What are the regulations and legal obligations of payment institutions?

A payment institution is a legal entity that provides payment services for electronically executed payments through the infrastructure it offers while transactions are carried out. In this context, payments made when purchasing a service or product online can also be described as the completion of banking transactions through a system provided by a payment institution.

In order to regulate the supervision and activities of legal entities qualified as payment institutions, Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (the “Law”) was enacted and entered into force on 27 June 2013. In addition to the Law, the Regulation on Payment Services and Issuance of Electronic Money and Payment Institutions and Electronic Money Institutions (the “Regulation”) and the Communiqué on the Management and Inspection of Information Systems of Payment Institutions and Electronic Money Institutions (the “Communiqué”) are also part of the legislation.

As clearly stated in this legislation, the authorization and supervision of payment institutions are the responsibility of the Banking Regulation and Supervision Agency (the “BRSA” or the “Agency”).

This article concerns payment institutions only; detailed information on e-money institutions will be the subject of another article.

PAYMENT INSTITUTION AND PAYMENT SERVICE PROVIDER

In terms of the Law’s terminology, it should be noted that the concepts of “payment institution” and “payment service provider” are not used interchangeably; “payment service provider” is the broader umbrella concept. In this sense, the Law classifies banks, e-money institutions and payment institutions all as “payment service providers”, whereas a “payment institution” refers to a legal entity authorized under the Law to provide and carry out payment services.

OBLIGATION OF PAYMENT INSTITUTIONS TO OBTAIN AN OPERATING PERMIT

The Law requires entities that wish to operate in the field of payment services to obtain permission from the BRSA.

Payment institutions must satisfy certain conditions in order to obtain an operating permit. Accordingly, the institution must:

• Be established as a joint stock company,
• Have shareholders holding ten percent or more of the shares, and persons who hold control, that meet the qualifications required of bank founders under the Banking Law,
• Have all of its shares issued in registered form,
• Have capital of at least TL 1 (one) million for payment institutions that intermediate bill payments and at least TL 2 (two) million for other payment institutions,
• Have the management, sufficient personnel and technical equipment necessary to perform the services, and also establish units for complaints and objections,
• Take the necessary measures regarding the continuity of operations and the security and confidentiality of funds and information relating to payment service users, and
• Have a transparent shareholding structure and organizational chart that is open to inspection.

Under the Regulation, payment institutions may also open branches and appoint agents, provided that they comply with the prescribed minimum equity requirement. For this purpose, the institution may carry out payment services through an agent under a written agreement. The payment institution is directly responsible for the agent’s compliance with the legislation and for the proper performance of the agent’s activities. The institution may also outsource its activities, again under a written agreement, but this does not mean a transfer of its powers and obligations.

LIMITATION OF ACTIVITIES

In addition to the criteria set out above, payment institutions are prohibited from extending credit, issuing e-money or engaging in any other commercial activity, and under the Regulation payment institutions are authorized only to carry out activities relating to the operation of payment systems permitted by the BRSA. Accordingly, the articles of association of payment institutions must not contain provisions stating that they may engage in the trade of other goods and services. If a payment institution goes beyond the permitted activities, its operating permit is cancelled by the BRSA or applications are rejected without being evaluated. This raises the question of whether services regarded as ancillary to payment services, such as card storage and fraud detection, may be performed by payment institutions without obtaining a license.

In this regard, it should be noted that the European Union Payment Services Directive, which served as a model for a significant part of the Law and many of whose provisions are almost identical to it, contains no restriction on activities of the kind described above, and expressly states that there is no restriction on the provision of closely related operational and ancillary services such as foreign exchange services, safekeeping activities, and data storage and processing. The legislation of the member states that have transposed the Directive into their national law likewise expresses this point in the same way, and the restriction on activities is in no way applied to ancillary services.

SAFEGUARDING ACCOUNT

Article 22 of the Law provides that the funds received by a payment institution for the purpose of performing a payment service, and the funds collected by an e-money institution in exchange for issuing e-money, will be safeguarded under conditions to be determined within the framework of secondary legislation. It also states that the BRSA may impose an obligation on payment and e-money institutions to hold collateral with a bank.

