY 2026
Version 1.2

CENTRAL BANK OF THE REPUBLIC OF TÜRKİYE

Version History

Update Date	Update Description	Version
June 2022	First Version	1.0
January 2024	Merchant Registry System participation conditions have been updated, certain rules regarding Merchant Registry System Data Sharing Services have been added, and various textual corrections have been made.	1.1
July 2026	The use of Merchant Registry System Data Sharing Services between the payment service provider providing the infrastructure and the payment service provider using the infrastructure for the purpose of information sharing to be carried out within the framework of the second paragraph of Article 10 of the Regulation has been made mandatory. In this regard, payment service providers have been obliged to comply with the transition process to be determined by BKM.	1.2

PART ONE

Purpose, Scope, Basis and Definitions

Purpose and scope

ARTICLE 1 – (1) The purpose of these rules is to regulate the operating rules, participation conditions and pricing principles of the Merchant Registry System (İKS) established and operated by Interbank Card Center Inc., as well as other procedures and principles regarding the functioning of İKS.

(2) These rules cover the rules to be complied with by the Participants and BKM regarding the Merchant Registry System, which enables a merchant-specific merchant code to be given to a merchant offering goods and services with a payment method within the scope of payment services.

Basis

ARTICLE 2 – (1) These rules have been prepared in accordance with Article 9 of the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers published in the Official Gazette dated 01/12/2021 and numbered 31676.

Definitions

ARTICLE 3 – (1) In the implementation of these rules;

a) BKM: Interbank Card Center Incorporated Company,

b) BKM Online: The online application accessible with special user definitions allocated to Participants, where BKM regulations (rules, regulations, information bulletins, etc.) and reports regarding the services offered by BKM to Participants are located,

c) Merchant: The merchant defined in Article 3 of the Regulation,

ç) Merchant Registry System (İKS): The system that enables a merchant-specific merchant code to be obtained by İKS Participants for merchants in accordance with the fifth paragraph of Article 9 of the Regulation,

d) Merchant Registry System Data Sharing Services: The services that ensure the secure sharing of data to be mutually shared between the payment service provider providing the infrastructure and the payment service provider using the infrastructure service before İKS Participants via BKM web services,

e) Law: The Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions dated 20/6/2013 and numbered 6493,

f) Participant: Legal entities that participate in İKS for the assignment of a merchant-specific merchant code, have the authority to use İKS, and are obliged to comply with İKS rules,

g) Payment service: The services specified in Article 12 of the Law,

ğ) Payment service provider: The institutions specified in Article 13 of the Law,

h) Payment transaction: The activity of depositing, transferring or withdrawing funds carried out upon the instruction of the sender or the recipient,

ı) Responsible Employee: The responsible persons notified by the Participants to BKM for communication regarding İKS transactions via the Merchant Registry System Responsible Employee Information Form,

i) TCMB: Central Bank of the Republic of Türkiye Incorporated Company,

j) Regulation: The Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers published in the Official Gazette dated 01/12/2021 and numbered 31676,

shall mean.

(2) For definitions not included in the first paragraph, the definitions in the Regulation and the Merchant Registry System Implementation Rules documents shall apply.

PART TWO Provisions Regarding the Functioning of İKS

Service provider

ARTICLE 4 – (1) The İKS service provider is Interbank Card Center Inc. located at the address “Nispetiye Cad. Akmerkez E3 Blok Kat: 2-3 Etiler 34337 İSTANBUL” and with e-mail address bkm@hs02.kep.tr (BKM).

Merchant Registry System Implementation Rules

ARTICLE 5 – (1) The Merchant Registry System Implementation Rules, which contain the technical details and requirements for Participants to integrate with İKS, the Merchant Registry System Participation Undertaking to be signed for participation in İKS, the Merchant Registry System Service Fee Tariff containing the fees related to İKS, and the Merchant Registry System Responsible Employee Information Form to be used by Participants to notify the contact point regarding matters related to İKS shall be created by BKM and shared with the Participants.

(2) The details of the information to be transmitted to İKS by the Participants and how this information shall be transmitted, including the fields to be used for checking whether there is a negative record regarding the merchant with which the Participants wish to reach an agreement, notifying the merchants with which they have signed contracts, checking whether there is a negative record regarding the merchants to which they provide services, and notifying İKS in the event that the services provided to the merchants are terminated, shall be included in the Merchant Registry System Implementation Rules document to be created within the scope of the first paragraph.

