Learn about Open Banking regulations in Turkey in 2026. Discover licensing requirements, account information services, payment initiation services, CBRT regulations, API standards, data protection compliance, FinTech opportunities, and legal obligations for startups and foreign investors.

Open Banking has become one of the most significant developments in the financial technology sector, transforming the way financial institutions, payment service providers, FinTech startups, and consumers interact with financial data. By allowing customers to securely share banking information with authorized third-party providers through application programming interfaces (APIs), Open Banking promotes competition, innovation, efficiency, and customer-centric financial services.

Turkey has emerged as one of the leading jurisdictions in the region for Open Banking development. Regulatory reforms introduced under Law No. 6493 and subsequent regulations issued by the Central Bank of the Republic of Türkiye (CBRT) have created a structured framework for account information services, payment initiation services, digital wallets, and API-based financial ecosystems. In March 2026, the CBRT expanded the Open Banking infrastructure by introducing card information services, card transaction visibility, scheduled payment initiation, and recurring payment functionality.

For FinTech startups, payment institutions, electronic money institutions, banks, software developers, and foreign investors, understanding the Turkish Open Banking framework is essential for regulatory compliance and long-term business success.

What Is Open Banking?

Open Banking is a system that allows customers to authorize licensed third-party providers to access their banking information or initiate payments on their behalf through secure digital interfaces.

The primary Open Banking services include:

• Account Information Services (AIS)
• Payment Initiation Services (PIS)
• Card Information Services
• Recurring Payment Services
• Financial Data Aggregation
• Embedded Finance Solutions

The objective is to provide consumers with greater control over their financial information while encouraging innovation within the financial services industry.

The Legal Framework Governing Open Banking in Turkey

Turkey’s Open Banking ecosystem is regulated through several legislative and regulatory instruments.

The primary legal sources include:

• Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions
• CBRT Regulations and Guidelines
• Regulation on Banks’ Information Systems and Electronic Banking Services
• Personal Data Protection Law (KVKK)
• Banking Regulations
• Consumer Protection Legislation

The CBRT serves as the primary authority responsible for licensing and supervising payment institutions and electronic money institutions participating in Open Banking activities.

Account Information Services (AIS)

Account Information Services allow licensed providers to access and consolidate financial information from one or more customer accounts held at different financial institutions.

AIS providers may offer:

• Personal finance management tools
• Budget planning applications
• Financial dashboards
• Expense tracking solutions
• Credit scoring services
• Wealth management platforms

The customer must provide explicit consent before any account information can be accessed or shared. Turkish regulations require licensed providers to maintain strict security and authentication standards when processing account information.

Payment Initiation Services (PIS)

Payment Initiation Services enable authorized providers to initiate payment transactions directly from a customer’s account.

Examples include:

• E-commerce payments
• Merchant payments
• Digital wallet funding
• Subscription payments
• Bill payments

Instead of using traditional card-based payment methods, customers may authorize licensed providers to initiate transfers directly from their bank accounts.

PIS has become one of the most important components of Turkey’s Open Banking ecosystem and is specifically regulated under Law No. 6493.

Major Open Banking Developments in 2026

Turkey’s Open Banking infrastructure experienced significant expansion in 2026.

The CBRT announced several important enhancements including:

• Card information sharing
• Card transaction visibility
• Scheduled payment initiation
• Recurring payment initiation
• Expanded account information services

These developments allow consumers to view broader financial information through a single interface while enabling businesses to offer more sophisticated financial products and services.

Licensing Requirements for Open Banking Providers

Businesses wishing to provide regulated Open Banking services must generally obtain authorization from the CBRT.

Licensing requirements may apply to entities providing:

• Account Information Services
• Payment Initiation Services
• Electronic Money Services
• Payment Services
• Digital Wallet Solutions

Regulators evaluate various factors during the licensing process, including:

• Corporate governance
• Capital adequacy
• Ownership structures
• Risk management systems
• Information security controls
• Compliance programs

Operating without the required authorization may result in administrative sanctions and regulatory action.

API Infrastructure and Data Sharing Standards

Open Banking relies heavily on standardized APIs.

In Turkey, the Interbank Card Center (BKM) plays a central role in facilitating technical integration between participants.

The infrastructure enables:

• Secure data exchange
• Customer authentication
• Payment initiation
• Account information access
• Interoperability among financial institutions

Licensed participants integrate with BKM rather than establishing separate connections with every financial institution individually. This significantly improves efficiency and scalability within the ecosystem.

Data Protection and KVKK Compliance

Open Banking involves extensive processing of personal and financial information.

As a result, compliance with Turkey’s Personal Data Protection Law (KVKK) is critical.

Businesses must ensure:

• Explicit customer consent where required
• Data minimization
• Purpose limitation
• Secure processing
• Appropriate retention periods
• Protection against unauthorized access

Failure to comply with data protection requirements may expose organizations to administrative fines, compensation claims, and reputational harm.

Privacy compliance should be integrated into every stage of Open Banking product development.

Customer Consent Requirements

Customer consent is one of the core principles of Open Banking.

