Introduction

Open banking has become one of the most important areas of financial technology regulation in Türkiye.

Traditional banking was historically based on a relatively closed model in which banks controlled both the customer’s financial account and the technological interface through which the customer accessed that account.

Open banking changes this structure.

Subject to customer authorisation and regulatory safeguards, third-party financial service providers may access specified payment-account information or initiate payments from accounts maintained by another payment service provider.

This model creates significant opportunities for fintech companies offering financial account aggregation, personal financial management applications, corporate cash-flow management, payment initiation, accounting integrations, merchant payment solutions and embedded finance services.

However, open banking in Türkiye is a regulated payment activity rather than merely an API-based technology service.

The legal foundation is primarily found in Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions together with the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers and the CBRT’s information systems and data-sharing regulations.

Türkiye formally incorporated the two core open banking services into Article 12 of Law No. 6493 through amendments made in November 2019:

• Payment Initiation Services, under Article 12/1(f); and
• Account Information Services, under Article 12/1(g).

The Central Bank of the Republic of Türkiye (“CBRT” or “TCMB”) expressly identifies both activities as regulated payment services.

Türkiye has subsequently developed a central technical infrastructure for these services through Ödeme Hizmetleri Veri Paylaşım Servisleri (“ÖHVPS”), commonly described in English as Data Sharing Services in the Field of Payment Services, and the GEÇİT infrastructure developed by the Interbank Card Center (“BKM”).

The ecosystem has developed rapidly. On 17 March 2026, the CBRT launched ÖHVPS version 2.0.0, significantly expanding account information functionality and introducing new features concerning card information, scheduled payments and recurring payment initiation. According to the CBRT, the open banking ecosystem had reached 16.4 million users, approximately 12.3 million transactions per day and 53 participants by that date.

This article provides a comprehensive explanation of open banking regulation in Turkey, focusing particularly on Payment Initiation Services (“PIS”) and Account Information Services (“AIS”), licensing requirements, API architecture, customer consent, strong authentication, data protection and regulatory compliance.

1. What Is Open Banking in Turkey?

Open banking can broadly be described as the regulated sharing of financial account data and payment functionality between payment service providers through secure technological interfaces.

In Türkiye, open banking in the payment-services sector principally refers to:

Payment Initiation Services, and

Account Information Services.

The CBRT refers to these services collectively as payment-services data-sharing services or ÖHVPS.

The introduction of these activities into Law No. 6493 was influenced by international developments, particularly the framework developed under the European Union’s Second Payment Services Directive (“PSD2”).

However, Türkiye has developed its own technical and regulatory architecture rather than simply reproducing the European system.

The Turkish model is especially notable for the central role of BKM’s GEÇİT infrastructure, which provides a standardised connection environment for open banking participants.

2. Legal Framework for Open Banking in Turkey

The principal legislation governing Turkish open banking consists of:

Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions;

Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers;

and

Communiqué on Information Systems of Payment and Electronic Money Institutions and Data-Sharing Services of Payment Service Providers in the Field of Payment Services.

The CBRT lists these regulations within the current legal framework governing Turkish payment services.

Article 12/1(f) of Law No. 6493 regulates payment initiation services.

Article 12/1(g) regulates services involving the presentation of consolidated information concerning one or more payment accounts on online platforms.

These two activities form the principal legal basis of open banking in Türkiye.

The amendment was introduced on 12 November 2019, and the operational and technical regulatory framework was subsequently developed through secondary legislation and CBRT/BKM infrastructure.

3. What Is a Payment Initiation Service?

A Payment Initiation Service (“PIS”) allows a customer to initiate a payment from a payment account maintained by another payment service provider.

The business providing this service is generally referred to as a:

Payment Initiation Service Provider (“PISP”)

or, in Turkish terminology,

Ödeme Emri Başlatma Hizmeti Sağlayıcısı (“ÖBHS”).

A simplified example illustrates the structure.

A customer maintains an account with Bank A.

Instead of opening Bank A’s mobile banking application and manually making a transfer, the customer uses a fintech application.