The Regulation sets out the conditions under which the funds defined therein (the “Payment Funds”) are to be safeguarded. Accordingly:

• The payment institution tracks the payment funds separately from other funds and may use them only for the purpose of executing payment transactions.
• The amount of payment funds that remain unpaid at the end of the business day following the day on which they were received is deposited into safeguarding accounts that are opened in the name of the payment institution at a bank subject to Law No. 5411 and used solely for the purpose of safeguarding these funds.
• Payment funds are held in safeguarding accounts opened in the currency in which they were received. If it is not possible to open an account in the relevant foreign currency, or doing so would involve an unreasonable cost, the payment funds may be converted into another currency and held in the safeguarding account.
• The payment institution keeps records of the funds held in the safeguarding accounts in a way that allows the payment funds to be tracked on a payment service user basis.
• The payment institution is obliged to compare its own records of the funds held in the safeguarding accounts with the account statements obtained from the bank on a daily basis, and to reconcile the records of the previous business day on each business day. Except for discrepancies arising from timing differences, the records of any correction made to achieve reconciliation must be retained. If there is a significant discrepancy between the records, the payment institution immediately informs the Agency.
• If reconciliation is performed electronically, the statements relating to the transaction are retained by the institution physically or securely in electronic form.
• If reconciliation cannot be performed in accordance with the principles and procedures set out in the sixth and seventh paragraphs, the payment institution immediately informs the Agency.
• The balances of payment funds and of the funds held in safeguarding accounts are reported to the Agency in accordance with the procedures and principles to be determined by the Agency.

As can be understood from the conditions set out in the Regulation, although there is no express provision stating that the amount transferred to a safeguarding account may not be put to profitable use by banks or the payment institution solely for their own benefit, in practice these funds do not earn returns. We believe that this issue should be clarified soon, and that the way should be opened for putting to use this asset, which in a sense lies idle because no one can operate it.

The European Union Directive, on the other hand, provides a more flexible structure in favor of payment institutions with regard to safeguarding funds. The Directive grants the payment institution a choice of options for the security of funds. Accordingly, the payment institution may:

• Hold the funds in a separate account with banks or invest them in secure, low-risk liquid assets, or
• Cover them with an insurance policy for an amount equivalent to the value of the funds.

In European Union countries that have transposed the Directive into their national law, a provision very similar to the relevant article of the Directive has been adopted and is applied.

SUPERVISION OF PAYMENT INSTITUTIONS

The BRSA is authorized to carry out inspections at payment institutions, their branches, their agents or the institutions from which they obtain outsourced services. On-site inspections of institutions are carried out by the Agency’s professional staff authorized to conduct on-site inspections. The payment institution is obliged to provide any information and documents requested by the Agency’s professional staff authorized to conduct on-site inspections, to present books and other documents, and to keep them available for examination. This obligation applies to any document requested by the Agency, even if it is confidential, without regard to prohibitive and restrictive provisions in special laws, subject to circumstances that would have serious consequences for state security and fundamental external interests and to the provisions on professional secrecy, the privacy of family life, the confidentiality of investigations and the right of defense.

The BRSA requires the necessary measures to be taken regarding matters identified as a result of inspections of payment institutions, including independent audits, may grant up to six months for the measures to be taken, and within this period may temporarily suspend the operating permits of institutions until the necessary measures are taken. Ultimately, the Board is authorized to cancel the operating permit if the relevant measures are not taken.

The BRSA may cancel the operating permit granted to a payment institution in the following cases:

• Failure to commence operations within one year despite having obtained an operating permit,
• The institution expressly waiving this authority or notifying the Agency that it has ceased its activities, despite having obtained an operating permit,
• It being determined that the operating permit was obtained through false statements and documents,
• It being determined that the payment institution has lost the conditions required for the operating permit listed above,
• Failure to immediately inform the Agency of any change that would affect the validity of the information and documents requested by the relevant authority in connection with the obligation to retain documents and records,
• The Board reaching the conclusion that the continuation of the payment institution’s activities threatens the security of payments, in which case the permit may be cancelled by the vote of at least five of its members. This decision is notified, together with its reasons, to the payment institution and to the Central Bank, and is published in the Official Gazette.

Besides cases in which the operating permit is cancelled, the operating permit may also expire. The operating permit of a payment institution expires:

• If the legal personality of the payment institution has ended in transactions that change its legal structure, such as a merger or demerger,
• If the payment institution’s existence as a joint stock company has ended under the Commercial Code, automatically, owing to the lack of its bodies, or as a result of dissolution for just cause,
• At the end of a six-month period, if no activity has been carried out for more than six months within one year after the institution commenced operations.

Although the supervision of payment institutions under the Law is carried out by the BRSA, institutions are also subject to independent audit under the Decree Law on the Organization and Duties of the Public Oversight, Accounting and Auditing Standards Authority.

OBLIGATIONS STIPULATED UNDER THE LAW

• Criteria Required of Board Members and the General Manager

In addition to the conditions set out above for the operating permit application, as also provided in the Regulation, the members of the board of directors and the general managers of payment institutions must meet certain criteria, and the documents evidencing this must be submitted to the BRSA during the operating permit application.