(3) BKM may make changes in the Merchant Registry System Implementation Rules, the Merchant Registry System Participation Undertaking, the Merchant Registry System Service Fee Tariff and the Merchant Registry System Responsible Employee Information Form and shall notify TCMB of the change it has made.

(4) The changes in the second paragraph and the date on which the changes are valid shall be notified to the Participants via BKM Online and through e-mails sent to the Responsible Employees.

Services to be provided by İKS

ARTICLE 6 –(1) İKS provides its Participants with the workflows and requirements related to;

a) Merchant and Terminal Database,

b) Termination Tracking System,

c) İKS Data Sharing Services,

services.

(2) In the event that a new flow is added to the modules within the scope of the İKS service, the following steps shall be carried out by BKM:

a) Software developments for the new transaction flow are completed.

b) Test and certification scenarios for the new transaction flow are determined.

c) The İşyeri Kayıt Sistemi Uygulama Kuralları are updated and announced to the Participants.

Participation in the İKS

ARTICLE 7 – (1) In order to participate in the İKS, the administrative and technical conditions set out below must be fulfilled.

(2) The Participant candidate who wishes to participate in the İKS;

a) Being a Payment Service Provider pursuant to Article 13 of the Law, or being a BKM member other than a Payment Service Provider that is assessed to contribute to the efforts of BKM to facilitate the processes related to payment transactions and to prevent fraud and malicious use activities in the field of payments,

b) Signing the İşyeri Kayıt Sistemi Katılımcı Taahhütnamesi with BKM,

c) Sending to BKM the Trade Registry Gazette in which its articles of association are published and the Trade Registry Gazettes containing any amendments, if any, as well as the signature circulars of the managers/authorized persons who sign the İşyeri Kayıt Sistemi Katılımcı Taahhütnamesi,

ç) Filling out and signing the İşyeri Kayıt Sistemi Sorumlu Çalışan Bilgi Formu,

d) Sending the originals of the documents signed by authorized persons to BKM,

e) Paying the fees set out in the İşyeri Kayıt Sistemi Hizmeti Ücret Tarifesi that must be paid to BKM before participation,

must fulfill the administrative conditions.

(3) If the documents that the Participant candidate has shared with BKM under a different service pursuant to the second paragraph remain valid, these documents may not be shared again.

(4) After the fulfillment of the administrative conditions specified in the second paragraph, the Participant candidate;

a) Completing the technical details and requirements described in the İşyeri Kayıt Sistemi Uygulama Kuralları for the transaction flows for which it will receive service and for its ability to perform integration,

b) Establishing the software, hardware and communication network infrastructure required for a secure connection between BKM and the Participant, and having this architecture approved by BKM,

c) Developing software in the manner specified in the İşyeri Kayıt Sistemi Uygulama Kuralları and successfully completing the relevant acceptance tests,

after fulfilling the technical conditions, the İKS certification process is initiated.

(5) The Participant candidate that BKM accepts as having successfully completed the certification process shall have fulfilled the technical conditions required for participation in the İKS.

(6) For Participant candidates, participation shall take place after the conditions set out above have been fulfilled completely.

(7) If it is deemed appropriate for the BKM members determined by BKM to become İKS Participants, BKM shall inform the TCMB without delay.

Restriction of İKS access

ARTICLE 8 – (1) Participants must keep the records they create by accessing the İKS database up to date.

(2) If one or more of the following situations occur with respect to the Participant;

a) Having lost the conditions for participation in the İKS,

b) Creating a risk of a nature that would endanger the secure and uninterrupted operation of the İKS,

c) Receipt of a written instruction from the TCMB regarding its removal from the İKS,

BKM shall block the Participant's access to the İKS until the relevant situation is remedied or the ÖHS's connection to the İKS is terminated; announce the situation to the relevant parties and take the necessary measures.

(3) A Participant without access to the İKS cannot make new workplace and terminal notifications, and therefore can only work with its existing registered workplaces. While access is restricted, if there is an action that must be taken regarding the Fesih Takip Sistemi, it shall immediately inform BKM and, as soon as access is provided, make the relevant notifications and controls.