Through the fintech application, the customer authorises a payment to a merchant.

The fintech provider securely communicates with Bank A through the regulated open banking infrastructure and initiates the payment from the customer’s account.

The fintech application does not necessarily hold the customer’s money.

Its regulated function is to initiate the payment instruction.

This distinction is important because payment initiation can provide an alternative to traditional card-based payment flows in certain business models.

4. What Is an Account Information Service?

An Account Information Service (“AIS”) allows customers to access consolidated information relating to payment accounts maintained by one or more different payment service providers.

The relevant provider is generally referred to as an:

Account Information Service Provider (“AISP”)

or

Hesap Bilgisi Hizmeti Sağlayıcısı (“HBHS”).

Consider a customer with accounts at three different banks.

Traditionally, the customer would need to open three separate mobile banking applications to review balances and transactions.

An account information service can allow the customer, subject to the required authorisation and security procedures, to view those accounts through a single platform.

This structure creates opportunities for products including:

• personal finance management applications;
• corporate treasury dashboards;
• SME cash-flow applications;
• accounting software;
• financial planning services;
• financial comparison platforms;
• credit-risk analytics;
• embedded finance applications.

The CBRT’s guidance explains that an account information service provider consolidates information from accounts held with different account service providers and presents that information to the payment service user through a single online interface.

5. Principal Participants in the Turkish Open Banking Ecosystem

The Turkish regulatory framework uses several important categories.

Payment Service User

The Payment Service User is the customer using the relevant open banking service.

This may be an individual or a legal entity.

Account Servicing Payment Service Provider

The Account Servicing Payment Service Provider, known in Turkish as the Hesap Hizmeti Sağlayıcısı (“HHS”), maintains the customer’s payment account.

Banks, electronic money institutions, payment institutions and other payment service providers can fall within this structure where the regulatory conditions are satisfied.

Payment Initiation Service Provider

The PISP/ÖBHS initiates a payment from the customer’s payment account following the customer’s instruction.

Account Information Service Provider

The AISP/HBHS collects permitted payment-account information and presents it to the customer through a consolidated interface.

BKM and GEÇİT

The Interbank Card Center (“BKM”) operates the GEÇİT infrastructure through which standardised open banking communications take place.

The architecture allows account service providers and authorised payment service providers to integrate into a common framework instead of establishing separate technical integrations for every bilateral relationship.

6. What Is ÖHVPS?

ÖHVPS stands for Ödeme Hizmetleri Veri Paylaşım Servisleri.

It refers to the payment-services data-sharing framework developed for Turkish open banking.

The system implements the payment initiation and account information services recognised under Article 12 of Law No. 6493.

ÖHVPS establishes technical and operational standards governing communication between open banking participants.

The CBRT and BKM developed the relevant API standards, operational principles and infrastructure.

The initial API standards were published in 2022, while the common BKM API infrastructure known as GEÇİT became operational on 1 December 2022.

7. What Is the GEÇİT Open Banking Infrastructure?

GEÇİT is one of the most distinctive features of the Turkish open banking model.

Rather than requiring every fintech company to establish individual technical integrations with every bank and account service provider, the Turkish architecture uses a central technical gateway.

An Account Service Provider develops services compatible with the ÖHVPS API standards and connects them to GEÇİT.

Similarly, an authorised PISP or AISP can integrate with GEÇİT.

This substantially simplifies the technical architecture.

The CBRT’s guidance explains that Account Service Providers provide their data-sharing services to authorised AISPs and PISPs through the infrastructure established by BKM. Connections between HHS, GEÇİT and the relevant authorised provider are designed to operate through secure end-to-end communication.

This common infrastructure can reduce duplication and facilitate more consistent standards across the Turkish market.

8. Does a Fintech Company Need a Licence to Provide Open Banking Services?

Generally, yes.

Payment initiation and account information services are expressly classified as payment services under Article 12 of Law No. 6493.

Consequently, a fintech company wishing to provide these services generally requires the appropriate regulatory authorisation.

