In the Official Gazette No. 32332 dated 07.10.2023, the following were published:
(a) the Regulation Amending the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (the “Amending Regulation”), and
(b) the Communiqué Amending the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in the Field of Payment Services (the “Amending Communiqué”)
These texts introduce changes on many subjects, including e-money issuance, the provision of payment services, share acquisitions and transfers, community cloud computing outsourcing, and remote identity verification. In addition, the Central Bank of the Republic of Turkey (“CBRT” or the “Bank”) has introduced many new definitions to align with industry practice, along with restrictions and innovations concerning the fields of activity of institutions that issue e-money and/or provide payment services.
The first part of this information note covers the points considered most significant, while the full content of the changes in question is presented to you in a comparative table format.
I. Significant changes made to the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (the “Regulation”):
a. Regarding the Newly Introduced Definitions
The definitions of “Digital Wallet”, “Card System Institution” and “Qualified Services” have been added to the Regulation by means of the Amending Regulation. In the Amending Regulation,
Digital wallet: means a payment instrument offered as an electronic device, online service or application in which information on the payment account or payment instrument defined by the customer is stored, and which enables the customer to carry out payment transactions using the information on that payment account or payment instrument,
Card system institution: means the institutions defined in subparagraph (f) of the first paragraph of Article 3 of Law No. 5464 on Bank Cards and Credit Cards,
Qualified services: means services that do not fall within the scope of payment services under the Law, but that facilitate, secure or increase the effectiveness of payment services by supporting the financial situation and financial awareness of natural persons, such as personal budget management, bill management, account verification and payment reminders.
b. Regarding the Obligation to Obtain Customer Consent
Provided that the CBRT so decides, and provided that a framework agreement for another payment service already exists between the customer and the institution from which the customer receives payment services, the requirement to obtain the customer’s consent and request will not apply to the provision of additional payment services determined by the CBRT. The customer will be able to terminate the provision of these additional services following a notification made to them.
c. Regarding the Payment Initiation Service
Under the Amending Regulation, for a payment transaction to be considered a payment initiation service, the party initiating the payment transaction must also be using a payment service provider other than the payment service provider holding its own payment account from which the payment transaction will be carried out, in order to give the payment order.
In payment transactions initiated by the payer through the payee, where the payer does not use a payment service provider other than the one holding its own payment account to give the payment order, and the transaction takes place solely by storing a payment instrument issued by another payment service provider for the purpose of loading funds to the payment account held with the service-providing payment service provider and to the payment instrument issued by that payment service provider, this service will not be considered a payment initiation service.
d. Regarding the Digital Wallet
Under the Amending Regulation, electronic devices, online services or applications in which only the payment account held with the payment service provider offering the payment service, and the payment instrument issued by that payment service provider, can be defined and stored are not considered a digital wallet service.
Where a digital wallet is used as a payment instrument at merchants and, in such transactions, the funds relating to the payment transaction are transferred through the institution providing the digital wallet service, the institution is required to be authorized to issue e-money pursuant to the second paragraph of Article 18 of Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (“Law No. 6493”).
Where the payment account or payment instrument defined in the digital wallet is used directly in a payment transaction at the merchant, and the institution providing the digital wallet service supplies the merchant with the necessary payment services, the transfer of the funds relating to the payment transaction through the institution providing the digital wallet service is not assessed under the Digital Wallet provisions.
An important point specific to the Digital Wallet service is that persons who were already providing digital wallet services before the effective date of Article 4/A of the Regulation, who could be included in the payment institution or e-money institution category established under the Law but do not hold an operating license, are required to apply to the Bank within one year from the date Article 4/A of this Regulation enters into force. On the other hand, institutions that already provide digital wallet services must comply with the Amending Regulation within one year from the date Article 4/A of the Amending Regulation enters into force.
e. Regarding Interoperability and Infrastructure Services Established Between Payment Service Providers
Where the payment account services and the payment service infrastructure services offered by a payment service provider are used by other payment service providers, including a payment service provider it controls, it must offer services of the same nature to the payment service provider it controls and to the other payment service providers under the same conditions and facilities and with the same fee policy, and it may not direct its own customers to receive services from the payment service provider it controls in a way that places that provider at an advantage over other payment service providers.
Payment service providers controlled by another payment service provider may not, in any document, notice, advertisement or public statement relating to the services they offer, use expressions that would give the impression that they are acting on behalf of the payment service provider that controls them, except for services offered as an interface provider under the relevant provisions of the Law.
f. Regarding the Right to Request Information of the Payment Service Provider Whose Infrastructure Is Used
Where a payment service provider uses the infrastructure offered by another payment service provider for the services it provides to enable a merchant to sell goods and services through a payment method within the scope of payment services, the payment service provider whose infrastructure is used may, in addition to the matters regulated under the Regulation, also request information on matters arising from the legislation.
g. Regarding Share Acquisitions and Transfers
The Amending Regulation provides that share acquisitions and transfers between companies belonging to the same group, which do not cause any change in the direct or indirect shareholding ratio of the institution’s ultimate shareholders in the institution, are not subject to the Bank’s permission. Share transfers falling within the scope of this paragraph must be notified to the Bank within ten business days after the institution becomes aware of them.
h. Regarding the Fields of Activity and Business Models of Institutions
Changes have been made to the scope of activities of institutions, chiefly the provision of and intermediation in transactions relating to the purchase and sale of precious metals, precious stones and foreign currency listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, and the provision of services as an interface provider under the Regulation on Operating Principles of Digital Banks and Service Model Banking.
