QR CODE ROUTING SYSTEM (KYS) RULES

February 2024
Version 1.2

CENTRAL BANK OF THE REPUBLIC OF TÜRKİYE

Version and Change History

Change Date	Change Description	Version
December 2020	First Version	1.0
January 2023	Participation fee has been updated.	1.1
February 2024	ATM deposit to account flow has been added. Statements have been added regarding enabling indirect participation in KYS by payment service providers and payment system operators resident abroad, additional obligations of the relevant participants, and other related details being determined by BKM through the KYS Reference Document.	1.2

PART ONE

Purpose, Scope, Basis and Definitions

Purpose and scope

ARTICLE 1 – (1) The purpose of these rules is to regulate the operating rules, participation conditions and pricing principles of the QR Code Routing System (KYS) established and operated by Interbank Card Center Inc., as well as other procedures and principles regarding the operation of KYS.

(2) These rules cover the rules to be followed by Participants and BKM regarding the transmission of information contained in the content of the TR QR Code to be used for QR code card payments, FAST payments, mobile payments and other payments to be carried out through KYS.

Basis

ARTICLE 2 – (1) These rules have been prepared in accordance with the second paragraph of Article 7 of the Regulation on the Generation and Use of TR QR Code in Payment Services published in the Official Gazette dated 21/8/2020 and numbered 31220.

Definitions

ARTICLE 3 – (1) In the implementation of these rules;

a) Recipient: The real or legal person to whom the funds subject to the payment transaction are intended to reach,

b) BKM: Interbank Card Center Incorporated Company,

c) BKM Online: The online application accessible with special user definitions allocated to Participants, where BKM regulations (rules, regulations, information bulletins, etc.) and reports related to the services offered by BKM to Participants are located,

ç) Indirect participation: The ability of a payment service provider and payment system operator resident abroad, which does not have the authority to directly access KYS services by participating in KYS, to benefit indirectly from KYS services through Participants,

d) FAST: The Instant and Continuous Transfer of Funds System operated by the CBRT,

e) Sender: The real or legal person who issues a payment order from their own payment account or without having a payment account,

f) Law: The Law on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions dated 20/6/2013 and numbered 6493,

g) QR Code Routing System (KYS): The infrastructure that enables the transmission of information contained in the content of the scanned QR codes and necessary for the completion of the transaction between the payment service providers of the sender and the recipient,

ğ) Participant: Legal entities that participate in KYS for QR code payments, have the authority to perform QR code transactions using the KYS system, and are obliged to comply with KYS rules,

h) KYS Reference Document: The QR Code Routing System Reference Document,

ı) Mobile payment: The payment service in subparagraph (d) of the first paragraph of Article 12 of the Law,

i) Payment service: The services specified in Article 12 of the Law,

j) Payment service provider: The institutions specified in Article 13 of the Law,

k) Payment transaction: The activity of depositing, transferring or withdrawing funds carried out upon the instruction of the sender or recipient,

l) Responsible Employee: The responsible persons notified by Participants to BKM for communication regarding KYS transactions via the Annex-3 QR Code Routing System Responsible Employee Information Form,

m) CBRT: Central Bank of the Republic of Türkiye Incorporated Company,

n) Regulation: The Regulation on the Generation and Use of TR QR Code in Payment Services published in the Official Gazette dated 21/8/2020 and numbered 31220,

o) Payment service provider resident abroad: A legal entity authorized by the relevant authorities of the country in which it is resident to provide payment services or issue electronic money,

ö) Payment system operator resident abroad: A legal entity authorized by the relevant authorities of the country in which it is resident to operate a payment system,

(2) For definitions not included in the first paragraph, the definitions in the Regulation and the Technical Principles and Rules Guides shall apply.

PART TWO Provisions Regarding the Operation of KYS

Service provider

ARTICLE 4 – (1) The KYS service provider is "Nispetiye Cad. Akmerkez E3 Blok Kat: 2-3 Etiler 34337 İSTANBUL" located at the address and with e-mail address bkm@hs02.kep.tr, Interbank Card Center Inc. (BKM).

KYS Reference Document

ARTICLE 5 – (1) The KYS Reference Document, which contains the technical details and requirements for Participants to integrate into KYS and for payment service providers and payment system operators resident abroad to ensure indirect participation through Participants, is created by BKM and shared with Participants.

(2) BKM may make changes to the KYS Reference Document and shall notify the CBRT of the change it makes.

(3) The changes in the second paragraph and the dates on which the changes are valid shall be notified to Participants via BKM Online and through e-mails sent to Responsible Employees.

Transaction types in which KYS will be used

ARTICLE 6 – (1) This document covers the following, which are included in KYS transaction flows and made with TR QR Code;

a) Card payments,

b) FAST payments,

c) Mobile payment transactions,

ç) Other payment transaction types,

it covers.

(2) KYS services shall be used in the following transaction flows on a transaction type basis:

a) In card payments, at physical and virtual POS, payment, cancellation of payment, and refund of payment transactions via credit card, debit card, or a prepaid card through long and short QR codes offered by the merchant.

b) In card payments, cash withdrawal and cash deposit transactions at ATMs via QR code from an account linked to a debit card.

c) In FAST payments, payment transactions via short QR code offered by the merchant.