The relevant authorisation is granted by the Central Bank of the Republic of Türkiye.

The CBRT’s current public register shows which payment institutions are authorised for the individual services listed under Article 12, including the (f) and (g) open banking services.

This means that an ordinary technology company cannot simply begin connecting customer bank accounts and providing regulated open banking functionality without first analysing whether a CBRT licence is required.

9. Licensing a Payment Initiation Service Provider in Turkey

A company intending to provide Payment Initiation Services generally falls within the ordinary payment institution licensing framework.

Under Law No. 6493, a payment institution must satisfy requirements concerning:

• corporate form;
• shareholders;
• management;
• capital;
• financial strength;
• organisational structure;
• internal controls;
• risk management;
• information systems;
• regulatory reporting.

The company’s authorisation must specifically cover Article 12/1(f).

From 30 June 2026, the general minimum own-funds threshold applicable to payment institutions other than the specially excluded account-information-only category is TRY 40 million, subject also to the additional calculation rules based on payment volume and the CBRT’s risk-based supervisory powers.

This distinction matters significantly for fintech founders.

A PISP is not treated in exactly the same manner as an AISP that exclusively provides account information services.

10. Special Licensing Rules for Account Information Service Providers

Turkish law provides a special regulatory structure for companies that exclusively provide account information services under Article 12/1(g).

Article 14/A of Law No. 6493 states that a payment institution exclusively providing the account information service is exempt from certain requirements ordinarily applicable to payment institutions.

In particular, the statutory requirements concerning:

• issuing shares against cash;
• all shares being registered; and
• minimum capital

do not apply in the ordinary manner to an institution exclusively providing Article 12/1(g) account information services.

This reflects the lower financial risk generally associated with pure account-information businesses, which typically do not hold or transfer customer funds.

However, an AISP-only institution is not free from financial responsibility requirements.

11. Professional Liability Insurance for AISP-Only Businesses

An institution exclusively providing Account Information Services is subject to a professional liability insurance or guarantee requirement.

Under Article 33 of the Payment Services Regulation, such an institution must maintain at least:

TRY 1 million in professional liability insurance

or

TRY 1 million in qualifying collateral/guarantee.

The amount increases by TRY 500,000 for each additional 100,000 customers after the first 100,000 customers.

The CBRT also has authority to increase the relevant amount by up to 50%.

This should therefore be included in the financial planning of any standalone AISP project in Türkiye.

12. Which Payment Accounts Fall Within Open Banking?

The classification of a payment account is central to Turkish open banking.

CBRT guidance identifies relevant payment-account categories including:

• demand deposit accounts;
• transaction accounts;
• credit card accounts;
• electronic money accounts;
• certain other accounts opened in the customer’s name that allow transfers to other persons without being dependent upon another account.

In addition, an account must generally be accessible online for the relevant open banking requirements to apply.

A fintech company should therefore carefully determine which customer accounts its proposed application will access.

The existence of financial information in a system does not automatically mean every type of financial account falls within precisely the same ÖHVPS framework.

13. Customer Consent Is Fundamental

Open banking is built around customer authorisation.

A PISP or AISP does not obtain unlimited access to the customer’s financial life merely because the customer has registered with the fintech application.

The payment initiation service provider may act only within the scope of the payment authorised by the customer.

Similarly, an account information service provider can provide only services for which the customer has given the required approval.

The Turkish Payment Services Regulation expressly limits AISPs to services covered by customer authorisation and restricts access, use and storage of data to the purposes necessary for providing the account information service.

Consent architecture should therefore be integrated into product design.

The application should clearly establish:

• which accounts are connected;
• what information is accessed;
• what functionality is authorised;
• how long access continues;
• how authorisation can be withdrawn;
• how security is maintained.

14. Strong Customer Authentication

Security is one of the central legal principles of open banking.

The Turkish framework uses Strong Customer Authentication, known as Güçlü Kimlik Doğrulama (“GKD”).

CBRT documentation describes strong customer authentication as a mechanism involving at least two independent authentication components drawn from different categories, such as:

• something the customer knows;
• something the customer possesses; or
• a biometric characteristic of the customer.