Some of these qualifications are undertakings stating that board members and general managers have not been declared bankrupt or entered into a composition with creditors, documents to be obtained from the Savings Deposit Insurance Fund, undertakings stating that they have not been convicted of the offenses specified in the Law, and criminal record certificates that include archive records. In addition, general managers are required to have at least seven years of professional experience in business management or finance and to have completed education at the undergraduate level.

• Obligation to Establish Internal Control, Risk Management and Compliance Units

As regulated by the Regulation, the institution is required to establish an adequate and effective internal control system in order to ensure that its activities are carried out effectively, efficiently and in accordance with the Law, and also to ensure the integrity and reliability of its accounting and reporting systems.

Once the internal control unit has been established, internal control personnel are also required to report on internal control activities to the board of directors, or to a board member other than the general manager designated by the board of directors, twice a year, as of the end of June and December.

The Regulation also requires the payment institution to establish an effective risk management system to ensure that all risks to which it may be exposed are identified, measured, monitored, controlled and reported.

In addition to the Law and Regulations mentioned above, payment institutions are subject to a number of obligations under the Regulation on the Compliance Program for Obligations Regarding the Prevention of Laundering Proceeds of Crime and Financing of Terrorism (the “MASAK Regulation”) . In this context, payment institutions are obliged to appoint a compliance officer and establish a compliance unit within 30 days following the granting of their operating permit. The aim of the compliance unit is to regulate risk management and the related activities.

• Agreements Signed with Third Parties and Institutions and the Obligation to Provide Information

Agreements Signed with Payment Service Users/Customers

One of the most important matters laid down by the Regulation concerns the forms of agreement that payment institutions enter into and the rights and obligations of the contracting parties. In this regard, the Regulation treats a payment transaction executed on a one-off basis and not covered by a framework agreement as a ‘one-off payment transaction’, and underlines that the payment institution has an obligation to inform users before a payment relationship is established. This information can also be provided through the institution’s website. Users who will benefit from the services offered by the payment institution are clearly informed about the terms, risks and exceptional circumstances relating to the services. The institution warns its users about the risks and threats relating to the services it offers and takes the utmost care to raise user awareness of these matters. The matters to be brought to the user’s attention in this context are set out in detail in the Communiqué.

If, instead of one-off payment transactions, there are continuing periodic payment relationships, a ‘framework agreement’ must be drawn up in writing. The content of the framework agreement must be prepared in accordance with the content prescribed in the Regulation. The pre-contractual information obligation likewise rests with the payment institution. Here too, publishing this information on the website is deemed sufficient. Unlike a one-off transaction, the payment institution must notify the user of any change to the framework agreement at least thirty days before the date on which the change takes effect.

In addition to the above, the written form requirement is not applied to agreements concluded by means of distance communication (agreements signed electronically).

Under the legislation, the burden of proving that the information obligations mentioned above have been fulfilled lies with the payment service provider. The provider may not charge the payment service user any fee for fulfilling these information obligations. However, if so agreed in the agreement, where the payment service user requests additional information, more frequent information, or the transmission of information by methods different from those provided for in the framework agreement, a fee proportionate to the cost of this service may be charged to the user.

The Regulation also regulates termination of the agreement and provides that, if no notice period has been agreed between the parties, the payment service user may terminate the agreement at any time. Where a notice period has been agreed, it may not exceed one month.

In the event of termination, a termination fee proportionate to the cost may be charged to the payment service user, but this must be provided for in the agreement. If the agreement is for a term longer than one year or for an indefinite term, no such fee may be charged for terminations after one year.

The payment service provider may terminate an indefinite-term agreement by giving at least two months’ notice, but this also depends on its being provided for in the agreement.

If the payment service fee is paid in advance, the overpaid amount must be refunded to the user.

Agreements Signed with Merchants and Agents

In the agreements it enters into with the merchants and agents to which it provides services, the payment institution is obliged to ensure that provisions are included requiring that the necessary measures be taken to ensure the confidentiality and security of sensitive payment data, that it not hold, process or record sensitive payment data itself other than in the communication between the terminals needed to perform the services and the institution, and that any major security incident be reported to the institution without delay. The institution is obliged to oversee compliance with the requirements of these provisions in agreements with merchants and agents and to terminate the agreement if it is found that they have not been met.

PENALTIES STIPULATED IN CASE OF VIOLATION OF THE LEGISLATION

Although the Law regulates the cases requiring sanctions individually, it generally underlines that, in the event of a violation of the legislation, the BRSA will impose an administrative fine of between TL 20,000 (twenty thousand) and TL 500,000 (five hundred thousand). It also provides that where a benefit has been obtained by the payment institution, the amount of this fine may not be less than twice the amount of that benefit.