(3) In the event that a new flow is added to the transaction flows that KYS will serve, the following steps shall be carried out by BKM:

a) Software developments for the new transaction flow are completed.

b) Test and certification scenarios for the new transaction flow are determined.

c) The KYS Reference Document is updated and announced to the Participants.

Participation in KYS

ARTICLE 7 – (1) In order to participate in KYS, the administrative and technical conditions set out below must be fulfilled.

(2) The Participant candidate who wishes to participate in KYS;

a) must be the owner of a QR code producer code in accordance with Article 5 of the Regulation,

b) must sign the EK-1 QR Code Routing System Participant Undertaking with BKM,

c) must send to BKM the Trade Registry Gazette in which its articles of association were published and, if any, the Trade Registry Gazettes containing amendments, as well as the signature circulars of the managers/authorized persons who signed the EK-1 QR Code Routing System Participant Undertaking

ç) must send the originals of the documents signed by authorized persons to BKM,

d) must pay the fees set out in the EK-2 QR Code Routing System Service Fee Tariff that must be paid to BKM prior to participation,

must fulfill the administrative conditions.

(3) If the documents that the Participant candidate shared with BKM under the second paragraph within the scope of a different service remain valid, the candidate may not share these documents again.

(4) After the fulfillment of the administrative conditions specified in the second paragraph, the Participant candidate;

a) must complete the technical details and requirements described in the KYS Reference Document for the transaction flows for which it wishes to receive service and that are necessary for it to be able to integrate,

b) must establish the infrastructure for the software, hardware, and communication network required for a secure connection closed to the internet between BKM and the Participant, and this architecture must be approved by BKM,

c) must develop software in the manner specified in the KYS Reference Document and successfully complete the relevant acceptance tests,

after fulfilling the technical conditions, the KYS certification process is initiated.

(5) The Participant candidate that is deemed by BKM to have successfully completed the certification process shall have fulfilled the technical conditions required for participation in KYS.

(6) If Participant candidates that are BKM members fulfill the above conditions, their participation in KYS shall be realized. For Participant candidates that are not BKM members, after the complete fulfillment of the conditions set out above, the application to participate in KYS is discussed at the BKM Board of Directors, and upon approval of the application, the application process is concluded and participation is realized.

(7) Participants may enable the indirect participation of a payment service provider and payment system operator established abroad in KYS, provided that BKM approves that the requirements set out in the KYS Reference Document prepared in accordance with the first paragraph of Article 5 have been fulfilled. Payment service providers and payment system operators established abroad whose indirect participation process has been completed within the scope of this paragraph shall be notified to the CBRT by BKM.

Leaving KYS

ARTICLE 8 – (1) A Participant may leave KYS at its own request, provided that it notifies BKM in writing at least thirty (30) days in advance.

(2) The date on which the Participant requesting to leave may leave KYS shall be determined by BKM, provided that it is not less than thirty (30) days from the date of notification, and its relationship with KYS shall be terminated on the determined date. In this case, BKM; prevents the Participant's access to KYS; announces the situation to the relevant parties and takes the necessary measures.

(3) If a Participant that has left KYS at its own request wishes to rejoin KYS, it must re-fulfill all the conditions specified in these rules.

(4) In the event that the Participant;

a) has lost the conditions for participation in KYS,

b) poses a risk of a nature that would endanger the secure and uninterrupted operation of KYS, or

c) a written instruction is received from the CBRT regarding its removal from KYS,

d) fails to terminate indirect participation that poses a risk to the uninterrupted and healthy functioning of KYS or to the development of the payments field,

BKM; in order to remove the Participant from KYS, prevents the Participant's access to KYS; announces the situation to the relevant parties and takes the necessary measures.

(5) If a Participant removed from KYS by BKM wishes to rejoin KYS, it must re-fulfill all the conditions specified in this document.

KYS working days and hours

ARTICLE 9 – (1) KYS operates on a 7 days 24 hours basis.

(2) In all transactions carried out in KYS, the BKM system clock shall be taken as the basis.

(3) KYS planned maintenance works and disaster recovery center drills shall be announced to the Participants in advance by BKM.

Discrepancy in records

ARTICLE 10 – (1) In cases of inconsistency between KYS data and Participant data, BKM records shall be taken as the basis.

Pricing

ARTICLE 11 – (1) In the pricing and invoicing of the services to be provided to the Participants, the EK-2 QR Code Routing System Service Fee Tariff shall apply. BKM is obliged to announce the current fee tariff to the Participants via BKM Online.

PART THREE

Powers and Obligations of BKM

Powers of BKM

ARTICLE 12 – (1) BKM may add new flows and functions to KYS or make changes to existing flows and functions in order to comply with changes that occur in the Regulation or to fulfill instructions given by the CBRT.

(2) BKM has the authority to carry out all kinds of supervision activities and take measures regarding the system in order to ensure the uninterrupted operation of KYS. BKM informs the Participants about the measures to be taken through announcements to be made via BKM Online and through Responsible Employees.