Strong authentication protects against unauthorised access and fraudulent payment initiation.

The HHS, PISP and AISP technical architecture must therefore be designed consistently with the applicable authentication rules.

15. Rules Applicable to Payment Initiation Service Providers

The Payment Services Regulation imposes detailed restrictions on PISPs.

A payment initiation service provider must identify itself to the institution where the payment account is maintained and communicate securely with the customer and the relevant account service provider.

The PISP may not request information from the customer beyond what is necessary to provide the payment initiation service.

It may access, use and retain information only within the scope necessary to provide the authorised service.

Most importantly, the PISP cannot alter the recipient, payment amount or other characteristics of the payment transaction authorised by the customer.

This ensures that the third-party provider cannot transform a customer’s payment instruction after authorisation.

16. Restrictions on Sensitive Customer Data

Open banking inevitably involves access to valuable financial data.

For this reason, Turkish regulations impose restrictions concerning sensitive customer data.

A PISP may not retain sensitive customer information contrary to the applicable regulatory rules.

An AISP similarly cannot request sensitive customer information relating to the payment account beyond what the regulatory framework permits.

Data access must be limited to what is necessary for providing the relevant service.

This principle is consistent with both financial-sector information-security requirements and personal data protection principles.

17. Rules Applicable to Account Information Service Providers

An AISP must comply with several important requirements.

It may provide only services authorised by the customer.

It must establish secure communication with the Account Service Provider.

It may access only designated accounts and associated payment transaction information.

It cannot access, use or retain information for purposes unrelated to the account information service.

Where it stores permitted information, it must comply with information-security and confidentiality obligations.

These restrictions are particularly relevant to fintech companies planning to monetise customer banking information.

A company cannot assume that information obtained for an account aggregation service may automatically be repurposed for advertising, behavioural profiling, credit scoring or unrelated commercial purposes.

Separate legal analysis may be required.

18. Obligations of Account Service Providers

The open banking framework does not impose obligations only on fintech companies.

Banks and other Account Service Providers also have significant duties.

For example, an Account Service Provider must communicate securely with authorised PISPs and AISPs.

For account information requests, the institution must generally treat requests transmitted through an AISP without discrimination in relation to matters such as timing, priority or fees unless objective reasons justify different treatment.

This non-discrimination principle is central to an effective open banking market.

Without such a requirement, established financial institutions could technically disadvantage third-party providers even where those providers were properly authorised.

19. Is a Separate Agreement With Every Bank Required?

One of the significant advantages of the Turkish regulatory structure is that authorised open banking providers do not necessarily need a separate bilateral agreement with every Account Service Provider for the basic regulated service.

The Payment Services Regulation provides that where the relevant legal and technical requirements are satisfied and BKM’s infrastructure is used, a separate service-specific agreement between the PISP/AISP and the Account Service Provider is not required, except in relation to matters involving fees, costs, commissions and other commercial benefits.

This mechanism significantly reduces a potential barrier to entry.

A new fintech company does not need to negotiate technical access independently with every bank before its regulated service can function.

20. The 2025 Expansion of Account Service Provider Obligations

Türkiye’s open banking framework continued to develop during 2025.

On 28 March 2025, amendments to the Payment Services Regulation and the relevant information systems communiqué updated the scope of Account Service Provider obligations and the compliance periods applicable to providers falling within that scope.

The amendments also addressed transition periods concerning digital wallet services.

This development demonstrates an important characteristic of Turkish fintech regulation:

Open banking is not a static framework.

Businesses operating in this sector must continuously monitor regulatory changes, technical standards and transition periods.

21. ÖHVPS 2.0.0: Major Open Banking Changes in 2026

The most important recent open banking development occurred on 17 March 2026, when the CBRT announced the launch of ÖHVPS version 2.0.0.

The new version substantially expanded the functionality of the Turkish open banking ecosystem.

The CBRT announced three particularly important developments.

Expanded Account Information Services

The scope of account information functionality was expanded.