It has been regulated that Payment Institutions may carry out activities in relation to the following:
- Services to be offered as an interface provider within the scope of the Regulation on Operating Principles of Digital Banks and Service Model Banking, published in the Official Gazette No. 31704 dated 29/12/2021, excluding transactions relating to the purchase and sale of precious metals, precious stones and foreign currency listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, put into force by Council of Ministers Decision No. 89/14391 dated 7/8/1989, whether directly or indirectly,
- Ancillary services that may increase the use of the institution’s payment services, such as marketing and redirection to the systems of the relevant financial institution, offered to the customer so that they can access the services of financial institutions whose activities are regulated and supervised by a competent authority under the relevant legislation, excluding transactions relating to the purchase and sale of foreign currency listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, whether directly or indirectly, and
- Services to be offered within the scope of intermediating activities relating to the purchase and sale of processed precious metals and precious stones listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, provided that the maximum transaction amount the institution will intermediate within a month is limited to one percent of the payment volume of the previous calendar year calculated pursuant to the fourth paragraph of Article 33.
It has been regulated that E-Money Institutions may carry out activities in relation to the following:
- Services to be offered as an interface provider within the scope of the Regulation on Operating Principles of Digital Banks and Service Model Banking, excluding transactions relating to the purchase and sale of precious metals, precious stones and foreign currency listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, whether directly or indirectly,
- Ancillary services that may increase the use of the institution’s payment services, such as marketing and redirection to the systems of the relevant financial institution, offered to the customer so that they can access the services of financial institutions whose activities are regulated and supervised by a competent authority under the relevant legislation, excluding transactions relating to the purchase and sale of foreign currency listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, whether directly or indirectly,
- Services to be offered within the scope of intermediating activities relating to the purchase and sale of processed precious metals and precious stones listed in Article 2 of Decision No. 32 on the Protection of the Value of Turkish Currency, provided that the maximum transaction amount to be intermediated within a month is limited to one percent of the payment volume of the previous calendar year calculated pursuant to the fourth paragraph of Article 33, and
- Provided that they are authorized to provide the payment services specified in subparagraph (f) or (g) of the first paragraph of Article 4 of the Regulation, value-added services and qualified services may be carried out in relation to accounts held with other payment service providers, in addition to the accounts held with the institution itself.
i. Regarding Payment Instruments and Card System Institutions;
Regulations have been introduced, effective from 31/3/2024, requiring institutions that issue payment instruments to give their users a choice regarding card system institutions (Visa, Troy, Mastercard, etc.). With this change, it can be said that a major step has been taken in the strategy to expand the use of Troy, Turkey’s first and only Card System Institution, operated by the Interbank Card Center (“BKM”).
Where a payment service provider that issues payment instruments issues payment instruments compatible with more than one card system institution, and the customer requests that the payment instrument be issued as defined for a specific card system institution, it is obliged to issue the payment instrument compatible with the card system institution the customer wants, and not to apply different practices to the customer depending on the card system institution, before and after the issuance of the payment instrument, in a way that would make the process of issuing a payment instrument compatible with the card system institution selected by the customer more difficult for the customer.
A payment service provider that carries out card-based payment instrument acceptance is obliged to ensure that the devices, hardware and software it uses in its acceptance activities are compatible with the card systems established by systemically important payment system operators authorized to carry out card system institution activities, and that payment instruments issued in compliance with these infrastructures can be used at the merchants it serves.
II. Significant changes made, by means of the Communiqué, to the Communiqué on Information Systems of Payment and Electronic Money Institutions and Data Sharing Services of Payment Service Providers in the Field of Payment Services (the “Communiqué”):
a. Regarding the Newly Introduced Definitions
By means of the Amending Communiqué, the Regulation on Independent Audit of Information Systems and Business Processes (“BSISBDHY”), “MASAK” (Financial Crimes Investigation Board) and “Near Field Communication” definitions have been added to the Communiqué.
b. Regarding the Outsourcing Process for Information Systems and Data Security
With respect to outsourcing relating to information systems to be obtained by institutions, restrictions on institutions within group companies obtaining community cloud computing services have been reduced, and regulations on information and data security have been introduced.
In addition, utmost care has been taken to ensure that products and services to be obtained in the context of critical information systems and security are produced in Turkey or that their manufacturers’ R&D centers are located in Turkey, and this has been treated as an important criterion in outsourcing.
c. Regarding Restrictions on Information Systems
In line with the principle of proportionality, the transfer of data abroad specifically in relation to payment transactions has been regulated.
d. Regarding the Process of Identity Verification and Establishing a Contractual Relationship via Remote Communication Tools
The Amending Communiqué contains provisions allowing institutions that issue e-money and/or provide payment services to also offer remote identity verification, which can currently be carried out by banks and by non-bank financial institutions, namely financial leasing, factoring, financing and savings financing companies, brokerage firms and portfolio management companies.
“The Regulation Amending the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers“ can be accessed at the link below:
https://www.resmigazete.gov.tr/eskiler/2023/10/20231007-3.htm