(3) BKM subjects Participants that do not comply with the rules set out in the Regulation and its annex or the mandatory transition dates, or that negatively affect the KYS, to the compliance process set out in EK-1 Karekod Yönlendirme Sistemi Katılımcı Taahhütnamesi and, where necessary, may request the compliance fees set out in EK-2 Karekod Yönlendirme Sistemi Hizmeti Ücret Tarifesi. If the Participant continues its non-compliance and the KYS is negatively affected for this reason, BKM may remove the Participant from the system.

(4) In the indirect participation processes to the KYS, if situations that pose a risk to the uninterrupted and healthy operation of the KYS or to the development of the payments field are identified, BKM may request the Participant to terminate the indirect participation.

BKM's operational obligations

ARTICLE 13 – (1) BKM;

a) To manage the process regarding the participation of Participants in the KYS and to manage the indirect participation processes of payment service providers and payment system operators established abroad,

b) To store information regarding the messages processed in the KYS in its archive for the period specified in the relevant regulations, and in case of disputes, to submit the records to the parties and to the legally authorized authorities,

c) To carry out KYS business continuity work within the framework of the business continuity plan and to ensure coordination with the Participants,

ç) To evaluate the operational requests of the Participants in terms of business needs, risk management, compliance with legislation and international standards, and to determine the changes to be made in the operating principles of the KYS,

d) To take the necessary measures within its own systems for the uninterrupted and secure provision of the services that the Participant receives within the framework of this document, to notify the Participant in advance of planned work; in the event of any unplanned interruption, to inform the Participant of the situation and to make the best possible effort and show due diligence to resolve the problem as soon as possible,

is obliged to.

BKM's technical obligations

ARTICLE 14 – (1) BKM;

a) To operate and develop the KYS,

b) To establish the access infrastructure to the KYS and to establish, operate and develop security practices in order to ensure information confidentiality, integrity and availability,

c) To prepare documents, procedures and technical specifications regarding the development of Participant applications,

ç) To evaluate Participant requests and, if the requests are appropriate, to develop the KYS infrastructure and applications,

d) To monitor and manage the KYS infrastructure,

e) To provide first-level service management support to the Participants,

f) To prepare the tools and infrastructures that will ensure the uninterrupted operation of the KYS, to monitor the Participants' emergency preparedness and, in the event of an emergency, to act within the framework of business continuity planning to be applied,

g) To carry out the data traffic between the Participant and the KYS securely and encrypted and to store the data encrypted,

ğ) In the KYS, even if it does not ensure the verification of the customer in the transactions carried out, to carry the additional data that will enable verification between the Customer's Payment Service Provider and the Merchant's Payment Service Provider during the transaction,

is obliged to.

FOURTH CHAPTER

Obligations of Participants

Participant obligations regarding software, hardware and infrastructure

ARTICLE 15 – (1) The Participant;

a) To establish the software, hardware and communication infrastructure that it will use to access the KYS, as specified in this document, and to complete the KYS certification process,

b) To monitor security, continuity, performance and capacity in the software and access infrastructure and to take measures if necessary,

c) To implement the software and infrastructure changes announced by BKM in a timely manner,

ç) To test any changes to be made in its own systems regarding the KYS in accordance with the test scenarios specified in this document, and if deemed necessary by BKM, to notify BKM at least 10 business days in advance and obtain BKM's approval in order to renew the KYS certification and put it into production,

d) If BKM authorities need records, information and documents for the smooth operation of the KYS, to provide all kinds of convenience and, within this scope, to submit any requested records, information and documents in the requested manner to the extent permitted by the provisions of the legislation in force,

e) To preserve all kinds of archives, transaction records and information needed within the framework of public regulations regarding the KYS,

f) To comply with the standards determined by BKM within the scope of business continuity, to establish and keep connections open,

g) To cover the installation and usage fees for the data communication lines it uses,

is obliged to.

Participant obligations regarding security

ARTICLE 16 – (1) The Participant;

a) To establish the structure to be used in KYS access as specified in this document and to take security measures,

b) To ensure access to KYS applications and application security,

c) To take all necessary measures to prevent the KYS service from being used for purposes other than those envisaged on its own behalf or on behalf of its customers or the payment service providers and payment system operators established abroad to which it offers the opportunity for indirect participation in the KYS,

ç) To monitor, detect and take measures to eliminate actions in its own systems that would put the KYS at risk, and if this situation cannot be eliminated, to notify BKM,

d) To immediately notify BKM of the situation if there is suspicion that any criminal attempt that could negatively affect the operation of the KYS has been made,

is obliged to.

Participant obligations regarding responsible employees

ARTICLE 17 – (1) The Participant is obliged to keep the Responsible Employee list, which includes information on its responsible personnel regarding the KYS-related processes and operation, up to date and to notify BKM of changes immediately.

(2) BKM ensures communication by making all kinds of announcements and notifications regarding the KYS, both general and specific to the Participant, through Responsible Employees or via BKM Online, and such announcements and notifications are deemed to have been duly communicated to the Participant.