This allows more comprehensive financial data to be presented within authorised open banking applications.

Card Information and Transaction Data

New functionality relating to card information and card transactions was introduced.

This enables users to obtain a broader view of their financial position rather than limiting open banking functionality to conventional account balances and transfers.

Scheduled Payment Initiation

ÖHVPS 2.0.0 introduced Scheduled Payment Order Initiation.

A user can therefore use open banking infrastructure for authorised payments intended to occur at a future date.

Recurring Payment Initiation

The update also introduced Recurring Payment Order Initiation functionality.

This creates significant opportunities for subscription payments, recurring bills and other scheduled financial obligations.

These changes significantly increase the commercial potential of Turkish open banking.

22. Scale of the Turkish Open Banking Market in 2026

The CBRT’s March 2026 announcement provides important information regarding the scale of the market.

As of 17 March 2026:

16.4 million users had joined the open banking ecosystem.

The infrastructure was processing an average of approximately 12.3 million transactions per day.

There were 53 participants in the open banking infrastructure.

These numbers indicate that open banking in Türkiye is no longer merely an experimental regulatory initiative.

It has become an established part of the country’s payments infrastructure.

For international fintech investors, this makes the Turkish market increasingly relevant.

23. Personal Data Protection and Open Banking

Open banking fundamentally involves personal and financial data.

Accordingly, fintech companies must consider Law No. 6698 on the Protection of Personal Data (“KVKK”) in addition to financial-sector regulations.

An account information provider may potentially process:

• names;
• account numbers;
• transaction history;
• balances;
• payment information;
• merchant information;
• device information;
• financial behaviour.

Processing this information requires a valid legal basis and appropriate compliance measures.

An open banking company should therefore establish:

• privacy notices;
• processing inventories;
• data-retention rules;
• access controls;
• processor agreements;
• information-security policies;
• data breach procedures;
• international transfer mechanisms where applicable.

Importantly, permission under payment-services legislation and lawful processing under KVKK are related but separate compliance questions.

A CBRT licence does not remove data protection obligations.

24. Data Minimisation in Open Banking

One of the most important principles in open banking is that providers should access only information required to provide the authorised service.

This is particularly clear under Article 61 of the Payment Services Regulation.

An AISP may access only the specified payment accounts and related payment transactions necessary for its service.

It cannot access or retain unrelated information merely because the API technically makes that information available.

This requirement should influence API architecture.

A compliant fintech product should be designed around minimum necessary access.

25. Cross-Border Data Transfers

International open banking businesses often use foreign infrastructure.

Examples include:

• overseas cloud hosting;
• global analytics platforms;
• foreign fraud-prevention providers;
• international CRM platforms;
• foreign parent-company databases.

Where Turkish customer personal data is transferred abroad, Article 9 of Law No. 6698 should also be considered.

Cross-border data transfers therefore require a separate data-flow analysis.

For an international fintech company, the legal architecture should identify:

1. which data is collected in Türkiye;
2. which entity acts as data controller;
3. which foreign providers receive data;
4. which transfer mechanism applies;
5. whether financial-sector restrictions impose additional requirements.

Open banking therefore requires both financial regulatory compliance and data governance.

26. Information Systems and API Security

Open banking is impossible without secure APIs.

For this reason, the Turkish regulatory framework contains detailed information systems requirements.

The CBRT’s information systems communiqué regulates payment and electronic money institutions and data-sharing services used in the payment-services sector.

A regulated open banking provider should consider matters including:

• encryption;
• API authentication;
• access controls;
• logging;
• transaction integrity;
• fraud monitoring;
• certificate management;
• incident response;
• business continuity;
• penetration testing;
• secure software development;
• authentication credentials.

Cybersecurity should not be treated as an issue that arises only after licensing.

Technical certification and security readiness form part of the operational framework itself.

27. Technical Certification and GEÇİT Integration

Open banking participation requires more than obtaining a legal authorisation.

The technical infrastructure must also comply with the ÖHVPS standards.

