The purpose of this Communiqué is to regulate the procedures and principles regarding the management of the information systems used in carrying out activities within the scope of transactions made with bank cards and credit cards.
Institutions that set up card systems, issue cards or sign merchant agreements, as well as merchants and outsourced service providers, are within the scope of this Communiqué.
The relevant Communiqué can be accessed from the link below:
https://www.bddk.org.tr/ContentBddk/dokuman/mevzuat_0821.pdf
Who does the communiqué affect?
The scope is broad: card-issuing banks, institutions signing merchant agreements, card system operators and outsourced service providers. For this reason, a payment gateway, POS software or card personalization company is also indirectly within this framework.
In practice, topics such as card data security, access control, logging, cryptographic key management and incident reporting come to the fore.
Institutions can avoid duplicate work by addressing these requirements together with industry standards such as PCI DSS.