(4) If a Participant that has lost the conditions for participation in the İKS wishes to rejoin the İKS, it must re-fulfill all the conditions specified in these rules.

İKS working days and hours

ARTICLE 9 – (1) The İKS operates on a 24/7 basis.

(2) In all transactions carried out in the İKS, the BKM system clock shall be taken as the basis.

(3) Planned maintenance work and extraordinary situation drills in the İKS shall be announced to the Participants by BKM a reasonable time in advance.

Dispute in records

ARTICLE 10 – (1) In cases of inconsistency between the İKS data and the Participant data, BKM records shall be taken as the basis.

Pricing

ARTICLE 11 – (1) The İşyeri Kayıt Sistemi Hizmeti Ücret Tarifesi shall be applicable in the pricing and invoicing of the services to be provided to the Participants. BKM is obliged to announce the current fee tariff to the Participants via BKM Online.

PART THREE

Powers and Obligations of the TCMB and BKM

Powers of the TCMB

ARTICLE 12 – (1) The TCMB may impose sanctions pursuant to Article 27 of the Law on the parties causing the violation regarding violations that may threaten the security and reliability of the İKS and the related infrastructure.

(2) Without prejudice to the provisions of the first paragraph, the TCMB may decide to suspend or remove from the İKS the membership of the parties causing the violation.

Powers of BKM

ARTICLE 13 – (1) BKM may add new flows and functions to the İKS or make changes to existing flows and functions in order to comply with changes to be made in the Regulation or to fulfill instructions given by the TCMB.

(2) BKM has the authority to carry out all kinds of supervision activities and take measures regarding the system in order to ensure the uninterrupted operation of the İKS. BKM shall inform the Participants about the measures to be taken through announcements to be made via BKM Online and through the Sorumlu Çalışanlar.

(3) BKM shall subject Participants that adversely affect the İKS to the compliance process set out in the İşyeri Kayıt Sistemi Katılımcı Taahhütnamesi and, where necessary, may request from the participants the compliance fees set out in the İşyeri Kayıt Sistemi Hizmeti Ücret Tarifesi. If the Participant continues its non-compliance and the İKS is adversely affected for this reason, BKM may restrict the Participant's access to the system.

Operational obligations of BKM

ARTICLE 14 – (1) BKM;

a) To manage the process regarding the participation of Participants in the İKS,

b) To store the information regarding the messages processed in the İKS in its archive for the period specified in the relevant regulations, and in case of disputes, to submit the records to the parties and to the legally authorized authorities,

c) To carry out İKS business continuity activities within the framework of the business continuity plan and to ensure coordination among the Participants, ç) To evaluate the operational demands of the Participants in terms of business needs, risk management, compliance with legislation and international standards, and to determine the changes to be made in the operating principles of İKS,

d) To take the necessary measures within its own systems for the uninterrupted and secure provision of the services that the Participant receives within the framework of this document, to notify the Participant in advance of planned works; in the event of any unplanned interruption, to inform the Participant of the situation and to exercise the utmost effort and care to resolve the problem as soon as possible,

is obliged.

Technical obligations of BKM

ARTICLE 15 – (1) BKM;

a) To operate and develop İKS,

b) To establish the access infrastructure to İKS and to set up, operate and develop security practices in order to ensure information confidentiality, integrity and availability,

c) To prepare documents, procedures and technical specifications regarding the development of Participant applications,

ç) To evaluate Participant requests and, if the requests are appropriate, to develop İKS infrastructure and applications,

d) To monitor and manage the İKS infrastructure,

e) To provide first-level service management support to the Participants,

f) To prepare the tools and infrastructures that will ensure the uninterrupted operation of İKS, to follow up the Participants' emergency preparedness and, in the event of an emergency, to act within the framework of business continuity planning to be applied,

is obliged.