Participant obligations regarding day-long operability

ARTICLE 18 – (1) The Participant;

a) To keep the communication infrastructure and data communication lines to be used for access to the KYS continuously operational, and to inform the BKM Support Team and System Operations Team without delay in case of failure,

b) To immediately intervene in incidents notified by BKM and to inform BKM of the outcome,

c) To regularly monitor the IPs and Ports to be provided by BKM for the Company Headquarters and Business Continuity Backup Center, and to automatically route KYS transactions to the IP and Port seen as active,

is obliged to.

Participant obligations regarding service management

ARTICLE 19 – (1) The Participant;

a) To follow the announcements communicated by BKM via BKM Online or via e-mails sent to Responsible Employees, to perform the necessary actions, to comply with the defined service levels,

b) To notify BKM without waiting of any errors and incidents occurring in the Participant's systems or applications that interrupt its transactions in the KYS,

is obliged to.

Participant obligations regarding cooperation

ARTICLE 20 – (1) The Participant;

a) To comply with the plans in the works carried out or coordinated by BKM in line with the plans announced in advance and to provide the necessary support,

b) To provide BKM with information when necessary regarding the operation of the KYS and to notify BKM as soon as possible if this information changes,

is obliged to.

Participant obligations regarding service use

ARTICLE 21 – (1) The Participant;

a) To use the KYS services in accordance with its purpose, structure and rules as specified in this document,

b) To transmit the transactions carried out by its customer to the KYS without delay at the time of the transaction, and to notify its customers of the results of these transactions, whether completed successfully or unsuccessfully, as soon as the transaction is completed,

c) To have verified its customer before using the KYS services,

ç) To transmit transactions via the KYS, if any, in compliance with the relevant Technical Principles and Rules Guide and the rules of the relevant payment system or other BKM services,

d) Before starting to have a payment service provider and payment system operator established abroad use the KYS services and after starting, to take the necessary measures and actions to ensure that the indirect participation of such organizations does not adversely affect the operation of the KYS, including its operational processes, security and business continuity, in a manner that also fulfills the matters that may be requested by BKM, ,

is obliged to.

Participant obligations regarding certification

ARTICLE 22 – (1) The Participant; is obliged to complete BKM certification after completing the developments described in the KYS Reference Document.

(2) The Participant is also obliged to repeat the BKM certification if it makes any change in its own systems that will affect the KYS flows while it is operational with the KYS.

(3) In order for the certifications to be completed successfully, the Participant;

a) After making the developments described in the KYS Reference Document and completing their tests, to apply to BKM and request time for certification,

b) To have its systems and human resources ready for certification in the certification time slot assigned by BKM,

c) To make the necessary preliminary preparations for the certification to be concluded in the time slot allocated to it and to show the necessary care and effort during the certification, is required.

Other responsibilities of the Participants

ARTICLE 23 – (1) The Participant is responsible for the information transmitted to the KYS and for the accuracy and up-to-dateness of this information.

(2) The Participant is responsible for the damages it may cause to the KYS, other Participants and relevant parties due to its own and the indirect participant's failure to fulfill their obligations.

(3) In the event of an objection regarding QR code transactions carried out through the KYS, the Participant operates the objection process in accordance with the rules of the payment system in which the transaction took place.

CHAPTER FIVE

Requirements of the Participants

Communication Network requirements

ARTICLE 24 – (1) The message traffic between the KYS and the Participant operates over a secure MPLS VPN communication network.

(2) Before certification, the Participants;

a) To procure two redundant Routers and SD-WAN Licenses,

b) To establish connection with data lines to be procured from at least two different ISPs that BKM deems appropriate,

c) To meet the technical requirements shared by the BKM Network Team,

ensures.

Business continuity and redundancy requirements

ARTICLE 25 – (1) All system components belonging to the KYS are prepared to operate with the Active/Passive principle in both BKM's primary data center and secondary data center.

(2) Participants who also want to provide connection to BKM from other data centers in terms of business continuity or redundancy must decide on the number of Routers and data lines according to their own risk assessments.

Security requirements

ARTICLE 26 – (1) The message traffic between the Participants and the KYS is carried out over an MPLS VPN communication network on an end-to-end encrypted SD-WAN infrastructure.

(2) Message integrity control is performed on the message traffic between the Participants and the KYS as described in the KYS Reference Document.

Application requirements

ARTICLE 27 – (1) Participants develop applications in accordance with the requirements defined in the KYS Reference Document for KYS integration.

(2) In the case where Participants develop clients, the services must be offered as REST API. Participants accept requests as JSON body and return responses as JSON.

CHAPTER SIX Integration Steps, Certification and Key Management Process

Integration steps and certification process

ARTICLE 28 – (1) After completing the software development they will carry out in accordance with the principles of the KYS Reference Document, Participants may begin using the service after the completion of the test and certification processes also set out in the same document.

(2) The following steps are followed in the certification process:

a) After completing the technical preparations described in the KYS Reference Document, Participants send the KYS certification team, via an e-mail to be sent to kys@bkm.com.tr, a request stating that they wish to begin certification.

b) BKM makes planning for certification and provides the Participant with slot information.

c) All scenarios under the heading Certification Scenarios in the KYS Reference Document and relating to the flows of the service to be received from KYS must be successfully executed in order by the Participant.