Financial information may only be shared when the customer has provided clear authorization.

Consent mechanisms should:

• Be transparent
• Be easily understandable
• Clearly explain data usage
• Allow withdrawal of consent
• Record authorization history

Businesses should maintain comprehensive records demonstrating that valid consent was obtained before processing customer information.

Cybersecurity Obligations

Open Banking increases connectivity between financial institutions and service providers.

This creates additional cybersecurity responsibilities.

Organizations should implement:

• Multi-factor authentication
• Encryption protocols
• API security controls
• Penetration testing
• Incident response procedures
• Continuous monitoring systems

Regulators increasingly expect financial institutions and FinTech providers to maintain sophisticated cybersecurity programs that protect customer information and critical infrastructure.

Open Banking Opportunities for FinTech Startups

Open Banking has created substantial opportunities for innovative startups.

Popular business models include:

• Financial management applications
• Embedded finance solutions
• Lending platforms
• Digital wallets
• Merchant payment services
• Personal finance management tools
• Banking-as-a-Service (BaaS)
• Alternative credit scoring platforms

The ability to securely access customer-authorized financial information allows startups to develop products that were previously only available through traditional financial institutions.

Open Banking and Foreign Investors

Turkey’s expanding Open Banking ecosystem has attracted considerable interest from international investors.

Foreign investors evaluating opportunities in Turkey should carefully assess:

• Licensing requirements
• Regulatory compliance obligations
• Data localization considerations
• Corporate governance structures
• Technology infrastructure
• Cybersecurity controls

Businesses seeking investment should establish robust compliance programs before approaching institutional investors.

Compliance Challenges Facing Open Banking Providers

Some of the most common regulatory challenges include:

• Licensing compliance
• Data protection requirements
• Customer authentication obligations
• API security management
• Third-party risk oversight
• Regulatory reporting
• Cybersecurity governance

Organizations that proactively address these challenges are generally better positioned for sustainable growth.

Future of Open Banking in Turkey

Turkey’s Open Banking ecosystem continues to evolve rapidly.

Future developments are expected to include:

• Expanded Open Finance services
• Enhanced API capabilities
• Greater integration of financial products
• Increased use of artificial intelligence
• More advanced payment services
• Stronger consumer protections

The regulatory environment is likely to continue developing in response to technological innovation and international trends.

Businesses that invest in compliance and technological readiness today will be better positioned to capitalize on future opportunities.

Frequently Asked Questions (FAQ)

1. What is Open Banking?

Open Banking allows customers to securely share banking information with authorized third-party providers through APIs and digital interfaces.

2. Who regulates Open Banking in Turkey?

The Central Bank of the Republic of Türkiye (CBRT) serves as the primary regulator for payment services and Open Banking activities.

3. What are Account Information Services?

AIS allows authorized providers to access and consolidate information from customer payment accounts with customer consent.

4. What are Payment Initiation Services?

PIS allows licensed providers to initiate payments directly from customer accounts with customer authorization.

5. Do Open Banking providers require a license?

Yes. Businesses providing regulated Open Banking services generally require authorization from the CBRT.

6. Is customer consent required?

Yes. Customer authorization is a fundamental requirement before accessing or sharing financial information.

7. How does BKM support Open Banking?

BKM provides the technical infrastructure enabling secure integration and data sharing among participants.

8. Are Open Banking providers subject to KVKK?

Yes. Open Banking businesses processing personal data must comply with Turkey’s Personal Data Protection Law.

9. What changed in Open Banking during 2026?

The CBRT introduced card information services, card transaction visibility, scheduled payment initiation, and recurring payment capabilities.

10. Why is Open Banking important for FinTech startups?

Open Banking enables startups to access customer-authorized financial information and develop innovative financial products and services.

LEGAL SUPPORT FOR OPEN BANKING AND FINTECH COMPANIES

Open Banking presents significant opportunities for financial innovation, but it also creates complex regulatory, licensing, privacy, cybersecurity, and compliance obligations. Whether you are launching a FinTech startup, obtaining a payment institution license, developing Open Banking APIs, implementing embedded finance solutions, or expanding an international financial services business into Turkey, obtaining professional legal guidance is essential.

A well-structured legal strategy can help reduce regulatory risks, strengthen investor confidence, ensure compliance with CBRT requirements, and support long-term business growth.

LEGAL SUPPORT AND CONTACT OUR LAW FIRM

If you are planning to establish or expand an Open Banking business in Turkey, our team can assist with licensing, regulatory compliance, corporate governance, data protection, commercial agreements, technology law matters, and FinTech investment transactions.

Phone: +90 312 434 22 22

Mobile: +90 532 769 22 22

Email: info@firatfesihkaya.av.tr

Address: Mevlana Boulevard No:221, Yildirim Tower No:148, 06520 Balgat, Cankaya, Ankara, Turkey

Fırat Fesih Kaya Law provides legal services to FinTech startups, payment institutions, electronic money institutions, technology companies, software developers, investors, and international businesses operating in Turkey.