The licensing procedure for Article 12/1(f) and (g) services requires evidence confirming that the necessary technical conditions have been satisfied following the relevant BKM controls and assessments.

This means a fintech company pursuing a Turkish open banking licence needs to run two projects in parallel:

the regulatory authorisation project, and

the technical integration/certification project.

Failure in either area may prevent commercial launch.

28. AML and KYC Considerations

Open banking providers also need to consider Turkish anti-money laundering legislation.

The relevant obligations depend upon the exact regulated activity and business structure.

A fintech company may need processes concerning:

• customer identification;
• beneficial ownership;
• transaction monitoring;
• suspicious activity;
• sanctions;
• politically exposed persons;
• record retention.

An Account Service Provider may also decline or restrict certain customer activity where obligations under Law No. 5549 on Prevention of Laundering Proceeds of Crime or other applicable legislation require it.

The CBRT itself notes that payment and electronic money institutions remain subject to requirements arising from Law No. 5549 in addition to Law No. 6493.

29. Consumer Protection and Customer Agreements

Open banking companies should also consider consumer and contractual obligations.

The customer should understand:

• which institution provides the service;
• which accounts will be accessed;
• what permissions are being granted;
• whether payments can be initiated;
• how consent may be withdrawn;
• which fees apply;
• how complaints are submitted;
• responsibility for unauthorised transactions;
• how personal data is processed.

Customer agreements should therefore be drafted specifically for the relevant open banking product.

Copying the terms of a conventional mobile application is unlikely to be sufficient.

30. Can Foreign Open Banking Companies Operate in Turkey?

Foreign fintech companies should not assume that an AISP or PISP licence issued in the European Union, United Kingdom or another jurisdiction automatically permits regulated open banking activity in Türkiye.

There is no general passporting mechanism under which a foreign payment-services licence automatically becomes a Turkish licence.

Where services fall within Article 12/1(f) or (g) of Law No. 6493, Turkish authorisation requirements must be analysed.

Certain cooperation arrangements between Turkish payment service providers and foreign legal entities may be possible under Article 19 of the Payment Services Regulation, subject to CBRT approval.

The CBRT currently publishes a list of authorised cross-border cooperation structures involving Turkish institutions and foreign payment businesses.

Foreign fintech companies considering Turkish market entry may therefore evaluate:

• establishing a Turkish payment institution;
• acquiring an existing licensed institution;
• partnering with a licensed Turkish provider;
• providing purely technical infrastructure without itself performing the regulated service.

The appropriate structure depends on the exact division of contractual, technological and financial functions.

31. Business Opportunities Created by Open Banking in Turkey

The Turkish framework creates numerous potential fintech business models.

Personal Finance Management

Customers can view multiple financial accounts within one application.

Corporate Treasury

Companies can monitor accounts maintained with multiple banks through a single dashboard.

Accounting Integration

Account information can be integrated into accounting and ERP software.

Alternative Payment Solutions

Payment initiation can potentially provide merchant payment flows outside traditional card acceptance structures.

Subscription Payments

The introduction of recurring payment initiation under ÖHVPS 2.0.0 creates new opportunities for recurring payment models.

Scheduled Payments

Future-dated payment initiation can support rent, supplier payments and other planned transactions.

Financial Analysis

Authorised account data may support budgeting and financial management products, subject to regulatory and data-protection limitations.

Embedded Finance

Open banking functionality can be integrated into non-bank digital platforms.

The March 2026 expansion significantly increases the potential range of products that can be developed around these services.

32. Common Legal Mistakes in Turkish Open Banking Projects

Several mistakes regularly create regulatory risk.

Treating Open Banking as an Ordinary API Business

Technical access to financial data can itself constitute a regulated payment service.

Accessing More Data Than Necessary

The availability of information through an API does not automatically create legal permission to process it.

Failing to Obtain the Correct Licence

Payment initiation and account information require different regulatory analysis.

Ignoring the AISP-Only Special Regime

A pure account information provider may benefit from different capital requirements than a PISP.

