It is the regulation that sets out the procedures and principles for banks procuring support services.
(2) The following services are outside the scope of this Regulation when procured externally by banks:
a) Services procured for matters such as catering, transportation and cleaning; the procurement, maintenance and repair of all kinds of technical equipment and fixtures owned by banks or over which they have the right of use; and training services,
b) Legal services and legal counsel, consultancy and advertising activities,
c) Procurement of services for personnel who are employed by another company but work temporarily or permanently at the bank in the jobs listed in subparagraph (a).
You can access the details of the regulation from the link below.
https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=15481&MevzuatTur=7&MevzuatTertip=5
The bank's responsibility in support services
Even if a bank outsources one of its activities, its responsibility toward its customers and the regulator continues. That is why provider selection, contract terms, data security and audit rights are designed carefully.
For critical services, an alternative plan is expected in case the provider suffers an outage. If the service is procured from abroad, additional conditions may apply.
For technology providers, this regulation explains why contract and security requirements are so detailed when working with banks.