PART FOUR Obligations of the Participants

Participant obligations regarding software, hardware and infrastructure

ARTICLE 16 – (1) The Participant;

a) As specified in the İşyeri Kayıt Sistemi Uygulama Kuralları, to establish the software, hardware and communication infrastructure to be used to access İKS, to develop the application and to complete the İKS certification process,

b) To monitor security, continuity, performance and capacity in the software and access infrastructure and to take measures if necessary,

c) To implement the software and infrastructure changes announced by BKM in a timely manner,

ç) To test any changes to be made in its own systems regarding İKS in accordance with the test scenarios specified in the İşyeri Kayıt Sistemi Uygulama Kuralları, and if deemed necessary by BKM, to renew the İKS certification and to notify BKM at least 10 business days in advance and obtain BKM's approval so that it can be put into production,

d) If there are records, information and documents that BKM authorities may need for the smooth operation of İKS, to provide all kinds of convenience and, in this context, to submit any requested records, information and documents in accordance with the provisions of the legislation in force and in the requested manner,

e) To preserve the information needed within the framework of all kinds of archives, transaction records and administrative regulations related to İKS for the legal retention period,

f) To comply with the standards determined by BKM within the scope of business continuity, to establish and keep connections open,

g) To cover the installation and usage fees for the data communication lines it uses, is obliged.

Participant obligations regarding security

ARTICLE 17 – (1) The Participant;

a) As specified in the İşyeri Kayıt Sistemi Uygulama Kuralları, to establish the structure to be used in İKS access and to take security measures,

b) To ensure access to İKS applications and application security,

c) To take all necessary measures to prevent the İKS service from being used for purposes other than those envisaged on its own behalf or on behalf of its customers,

ç) To monitor and detect actions in its own systems that would put İKS at risk and to take measures to eliminate them, and if this situation cannot be eliminated, to notify BKM,

d) To immediately notify BKM of any suspicious situation that may adversely affect the operation of İKS,

e) To use the information obtained within the scope of İKS only for the purpose of facilitating processes related to payment transactions and preventing fraud and malicious use activities in the field of payments, and not to use this information for purposes such as marketing and customer acquisition, regardless of the reason,

f) To comply with the processes in Section 4 of the Güvenlik Hizmetleri Uygulama Kuralları document, which contains application rules for security services within its body and the current version of which is published on BKM Online,

is obliged.

Participant obligations regarding responsible employees

ARTICLE 18 – (1) The Participant; is obliged to keep the list of Responsible Employees, which includes the information of its personnel responsible for the processes and operation related to İKS, up to date and to notify BKM of changes immediately.

(2) BKM ensures communication by making all kinds of announcements and notifications regarding İKS, both general and specific to the Participant, via e-mail and through BKM Online via the Responsible Employees, and such announcements and notifications are deemed to have been validly communicated to the Participant.

(3) The Participant's Responsible Employees; are obliged to follow the current versions of the İşyeri Kayıt Sistemi Uygulama Kuralları and Güvenlik Hizmetleri Uygulama Kuralları documents.

Participant obligations regarding round-the-clock operability

ARTICLE 19 – (1) The Participant;

a) To keep the communication infrastructure and data communication lines to be used for access to İKS continuously operational, and in case of failure, to inform the BKM Support Team and System Operation Team without delay via the support@bkm.com.tr address,

b) To immediately respond to incidents notified by BKM and to inform BKM of the outcome,

c) To establish systems that will support the infrastructure and applications defined in the İşyeri Kayıt Sistemi Uygulama Kuralları, and in extraordinary situations, to carry out transactions as set out in the document,

is obliged.

Participant obligations regarding service management

ARTICLE 20 – (1) The Participant;

a) To follow the announcements notified by BKM via BKM Online and e-mails sent to the Responsible Employees, to carry out the necessary transactions, to comply with the defined service levels,

b) To notify BKM without delay of all kinds of errors and incidents occurring in the participant's systems or applications and interrupting its transactions in the İKS,

is obliged.

Participant obligations regarding cooperation

ARTICLE 21 – (1) The Participant;

a) To comply with the plans in the works carried out or coordinated by BKM in line with the plans announced in advance and to provide the necessary support,

b) To provide BKM with the necessary information regarding the operation of the İKS and to inform BKM as soon as possible in case this information changes,

is obliged.