Assuming Customer Consent Solves Every Legal Issue

Consent does not replace licensing, cybersecurity, AML or other statutory obligations.

Using Financial Data for Secondary Commercial Purposes

Information obtained to provide account information services should not automatically be repurposed for unrelated advertising or profiling.

Ignoring Technical Certification

A legal licence alone does not complete GEÇİT participation requirements.

Assuming a Foreign Licence Works in Türkiye

Foreign regulatory authorisation does not automatically provide Turkish market access.

33. Open Banking Regulatory Due Diligence

Investors acquiring or financing a Turkish open banking company should perform specialised regulatory due diligence.

Important areas include:

Licence Scope:
Does the company’s CBRT authorisation actually include Article 12/1(f), (g) or both?

Technical Certification:
Has the institution completed the required integration and certification processes?

Customer Consent:
Are permissions properly recorded?

Data Usage:
Does the company process information beyond what customers authorised?

KVKK Compliance:
Are privacy notices, transfers and retention policies lawful?

Cybersecurity:
Has the institution experienced material security incidents?

AML/KYC:
Are customer identification and transaction monitoring systems adequate?

Outsourcing:
Do cloud and technology agreements comply with regulatory requirements?

Regulatory Correspondence:
Has the CBRT identified deficiencies?

These issues may directly affect company valuation.

34. Open Banking Compliance Checklist for Turkey

Before launching an open banking product in Türkiye, businesses should verify:

Regulatory Classification

Determine whether the service constitutes PIS, AIS or another payment service.

CBRT Licence

Confirm the necessary Article 12 authorisation.

Corporate Structure

Ensure the company satisfies Law No. 6493 requirements.

Financial Requirements

Determine whether the general payment institution own-funds requirements or the special AISP regime applies.

Professional Liability Insurance

For AISP-only institutions, establish the required insurance or guarantee.

GEÇİT Integration

Complete technical integration and certification.

Strong Customer Authentication

Implement compliant authentication mechanisms.

Consent Management

Record and manage customer authorisations.

Data Minimisation

Access only information necessary for the authorised service.

KVKK Compliance

Implement data protection policies.

Cybersecurity

Establish secure API and information systems infrastructure.

AML/KYC

Apply applicable financial crime controls.

Customer Agreements

Prepare clear contractual terms and disclosures.

Complaint Handling

Create a regulated customer complaint process.

Regulatory Monitoring

Continuously monitor CBRT and BKM updates.

Frequently Asked Questions About Open Banking in Turkey

Is open banking regulated in Turkey?

Yes.

Payment initiation and account information services are expressly recognised as regulated payment services under Article 12/1(f) and (g) of Law No. 6493.

Who regulates open banking in Turkey?

The principal regulatory authority is the Central Bank of the Republic of Türkiye.

BKM also plays a central technical role through GEÇİT and ÖHVPS infrastructure.

What is a Payment Initiation Service?

A Payment Initiation Service allows a customer to authorise a third-party provider to initiate a payment from an account maintained with another payment service provider.

What is an Account Information Service?

An Account Information Service allows a customer to obtain consolidated information concerning one or more payment accounts through an online platform.

Does a PISP need a licence in Turkey?

Yes, providing payment initiation services generally requires CBRT authorisation under Article 12/1(f).

Does an AISP need a licence?

Yes, but institutions exclusively providing Article 12/1(g) Account Information Services benefit from special regulatory treatment under Article 14/A of Law No. 6493.

What is the minimum capital for an AISP in Turkey?

An institution exclusively providing Account Information Services is exempt from the ordinary statutory minimum capital requirement under Article 14/A.

However, professional liability insurance or qualifying collateral is required.

How much professional liability insurance does an AISP need?

Under the current Payment Services Regulation, an AISP-only institution must maintain at least TRY 1 million of professional liability insurance or qualifying collateral. The amount increases by TRY 500,000 for every additional 100,000 customers after the first 100,000 customers.

What is GEÇİT?

GEÇİT is the common open banking technical infrastructure developed by BKM for standardised communication between Account Service Providers and authorised open banking service providers.

What is ÖHVPS?

ÖHVPS refers to Türkiye’s Payment Services Data Sharing Services framework, covering principally payment initiation and account information services.

What changed in open banking in 2026?

On 17 March 2026, ÖHVPS 2.0.0 was launched.

The update expanded Account Information Services, added card information and card transaction functionality, and introduced scheduled and recurring payment initiation.

How large is Turkey’s open banking market?

According to the CBRT’s March 2026 announcement, the ecosystem had reached 16.4 million users, an average of 12.3 million daily transactions and 53 participants.

Can a European AISP operate in Turkey with its EU licence?

A foreign licence does not automatically authorise regulated payment services in Türkiye. Turkish regulatory requirements should be separately assessed.

Conclusion: The Future of Open Banking in Turkey

Open banking regulation in Turkey has evolved from a legislative concept introduced in 2019 into a large-scale operational financial infrastructure.

Payment Initiation Services and Account Information Services are now expressly regulated payment activities under Law No. 6493.

The regulatory architecture is built around the CBRT’s supervision and the common ÖHVPS/GEÇİT infrastructure developed in cooperation with BKM.

For fintech companies, the two principal open banking models should be clearly distinguished.

A Payment Initiation Service Provider enables customers to initiate payments from accounts maintained with another provider.

An Account Information Service Provider allows customers to consolidate and view information concerning accounts maintained with multiple providers.

Although both models fall within open banking regulation, their licensing structures are not identical.

In particular, AISP-only institutions benefit from the special framework under Article 14/A of Law No. 6493 and are exempt from certain ordinary capital requirements, while professional liability insurance or qualifying collateral is required. By contrast, PISPs generally remain within the broader payment institution financial framework.

Technical infrastructure is equally important.

Open banking services are delivered through standardised ÖHVPS interfaces and BKM’s GEÇİT infrastructure. Providers must satisfy technical, security and certification requirements in addition to obtaining the appropriate regulatory authorisation.

The launch of ÖHVPS 2.0.0 on 17 March 2026 represents an important new phase in the development of Turkish open banking.

The inclusion of card information and transaction functionality provides customers with a more comprehensive view of their finances.

Scheduled Payment Order Initiation and Recurring Payment Order Initiation, meanwhile, create important opportunities for new merchant, subscription, corporate finance and embedded payment models.

The commercial scale of the ecosystem is also significant. With 16.4 million users, approximately 12.3 million daily transactions and 53 participants reported by the CBRT in March 2026, open banking has become an established component of Türkiye’s payment infrastructure.

Nevertheless, commercial opportunity comes with substantial regulatory responsibility.

Businesses operating in Turkish open banking must consider not only CBRT licensing but also:

• customer consent;
• strong customer authentication;
• API security;
• sensitive customer information;
• personal data protection;
• AML/KYC;
• outsourcing;
• contractual responsibilities;
• technical certification;
• ongoing regulatory supervision.

International fintech companies must also recognise that a foreign AISP or PISP licence does not automatically provide access to the Turkish market.

A Turkish regulatory analysis should therefore be conducted before offering open banking functionality to customers located in Türkiye.

The most effective strategy is to develop the legal structure, regulatory licence, API architecture, customer consent process and data governance framework together.

For businesses considering the launch of an open banking platform, payment initiation service, account aggregation application, personal finance management platform, corporate treasury solution, embedded finance service or financial API business in Turkey, early regulatory planning is essential.

Open banking will likely remain one of the fastest-developing areas of Turkish Fintech Law.

The expansion introduced through ÖHVPS 2.0.0 indicates that the Turkish regulatory framework is moving beyond simple account aggregation and one-time payment initiation toward a broader infrastructure capable of supporting increasingly sophisticated digital financial products.

Legal Disclaimer: This publication provides general information regarding Turkish open banking regulation as of July 2026. It does not constitute legal advice. Licensing requirements, technical standards, financial requirements and regulatory practices may change. Each open banking business model should be assessed individually under the legislation and CBRT rules applicable at the relevant time.