ç) For BKM to check these transactions, the Participant sends the transaction information and the scenario execution start and end time information to kys@bkm.com.tr.

d) BKM carries out the tests on its own side and gives the Participant confirmation of the reflections of the test results in the Participant's systems. If the Participant wishes, it tests different scenarios that it will determine itself.

e) After the completion of BKM's tests, confirmation is obtained from the Participant that the transactions subject to certification are also correctly reflected in its own system.

f) If BKM confirms that all scenarios have been successful, the certification process is completed. If at least one unsuccessful scenario is identified, the process is run again from the beginning.

Key management process

ARTICLE 29 – (1) The message integrity fields used at the time of the transaction between KYS and the Participants and the blocks containing sensitive card data are encrypted with AES 256 keys (Participant Key).

(2) Each Participant must use separate keys in the encryption of KYS transactions. These keys cannot be a key previously used for a different product or service. The keys assigned and transmitted to the Participant by BKM will also be used for the KYS service and cannot be used for a different product or service.

(3) The keys will be generated by BKM in compliance with PCI DSS processes and shared with the Participants.

PART SEVEN Miscellaneous and Final Provisions

Extraordinary situations

ARTICLE 30 – (1) In the event that KYS becomes inoperable due to extraordinary situations that may arise in the system and/or infrastructure constituting the BKM KYS services, the actions to be taken are defined in the BKM Karekod Yönlendirme Sistemi İş Sürekliliği Yedekleme Merkezi (İSYM) Prosedürü document. The said document includes the transition to the backup system(s) located in the İSYM, working in this/these system(s), and the forms and methods of returning to the system(s) located in the BKM İstanbul Center.

Amendments

ARTICLE 31 – (1) Amendments to be made to these Rules and their annexes are announced to the Participants via BKM Online or by sending an e-mail to the Responsible Employees notified by the Participants with the EK-3 Karekod Yönlendirme Sistemi Sorumlu Çalışan Bilgi Formu, together with their effective date, and are published on the TCMB website. The amendments become binding on KYS Participants as of the announced effective date.

(2) In the event that the amendments to be made cause an increase in the fees or transaction costs to be paid by the Participant, the Participant shall not be obliged to pay the amount of the said increase for any period or any transaction prior to the publication of this amendment on BKM Online or its transmission by e-mail to the Responsible Employees notified by the Participants with the EK-3 Karekod Yönlendirme Sistemi Sorumlu Çalışan Bilgi Formu.

Effective date

ARTICLE 32 – (1) These rules enter into force on the date they are published on the website of the Central Bank of the Republic of Turkey.

Execution

ARTICLE 33 – (1) The President of the Central Bank of the Republic of Turkey executes these rules.

ANNEX-1 QR Code Routing System Participant Undertaking
ANNEX-2 QR Code Routing System Service Fee Tariff
ANNEX-3 QR Code Routing System Responsible Employee Information Form

ANNEX 1- KAREKOD YÖNLENDİRME SİSTEMİ KATILIMCI TAAHHÜTNAMESİ

1. PARTIES:

1.1. This Karekod Yönlendirme Sistemi Katılımcı Taahhütnamesi (hereinafter referred to as the "Taahhütname"), whose center is "Nispetiye Cad. Akmerkez E3 Blok Kat: 2,3 34337 Etiler, İstanbul" and which is registered with the Istanbul Ticaret Müdürlüğü under registry number 267660, has been issued in the name of Bankalararası Kart Merkezi A.Ş. (hereinafter referred to as "BKM").

1.2. The party that undertakes the matters specified below with this Taahhütname (hereinafter referred to as the "Participant") is [...............................], whose center is at [................] and which is registered with the [................] Ticaret Müdürlüğü under registry number [................].

2. SUBJECT and DEFINITIONS:

2.1. This Taahhütname has been drawn up by ……………………………, who wishes to participate in the Karekod Yönlendirme Sistemi (hereinafter referred to briefly as "KYS"), of which BKM is the owner and operator, pursuant to Article 7 of the "Ödeme Hizmetlerinde TR Karekodun Üretilmesi ve Kullanılması Hakkında Yönetmelik" (the Regulation) published in the Official Gazette dated 21/8/2020 and numbered 31220, in order to ensure that the rules prepared by the Central Bank of the Republic of Turkey A.Ş. (hereinafter referred to as "TCMB") and/or BKM, which regulate the relations between BKM and the Participants regarding the said system, the rights and obligations of the parties, and other matters concerning the operation of the systems, are binding on the undertaker.

2.2. All regulations and amendments relating to KYS, especially the Regulation and the KYS Rules, which will enter into force through notifications and announcements published on BKM Online or made through responsible employees, are an integral part of this Taahhütname.

2.3. Words written with an initial capital letter in this Taahhütname shall have the meanings specified in the KYS Rules.