The cases expressly regulated by the Law that require sanctions can be listed as follows:

• Natural persons, and the officers of legal entities, who engage in activities without a permit will be sentenced to imprisonment from one to three years and a judicial fine of up to five thousand days.
• Natural persons, and the officers of legal entities, who without a permit create the impression that they hold one and use wording to that effect in their trade names or elsewhere will likewise be sentenced to imprisonment from one to three years and a judicial fine of up to five thousand days.
• If the above offenses are committed within a business, the BRSA may order the closure of that business for two to six months.
• If a payment institution whose operating permit has been cancelled continues its activities, the above provisions apply in the same way.
• A person who obstructs the performance of inspection and supervision duties is punished with imprisonment from one to three years. Likewise, a person who does not provide the requested information and documents is punished with imprisonment from three months to one year and a judicial fine of up to one thousand five hundred days.
• Persons who sign false statements in documents that must be provided or published under the legislation are punished with imprisonment from one to three years and a judicial fine of up to two thousand days.
• Those who violate the obligation to retain documents and records for at least ten years, securely and within the country, in a manner that allows access at any time, are punished with imprisonment from one to three years and a judicial fine of from five hundred days to one thousand five hundred days.
• Those who violate the obligations to take security measures are punished with imprisonment from one to three years and a judicial fine of up to one thousand days; if this is committed through negligence, imprudence or lack of professional competence, such persons are punished with a judicial fine of up to one thousand days.
• The institution’s shareholders, board members, personnel, persons acting on their behalf, officers, employees of the outsourced service provider and even third parties may not disclose confidential information about the institution or its customers, even after they have left their positions. Otherwise, they are punished with imprisonment from one to three years and a judicial fine of up to one thousand days.
• Those who deliberately cause damage to the reputation of a payment institution through any press or broadcast medium are sentenced to imprisonment from one to three years.
• Persons who sign documents relating to the institution’s transactions being kept off the books or being recorded in the accounts in a manner inconsistent with their true nature are punished with imprisonment from one to three years and a judicial fine of up to two thousand days.
• Those who commit embezzlement for themselves or for others are punished with imprisonment from six to twelve years and a judicial fine of up to five thousand days, and also compensate the loss suffered by the institution. If fraud was used to prevent this from coming to light, the lower limit of the sentence rises to twelve years and twenty thousand days, and the judicial fine is at least three times the loss suffered by the institution.

TAXATION SYSTEM TO WHICH A PAYMENT INSTITUTION IS SUBJECT

The Expenditure Taxes General Communiqué Serial No. 91, published in the Official Gazette on 11 March 2017 (the “General Communiqué”) is another regulation that payment institutions must comply with. The taxation of these institutions is regulated by the General Communiqué, which has been in force since 1 April 2017.

Since payment services are among the banking transactions and services under the Expenditure Tax Law No. 6802, payment institutions whose main business is carrying out these transactions become liable for Banking and Insurance Transactions Tax (“BITT”) as bankers. All commissions, fees and similar amounts collected by payment institutions in respect of the services provided to payment service users are in principle subject to tax.

PAYMENT INSTITUTIONS WITHIN THE EUROPEAN UNION

Payment institution, for the European Union, refers to the payment service providers that emerged after the Payment Services Directive (“PSD”) entered into force in 2009. In regulating the activities of payment service providers, the PSD pursued certain main objectives, such as creating a uniform payment market, introducing an outline regulation for this market, promoting competition by establishing a level playing field, protecting consumers and ensuring transparency, and achieving efficiency in the payment services market. The main aim of the Directive in this context is to remove legal barriers to payment services in the European Union so that consumers and service providers can carry out payment transactions easily, securely, quickly and efficiently.

For these purposes, the regulation established an area (the Single Euro Payments Area, “SEPA”), which includes Iceland, Norway and Liechtenstein in addition to the EU, where uniform rules apply to payment services, and in addition to banks a category of ‘payment service providers’ was created. In 2015, this regulation was in a sense revised, developed and expanded in scope. Known briefly as ‘PSD2’, this regulation entered into force at the beginning of 2016, but member states were given two years to comply with its rules. The innovations it sought to introduce are mainly the inclusion of payment transactions outside the European Union within its scope, the development of separate service provider concepts for sub-concepts such as account information and payment initiation, and strengthened security.

Another point to know about payment institutions within the European Union is that they are members of the European Payment Institutions Federation (“EPIF”). EPIF is an umbrella organization, founded in 2011, that looks after the interests of institutions providing payment services outside the banking sector. In Turkey, there has been, since 2015, a sector association called the Payment and Electronic Money Association (“ODED”), which represents payment and e-money institutions. The aim of this association in Turkey is likewise, in parallel with the PSD, to provide access to secure, easy and innovative services that will make life easier for consumers and businesses, and to ensure close solidarity and cooperation among its members and across sectors.