Participant obligations regarding service use

ARTICLE 22 – (1) The Participant;

a) To use the İKS services in accordance with their purpose, structure and rules as specified in this document,

b) To transmit the notification regarding the workplace to the İKS before starting to provide payment services to the workplace after signing the contract with the workplace, and to transmit the changes occurring in the workplace information to the İKS within at most 1 business day from the moment it learns of them,

c) In case it has terminated the payment services it provides to the workplace for commercial and/or non-technical reasons, to notify the İKS of this situation and the reason for the termination of the contract within 1 business day,

ç) To transmit the transactions regarding the workplace to the İKS without delay at the time of the transaction, and to record the results of these transactions completed successfully or unsuccessfully in its own system as well,

d) To clearly inform the workplace about the information sharing and inquiries to be made within the scope of the operation of the İKS before using the İKS services and to obtain the approval of the workplace on the subject, and to have made a workplace agreement containing the necessary matters regarding obtaining the approval of the workplace,

e) To transmit transactions over the İKS and in compliance with the rules of the relevant payment system or other BKM services,

is obliged.

(2) The Participant must not notify the İKS of the workplace and terminal information of the payment service provider in our country to which it provides infrastructure and with which it has an agreement. The said notification must essentially be made by the payment service provider in our country that has an agreement with the workplace. BKM is authorized to determine the details regarding which information the payment service provider providing the infrastructure and the payment service provider using the infrastructure service provided will notify it of, and in what manner.

(3) Within the scope of the second paragraph, the data that the payment service provider using the infrastructure service will mutually share with the payment service provider providing the infrastructure before the Workplace Registry System Data Sharing Services operated by BKM shall in any case consist of the elements specified in the current Workplace Registry System Application Rules document published by BKM. The payment service provider providing the infrastructure cannot request any data other than the data elements specified in the aforementioned rules document.

(4) Within the framework of the second paragraph of Article 10 of the Regulation, the information sharing to be made between the payment service provider providing the infrastructure and the payment service provider using the infrastructure may only be made through the İKS Data Sharing Services. The Participant is obliged to comply with the transition process to be determined by BKM regarding the use of the İKS Data Sharing Services.

Participant obligations regarding certification

ARTICLE 23 – (1) The Participant is obliged to complete the BKM certification before transitioning to production after completing the developments described in the Workplace Registry System Application Rules.

(2) The Participant is also obliged to repeat the BKM certification in case it makes any change in its own systems that will affect the İKS flows while working with the İKS.

(3) In order for the certification process to be completed successfully, the Participant;

a) After making the developments described in the Workplace Registry System Application Rules and completing their tests, to apply to BKM and request a time slot allocation for certification,

b) To have its systems and human resources ready for certification in the certification time slot assigned by BKM,

c) To make the necessary preliminary preparations for the certification to be concluded in the time slot allocated to it and to show the necessary care and effort during the certification,

is required.

Other responsibilities of the Participants

ARTICLE 24 – (1) The Participant is responsible for the information transmitted to the İKS and for the accuracy, currency and use of this information solely for its purpose.

(2) The Participant is responsible for the damages that its failure to fulfill its obligations will cause to the İKS, other Participants and relevant parties.

PART FIVE Miscellaneous and Final Provisions

Extraordinary situations

ARTICLE 25 – (1) In case the İKS becomes inoperable due to extraordinary situations that may arise in the system and/or infrastructure constituting the BKM İKS services, the actions to be taken are defined in the Workplace Registry System Application Rules. The said document includes the forms and methods of switching to the backup system(s) located in the Business Continuity Backup Center, working in this/these system(s) and returning to the system(s) located in the BKM Istanbul Center.

Amendments

ARTICLE 26 – (1) Amendments to be made to these Rules and their annexes are announced to the Participants via BKM Online and by sending e-mails to the Responsible Employees of the Participants, together with their effective date, and are published on the TCMB website. The amendments become binding for the İKS Participants as of the announced effective date.

(2) In case the amendments to be made cause an increase in the fees or transaction costs to be paid by the Participant, the Participant shall not be obliged to pay the said increase amount for any period or any transaction prior to the publication of this amendment on BKM Online or its transmission to the Responsible Employees of the Participants by e-mail.

Entry into force

ARTICLE 27 – (1) These rules enter into force on the date they are published on the website of the Central Bank of the Republic of Turkey.

Execution

ARTICLE 28 – (1) These rules are executed by the Governor of the Central Bank of the Republic of Turkey.