3. THE PARTICIPANT'S UNDERTAKINGS:

As the Participant, we accept, declare and undertake the following;

3.1. That we wish to participate in the KYS service operated by BKM in the capacity of Participant;

3.2. We have read and understood the Regulation and the KYS Rules, the fee schedule and the other annexes of the documents referred to herein, and that we will comply with the rules specified herein in the transactions we will carry out through KYS;

3.3. That the rules and procedures to be put into effect through notifications and announcements to be published on BKM Online or made through responsible employees regarding KYS, and the relevant regulations of the TCMB, are binding on us and that we will comply with them;

3.4. That BKM and the TCMB may make changes to the rules regarding KYS from time to time; that such changes, which will enter into force through notifications and announcements to be made to us via BKM Online or through our responsible employees, are directly applicable without the need for any amendment to this Undertaking, are binding on us and that we will comply with them;

3.5. That in the event we breach the above-mentioned undertakings, we will be liable for any damages and losses that may arise and that other Participants of KYS and third parties receiving services from BKM may suffer and claim from BKM;

3.6. That in the event we violate the rules regarding KYS, BKM is authorized to request a "compliance fee" from us, in accordance with the processes specified in the relevant rules, in order to ensure the smooth operation of KYS and to protect the interests of all Participants benefiting from the system;

3.7. That we will pay the invoices to be issued in our name by BKM in accordance with the rules regarding KYS, by bank transfer and immediately, within at most 10 (ten) business days from the notification to us, to the bank account specified by BKM;

3.8. Otherwise, without the need for any warning or notice, in addition to the invoice amount in 3.7, we will also pay daily default interest to be applied on the unpaid amount for each day of delay, based on twice the rediscount interest rate determined by the TCMB;

3.9. As a Participant wishing to join KYS, in the event of a change in the information we have declared to BKM during the application, integration, testing and certification stages that would affect the operation of the services carried out by BKM, the regular and continuous operation of the other Participants included in the system or the system, we will immediately notify BKM in writing and provide the necessary information about the effects of the new situation;

3.10. That we are subject to the supervision of institutions authorized by law regarding KYS, and that BKM may share with such authorized institutions, particularly the TCMB and the Banking Regulation and Supervision Agency, any and all information/documents requested by such authorized institutions from BKM and relating to us;

3.11. That BKM will not be a party to disputes in which our Customers may be involved regarding transactions carried out through KYS, and that we will be liable for all kinds of expenses incurred by BKM due to such disputes;

3.12. That BKM cannot be held liable for damages arising from technical errors, unexpected situations, force majeure arising from KYS, except for damages arising from the intent or negligence of BKM employees, and that we will not make any claim from BKM for the compensation of such damages,

3.13. That we will not hold BKM directly or indirectly liable for damages, including legal fees, that may arise due to erroneous transactions, misuse, etc. originating from another Participant,

3.14. That in cases where BKM's liability arises regarding damages we may incur in accordance with the KYS Rules, BKM's liability is limited, for each year, to the total amount of fees we paid to BKM for KYS in the last 6 (six) months preceding the event causing the damage,

3.15. That the liability limit set out in Article 3.14 above may be changed by BKM in our favor through regulations to be published on BKM Online; that BKM is not authorized to make changes that are not in our favor with respect to the liability limit,

3.16. That as a Participant wishing to benefit from the KYS service, we will not transfer the rights we have obtained to third parties without the written permission of BKM.

4. Notifications:

4.1. Any correspondence sent by BKM to the Participant regarding KYS; shall be deemed validly notified to the Participant upon signing the receipt of the registered mail with return receipt, or 24 (twenty-four) hours after the sending of the e-mail for notifications sent by e-mail.

4.2. The Participant accepts that in the event of a change in contact information, it will notify BKM of the change within 3 (three) business days from the change, otherwise the notification made to the old address will be deemed valid.

5. Compliance Process:

The Participant accepts, declares and undertakes that it will act in accordance with the KYS Compliance Process detailed in this article;

5.1. In order to detect errors and/or violations regarding the rules and practices established for the use of the KYS system, by BKM;

a. Within the scope of Participant Certifications or re-certifications,

b. Within the scope of BKM Information Technologies Department controls,

c. During BKM field tests,

ç. Regarding the Participants' documented notifications,

d. Regarding the documented notifications/complaints received by BKM, necessary examinations and analyses are ensured to be carried out.

5.2. In cases of detected non-compliance, the following actions are taken:

a. The Participant notifies BKM of the details regarding the detected errors and/or violations in detail.

b. BKM sends a warning letter to the relevant Participant and to the Responsible Employees notified by the Participant via the QR Code Routing System Responsible Employee Information Form, and the Participant is given a period of 1 month to send a correction plan.

c. If the correction plan takes longer than 2 months or if the correction plan is not sent within 1 month, BKM determines the period itself for the compliance of the relevant Participant and notifies the Participant.

ç. At the end of the specified period or on the mandatory date, a control is carried out by BKM.

d. If there is a violation/error or if it continues; by the BKM Rules Department to the relevant Participant;

i. The Detection and Warning Compliance Fee is invoiced and

ii. A first warning letter is sent and a 1-month period is granted for correction.

e. At the end of the specified period, a check is performed by the BKM Information Technologies Department.

f. If the violation/error continues; by the BKM Rules Department to the relevant Participant

i. The Detection and Warning Compliance Fee is invoiced and

ii. A second warning letter is sent and a 1-month period is granted for correction.

g. At the end of the specified period, a check is performed by the BKM Information Technologies Department.

