The purpose of this Communiqué is to regulate the procedures and principles for the management of the information systems used by payment institutions and electronic money institutions in carrying out their activities, their audit by authorized independent audit firms, and the data sharing services of payment service providers in the field of payment services.
You can access the relevant communiqué from the link below:
https://www.resmigazete.gov.tr/eskiler/2021/12/20211201-3.htm
The two main parts of the communiqué
The first part of the communiqué sets out how institutions will manage their own information systems and pass independent audits. The second part covers data sharing services, that is, other providers accessing account information and initiating payments with the customer's consent.
These two parts should be read together: the institution must both operate its own infrastructure securely and protect the APIs it offers to third parties.
The practical takeaway for developers is that authentication, authorization, consent management and monitoring must be considered from the start in API design.