ğ. If it is observed that the error continues, for each subsequent month, until the error is corrected, the Resolution-Pending Error/Violation Compliance Fee is invoiced by the BKM Product Management Department.

5.3. The current amounts of the Detection and Warning Compliance Fee and the Resolution-Pending Error/Violation Compliance Fee are set out in the QR Code Routing System Service Fee Tariff.

5.4. Regardless of the above process and steps, with respect to violations that may threaten the security and reliability of the KYS and payment transactions carried out with the TR QR Code, the Participant's KYS membership may be suspended, provided that the approval of the TCMB is obtained.

6. Protection of Personal Data:

The Participant accepts, declares and undertakes that it will act in accordance with the Personal Data Protection rules detailed in this article;

6.1. In the KYS process, BKM and the Participants are required to share and process certain personal data belonging to the Customer with each other or with third parties. BKM and the Participants accept and undertake that they will process various personal data (“Personal Data”) as defined in the Personal Data Protection Law No. 6698 (the “Law”) in a manner limited to their purposes of obtaining them.

6.2. BKM and the Participants, with respect to the processing of Personal Data shared within the scope of this document;

a. undertake that they will mutually and completely fulfill the legal, administrative and technical obligations to which they are subject under the Law, the secondary regulations issued pursuant to the Law and the decisions of the Personal Data Protection Board (“PDPL Legislation”),

b. accept and undertake that, in the event that such Personal Data is obtained by others through unlawful means, they will immediately notify the other party of this situation.

6.3. In the process of initiating and concluding a transaction within the scope of the KYS, each of the Participants with the status of Payment Service Provider of the Customer has the title of “Data Controller” with respect to the data of its own customers.

6.4. Due to the third paragraph;

a. It is obliged to share with its customers, before or at the time of the transaction, the Information Notice that explains to the Customer the reasons for processing personal data (ensuring the security of the Participant's business processes, ensuring the fulfillment of legal obligations in cases required or mandated by legislation, protection of the Participant's legitimate interests, etc.); states that adequate administrative and technical measures are taken by the Participants during the processing of personal data; and reminds customers of their rights listed in Article 11 of the Personal Data Protection Law;

b. to retain Personal Data for the period required by the KYS Rules within the framework of the necessary security measures,

c. to process it in accordance with the Law within the framework of the data processing purposes regulated in the KYS Rules,

ç. to remedy damages arising from violation of these obligations.

6.5. In the process of initiating and concluding a transaction within the scope of the KYS, each Participant with the status of Payment Service Provider of the Workplace and BKM have the title of “Data Processor”. Therefore;

a. not to disclose to others the personal data shared by the Data Controller Participants in violation of the provisions of the Law,

b. to take the necessary measures regarding security and confidentiality while processing data,

c. to remain limited to the data processing purposes regulated in the KYS Rules,

ç. in the event that personal data is obtained by others through unlawful means, to immediately notify the Data Controller Participant of this situation,

d. to remedy damages arising from violation of these obligations.

6.6. The Participants are also obliged to fulfill without delay, with respect to the data processing activities to be carried out within the scope of the KYS, the requirements of the titles they hold under the Law and the requests of official authorities or data subjects on this matter.

6.7. The Participants are obliged to take all necessary technical and administrative measures to prevent the unlawful processing of Personal Data and unlawful access to Personal Data, and to ensure the preservation of the data.

7. Confidentiality:

The Participant accepts, declares and undertakes that it will act in accordance with the Confidentiality rules detailed in this article;

7.1. Each of BKM and the Participants may provide the other with access to all kinds of financial, commercial, technical, administrative, operational, management, legal, written or oral information, and personal data (“Confidential Information”) (in printed and/or electronic format) belonging to each other and relating to the other party's past, present or future research and development activities, commercial activities, products, customers, services and technical knowledge, even if not stated to be confidential information, in connection with the KYS. The following rules apply with respect to Confidential Information:

a. Confidential Information belonging to the disclosing party is used by the receiving party only for purposes related to the services provided by it.

b. Each of BKM and the Participants must show the same care in maintaining the confidentiality of the Confidential Information belonging to the other party as it shows in protecting its own property or information of a similar nature that contains confidentiality, and in any case shall exercise reasonable care. Access to Confidential Information is limited to the authorized personnel of the parties, provided that they comply with the confidentiality obligations specified herein and that it is used in connection with the KYS. Each party shall be responsible for its authorized personnel complying with the confidentiality obligations specified herein.

c. Confidential Information cannot be copied or reproduced without the prior written consent of the disclosing party.

ç) All Confidential Information provided for the KYS, including copies thereof, shall be returned or destroyed on the date on which whichever of the following occurs earlier: (a) the Participant's exit from the KYS, or (b) upon the request of the disclosing party.

d. Nothing contained herein shall impose any prohibition or restriction on BKM or the Participants from using information (including but not limited to ideas, concepts, know-how, techniques and methodologies) that (i) they had previously learned without being subject to any confidentiality obligation; (ii) was independently developed by or on behalf of the relevant party; (iii) was obtained from a third party who, to their knowledge, is not subject to any confidentiality obligation.

e. In the event that BKM or any of the Participants receives any legally valid and binding administrative or judicial order requiring the disclosure of the other party's Confidential Information, the party receiving such order shall, to the extent permitted by law, immediately notify the other party thereof and offer the other party the opportunity to make a defense in relation to such disclosure request. The party receiving such order shall thereafter act in accordance with the defense presented to it, to the extent permitted by law.

7.2. The confidentiality obligations of the Parties shall remain in effect even if the Participant exits the KYS for any reason.

Form Prepared By
Name – Surname:
.................................................................
Signature:
.................................................................
Telephone:
.................................................................
E-mail:
.................................................................
Commitment date: ………………………………..
Committed by: [Participant Title]

Name Surname
:
Title
:
Signature
:
Name Surname
:
Title
:
Signature
:

ANNEX -2 QR CODE ROUTING SYSTEM SERVICE FEE TARIFF

The fee tariff applicable for the QR Code Routing System (KYS) service as of 1 January 2023 is set out below.

1. QR Code Routing System Service Fees (Excluding VAT)

Fee Item	Amount (TL)
Participation Fee (*)	100.000 TL
Annual Service Fee	None
Transaction Fee	None

(*) Invoiced in the month in which the KYS Participant Undertaking is signed.

2. Test and Certification Fees (Excluding VAT)

Service Function	Fee (TL) / Hour
Business hours (09:00 – 17:00)	300 TL
Outside business hours	450 TL

2.1 Charging shall be made according to the following criteria for slots obtained from and used at BKM in the test and certification processes to be carried out after the first transition to production, and shall be invoiced at the end of the month.

a) Slots used for more than 15 minutes shall be charged as a minimum of 30 minutes and multiples of 30 minutes. For usage exceeding 30 minutes, the first 15 minutes shall be rounded to the previous, and usage in the 16-29 minute range shall be rounded to the next 30 minutes.

b) Slots used for less than 15 minutes shall, after 3 such uses, be reflected to the Participant as 30 minutes of usage.

c) The period subject to the slot fee begins with the slot opening email sent by BKM. Unless a slot closing notification (e-mail) is received, the slot shall be deemed open; a fee shall be calculated for the time elapsed until the closing notification (e-mail) is received or until the slot is given to a different Participant for the same test environment.

ç) For work to be performed outside business hours, a fee of 1.5 times the current tariff shall be applied.

d) Slot requests not cancelled within the following periods shall be charged for the allocated slot duration even if not used:

o For mutual work, at least 30 minutes before the slot start time,

o For work to be performed outside business hours, 1 business day before,

o In other cases, 5 minutes before the slot start time.

e) In the event that the test system is used without obtaining a slot from BKM, the slot duration shall be calculated by taking into account the first and last transaction times transmitted for each function and at 1.5 times the applicable tariff.

3. Compliance Fees (Excluding VAT)

3.1 These are the compliance fees to be applied to the Participant in the event that errors and/or violations are detected regarding the rules and practices established in relation to the use of KYS.

Fee Item	Amount (TL)
Detection and Warning Compliance Fee	22.500 TL
Error/Violation Compliance Fee for Which a Solution Is Expected	45.000 TL

4. Rules Regarding Invoicing

4.1 VAT is added to the calculated fees and an invoice is issued.

4.2 The Compliance Fee applied to Participants for whom non-compliance with the rules is detected is included in the monthly invoices.

APPENDIX 3- KAREKOD ROUTING SYSTEM RESPONSIBLE EMPLOYEE INFORMATION FORM

This “Karekod Routing System Responsible Employee Information Form” (Form) has been prepared in accordance with Article 7 of the “Regulation on the Generation and Use of TR Karekod in Payment Services” (Regulation) published in the Official Gazette dated 21/8/2020 and numbered 31220, for the purpose of transmitting the responsible employee information of the participant of the Karekod Routing System (KYS), of which the Interbank Card Center (BKM) is the owner and operator.

Date of Submission:
........................................................................
Participant EFT Code / Title:
........................................................................

The Participant accepts and undertakes that it will be deemed to have received any notification to be sent to it by BKM through the following channels regarding KYS 24 hours after it is sent, and that it will notify BKM as soon as possible in the event of any change in the following information.

Business Unit Manager's
Name – Surname:
.................................................................
Title:
.................................................................
Telephone:
.................................................................
E-mail:
.................................................................

Technical Manager's
Name – Surname:
.................................................................
Title:
.................................................................
Telephone:
.................................................................
E-mail:
.................................................................

Network Manager's
Name – Surname:
.................................................................
Title:
................................................................
Telephone:
.................................................................
E-mail:
.................................................................

Emergency (24/7) Manager's
Name – Surname:
.................................................................
Title:
.................................................................
Telephone:
.................................................................
E-mail:
.................................................................

Participant Title:

Form Approver (1)
Form Approver (2)
Name – Surname:
Name – Surname:
Signature:
Signature: